Add Proxmox host role, WireGuard VPN, and public Gitea via Traefik HTTPS

Proxmox host role:
- Admin user setup, SSH hardening (port 2222, no root login)
- claude-code SFTP chroot user
- Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token)
- WireGuard VPN server (10.10.10.0/24) with Fedora client registered
- Proxmox firewall management via pvesh API (idempotent Python script)

Public Gitea exposure:
- Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix
  middleware for /git subpath, HTTP→HTTPS redirect
- Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/
- Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass

SSH config fixes:
- StrictHostKeyChecking no → accept-new across all hosts
- Proxmox jump host: port 2222, user adyrem (root login disabled)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/playbooks/wireguard-README.md

@@ -0,0 +1,111 @@
+# Adding a new WireGuard client
+
+## Current peer assignments
+
+| Name   | IP           |
+|--------|--------------|
+| server | 10.10.10.1   |
+| fedora | 10.10.10.2   |
+
+Pick the next free IP (10.10.10.3, 10.10.10.4, …) for each new machine.
+
+---
+
+## Step 1 — Generate a keypair on the new machine
+
+**Linux / macOS:**
+```bash
+wg genkey | tee ~/wg-client.key | wg pubkey
+```
+
+**Windows** (WireGuard app installed):
+Open the WireGuard app → Add Tunnel → Add empty tunnel. It generates a keypair and shows the public key at the top.
+
+Copy the **public key** — you need it in Step 2.  
+Keep the **private key** local. Never commit it to git.
+
+---
+
+## Step 2 — Register the peer in Ansible
+
+Edit `ansible/inventory/group_vars/proxmox_hosts/vars.yml` and add an entry to `wireguard_peers`:
+
+```yaml
+wireguard_peers:
+  - name: fedora
+    public_key: "ivtchk9pxEwYwusMzmn7Uq89LFV3uB1I8iYto0EJuy4="
+    allowed_ips: 10.10.10.2/32
+  - name: my-new-machine          # ← add this
+    public_key: "<public key from Step 1>"
+    allowed_ips: 10.10.10.X/32   # ← next free IP
+```
+
+---
+
+## Step 3 — Push the peer to the server
+
+```bash
+cd ansible && ansible-playbook playbooks/host.yml
+```
+
+The server will accept connections from the new client immediately after this.
+
+---
+
+## Step 4 — Create the client config
+
+Use the template below. Store it in a location that is **not** committed to git.
+
+```ini
+[Interface]
+Address = 10.10.10.X/32
+PrivateKey = <private key from Step 1>
+DNS = 10.10.1.2
+
+[Peer]
+PublicKey = UJaAvoT65+qC7NdD4lKFK+/J1OxKBYp1ZY3ynHjqcHE=
+Endpoint = adyrem.duckdns.org:51820
+AllowedIPs = 10.10.10.0/24, 10.10.1.0/24, 10.10.2.0/24
+PersistentKeepalive = 25
+```
+
+`AllowedIPs` is a split tunnel — only homelab traffic goes through the VPN.  
+Replace `adyrem.duckdns.org` with `192.168.1.10` when connecting from inside the LAN.
+
+---
+
+## Step 5 — Connect
+
+**Linux (one-off):**
+```bash
+sudo wg-quick up /path/to/wg0.conf
+# disconnect: sudo wg-quick down /path/to/wg0.conf
+```
+
+**Linux (persistent, starts on boot):**
+```bash
+sudo cp wg0.conf /etc/wireguard/wg0.conf
+sudo systemctl enable --now wg-quick@wg0
+```
+
+**Windows / macOS / Android / iOS:**
+Import the config file into the WireGuard app, then toggle the tunnel on.
+
+---
+
+## Step 6 — Verify
+
+```bash
+ping 10.10.10.1        # Proxmox host
+ping 10.10.1.137       # monitoring VM
+# Proxmox web UI: https://10.10.10.1:8006
+# Grafana:        http://10.10.1.137:3000
+```
+
+---
+
+## Removing a client
+
+1. Delete the peer entry from `wireguard_peers` in `group_vars/proxmox_hosts/vars.yml`
+2. Run `ansible-playbook playbooks/host.yml`
+3. The client's public key is removed from the server — existing sessions drop immediately