Add Pi-hole and Traefik LXC containers

- LXC 103 (pihole): Debian 12, 10.10.1.2, Pi-hole v6 with local DNS for
  gitea/grafana/traefik/pihole.homelab, Proxmox dnsmasq updated to use
  Pi-hole upstream
- LXC 104 (traefik): Debian 12, 10.10.1.3, Traefik v3 routing
  gitea.homelab → 10.10.1.125:3000, grafana.homelab → 10.10.1.137:3000
- DNAT rules on vmbr0 forwarding :80/:443 to Traefik, persisted in
  /etc/network/interfaces
- Ansible roles: pihole, traefik; playbooks: pihole.yml, traefik.yml
- site.yml excludes Debian containers from Arch-specific common role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/traefik/tasks/main.yml

@@ -0,0 +1,86 @@
+---
+- name: Install dependencies
+  ansible.builtin.apt:
+    name:
+      - curl
+      - ca-certificates
+    state: present
+    update_cache: true
+
+- name: Create traefik user
+  ansible.builtin.user:
+    name: traefik
+    system: true
+    shell: /usr/sbin/nologin
+    home: /etc/traefik
+    create_home: false
+
+- name: Create traefik directories
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: traefik
+    group: traefik
+    mode: "0750"
+  loop:
+    - /etc/traefik
+    - /etc/traefik/conf.d
+
+- name: Check installed Traefik version
+  ansible.builtin.command:
+    cmd: /usr/local/bin/traefik version
+  register: traefik_installed_version
+  changed_when: false
+  failed_when: false
+
+- name: Download Traefik binary
+  ansible.builtin.get_url:
+    url: "https://github.com/traefik/traefik/releases/download/v{{ traefik_version }}/traefik_v{{ traefik_version }}_linux_amd64.tar.gz"
+    dest: /tmp/traefik.tar.gz
+    mode: "0644"
+  when: traefik_version not in (traefik_installed_version.stdout | default(''))
+
+- name: Extract Traefik binary
+  ansible.builtin.unarchive:
+    src: /tmp/traefik.tar.gz
+    dest: /usr/local/bin
+    include:
+      - traefik
+    remote_src: true
+    mode: "0755"
+  when: traefik_version not in (traefik_installed_version.stdout | default(''))
+  notify: Restart traefik
+
+- name: Write Traefik static config
+  ansible.builtin.template:
+    src: traefik.yml.j2
+    dest: /etc/traefik/traefik.yml
+    owner: traefik
+    group: traefik
+    mode: "0640"
+  notify: Restart traefik
+
+- name: Write Traefik dynamic routes config
+  ansible.builtin.template:
+    src: routes.yml.j2
+    dest: /etc/traefik/conf.d/routes.yml
+    owner: traefik
+    group: traefik
+    mode: "0640"
+  notify: Restart traefik
+
+- name: Write Traefik systemd service
+  ansible.builtin.template:
+    src: traefik.service.j2
+    dest: /etc/systemd/system/traefik.service
+    mode: "0644"
+  notify:
+    - Reload systemd
+    - Restart traefik
+
+- name: Enable and start Traefik
+  ansible.builtin.systemd:
+    name: traefik
+    state: started
+    enabled: true
+    daemon_reload: true