chore(aegis): remove local TLS configuration

AGENTS.md

@@ -163,8 +163,7 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
   `aegis_lan_subnet` and `aegis_adguard_web_port` host-specific; SSH permits only the declared
   key-authenticated users, never root or password authentication. Keep Apple IDs and other
   credentials in Vault and use `no_log` for their rendering.
-- `aegis_adguard_web_port` defaults to `80`; the playbook also permits HTTPS on `443` and DNS-over-TLS on `853/tcp`. The initial AdGuard
-  Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
+- `aegis_adguard_web_port` defaults to `80`. The initial AdGuard Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
   completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before
   AdGuard binds port 53; keep
   `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf` so Aegis retains router-provided DNS.

README.md

@@ -129,7 +129,7 @@ intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Qu
 Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted
 firewalld rules, SSH key-only access for `pi`, and `wake-ikaros`. Set the host-local
 `aegis_lan_subnet` and `aegis_adguard_web_port` values before applying it. The playbook permits
-AdGuard Home on ports `80`, `443`, and DNS-over-TLS on `853/tcp`; the initial wizard port `3000` is intentionally unmanaged and must be
+AdGuard Home HTTP on port `80`; the initial wizard port `3000` is intentionally unmanaged and must be
 opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS
 stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53
 for AdGuard while retaining DNS learned from the router. Define

ansible/roles/profile_aegis/tasks/main.yml

@@ -135,6 +135,15 @@
   loop_control:
     label: "{{ item }}"
 
+- name: Remove retired Aegis TLS access rule
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    rich_rule: 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept'
+    permanent: true
+    immediate: true
+    state: disabled
+    zone: "{{ aegis_firewalld_zone }}"
+
 - name: Allow Aegis services from the LAN only
   tags: [aegis, firewall]
   ansible.posix.firewalld:
@@ -146,7 +155,6 @@
   loop:
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept'
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept'
-    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept'
     - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept'
   loop_control:
     label: "{{ item }}"

ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2

@@ -3,5 +3,4 @@
   <short>Aegis AdGuard Home web interface</short>
   <description>AdGuard Home administrative web interface on Aegis.</description>
   <port protocol="tcp" port="{{ aegis_adguard_web_port }}"/>
-  <port protocol="tcp" port="443"/>
 </service>

secrets/vault.yml

@@ -1,40 +1,40 @@
 $ANSIBLE_VAULT;1.1;AES256
-31333936393638613266313236303037323963333839336537656538623730326661346335346361
-3635303665316130666139363462616230353763396439650a346463613033626365306666323638
-37343734316534653437643834383139613562353538303838383137636361663530313432343030
-3132333139346363630a343338336235613062336639633431643737383638363131316536363630
-31643031626666616537303538393134326335666165636362313861306362623939396337653365
-65386165343130613332363361313261353930396536396134323038623764326630653431633430
-33386463313266373531343365333734336433656635663130613334333666376336316232323836
-36373961373661323361363739623665616162323630396166616232613234623338613664303332
-30623361363663396633333865343461616334636439376631646236313538663363336432623765
-36323435626265333063326232663334376234303735313761306130623739323663333563363461
-61383066333639323034616535333535373666346337613035656635313466666362313130633035
-63383465663464363238643666653462656635626137613531343961336166373732323863613162
-62386263376231653836336331653064316430656661336137316432363464376435373136383630
-32633134383861616266643534303934396531343065376338653663356339343236356362393164
-39616464623232646536376630646239626131373938323337323261663536323135623736333534
-32393766663131376662666462666135616262353366336230336134383565656238313663626435
-62636333326331346661646135313766363935393563333939323336363163306132333534626361
-66623261376639646563306464623836306163396565326266366663386239306138333837376230
-34616230623336653633303864353434666335323936343366653733396463653838646534393265
-34393138656538373732616165646237353833313365383035346532613461613766653765366336
-37613963386333666662323731656237343862383837633734363333613537623836666339383731
-34313966383739383937343332613931656236336365643135373235343331346163333332313139
-30333035663361393266303464376464623864653631306430353830383935643930313132623936
-33303135386434366365396339636631633139663030323237646165376263666430626634333936
-34333638333638613339343437396566323435323361323061666338356130333032613736633735
-61643033383131306430653039633161343039303438373761386132626135613839313465353934
-38636533353465633231326665336130616462303730333733306533326466346665333239306662
-32336133346236316433353766356336653039303563623763396665653237383335316562376534
-61386464626264363436656362303233633833623835623630656635353962333264393466663865
-39626530323539656566326631316461303931323330356534316236616636613433363233303531
-30326463636162653935663361653363313633323635613666616437386537653532656461653131
-34376663393364356432656331383830633832363030643831303135393039343838303636616336
-64666132353364373235646637353934656264313330646530393637663063326134363166613037
-63373037333939363935316266363633316236373434363430323535393530383066396238653166
-34653666666435633832623139353330396235616134633339643932316432363263646263613863
-38343337353137653239623162656465363562643031353939653634323734663765356335316466
-31653636626538303161626334643235643236666130613437643930306263336564373465303564
-38353832313732376336643635613536336130393365336239303862393838323632303831656664
-333665383162333661393336643863376438
+65623833316230316230376465656261383230643661393032396462643232383334383236653134
+3964353234623165633736303035623132643565393461660a323930623462323635613361373836
+37613164656538353734333932326136303532346161663238613466616236636432346534626331
+3434663266366637650a336235363033333562626135333962626265666332386261643666306638
+64343262353661346435326662633833656533643464653665356233316466333432303536356539
+32623430303663616261386636613534326231613366636536303761646335396132623231336361
+61656337313766353533643266396230626439353033373630666336616230316362616135323462
+30306633373234386639633932393437323931613739383135353835393630623937636639343338
+35636530643330376538393262383738333735656230363633383463386366343065633961663562
+37653264326565376166666262643136616333656233386564333030663532353836306131316530
+62633738306434303236623239646638613230323434393761656265393064373235333435393264
+36363936336330636433643133346164643733356239616530653831626165316238643834356236
+36333262313764653137633930663131306132306434376433306230306564366633363738313634
+35316230623134623932396132316530366662643366643439643334366233646334633764346266
+35373764633138343235323931346134613265356238616138323134326338633335336339313862
+61653939366263386431636334333661306538643166353661336561396365366434353830643465
+31626136626336633363653531363064643534396336623331363130313966653966373636663232
+65653132363139653239383636333861323435613362666637366162323062376139633033373563
+66656134313931313965303134613836383534636438363936353836326639346565653031363839
+63623738366261363734376536646532396231616233303061363364383238616434333366613933
+63616539613336393863633361303466353738313666393164343638373530376666663666666235
+33666234353736633335343639623664326566333162333539636235346663663737366432366665
+66373831303666666533343234373466333132343135326261663532663062313939623963383437
+34653732653830313638343631313437623931623531323566306232373165636662316633333438
+66666537623966623932323463323330316337613637383339613637653637333832623965636434
+34653330336663323263353636353139323337646166623862343565646637616136646232373633
+33356134373464646664303865353763323531383661323930353038646333386366353665396431
+64303739643735376235626134663566343165646433393966373961393738323036353437346436
+66656166306561353637623462303039393465363261343164393062643130383736623261383232
+38623036626464613138363635646233323737653137633830316138663835656633336663626338
+33386232633862616432396662343738343462623263303337393533313264396637356134373739
+61323266623665353631316461633462646536386266343934356235363065653162363566623661
+35643332303333306362303538333034316461326363653632313765396664643533373862333533
+37306536356465393933366238663031653630386239383839316365323761316236326330306637
+36373434643864343064646437323736393330326361663231373933613864303339653661616139
+36356134636136333830663031656132656237383331663362313238653133366538323462376632
+63373766383939656265313934636462626633376162623931333363393837303336363036303439
+32643730383735383535633439326564376261343937343934366366373039653761383934316162
+383035326562353431616536646238323164