Add dormant Rocky server profile

README.md

@@ -36,8 +36,9 @@ infra/
 
 ## Managed machines
 
-The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, an Ubuntu server, and
-a Rocky Linux 9 NAS. Configuration is layered instead of being tied to host names:
+The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, an Ubuntu server, a
+dormant Rocky Linux 9 server profile, and a Rocky Linux 9 NAS. Configuration is layered instead of
+being tied to host names:
 
 ```text
 common user environment
@@ -53,6 +54,7 @@ common user environment
 | `nymph` | Fedora | Desktop laptop | GNOME |
 | `deadalus` | Fedora WSL | Development workstation | — |
 | `prometheus` | Ubuntu | Server | — |
+| — (`rocky_server`, dormant) | Rocky 9 | Server | — |
 | `atlas` | Rocky 9 | NAS | — |
 
 ```text
@@ -99,9 +101,15 @@ That gives it Fedora packages through DNF, Docker from the official repository,
 
 ## Server
 
-`prometheus` is the Ubuntu LTS server. It has no graphical environment and gets server-specific dotfiles and templates.
+`prometheus` is the Ubuntu LTS server. It has no graphical environment and gets server-specific
+dotfiles and templates. `rocky_server` is the empty alternative profile for a future Rocky Linux 9
+migration; it does not select any host until one is explicitly added to that inventory group.
 
-The server profile installs Ubuntu packages, Docker from the official repository, declared systemd services, UFW rules, and the server Compose stack. Syncthing ports `22000/tcp`, `22000/udp`, and `21027/udp` are opened; the Syncthing GUI is not directly opened in UFW.
+The server profile installs platform-specific packages, Docker CE from the official repository,
+declared systemd services, the server Compose stack, and either UFW on Ubuntu or firewalld on Rocky.
+Syncthing ports `22000/tcp`, `22000/udp`, and `21027/udp` are opened; the Syncthing GUI is not
+directly exposed by the managed firewall rules. Rocky bind mounts use private SELinux relabeling for
+application data while host system files remain unchanged.
 
 Server identity comes from `server_username`, `server_user_group`, and `server_user_home` in `ansible/inventory/group_vars/server.yml`. `server_username` defaults to `username`, but it can be overridden, for example:
 
@@ -112,6 +120,12 @@ ansible-playbook ansible/site.yml --limit prometheus \
   -e server_user_home=/srv/myuser
 ```
 
+The dormant profile provisions configuration only: it does not transfer data, start the Compose
+stack, update DNS, or perform a cutover. During migration, add the replacement machine to
+`rocky_server` under a distinct inventory name after creating `server_username` with local sudo
+access. When reusing `prometheus` at cutover, remove it from `ubuntu_server` before adding it to
+`rocky_server`; a host must never belong to both platform groups.
+
 ## NAS
 
 `atlas` is a Rocky Linux 9 NAS reached through SSH. Its pool already exists: the profile only
@@ -229,13 +243,14 @@ ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --di
 ## What `site.yml` runs
 
 ```text
-all -> dotfiles_common
+all except platform_rocky -> dotfiles_common
 platform_void -> packages_void + services_runit
 platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_niri + profile_desktop_host
 platform_freebsd -> packages_freebsd + services_freebsd
 platform_fedora -> packages_fedora + services_systemd
 platform_rocky -> packages_rocky + services_systemd
 atlas -> profile_atlas
+rocky_server -> dotfiles_common + profile_server (after platform_rocky)
 platform_fedora & role_personal_workstation -> profile_personal_workstation
 platform_fedora & desktop_gnome -> profile_desktop_gnome
 workstation_dev_fedora -> profile_workstation_dev_common
@@ -248,8 +263,9 @@ So, in practice:
 - `platform_fedora` configures `ikaros`, `nymph`, and `deadalus`.
 - `deadalus` gets the Fedora development layer followed by the WSL layer.
 - `ubuntu_server` configures `prometheus`.
+- Empty `rocky_server` defines the Rocky 9 server alternative without targeting a machine.
 - `atlas` receives the Rocky platform layer and the NAS profile through SSH.
-- Empty `platform_void` and `platform_freebsd` groups do nothing until they get a host.
+- Empty `platform_void`, `platform_freebsd`, and `rocky_server` groups do nothing until they get a host.
 - The playbook never restarts the display manager during a run.
 - `secrets/vault.yml` and then `secrets/vault.local.yml` are loaded only when present.