ansible: delete the duplicated vars files, move globals to group_vars/all

Three files existed only as second copies of things group_vars/all already auto-loads, and 34 playbooks named them in vars_files: - which outranks group_vars, so the copies won. The day someone edited one and not the other, those plays would silently keep the stale value. infra_vars.yml was already drifting: group_vars/all/main.yml had grown age_backup_recipient and backup_pull_public_key that it lacked. infra_vars.yml - a strict subset of group_vars/all/main.yml infra_secrets.yml - decrypts byte-identical to group_vars/all/vault.yml infra_secrets.yml.example - documented Uptime Kuma credentials as the reason the file exists, which stopped being true Deleted, along with 62 vars_files entries across 34 playbooks (12 of which named ../../group_vars/all/main.yml directly - same defect, a vars_files entry duplicating an auto-loaded file at higher precedence than the file itself). Checked before touching anything: infra_secrets.yml was listed LAST in 10 plays, after services_config.yml, so removal would flip precedence if the two shared a key. They share none, and neither does services_config.yml with group_vars/all/main.yml, so the removal is provably inert. services_config.yml was the last one standing. It held four unrelated things: caddy_sites_dir - an identical copy of roles/caddy_site/defaults/. Deleted; the role default is now the only one. *.tailscale_hostname (x3) - a THIRD copy of each box's identity, which inventory.ini already holds as ansible_host. Deleted. Edge plays now read hostvars['<host>'].ansible_host - verified an edge play resolves that with nothing loaded and the other host in no play. Three copies of one name is how bitcoin_rpc_host ended up labelled "knots_box" while pointing at fulcrum-box. subdomains, ntfy topic, - genuinely global: their readers span managed, headscale namespace monitoring, vpn_control and edge, so no single group covers them. Moved to group_vars/all/main.yml where they auto-load. The ntfy_topic and headscale_namespace indirection through service_settings collapses to the global name. the four cross-host ports - the only entries with a real justification. Left in place; they move in the next commit. Also dead, all Uptime Kuma residue or duplication: phoenixd_monitor_name, forgejo_runner healthcheck_timeout_seconds/retries, fulcrum_tailscale_hostname, and bitcoin_knots_version - the last being a v-prefixed copy of bitcoin_knots_version_short that nothing read, two hand-maintained copies of one version string. Corrected a false comment: services_config.yml claimed the uptime_kuma subdomain "no longer resolves to anything". It resolves to 164.92.239.72 and answers HTTP 302, and 11 playbooks still template it. Same wrong premise as PLAN_3. Verification: all 37 playbooks' --list-tasks output is byte-identical before and after. A probe resolving all 22 values services_config.yml used to supply returns 21 identical and one intended deletion (caddy_sites_dir, now role-only - confirmed the role still resolves it: "Ensure Caddy sites-enabled directory exists" comes back ok against the real path). memos check-diff identical before and after. Syntax passes on every playbook. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-13 20:58:46 +02:00 · 2026-09-13 20:58:46 +02:00 · 954b683c71
commit 954b683c71
parent 0f03c503c8
53 changed files with 82 additions and 403 deletions
--- a/ansible/group_vars/all/main.yml
+++ b/ansible/group_vars/all/main.yml
@ -14,3 +14,46 @@ age_backup_recipient: "age192wwdaseqej2ggwyp884gtm05c396anp7chr0vr8m47g50fahpyqr
 # Public key small-backups-box pulls with
 # Authorised on each source host for an unprivileged, dedicated user only
 backup_pull_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfIixKMhA9z+Nvyx6ToZIniC8aEgyiInRiboaTTemgX offsite-backup-pull"
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Subdomains. Global because the edge host proxies for services that live on
+# other machines, so no single inventory group covers the readers. Combine with
+# root_domain above to build an FQDN.
+#
+# Moved here from services_config.yml, which 30 plays had to remember to name in
+# vars_files: - a file everyone must opt into is a file someone will forget.
+# ─────────────────────────────────────────────────────────────────────────────
+subdomains:
+  # Monitoring (watchtower)
+  ntfy: ntfy
+  # Uptime Kuma IS still running and this subdomain DOES resolve
+  # (164.92.239.72, HTTP 302). Only the Ansible code and the vault credentials
+  # were retired. A comment here previously claimed the opposite.
+  uptime_kuma: uptime
+
+  # VPN infrastructure (spacey)
+  headscale: headscale
+
+  # Core services (vipy)
+  vaultwarden: vault
+  forgejo: forgejo
+  lnbits: wallet
+
+  # Secondary services (vipy)
+  ntfy_emergency_app: avisame
+  personal_blog: pablohere
+
+  # Memos (memos-box)
+  memos: memos
+
+  # Mempool block explorer (mempool-box, proxied via vipy)
+  mempool: mempool
+
+  # DATUM Gateway dashboard (knots-box, proxied via vipy)
+  datum_gateway: datum
+
+# Read by plays targeting managed, monitoring, vpn_control and edge - no one
+# group covers them, so these are global rather than group_vars/<group>.
+ntfy_topic: alerts
+headscale_namespace: counter-net
--- a/ansible/infra/01_user_and_access_setup_playbook.yml
+++ b/ansible/infra/01_user_and_access_setup_playbook.yml
@ -1,7 +1,5 @@
 - name: Secure Debian
  hosts: managed
-  vars_files:
-    - ../infra_vars.yml
  become: true

  tasks:
--- a/ansible/infra/02_firewall_and_fail2ban_playbook.yml
+++ b/ansible/infra/02_firewall_and_fail2ban_playbook.yml
@ -1,7 +1,5 @@
 - name: Secure Debian
  hosts: managed
-  vars_files:
-    - ../infra_vars.yml
  become: true

  tasks:
--- a/ansible/infra/410_disk_usage_alerts.yml
+++ b/ansible/infra/410_disk_usage_alerts.yml
@ -15,9 +15,7 @@
  hosts: managed
  become: yes
  vars_files:
-    - ../infra_vars.yml
    - ../services_config.yml
-    - ../infra_secrets.yml

  vars:
    disk_usage_threshold_percent: 80
@ -27,9 +25,8 @@
    monitoring_script_path: "{{ monitoring_script_dir }}/disk_usage_monitor.sh"
    log_file: "{{ monitoring_script_dir }}/disk_usage_monitor.log"
    systemd_service_name: disk-usage-monitor
-    # Uptime Kuma configuration (auto-configured from services_config.yml and infra_secrets.yml)
+    # Uptime Kuma configuration (auto-configured from group_vars/all/)
    uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"
-    ntfy_topic: "{{ service_settings.ntfy.topic }}"

  tasks:
    - name: Validate Uptime Kuma configuration
--- a/ansible/infra/420_system_healthcheck.yml
+++ b/ansible/infra/420_system_healthcheck.yml
@ -15,9 +15,7 @@
  hosts: managed
  become: yes
  vars_files:
-    - ../infra_vars.yml
    - ../services_config.yml
-    - ../infra_secrets.yml

  vars:
    healthcheck_interval_seconds: 60  # Send healthcheck every 60 seconds (1 minute)
@ -27,9 +25,8 @@
    monitoring_script_path: "{{ monitoring_script_dir }}/system_healthcheck.sh"
    log_file: "{{ monitoring_script_dir }}/system_healthcheck.log"
    systemd_service_name: system-healthcheck
-    # Uptime Kuma configuration (auto-configured from services_config.yml and infra_secrets.yml)
+    # Uptime Kuma configuration (auto-configured from group_vars/all/)
    uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"
-    ntfy_topic: "{{ service_settings.ntfy.topic }}"

  tasks:
    - name: Validate Uptime Kuma configuration
--- a/ansible/infra/430_cpu_temp_alerts.yml
+++ b/ansible/infra/430_cpu_temp_alerts.yml
@ -15,9 +15,7 @@
  hosts: hypervisor
  become: yes
  vars_files:
-    - ../infra_vars.yml
    - ../services_config.yml
-    - ../infra_secrets.yml

  vars:
    temp_threshold_celsius: 80
@ -27,7 +25,6 @@
    log_file: "{{ monitoring_script_dir }}/cpu_temp_monitor.log"
    systemd_service_name: nodito-cpu-temp-monitor
    uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"
-    ntfy_topic: "{{ service_settings.ntfy.topic }}"

  tasks:
    - name: Validate Uptime Kuma configuration
--- a/ansible/infra/900_install_rsync.yml
+++ b/ansible/infra/900_install_rsync.yml
@ -1,7 +1,5 @@
 - name: Install rsync
  hosts: managed
-  vars_files:
-    - ../infra_vars.yml
  become: true

  tasks:
--- a/ansible/infra/920_join_headscale_mesh.yml
+++ b/ansible/infra/920_join_headscale_mesh.yml
@ -2,13 +2,11 @@
  hosts: managed
  become: yes
  vars_files:
-    - ../infra_vars.yml
    - ../services_config.yml
  vars:
    headscale_host_name: "spacey"
    headscale_subdomain: "{{ subdomains.headscale }}"
    headscale_domain: "https://{{ headscale_subdomain }}.{{ root_domain }}"
-    headscale_namespace: "{{ service_settings.headscale.namespace }}"

  tasks:
    - name: Set facts for headscale server connection
--- a/ansible/infra/nodito/30_proxmox_bootstrap_playbook.yml
+++ b/ansible/infra/nodito/30_proxmox_bootstrap_playbook.yml
@ -1,8 +1,6 @@
 - name: Bootstrap Nodito SSH Key Access
  hosts: hypervisor
  become: true
-  vars_files:
-    - ../infra_vars.yml

  tasks:
    - name: Install sudo package
--- a/ansible/infra/nodito/31_proxmox_community_repos_playbook.yml
+++ b/ansible/infra/nodito/31_proxmox_community_repos_playbook.yml
@ -1,8 +1,6 @@
 - name: Switch Proxmox VE from Enterprise to Community Repositories
  hosts: hypervisor
  become: true
-  vars_files:
-    - ../infra_vars.yml

  tasks:
    - name: Check for deb822 sources format
--- a/ansible/infra/nodito/32_zfs_pool_setup_playbook.yml
+++ b/ansible/infra/nodito/32_zfs_pool_setup_playbook.yml
@ -1,8 +1,6 @@
 - name: Setup ZFS RAID 1 Pool for Proxmox Storage
  hosts: hypervisor
  become: true
-  vars_files:
-    - ../infra_vars.yml

  tasks:
    - name: Verify Proxmox VE is running
@ -187,8 +185,6 @@
 - name: Setup ZFS Pool Health Monitoring and Monthly Scrubs
  hosts: hypervisor
  become: true
-  vars_files:
-    - ../../infra_vars.yml

  vars:
    zfs_check_interval_seconds: 86400  # 24 hours
--- a/ansible/infra/nodito/33_proxmox_debian_cloud_template.yml
+++ b/ansible/infra/nodito/33_proxmox_debian_cloud_template.yml
@ -1,8 +1,6 @@
 - name: Create Proxmox template from Debian cloud image (no VM clone)
  hosts: hypervisor
  become: true
-  vars_files:
-    - ../../infra_vars.yml

  vars:
    # Defaults (override via vars_files or --extra-vars as needed)
--- a/ansible/infra/nodito/34_nut_ups_setup_playbook.yml
+++ b/ansible/infra/nodito/34_nut_ups_setup_playbook.yml
@ -1,8 +1,6 @@
 - name: Setup NUT (Network UPS Tools) for CyberPower UPS
  hosts: hypervisor
  become: true
-  vars_files:
-    - ../../infra_vars.yml

  tasks:
    # ------------------------------------------------------------------
@ -253,8 +251,6 @@
 - name: Setup UPS Heartbeat Monitoring
  hosts: hypervisor
  become: true
-  vars_files:
-    - ../../infra_vars.yml

  vars:
    ups_heartbeat_interval_seconds: 60
--- a/ansible/infra_secrets.yml
+++ b/ansible/infra_secrets.yml
@ -1,194 +0,0 @@
-$ANSIBLE_VAULT;1.1;AES256
-36353131353730316436313965366263666236396164323163376431623232313961323863633035
-6338333965643036666538303864376463623434326564660a396239633264353034653963366466
-66353130376366663730626331346235373935306434303462663763613763663131613335633430
-6335633535333166330a366232306230303033663931333734353636656132383034616336653235
-35636234306134376666666538386561663561626262396135313632393831363665646130643261
-65663137613530393162333838313962393934396135613064333564303666353634396266316135
-65346363663232626261643933353239663635343137646431623561653963363131303033623764
-34616339343835353765363962396665636335623066303062626463343733643137626265643366
-34653139616163666131333330376132343363306132653163343934353034353932383066373462
-31316664383938633361373839353762393838386636393564633430346334323734383430386663
-39313938383830373062336335303135396334323330316537303965653331323130323866663866
-38323462643633396531386632613961343835313931613933373963326465333836323935613436
-63346562313239623162333038663535656633323037363532373536616161303833626539366634
-35363462663539353366623732626237326465663436356630626335623334356465646439376461
-63653230343333613932646431383238373039653461306365326234303365373234613038343338
-30353937353734633631313765346662616138383462353864656264653534653239383936616437
-34313531383438613465626437313130326562316430366234326230303133356631363534396366
-64313732303837666537383161373865653162303034376533636264656564316530613738353435
-38353031616538346438336563336134643261366331623562663534643966306164306132646332
-31336539663131646232353633326637306637353239616331356337353761313763643933303838
-61636333663137623233323561306665666666363731383438373664363538613762393130646261
-66346335373437326536356330613962386662383031366536373635353438316664613362633966
-35393331613634653462323739343466313735376463643035326336396435656364356134626535
-32623036383737623631623332666264653964383939316465353765373132383230336334353463
-38303136356630653561333363306136363230383238666663373130663763336532323631663637
-32633263633835326662366237613639313431366433363730666666333961323036363533613236
-39343963613239333731336461393937633463303530643333626662316563313165613564386663
-34373636383231636461653862356332353161366331633036383837353434373865363139386235
-30323130343534386531666333343765373265626530373335633766353562356562326239336564
-62313033376330383563633138623838633132343130343262663030316435393835313762313564
-30393366393161663265303439383937333739396661393862356132343537616333623035653566
-64316333323733336135383637333739393931333461653731383863616138613234316161623765
-30343964623939663339633139383866336163613933363231303837646565626262303330363338
-64353931623366326666386637363866383761666232663866666438313535393434373933653139
-64636236306632613930363935353736393065353634653235303534316463653438646162663866
-63663839346162396262366563613131356161333137623966653039623436373466663163313938
-64636362383532303136316163306236333134346164376362363730363030643436356631306639
-31376131653162343338613830376466356363356238343436366232393062336433623238323864
-32376133346264383736396166343539363361623864613364613030623936396634616431386263
-35323632353334643466383933356236383432323162386532613535343932353531373065633732
-36626361313436613036363662376337613237353532366163656236323937316437613633383535
-39306334656532383063306332636538666462353836633366353932623962396131663532343364
-64393035303265336638343733366236373466343832333038633138306535303034386134653032
-62633532353462613664636333373461356434666130376332373762653966386238346463333939
-32386233326264666234353139643837636663633362626163356633396465643030383639663538
-31626331393161653038613438613735643364326565633362386331646231333539626133633739
-31336236663863376166636632363965343765666335633464613937653738313230356438313436
-39373936663363626337626164383237626164396337613430373035373339616266666264346164
-66386238373664386138636536616266353466666363383131616532323430663761633139626164
-33323936356565303332383463656533633935373564353461626139343265336334363433333138
-64363534363836666338366339636435366334383339663463376164613866333839366264666237
-35306231656536613138353663626166303366373761323866666436356438653764353431383430
-33323766643431303337323265646631373434393436333335666366306138356337343163336362
-39323131653734366561613864383266386131626164363361656534386363613565336532666162
-38333031656330306635313032343861653037323037616564323537666261316438303631616530
-35303238366338376363383764633865326530643736306634363436643330376432396535363932
-39646666333234326261373835646336663138366237346562396238326530356533326363373664
-38303634383036323232363934626562663864646239653066326565623635653535623137663065
-65376633356136333938623763396138376630636636376434333463313833386435633365623036
-30373937353433396264643231323832373963396437363562623639353764623063363733366165
-38613833353231333836373637626133323965316665313837653335386534326434363034653630
-38323335666466306665663262343737636564393934373338623130636362383564376434626533
-35623761396465333730626563633734373131373132343262653333343439623433313964623463
-33613639616636393563663331326535346131663832313861353434313965393164643538643437
-36363130363934623333666330353236386530626536616333303131396265386263363462356364
-38393864623461643831333731656566636532643338306361666335316265396430376432393730
-34633638636466313232376363306333356564393038323130313634386162333639366162623437
-66306234346430346537343338343064623131366337356262653130616464646336353136336234
-34623063336332666138303961333332326632326137366664306263666538616361316363323163
-38613431353762653139636365353031343465366138396161366538393833666236656264623132
-63313630633231613438613865613333343066376261326333623864636430643866656132353538
-65653731626464323930383636663364313437313531646462623163646630646664356335303764
-61313462623234303961356363386464333061306239643263333135653538313338383134343236
-63396461346438373830643031336165376563636530353836626436613561313536623130613663
-63383939663535326236313736613630313061323837346339353834313434393437383237633534
-65363334643238373864636530386434636565623131366433313562623933366633396565646565
-33626433373834633638656365363261643866343961663566333761306138383865316536303664
-35653463633336616438373732303938393032663961653262333134353762333433373039636638
-33366466336133383061373866323231663038373831386139613535376539393165363034303537
-35346638613137616666623362396564346464376133316262646339333936363961316161663332
-38303239356334633137316333363439303935346230613032643564353734643863636264316136
-39663131376638653138623838323739343064623430386166643962633363373335316239663339
-37633934393664346433316633353831373534653437623065363134626661323732656664633639
-32616539323931626130353836303533363232353066343666366263663565623862333062323237
-31393935313133333837626632346461356134376339633239396438336333376534353063633937
-61653230653666623935346134666130373934643438323464346239336430373635396165323738
-36613432356239323039386364643535346261373739363463373839373063346565616466663239
-33353165353631343730636531363565383363623839346434383737313136646330323461633665
-32376631663637353534636262666532643636366237383539346235383832313933336432363734
-35653866643136383934613261633439343831363234616438333530336437326562366536383834
-33343330316337323064386464656436333430643061663665306534386235336437643965393165
-61373038323539316161363731306334633833376532626537643164373638303438326637376630
-35343333343364326538333862643265336166396466373362326162303430383434626535336163
-31666662653261343631366165656131376462333063626134613466636637383936303933346362
-32386162323230666563353838613033393936386535646130613861356563633566393430313661
-37666561643361653630353262653234636232303534393661343834366562353864343638313134
-36656463653166393432646263626530316361643761646265613534643563306161333539633361
-33613830356238623962623739623437646635356334386637633035373262313539386662353732
-35666534663965333836396664316432633137363761623838356430316566383131363530316462
-62636235396136363538653836633133663465386139636339353664666634343238663861613437
-62656435363832623461363662643262323265353066376538306163376438303838373961303239
-63623066656532353933396534623637356362356231336361393534393465633565653132656130
-37363863666136643461383033653936383935333131343565643664386664326463663466633361
-36313638616533623431316361386539383434653866376363383630323632636237373666393561
-31313135303339633763303762653939386663393439646135656537303331366236396230303063
-32336336366533323936633166623434623365633163643461653966383563653533363335666638
-61313764656437613138663038386336336664396539373930373933326234636662653833656435
-61343962373935653238326265663164363561616435363134313634666331636431633133356563
-37326133363762383266353730343537373934653634366336316635653063313461303237633164
-61333231353135343666343461306161626432636331653962613334376439613265653437663333
-34623638313561356464356534343635653265633531323736386335656635303263636663323930
-39373462663438326366363433343735343234383735643363326339626135313564646432656330
-38653836653938383932643032616534363035366530336663653235366230353332636531653138
-63623537353165623037383361643937623466356464313931666430666632633866363232623230
-32353766383432613233313331356432326430383132616263656361613334383936643066326133
-30643935653662376433353039323836613239336265376663616336663264343331373236373237
-64326462626566386563623235633664653665356461316362663462343665303233313035366435
-32623465656138303161396233623661333238306334646663353263383437653461383366366466
-39303061363530373339623435613765313637616634313731666631653161623439323734383735
-65383666366330623338653561353032373231396431353466313335303935386136613566336331
-62326539383631636263353234393866333031643737663064383130313066396461663466623431
-38616364303439393432663035623138353264656635393633646363366538633262306466336564
-35623733613564323233303034636264336464373566303065383438366338643538666638643466
-63343130613461316465626237343235616536613838623930636136333131616437656631376564
-34366535383961656237333030376139353237343636306165646161323732646663376231393832
-61396263393561356438326237633634333533646638383865336164656465383166373236643063
-63643263303132656336333339623539663765333039396364643462396161366562626362343162
-34363936323230373839373734343332663664373634313364383062353130363362623937656139
-32653237643061646531623030646335383463333136366264363133303666663261343631663762
-36346432386465393765353763353265633837623165303634646137646564356237653336666331
-38376463376130353863636334353633313361313239373264333134333232353765346666326665
-65623333396165353334636532303537366566666130343366383964396365333461646566333431
-37303032643731346361393963303061363837373562393866353962333231623763623236323161
-39383538663837326663636166643864393733653764353536303433653563316339663438353838
-37616135373336326536333932636538336465323130626266613930393266633164636439663532
-37633264356661353836346462626538323631613539636631396436646139666538383838323437
-62663561356430336235343439633135326661653031653063363030326132336462336164373232
-31363131326334613361356461353934656364346666663762306161356463386332366562336630
-39326236656335363630363564316134623435343538386462663161396332366639363033383235
-35306434646330636137323939623565663939643161616336386633633133363963383739633434
-32336433663132363239356266653461633033623232346135353032353265343861316638643265
-66303932643235333764323239653430346132666136663133383935613962353235313336306136
-38373938376238313034346237373035383861613930323936663831346538313937343538663737
-62616139663634333636333635636364643966303565656265653634653437633233396138323831
-64313465643233663663303130653133626638313162356133316139333030663530313232626437
-35613439326639393032393962653933376636663934333764393064346465633637613836333933
-33646336653533666631656132623035323963623134653432363133646339346363336263323135
-34356233373965333362326132383762626436333365363731396134376664363465623362316366
-31623361376161393836623732613034643831363838663733386561313961373632643639666635
-37633061303235306437666337306236316331616330396632356266636137313833346366653031
-64366236306139363861323237396232336665633331326139373461353237336432373366333266
-32326565376464383937356562633730383961306535666464383364656137633662333662626366
-30653736646333333963656566326431376361666465363532393765393764633562626232643836
-32626261373835356634633461303664653362346231343030343433376364643664383464636666
-35323738366332306337616563646231663963353135623133613636666363396530643239626566
-35383330663138333631386363643032383161626439633437343934366635656433386163613663
-30623738656535396134363830626338353864356330613131623832363330633064376531303965
-35313036393031383035633035636165313363333564633938306166666639636436353733303662
-66653264356432383166333630646533313736366130666331306537393262363538313030646134
-38306363663932313230346664303531636639656339323062333739303239333861616533666132
-30353332303233323837346234336633646163643137636166633330633464663935653838313161
-37393533646139313236393234313763353533663638363031393764633862363938643838353937
-36613564353366663434633839303036343665313933326531353831396139613330316632613637
-37666432363330326232366664656462313336323866316633396533313638373462386365663332
-63626136396661353739633263363038326630623037353831323930346431666263333431643562
-39373133636465373064613664323335353236326562343966616439646565383934613462623363
-38613962386236356666643038303435376266656165336263653365353537666362616638636639
-34326262303930303237636339666563613663373863666339663135326661663866346264613734
-34353565613832323132343730396535656264376233356162353265623739613332333261393331
-33616230333033613766643264396633343535376461633330633064613662336532613163373962
-61343065373630383838306631633031656566343765333365373932373234313733396165623639
-65313731346632333235303463393039656232653163336161633265376434623466373361333865
-66323664343766306566663335656138323537656563383835653263323039656166613330613733
-38323064306365656561313163306439653937623536616435616431616133643466336362666330
-64303832343739383430626339663532653363626263393237343234666266323933316566343937
-32373335373237653265303638663331363838313961343936616639646438343633326461626363
-30653964646639663836636437653861343064393332306638363864326439626335373663653335
-33653230626337633863356534393466633162323734623135393931363339383163353466633031
-39343435616137373166376538633330386232333666316566336234373933613534666430353336
-33626637346337623132313833343430613832303932323739326537666531356630356137653963
-30623262373032353934353938346263396338336265393937336539386530343062623761646632
-39653035393535356630626164393464663738616239613166613364396539343039306538613230
-38636261633932643965323966346632616264343262643933346163656436326330336564623265
-30646561303563323937393533663066393733353638323332663736353766336664343265613733
-66643631633864386262343232636465613962386538366163613734386635303837636164383465
-35373331363864393934633563623662326632386534323436663634613030646563643035386539
-37323262646365633739626539346638383039643433343837363561303530376434336131353965
-32336133393139626232313933636136646264613338643238646431316566333662353837636232
-32623639636432333134643962313430623533333237343464383135643361336236396533653761
-66383165363539363938653130633630643865636663313665353839646462613334383266663563
-62333035626539383739656565633861363863333563656339353735336330333633633861643130
-35363062306165623861316639336237373434353437626461383931656531306134313264383664
-37353966616136326264376135373532653630393335336665343463323466353162
--- a/ansible/infra_secrets.yml.example
+++ b/ansible/infra_secrets.yml.example
@ -1,38 +0,0 @@
-# Uptime Kuma login credentials
-# Used by the disk monitoring playbook to create monitors automatically
-
-
-# ntfy credentials
-# Used for notification channel setup in Uptime Kuma
-
-ntfy_username: "your_ntfy_username"
-ntfy_password: "your_ntfy_password"
-
-# headscale-ui credentials
-# Used for HTTP basic authentication via Caddy
-# Provide either:
-#   - headscale_ui_password: plain text password (will be hashed automatically)
-#   - headscale_ui_password_hash: pre-hashed bcrypt password (more secure, use caddy hash-password to generate)
-
-headscale_ui_username: "admin"
-headscale_ui_password: "your_secure_password_here"
-# headscale_ui_password_hash: "$2a$14$..."  # Optional: pre-hashed password
-
-bitcoin_rpc_user: "bitcoinrpc"
-bitcoin_rpc_password: "CHANGE_ME_TO_SECURE_PASSWORD"
-
-# Mempool MariaDB credentials
-# Used by: services/mempool/deploy_mempool_playbook.yml
-mariadb_mempool_password: "CHANGE_ME_TO_SECURE_PASSWORD"
-
-# Forgejo Runner registration token
-# Used by: services/forgejo-runner/deploy_forgejo_runner_playbook.yml
-# See: services/forgejo-runner/SETUP.md for how to obtain this token
-forgejo_runner_registration_token: "YOUR_RUNNER_TOKEN_HERE"
-
-# DATUM Gateway secrets
-# Used by: services/datum-gateway/deploy_datum_gateway_playbook.yml
-datum_mining_address: "YOUR_BITCOIN_ADDRESS_FOR_BLOCK_REWARDS"
-datum_gateway_admin_password: "CHANGE_ME_TO_SECURE_PASSWORD"
-datum_dashboard_username: "admin"
-datum_dashboard_password_hash: "$2a$14$..."  # Generate with: caddy hash-password
--- a/ansible/infra_vars.yml
+++ b/ansible/infra_vars.yml
@ -1,9 +0,0 @@
-new_user: counterweight
-ssh_port: 22
-allow_ssh_from: "any"
-root_domain: contrapeso.xyz
-
-# Uptime Kuma was decommissioned on 2026-09-11. The monitoring blocks in the
-# playbooks are kept deliberately — the check logic is meant to be rewired to
-# whatever replaces it. This flag keeps them inert until then. See archive/uptime_kuma/.
-uptime_kuma_enabled: false
--- a/ansible/roles/bitcoin_knots/defaults/main.yml
+++ b/ansible/roles/bitcoin_knots/defaults/main.yml
@ -1,8 +1,10 @@
 # Bitcoin Knots Configuration Variables

 # Version - REQUIRED: Specify exact version/tag to build
-bitcoin_knots_version: "v29.2.knots20251110"  # Must specify exact version/tag
-bitcoin_knots_version_short: "29.2.knots20251110"  # Version without 'v' prefix (for tarball URLs)
+# The only version string. There used to be a second, v-prefixed copy
+# (bitcoin_knots_version) that nothing read - two hand-maintained copies of one
+# fact, with nothing keeping them in step.
+bitcoin_knots_version_short: "29.2.knots20251110"

 # Directories
 bitcoin_knots_dir: /opt/bitcoin-knots
--- a/ansible/roles/caddy_site/defaults/main.yml
+++ b/ansible/roles/caddy_site/defaults/main.yml
@ -15,7 +15,8 @@ caddy_site_headers_up: {}       # {"X-Forwarded-Host": "wallet.example.com"}
 # expression for the username silently passes through as literal text.
 caddy_site_basic_auth: []       # [{user: "{{ x_user }}", hash: "{{ x_hash }}"}]

-# Placement. caddy_sites_dir comes from services_config.yml; this is the fallback.
+# Placement. This is now the only definition of caddy_sites_dir - services_config.yml
+# used to carry an identical copy, which was removed as redundant.
 caddy_sites_dir: /etc/caddy/sites-enabled

 # Rendered site files can carry credentials (basic_auth hashes), so --diff is
--- a/ansible/roles/datum_gateway/defaults/main.yml
+++ b/ansible/roles/datum_gateway/defaults/main.yml
@ -31,7 +31,7 @@ datum_gateway_build_jobs: 4
 # The gateway runs on the same host as Bitcoin Knots so localhost RPC works.
 # datum_bitcoin_rpc_url should include http:// and port.
 datum_bitcoin_rpc_url: "http://127.0.0.1:8332"
-# Note: bitcoin_rpc_user and bitcoin_rpc_password come from infra_secrets.yml
+# Note: bitcoin_rpc_user and bitcoin_rpc_password come from group_vars/all/vault.yml

 # Mining config
 datum_coinbase_tag_primary: "DATUM"
--- a/ansible/roles/forgejo_runner/defaults/main.yml
+++ b/ansible/roles/forgejo_runner/defaults/main.yml
@ -21,8 +21,6 @@ forgejo_instance_url: "https://forgejo.contrapeso.xyz"
 # systemd stores it, so `systemctl is-failed forgejo-runner-healthcheck.service`
 # answers the question with no monitoring system involved at all.
 healthcheck_interval_seconds: 60
-healthcheck_timeout_seconds: 90
-healthcheck_retries: 1
 healthcheck_script_dir: /opt/forgejo-runner-healthcheck
 healthcheck_script_path: "{{ healthcheck_script_dir }}/forgejo_runner_healthcheck.sh"
 healthcheck_log_file: "{{ healthcheck_script_dir }}/forgejo_runner_healthcheck.log"
--- a/ansible/roles/fulcrum/defaults/main.yml
+++ b/ansible/roles/fulcrum/defaults/main.yml
@ -11,7 +11,7 @@ fulcrum_binary_path: /usr/local/bin/Fulcrum

 # Network - Bitcoin RPC connection
 # Bitcoin Knots is on a different host (knots_box_local)
-# Using RPC user/password authentication (credentials from infra_secrets.yml)
+# Using RPC user/password authentication (credentials from group_vars/all/vault.yml)
 # Addressed by Tailscale name, never a LAN IP. This was
 #   bitcoin_rpc_host: "192.168.1.140"  # IP of knots_box_local
 # but .140 is fulcrum-box ITSELF - knots-box is .135. The DHCP leases had
@ -21,7 +21,7 @@ fulcrum_binary_path: /usr/local/bin/Fulcrum
 # agree with it.
 bitcoin_rpc_host: "knots-box"
 bitcoin_rpc_port: 8332  # Bitcoin Knots RPC port
-# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from infra_secrets.yml
+# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from group_vars/all/vault.yml

 # Network - Fulcrum server
 fulcrum_tcp_port: 50001
@ -42,8 +42,6 @@ fulcrum_ssl_cert_path: "{{ fulcrum_config_dir }}/fulcrum.crt"
 fulcrum_ssl_key_path: "{{ fulcrum_config_dir }}/fulcrum.key"
 fulcrum_ssl_cert_days: 3650  # 10 years validity for self-signed cert

-# Port forwarding configuration (for public access via VPS)
-fulcrum_tailscale_hostname: "{{ service_settings.fulcrum.tailscale_hostname }}"

 # Performance
 # db_mem will be calculated as 75% of available RAM automatically in playbook
--- a/ansible/roles/mempool/defaults/main.yml
+++ b/ansible/roles/mempool/defaults/main.yml
@ -11,7 +11,7 @@ mempool_mysql_dir: "{{ mempool_dir }}/mysql"
 # Network - Bitcoin Core/Knots connection (via Tailnet Magic DNS)
 bitcoin_host: "knots-box"
 bitcoin_rpc_port: 8332
-# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from infra_secrets.yml
+# Note: bitcoin_rpc_user and bitcoin_rpc_password are loaded from group_vars/all/vault.yml

 # Network - Fulcrum Electrum server (via Tailnet Magic DNS)
 fulcrum_host: "fulcrum-box"
@ -30,7 +30,7 @@ mempool_backend_port: 8999
 # MariaDB settings
 mariadb_database: "mempool"
 mariadb_user: "mempool"
-# Note: mariadb_mempool_password is loaded from infra_secrets.yml
+# Note: mariadb_mempool_password is loaded from group_vars/all/vault.yml



--- a/ansible/roles/phoenixd/defaults/main.yml
+++ b/ansible/roles/phoenixd/defaults/main.yml
@ -35,7 +35,6 @@ phoenixd_http_bind_port: 9740
 # Optional webhook for payment events. Leave empty to disable.
 phoenixd_webhook_url: ""

-phoenixd_monitor_name: "Phoenixd"



--- a/ansible/services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml
+++ b/ansible/services/bitcoin-knots/deploy_bitcoin_knots_playbook.yml
@ -10,9 +10,7 @@
  hosts: bitcoin
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the push URL this check has been reporting to. The role knows
    # nothing about Uptime Kuma — this is just "a URL that accepts a ping".
@ -24,7 +22,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
  tasks:
    - name: Expose Bitcoin P2P through a socket proxy
@ -34,7 +31,7 @@
        socket_proxy_name: bitcoin-p2p
        socket_proxy_description: "Bitcoin P2P"
        socket_proxy_listen_port: "{{ service_settings.bitcoin.p2p_port }}"
-        socket_proxy_upstream_host: "{{ service_settings.bitcoin.tailscale_hostname }}"
+        socket_proxy_upstream_host: "{{ hostvars['knots_box_local'].ansible_host }}"
        socket_proxy_documentation: "https://github.com/bitcoin/bitcoin"
        socket_proxy_free_bind: true
        socket_proxy_timeout_stop_sec: 5
--- a/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
+++ b/ansible/services/datum-gateway/deploy_datum_gateway_playbook.yml
@ -11,9 +11,7 @@
  hosts: bitcoin
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the push URL this check reports to. The role knows nothing about
    # Uptime Kuma — this is just "a URL that accepts a ping".
@ -25,9 +23,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  tasks:
    - name: Publish the DATUM Gateway dashboard through Caddy
      ansible.builtin.include_role:
@ -35,7 +31,7 @@
      vars:
        caddy_site_name: datum-gateway
        caddy_site_domain: "{{ subdomains.datum_gateway }}.{{ root_domain }}"
-        caddy_site_upstream: "{{ service_settings.datum_gateway.tailscale_hostname }}:{{ service_settings.datum_gateway.api_port }}"
+        caddy_site_upstream: "{{ hostvars['knots_box_local'].ansible_host }}:{{ service_settings.datum_gateway.api_port }}"
        caddy_site_resolvers: "100.100.100.100"
        caddy_site_basic_auth:
          - user: "{{ datum_dashboard_username }}"
@ -52,7 +48,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
  tasks:
    - name: Expose the DATUM Stratum port through a socket proxy
@ -62,7 +57,7 @@
        socket_proxy_name: datum-stratum
        socket_proxy_description: "DATUM Stratum"
        socket_proxy_listen_port: "{{ service_settings.datum_gateway.stratum_port }}"
-        socket_proxy_upstream_host: "{{ service_settings.datum_gateway.tailscale_hostname }}"
+        socket_proxy_upstream_host: "{{ hostvars['knots_box_local'].ansible_host }}"
        # Matches the UFW comment already on the edge host; the derived default
        # would say "DATUM Stratum" and rewrite the rule.
        socket_proxy_ufw_comment: "DATUM Gateway Stratum public access"
--- a/ansible/services/forgejo-runner/deploy_forgejo_runner_playbook.yml
+++ b/ansible/services/forgejo-runner/deploy_forgejo_runner_playbook.yml
@ -3,9 +3,7 @@
  hosts: ci_runner
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the push URL this host has been reporting to all along, so the
    # move to a role changes no behaviour. The role itself knows nothing about
--- a/ansible/services/forgejo/deploy_forgejo_playbook.yml
+++ b/ansible/services/forgejo/deploy_forgejo_playbook.yml
@ -2,9 +2,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./forgejo_vars.yml
  vars:
    forgejo_subdomain: "{{ subdomains.forgejo }}"
--- a/ansible/services/forgejo/forgejo_vars.yml
+++ b/ansible/services/forgejo/forgejo_vars.yml
@ -9,7 +9,7 @@ forgejo_url: "https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo
 forgejo_bin_path: "/usr/local/bin/forgejo"
 forgejo_user: "git"

-# (caddy_sites_dir and subdomain now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # Remote access
 remote_host_name: "{{ groups['edge'] | first }}"
--- a/ansible/services/forgejo/setup_backup_forgejo.yml
+++ b/ansible/services/forgejo/setup_backup_forgejo.yml
@ -9,7 +9,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./forgejo_vars.yml

  tasks:
--- a/ansible/services/fulcrum/deploy_fulcrum_playbook.yml
+++ b/ansible/services/fulcrum/deploy_fulcrum_playbook.yml
@ -6,9 +6,7 @@
  hosts: electrum
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the push URL this check has been configured with. The role knows
    # nothing about Uptime Kuma — this is just "a URL that accepts a ping".
@ -20,7 +18,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
  tasks:
    - name: Expose Fulcrum SSL through a socket proxy
@ -30,4 +27,4 @@
        socket_proxy_name: fulcrum-ssl
        socket_proxy_description: "Fulcrum SSL"
        socket_proxy_listen_port: "{{ service_settings.fulcrum.ssl_port }}"
-        socket_proxy_upstream_host: "{{ service_settings.fulcrum.tailscale_hostname }}"
+        socket_proxy_upstream_host: "{{ hostvars['fulcrum_box_local'].ansible_host }}"
--- a/ansible/services/headscale/deploy_headscale_playbook.yml
+++ b/ansible/services/headscale/deploy_headscale_playbook.yml
@ -2,15 +2,12 @@
  hosts: vpn_control
  become: no
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./headscale_vars.yml
  vars:
    headscale_subdomain: "{{ subdomains.headscale }}"
    headscale_domain: "{{ headscale_subdomain }}.{{ root_domain }}"
    headscale_base_domain: "tailnet.{{ root_domain }}"
-    headscale_namespace: "{{ service_settings.headscale.namespace }}"
    uptime_kuma_api_url: "https://{{ subdomains.uptime_kuma }}.{{ root_domain }}"

  tasks:
--- a/ansible/services/headscale/headscale_vars.yml
+++ b/ansible/services/headscale/headscale_vars.yml
@ -1,5 +1,5 @@
 # Headscale service configuration
-# (subdomain and caddy_sites_dir now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 headscale_port: 8080
 headscale_grpc_port: 50443
@ -10,7 +10,7 @@ headscale_version: "0.26.1"
 # Data directory
 headscale_data_dir: /var/lib/headscale

-# Namespace now configured in services_config.yml under service_settings.headscale.namespace
+# Namespace is headscale_namespace in group_vars/all/main.yml

 # Remote access
 remote_host_name: "{{ groups['vpn_control'] | first }}"
--- a/ansible/services/headscale/setup_backup_headscale.yml
+++ b/ansible/services/headscale/setup_backup_headscale.yml
@ -3,7 +3,6 @@
  hosts: vpn_control
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./headscale_vars.yml

  tasks:
--- a/ansible/services/lnbits/deploy_lnbits_playbook.yml
+++ b/ansible/services/lnbits/deploy_lnbits_playbook.yml
@ -2,9 +2,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./lnbits_vars.yml
  vars:
    lnbits_subdomain: "{{ subdomains.lnbits }}"
--- a/ansible/services/lnbits/lnbits_vars.yml
+++ b/ansible/services/lnbits/lnbits_vars.yml
@ -3,7 +3,7 @@ lnbits_dir: /opt/lnbits
 lnbits_data_dir: "{{ lnbits_dir }}/data"
 lnbits_port: 8765

-# (caddy_sites_dir and subdomain now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # Remote access
 remote_host_name: "{{ groups['edge'] | first }}"
--- a/ansible/services/lnbits/setup_backup_lnbits.yml
+++ b/ansible/services/lnbits/setup_backup_lnbits.yml
@ -9,7 +9,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./lnbits_vars.yml

  tasks:
--- a/ansible/services/memos/deploy_memos_playbook.yml
+++ b/ansible/services/memos/deploy_memos_playbook.yml
@ -2,9 +2,7 @@
  hosts: memos
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./memos_vars.yml
  vars:
    memos_subdomain: "{{ subdomains.memos }}"
@ -160,9 +158,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./memos_vars.yml
  vars:
    memos_subdomain: "{{ subdomains.memos }}"
--- a/ansible/services/memos/memos_vars.yml
+++ b/ansible/services/memos/memos_vars.yml
@ -12,7 +12,7 @@ memos_url: "https://github.com/usememos/memos/releases/download/v{{ memos_versio
 memos_tailscale_hostname: "memos-box"
 memos_tailscale_ip: "100.64.0.4"

-# (caddy_sites_dir and subdomain in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # Remote access (for backup from lapy via Tailscale)

--- a/ansible/services/memos/setup_backup_memos.yml
+++ b/ansible/services/memos/setup_backup_memos.yml
@ -7,7 +7,6 @@
  hosts: memos
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./memos_vars.yml

  tasks:
--- a/ansible/services/mempool/deploy_mempool_playbook.yml
+++ b/ansible/services/mempool/deploy_mempool_playbook.yml
@ -3,9 +3,7 @@
  hosts: mempool
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # Preserves the three push URLs these checks have been reporting to all
    # along, so the move to a role changes no behaviour. The role knows nothing
@ -22,7 +20,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
  vars:
    mempool_domain: "{{ subdomains.mempool }}.{{ root_domain }}"
--- a/ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml
+++ b/ansible/services/ntfy-emergency-app/deploy_ntfy_emergency_app_playbook.yml
@ -2,8 +2,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
-    - ../../infra_secrets.yml
    - ../../services_config.yml
    - ./ntfy_emergency_app_vars.yml
  vars:
--- a/ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml
+++ b/ansible/services/ntfy-emergency-app/ntfy_emergency_app_vars.yml
@ -2,7 +2,7 @@
 ntfy_emergency_app_dir: /opt/ntfy-emergency-app
 ntfy_emergency_app_port: 3000

-# (caddy_sites_dir and subdomain now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # ntfy configuration
 ntfy_emergency_app_topic: "emergencia"
--- a/ansible/services/ntfy/deploy_ntfy_playbook.yml
+++ b/ansible/services/ntfy/deploy_ntfy_playbook.yml
@ -2,8 +2,6 @@
  hosts: monitoring
  become: yes
  vars_files:
-    - ../../infra_vars.yml
-    - ../../infra_secrets.yml
    - ../../services_config.yml
    - ./ntfy_vars.yml
  vars:
--- a/ansible/services/ntfy/ntfy_vars.yml
+++ b/ansible/services/ntfy/ntfy_vars.yml
@ -1,3 +1,3 @@
 ntfy_port: 6674

-# ntfy_topic now lives in services_config.yml under service_settings.ntfy.topic
+# ntfy_topic lives in group_vars/all/main.yml
--- a/ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml
+++ b/ansible/services/ntfy/setup_ntfy_uptime_kuma_notification.yml
@ -15,14 +15,11 @@
  hosts: monitoring
  become: no
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./ntfy_vars.yml

  vars:
    ntfy_subdomain: "{{ subdomains.ntfy }}"
-    ntfy_topic: "{{ service_settings.ntfy.topic }}"
    uptime_kuma_subdomain: "{{ subdomains.uptime_kuma }}"
    ntfy_domain: "{{ ntfy_subdomain }}.{{ root_domain }}"
    ntfy_server_url: "https://{{ ntfy_domain }}"
--- a/ansible/services/personal-blog/deploy_personal_blog_playbook.yml
+++ b/ansible/services/personal-blog/deploy_personal_blog_playbook.yml
@ -2,9 +2,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./personal_blog_vars.yml
  vars:
    personal_blog_subdomain: "{{ subdomains.personal_blog }}"
--- a/ansible/services/personal-blog/setup_deploy_alias_lapy.yml
+++ b/ansible/services/personal-blog/setup_deploy_alias_lapy.yml
@ -2,7 +2,6 @@
  hosts: control
  gather_facts: no
  vars_files:
-    - ../../infra_vars.yml
    - ./personal_blog_vars.yml
  vars:
    bashrc_path: "{{ lookup('env', 'HOME') }}/.bashrc"
--- a/ansible/services/phoenixd/deploy_phoenixd_playbook.yml
+++ b/ansible/services/phoenixd/deploy_phoenixd_playbook.yml
@ -5,9 +5,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
  vars:
    # phoenixd's health check has never reported anywhere since the Uptime Kuma
    # decommissioning — its systemd Environment= was left empty. Leaving it empty
--- a/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml
+++ b/ansible/services/vaultwarden/deploy_vaultwarden_playbook.yml
@ -2,9 +2,7 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ../../services_config.yml
-    - ../../infra_secrets.yml
    - ./vaultwarden_vars.yml
  vars:
    vaultwarden_subdomain: "{{ subdomains.vaultwarden }}"
--- a/ansible/services/vaultwarden/disable_vaultwarden_sign_ups_playbook.yml
+++ b/ansible/services/vaultwarden/disable_vaultwarden_sign_ups_playbook.yml
@ -2,7 +2,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../infra_vars.yml
    - ./vaultwarden_vars.yml

  tasks:
--- a/ansible/services/vaultwarden/setup_backup_vaultwarden.yml
+++ b/ansible/services/vaultwarden/setup_backup_vaultwarden.yml
@ -6,7 +6,6 @@
  hosts: edge
  become: yes
  vars_files:
-    - ../../group_vars/all/main.yml
    - ./vaultwarden_vars.yml

  tasks:
--- a/ansible/services/vaultwarden/vaultwarden_vars.yml
+++ b/ansible/services/vaultwarden/vaultwarden_vars.yml
@ -3,7 +3,7 @@ vaultwarden_dir: /opt/vaultwarden
 vaultwarden_data_dir: "{{ vaultwarden_dir }}/data"
 vaultwarden_port: 8222

-# (caddy_sites_dir and subdomain now in services_config.yml)
+# (subdomain in group_vars/all/main.yml, caddy_sites_dir in roles/caddy_site/defaults/)

 # Remote access
 remote_host_name: "{{ groups['edge'] | first }}"
--- a/ansible/services_config.yml
+++ b/ansible/services_config.yml
@ -1,67 +1,24 @@
-# Centralized Services Configuration
-# Subdomains and Caddy settings for all services
-
-# Edit these subdomains to match your preferences
-subdomains:
-  # Monitoring Services (on watchtower)
-  ntfy: ntfy
-  # DEPRECATED 2026-09-11 — Uptime Kuma is decommissioned and this subdomain no
-  # longer resolves to anything. Kept only because the deprecated monitoring
-  # blocks still template it into uptime_kuma_api_url. See archive/uptime_kuma/.
-  uptime_kuma: uptime
-  
-  # VPN Infrastructure (on spacey)
-  headscale: headscale
-  
-  # Core Services (on vipy)
-  vaultwarden: vault
-  forgejo: forgejo
-  lnbits: wallet
-  
-  # Secondary Services (on vipy)
-  ntfy_emergency_app: avisame
-  personal_blog: pablohere
-  
-  # Memos (on memos-box)
-  memos: memos
-  
-  # Mempool Block Explorer (on mempool_box, proxied via vipy)
-  mempool: mempool
-
-  # DATUM Gateway dashboard (on knots_box, proxied via vipy)
-  datum_gateway: datum
-
-# Caddy configuration
-caddy_sites_dir: /etc/caddy/sites-enabled
-
-# Service-specific settings shared across playbooks
+# Cross-host service settings.
+#
+# These exist because a value is needed by the service's own role on one host
+# AND by a play that runs on the edge host. A role default is invisible to that
+# second play, so it cannot live in roles/<svc>/defaults/.
+#
+# Everything else that used to be here has moved:
+#   subdomains, ntfy topic, headscale namespace -> group_vars/all/main.yml
+#   caddy_sites_dir                             -> roles/caddy_site/defaults/
+#   *.tailscale_hostname                        -> deleted; inventory already
+#     holds each box's identity as ansible_host, and an edge play reads it with
+#     hostvars['<host>'].ansible_host. Three copies of one name is how
+#     bitcoin_rpc_host ended up labelled "knots_box" while pointing at
+#     fulcrum-box.
 service_settings:
-  ntfy:
-    topic: alerts
-  headscale:
-    namespace: counter-net
  mempool:
-    # The frontend port is needed in two places on two different hosts: the
-    # mempool role deploys it on mempool-box, and the Caddy play proxies to it
-    # from the edge host. A role default cannot serve the second play, so it
-    # lives here rather than in roles/mempool/defaults.
    frontend_port: 8080
  bitcoin:
-    # The P2P port is needed on two hosts: the bitcoin_knots role deploys the
-    # node on knots-box, and the socket-proxy play publishes the port from the
-    # edge host. A role default cannot reach that second play.
    p2p_port: 8333
-    tailscale_hostname: knots-box
  datum_gateway:
-    # Needed on two hosts: the datum_gateway role deploys on knots-box, while the
-    # Caddy play (dashboard) and the socket-proxy play (Stratum) both run on the
-    # edge host. A role default cannot reach either of those plays.
    api_port: 7152
    stratum_port: 23334
-    tailscale_hostname: knots-box
  fulcrum:
-    # Same shape as mempool: the fulcrum role deploys on fulcrum-box, and the
-    # socket-proxy play publishes the SSL port from the edge host. A role default
-    # is invisible to that second play.
    ssl_port: 50002
-    tailscale_hostname: fulcrum-box