Add Gitea Actions runner, ansible-lint CI, vault setup, and fix group_vars layout

- Move group_vars into inventory/ so playbooks can find them (was only
  visible to ad-hoc commands via CWD)
- Add Ansible Vault for sensitive variables (gitea/grafana passwords,
  tokens, db credentials) with vault_password_file outside the repo
- Enable Gitea Actions and deploy act_runner with Docker backend on
  the gitea VM
- Add .gitea/workflows/lint.yml to run ansible-lint on every push
- Set up Gitea → GitHub push mirror (sync_on_commit)
- Fix ansible.cfg stdout_callback for ansible-core 2.20 compatibility
- Add python-psycopg2 to gitea role (required for postgresql modules)
- Add docker to gitea_runner role (required by act_runner at startup)
- Exclude password hashes and VM images from git

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/ansible.cfg

@@ -4,8 +4,10 @@ remote_user        = adyrem
 private_key_file   = ../keys/homelab_ed25519
 roles_path         = roles
 host_key_checking  = False
-stdout_callback    = yaml
+stdout_callback    = default
+result_format      = yaml
 diff_mode          = True
+vault_password_file = ~/.config/homelab/vault_pass
 
 [privilege_escalation]
 become        = True

ansible/inventory/group_vars/all/vault.yml

@@ -0,0 +1,30 @@
+$ANSIBLE_VAULT;1.1;AES256
+31373161366133353539336439393963366530323131303662326630346565326664333330613031
+3064633138633062656230626261623132663839343162310a633964633136323634616230313334
+34363739636133363830393462376638326632383634313664333066366262323131636337613335
+6535353866363935310a363536633861326562626365653439386331643262646338633039316135
+64366432333635333162613862636534643730656266353839396165353337333934366633326134
+35313637386437306562616536383966336663663064656234306661626533323266336262363834
+37326130343966323764303562333038386231623737313762633437393266396365653132646133
+38633466363530666532336664636638306461643361613239373735343863646132313835393333
+62643763306265636362353934623030663966363530636535326632353637663164323137656239
+39336438626334353465613739323939646465393233363366653333363237393930353031393031
+33646633363337623664396162393630393365323630616532383233636233613238356236393337
+38646364616534303136333338396331333362303730633739353163646263396638623231323332
+64636564396633396436393535366366333238656234336261633433616538366434376565646236
+39373237663638666236306634643838613765653365396230363465386661623234626534393863
+61366336363839373939303138333865663031663338393938663265383564326335626263303563
+38646133646533363637653130616361646232613565346561316234383965353038373532633631
+64613432303761303161333162316465333432356266316533616636353561353534623032663534
+31316234346463316236623265356163383562643161626237393333316161663662336264333465
+32363236313862376436663537383531343562353462346132333062666261346462613839636462
+38323333356335653637323435643966386332333639623364373764306564646266343339653765
+64313936346663646131643135613161616261383233616237323663363063373632373936343831
+39663034623165623466653730323565653030616239356463303236653033353438323232666635
+33363237613263616264663861623365636230363934383861636266343064326136633430386634
+30373132623861386333343637633239353431383761656431643234356437656435653136343138
+35343635303931363464383665326134333634663033383937316135616263353763373036643932
+34376135623631313061306432356136623137373534643031326465666262393238333335666534
+33646532303633356163616465373366623866623930653939373336386331323435343635616563
+66356432636364373436646666613764313535363836666164333663323932623236313739306462
+34613439393834656535623437643431373761633865333234633866646531316131

ansible/playbooks/gitea.yml

@@ -5,3 +5,4 @@
     - node_exporter
     - promtail
     - gitea
+    - gitea_runner

ansible/roles/gitea/defaults/main.yml

@@ -3,10 +3,10 @@ gitea_http_port: 3000
 gitea_domain: "{{ ansible_host }}"
 gitea_db_name: gitea
 gitea_db_user: gitea
-gitea_db_password: gitea
-gitea_secret_key: "4XlGCDRMd6ojyxs2RT7t2gHt9zP1vyMdzw3ci8svaTt2JemYpxW9Lk5Ptp3YpeBz"
-gitea_internal_token: "opPpoCIIb3bzUtejXGTSDT1HnSjuP5SeUzdteUSp2XjI0ZvywO5Ahr3PBuhVteUM"
+gitea_db_password: "{{ vault_gitea_db_password }}"
+gitea_secret_key: "{{ vault_gitea_secret_key }}"
+gitea_internal_token: "{{ vault_gitea_internal_token }}"
 
 gitea_admin_user: adyrem
-gitea_admin_password: ""      # set in vault or at runtime
-gitea_admin_email: ""         # set in group_vars or vault
+gitea_admin_password: "{{ vault_gitea_admin_password }}"
+gitea_admin_email: "{{ vault_gitea_admin_email }}"

ansible/roles/gitea/tasks/main.yml

@@ -4,6 +4,7 @@
     name:
       - gitea
       - postgresql
+      - python-psycopg2
     state: present
 
 - name: Initialize PostgreSQL cluster

ansible/roles/gitea/templates/app.ini.j2

@@ -45,6 +45,9 @@ PROVIDER = db
 [cache]
 ADAPTER = memory
 
+[actions]
+ENABLED = true
+
 [indexer]
 ISSUE_INDEXER_TYPE   = bleve
 REPO_INDEXER_ENABLED = true

ansible/roles/gitea_runner/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+gitea_runner_version: "0.2.11"
+gitea_runner_url: "http://10.10.1.125:3000"
+gitea_runner_name: "{{ inventory_hostname }}"
+gitea_runner_labels: "native:host"
+gitea_runner_registration_token: "{{ vault_gitea_runner_token }}"

ansible/roles/gitea_runner/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: Restart act_runner
+  ansible.builtin.systemd:
+    name: act_runner
+    state: restarted

ansible/roles/gitea_runner/tasks/main.yml

@@ -0,0 +1,106 @@
+---
+- name: Install act_runner dependencies
+  community.general.pacman:
+    name:
+      - git
+      - docker
+    state: present
+
+- name: Enable and start Docker
+  ansible.builtin.systemd:
+    name: docker
+    enabled: true
+    state: started
+
+- name: Download act_runner binary
+  ansible.builtin.get_url:
+    url: "https://dl.gitea.com/act_runner/{{ gitea_runner_version }}/act_runner-{{ gitea_runner_version }}-linux-amd64"
+    dest: /usr/local/bin/act_runner
+    mode: "0755"
+    owner: root
+    group: root
+
+- name: Create act_runner user
+  ansible.builtin.user:
+    name: act_runner
+    system: true
+    shell: /sbin/nologin
+    home: /var/lib/act_runner
+    create_home: true
+    groups: docker
+    append: true
+
+- name: Create act_runner config directory
+  ansible.builtin.file:
+    path: /etc/act_runner
+    state: directory
+    owner: act_runner
+    group: act_runner
+    mode: "0750"
+
+- name: Generate default act_runner config
+  ansible.builtin.command:
+    cmd: act_runner generate-config
+    stdin: ""
+  register: runner_config_out
+  changed_when: false
+
+- name: Write act_runner config
+  ansible.builtin.copy:
+    content: "{{ runner_config_out.stdout }}"
+    dest: /etc/act_runner/config.yml
+    owner: act_runner
+    group: act_runner
+    mode: "0640"
+    force: false
+
+- name: Set runner labels in config
+  ansible.builtin.replace:
+    path: /etc/act_runner/config.yml
+    regexp: '^  labels:$'
+    replace: "  labels:\n    - \"native:host\""
+  notify: Restart act_runner
+
+- name: Register runner with Gitea
+  ansible.builtin.command:
+    cmd: >
+      act_runner register
+      --no-interactive
+      --instance "{{ gitea_runner_url }}"
+      --token "{{ gitea_runner_registration_token }}"
+      --name "{{ gitea_runner_name }}"
+      --labels "{{ gitea_runner_labels }}"
+      --config /etc/act_runner/config.yml
+    chdir: /var/lib/act_runner
+    creates: /var/lib/act_runner/.runner
+  become_user: act_runner
+
+- name: Install act_runner systemd service
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/act_runner.service
+    content: |
+      [Unit]
+      Description=Gitea Actions Runner
+      After=network.target
+
+      [Service]
+      Type=simple
+      User=act_runner
+      WorkingDirectory=/var/lib/act_runner
+      ExecStart=/usr/local/bin/act_runner daemon --config /etc/act_runner/config.yml
+      Restart=always
+      RestartSec=5
+
+      [Install]
+      WantedBy=multi-user.target
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart act_runner
+
+- name: Enable and start act_runner
+  ansible.builtin.systemd:
+    name: act_runner
+    enabled: true
+    state: started
+    daemon_reload: true