rebuild: fold monitoring into spacey and prd-arbret into vipy

All four droplets were deleted by mistake on 2026-10-17 and rebuilt as two:
Gatus and signal-api now share spacey with headscale, and arbret moves onto
vipy. The old IPs were recycled to strangers within a day.

- inventory: [observability] is spacey. Left as it was, the bare name
  `monitoring` resolved through ~/.ssh/config to an IP that now belongs to
  someone else. [arbret]/prd-arbret is gone.
- inventory: lan_ip fallbacks corrected from the Proxmox guest agent -
  memos-box is .130 (was .145) and arbret-staging-box .145 (was .147).
- spacey: gatus_port 8081. headscale already holds 0.0.0.0:8080, and the two
  never shared a host before.
- 402: status.<domain> is expected to resolve to spacey.
- headscale ACL: prd-arbret, prd-monitoring and stalwart-box removed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ansible/host_vars/monitoring/main.yml

@@ -1,12 +0,0 @@
----
-
-# Systemd services deployed on this host, monitored every 5 minutes.
-#
-# The fact lives with the machine rather than in a central map, for the same
-# reason the cross-host ports do: "what runs here" is a property of the host,
-# and a central list is one more thing to forget to update when a service moves.
-#
-# Only units WE deploy belong here. Distro units (ssh, cron) have their own
-# supervision and would be noise.
-monitored_services:
-  - caddy

ansible/host_vars/spacey/main.yml

@@ -11,3 +11,10 @@
 monitored_services:
   - headscale
   - caddy
+
+# Gatus moved onto this host in the 2026-10-17 rebuild (the `monitoring` droplet
+# is gone). Headscale already listens on 0.0.0.0:8080, so Gatus takes 8081.
+# Host vars rather than role defaults: the Caddy vhost play in
+# services/gatus/deploy_gatus_playbook.yml does not load the role and reads
+# this same variable.
+gatus_port: 8081

ansible/infra/402_public_monitoring.yml

@@ -21,7 +21,7 @@
     # then left behind when the machine moved, so the check asserts against
     # ansible_host - if a box is renumbered, inventory is the one edit.
     dns_records:
-      - {sub: "{{ subdomains.gatus }}",              host: monitoring}
+      - {sub: "{{ subdomains.gatus }}",              host: spacey}
       - {sub: "{{ subdomains.headscale }}",          host: spacey}
       - {sub: "{{ subdomains.vaultwarden }}",        host: vipy}
       - {sub: "{{ subdomains.forgejo }}",            host: vipy}

ansible/inventory.ini

@@ -1,7 +1,6 @@
 [vps]
-vipy ansible_host=167.172.107.33 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
+vipy ansible_host=167.172.98.204 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
-spacey ansible_host=64.227.112.128 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
+spacey ansible_host=46.101.250.26 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
-monitoring ansible_host=64.226.70.190 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
 
 [nodito_host]
 nodito ansible_host=192.168.1.139 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
@@ -11,9 +10,9 @@ nodito ansible_host=192.168.1.139 ansible_user=counterweight ansible_port=22 ans
 knots_box_local ansible_host=knots-box lan_ip=192.168.1.135 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
 fulcrum_box_local ansible_host=fulcrum-box lan_ip=192.168.1.140 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
 mempool_box_local ansible_host=mempool-box lan_ip=192.168.1.142 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
-memos_box_local ansible_host=memos-box lan_ip=192.168.1.145 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
+memos_box_local ansible_host=memos-box lan_ip=192.168.1.130 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
 forgejo_runner_local ansible_host=forgejo-runner-box lan_ip=192.168.1.132 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
-arbret_staging_local ansible_host=arbret-staging-box lan_ip=192.168.1.147 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
+arbret_staging_local ansible_host=arbret-staging-box lan_ip=192.168.1.145 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
 small_backups_local ansible_host=small-backups-box lan_ip=192.168.1.131 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
 monerod_box_local ansible_host=monerod-box lan_ip=192.168.1.146 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
 # lan_ip read off nodito's ARP table for the VM's own MAC (bc:24:11:89:fc:1f),
@@ -30,18 +29,13 @@ jar_lid_staging_local ansible_host=jar-lid-archive-staging-box lan_ip=192.168.1.
 [lapy]
 localhost ansible_connection=local ansible_user=counterweight
 
-[arbret]
-prd-arbret ansible_host=167.99.242.62 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua
-
 [edge]
 vipy
 
-# The group is `observability`, NOT `monitoring` — there is a HOST named
+# Gatus and its Signal transport. Shares spacey with headscale since the
-# `monitoring` on line 5, and a group with the same name makes `hosts: monitoring`
+# 2026-10-17 rebuild; the separate `monitoring` droplet is gone.
-# ambiguous. Ansible resolved it to the host and warned:
-#   [WARNING]: Found both group and host with same name: monitoring
 [observability]
-monitoring
+spacey
 
 [vpn_control]
 spacey
@@ -78,7 +72,7 @@ forgejo_runner_local
 localhost
 
 # Every machine Ansible may configure as a server.
-# Deliberately EXCLUDES [control] (your laptop) and [arbret].
+# Deliberately EXCLUDES [control] (your laptop).
 [managed:children]
 vps
 nodito_host

ansible/services/headscale/templates/acl.json.j2

@@ -46,12 +46,7 @@
         "tag:jar-lid-archive-staging-box:8000",
         "tag:monerod-box:18089",
         "tag:monerod-box:8081",
-        "tag:arbret-staging-box:80",
+        "tag:arbret-staging-box:80"
-        "tag:stalwart-box:25",
-        "tag:stalwart-box:465",
-        "tag:stalwart-box:993",
-        "tag:stalwart-box:4190",
-        "tag:stalwart-box:8080"
       ],
       "src": [
         "tag:prd-vipy"
@@ -80,10 +75,8 @@
     {
       "action": "accept",
       "dst": [
-        "tag:prd-arbret:22",
         "tag:prd-vipy:22",
         "tag:memos-box:22",
-        "tag:stalwart-box:22",
         "tag:jar-lid-archive-staging-box:22"
       ],
       "src": [
@@ -125,20 +118,11 @@
     "tag:nodito": [
       "{{ headscale_namespace }}@"
     ],
-    "tag:prd-arbret": [
-      "{{ headscale_namespace }}@"
-    ],
-    "tag:prd-monitoring": [
-      "{{ headscale_namespace }}@"
-    ],
     "tag:prd-vipy": [
       "{{ headscale_namespace }}@"
     ],
     "tag:small-backups-box": [
       "{{ headscale_namespace }}@"
-    ],
-    "tag:stalwart-box": [
-      "{{ headscale_namespace }}@"
     ]
   }
 }