arbret: our side of running it on vipy

prd-arbret was folded into vipy. arbret itself (app, worker, Postgres, timers,
its backup dump) is deployed by its owner's own repo; this repo owns the
shared host's side of it. arbret_handoff.md documents the split, the Gatus
push API and the backup contract.

- services/arbret: arbret.com -> localhost:3100, www redirects to the apex,
  port 4117 allowed on tailscale0 only, /opt/backups/arbret pre-created to
  the contract so the pull job is green before the first dump.
- headscale ACL: framie may reach prd-vipy:4117.
- vipy: arbret-server, arbret-worker and postgresql in the unit checks.
- 402: DNS and HTTP checks for arbret.com, www, and /api/health with
  [BODY].status == ok. Entries may now name an fqdn outside root_domain and
  add conditions.
- 403: probes arbret-analytics (hourly, 130m window) and arbret-beancount
  (daily, 26h), pushing with the dedicated arbret token.
- backups: pull from backup-pull@prd-vipy:/opt/backups/arbret/, and a
  backup-dump_arbret endpoint.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ansible/services/arbret/deploy_arbret_edge_playbook.yml

@@ -0,0 +1,59 @@
+---
+# arbret's footprint on the edge host - and ONLY that.
+#
+# arbret itself (app, worker, Postgres, timers, its backup dump) is deployed by
+# the arbret owner's own Ansible repo since prd-arbret was merged into vipy on
+# 2026-10-17. This playbook owns the parts of the shared host that are ours:
+# the public front door, the tailnet port, and the backup directory contract.
+# See arbret_handoff.md at the repo root for the division of labour.
+- name: Publish arbret on the edge host
+  hosts: edge
+  become: yes
+  vars:
+    # Local port the arbret app binds on 127.0.0.1, per the arbret owner.
+    arbret_port: 3100
+    arbret_domain: arbret.com
+    # Admin port reachable from the tailnet only (ACL in headscale's acl.json.j2).
+    arbret_tailnet_port: 4117
+
+  tasks:
+    - name: Publish arbret through Caddy
+      ansible.builtin.include_role:
+        name: caddy_site
+      vars:
+        caddy_site_name: arbret
+        caddy_site_domain: "{{ arbret_domain }}"
+        caddy_site_upstream: "localhost:{{ arbret_port }}"
+
+    - name: Redirect www to the apex
+      ansible.builtin.include_role:
+        name: caddy_site
+      vars:
+        caddy_site_name: arbret-www
+        caddy_site_domain: "www.{{ arbret_domain }}"
+        caddy_site_body: |
+          redir https://{{ arbret_domain }}{uri} permanent
+
+    # tailscale0 only. UFW's default-deny applies to the tailnet interface too,
+    # so the headscale ACL alone does not open it - and this must never be
+    # reachable on the public interface.
+    - name: Allow the arbret admin port from the tailnet
+      community.general.ufw:
+        rule: allow
+        interface: tailscale0
+        direction: in
+        port: "{{ arbret_tailnet_port | string }}"
+        proto: tcp
+        comment: "arbret admin, tailnet only"
+
+    # The backup contract directory (arbret_handoff.md section 3.3). The arbret
+    # repo creates it identically; creating it here too means small-backups-box
+    # can pull - an empty dir - before arbret's first dump, so one missing
+    # source does not turn the whole pull job red.
+    - name: Ensure the arbret backup directory exists
+      ansible.builtin.file:
+        path: /opt/backups/arbret
+        state: directory
+        owner: root
+        group: backup-pull
+        mode: "0750"