Document Atlas NAS backups and monitoring

* Add Atlas media and storage services

* Document Atlas backend phase one and WireGuard deployment

* Enable Atlas NAS management and document bootstrap workflow

* Harden Atlas network, SSH, firewall, and sharing

* Rotate Ansible Vault secrets

* Allow configurable Aegis SSH users and authorized keys

* Manage Aegis SSH authorized key fragments

* Manage SSH authorized key fragments for infrastructure hosts

* Harden Rocky storage and sharing configuration

* Verify WireGuard handshakes and restore Podman networking

.gitignore

@@ -0,0 +1,2 @@
+# DuckDNS runtime files contain a rendered Vault token and must stay on the host.
+/dotfiles/server/duckdns/

AGENTS.md

@@ -1,6 +1,6 @@
 # AGENTS.md
 
-Ansible-driven personal infrastructure repo for Fedora and Void desktops, FreeBSD transition targets, WSL, and an Ubuntu server.
+Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora IoT, WSL, a Rocky Linux 9 server, and an Atlas NAS.
 
 ## Source Of Truth
 - Main orchestration: `ansible/site.yml`
@@ -15,8 +15,9 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, FreeBS
 - Current laptop: `nymph = platform_fedora + graphical_desktop + desktop_gnome`
 - Void desktop profile is also the base for other future/reference hosts via `platform_void + graphical_desktop`
 - Workstation: `deadalus` is Windows + Fedora WSL.
-- Ubuntu server: `prometheus`
+- Rocky server: `prometheus` belongs to `rocky_server`.
 - NAS: `atlas` (Rocky Linux 9, reached through SSH)
+- Always-on LAN node: `aegis` (Fedora IoT on Raspberry Pi 4, reached through SSH)
 - Hosts intentionally belong to multiple groups; trust `ansible/site.yml` over hostname assumptions.
 - Inventory axes are independent: `platform_*`, `role_*`, and `desktop_*`. Legacy `void` and `desktop` remain compatibility parents.
 
@@ -24,7 +25,10 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, FreeBS
 - Preserve layering `all -> platform -> role -> desktop -> host`.
 - Keep `ansible/site.yml` small; orchestration belongs there, implementation belongs in roles.
 - Prefer minimal, targeted edits. Preserve idempotency and existing ordering.
-- All hosts use `ansible_connection: local`.
+- Use Git Flow branch prefixes: `feature/` for new functionality, `bugfix/` for non-urgent fixes,
+  `hotfix/` for urgent production fixes, `release/` for release preparation, and `support/` for
+  maintained release lines. Do not use abbreviated prefixes such as `feat/`.
+- Desktop and WSL hosts use `ansible_connection: local`; remote infrastructure hosts use SSH.
 - Treat `secrets/` as sensitive. Never print secret values.
 - Tmux plugins are bootstrapped by TPM on the host; the repo only keeps tmux config and custom helper scripts.
 - Read the relevant role tasks, templates, vars, and deployed dotfiles before editing.
@@ -41,11 +45,35 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, FreeBS
   - Fedora laptop work: `ansible-playbook ansible/site.yml --limit nymph --check --diff`
   - WSL workstation dev: `ansible-playbook ansible/site.yml --limit deadalus --check --diff`
   - Server: `ansible-playbook ansible/site.yml --limit prometheus --check --diff`
+  - Rocky server after activation: `ansible-playbook ansible/site.yml --limit <host> --check --diff`
   - Atlas NAS: `ansible-playbook ansible/site.yml --limit atlas --check --diff`
+  - Aegis IoT: `ansible-playbook ansible/site.yml --limit aegis --check --diff`
+  - Aegis NFS client layer: `ansible-playbook ansible/site.yml --limit aegis --tags nfs --list-tasks`
+  - Aegis host DNS: `ansible-playbook ansible/site.yml --limit aegis --tags dns --check --diff`
 - Focused checks:
   - Emacs is disabled by default; temporary Emacs check: `ansible-playbook ansible/site.yml --limit <host> --tags emacs --check --diff -e emacs_enabled=true`
+  - AI coding agents: `ansible-playbook ansible/site.yml --limit <host> --tags ai_agents --check --diff`
   - Mail bootstrap: `sh -n scripts/bootstrap_mail.sh` and `shellcheck scripts/bootstrap_mail.sh`
-  - Server compose render: `docker compose -f /opt/docker/server/docker-compose.yml config`
+  - Server compose render: `podman-compose -f /opt/docker/server/docker-compose.yml config` and `systemctl status podman-compose-server`
+  - Atlas media stack:
+    `ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff`
+  - Atlas network/share hardening:
+    `ansible-playbook ansible/site.yml --limit atlas --tags hardening,sharing --check --diff`
+  - Atlas ZFS snapshot retention and scrub timers:
+    `ansible-playbook ansible/site.yml --limit atlas --tags snapshots,scrub --check --diff`
+  - Atlas encrypted Borg backup:
+    `ansible-playbook ansible/site.yml --limit atlas --tags packages,borg --check --diff`
+  - Atlas Borg progress logging only:
+    `ansible-playbook ansible/site.yml --limit atlas --tags borg_logging --check --diff`
+  - Atlas manual offline USB backup and 45Drives Alerts reminder:
+    `ansible-playbook ansible/site.yml --limit atlas --tags usb_backup,usb_reminder --check --diff`
+  - Atlas pool, disk, capacity, temperature, and job monitoring:
+    `ansible-playbook ansible/site.yml --limit atlas --tags monitoring --check --diff`
+  - Atlas explicit post-restore SELinux relabeling:
+    `ansible-playbook ansible/site.yml --limit atlas --tags restorecon --check -e '{"atlas_restorecon_paths":["/zpool/archive"]}'`
+  - Prometheus/Aegis WireGuard gateway:
+    `ansible-playbook ansible/site.yml --limit prometheus,aegis --tags wireguard --check --diff`
+  - DuckDNS config only: `ansible-playbook ansible/site.yml --limit prometheus --tags duckdns --check --diff`
 
 ## Conventions
 - Use FQCN Ansible modules.
@@ -77,59 +105,200 @@ The Void desktop package lists in `ansible/inventory/group_vars/void.yml` are ke
 - `desktop_common_packages` — GUI infrastructure shared by the minimal desktop mode.
 - `desktop_minimal_packages` — applications, integration components, and the `emptty` display manager.
 - `desktop_sway_packages` — binaries specific to the Sway session.
-`profile_packages` in the same file is cross-distro and is overridden by `group_vars/server.yml` and the workstation group vars; do not move desktop-specific Void entries through it.
+`profile_packages` remains the shared package bucket for Void and Fedora profiles. Rocky uses
+`rocky_profile_packages` so RPM-specific names do not leak back into the other platforms; do not move
+desktop-specific Void entries through either bucket.
 The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-independent content and `desktop_minimal_dotfiles` carries Thunar, Udiskie, and MIME defaults. `desktop_void_dotfiles` remains reserved for files that need the Void runtime.
 
 ## Workstation Notes
 - `deadalus` is modeled as Windows + Fedora WSL and is the sole workstation target.
 - Fedora WSL belongs to `platform_fedora`, `workstation_dev_fedora`, and the shared WSL layer. It must not receive Flatpak or Snap runtimes.
+- Fedora WSL installs Mise from the official `jdxcode/mise` COPR and uses its pinned Temurin Java 11 JDK; update the declared Mise version deliberately.
 - Windows applications are installed manually and are not managed from the WSL profile.
 
+## Rocky Server Notes
+- DuckDNS is rendered by `profile_server` from host-local `server_duckdns_domain` and
+  `vault_duckdns_token`. Keep the rotated token in encrypted Vault or untracked local vars, never in
+  dotfiles. The private `~/duckdns/duck.sh` keeps the existing entrypoint; rendering uses `no_log`
+  and disables diffs. Provisioning does not execute the updater or change its external schedule.
+- `rocky_server` is a child of both `platform_rocky` and `server`; `prometheus` is its active target.
+- The target must already provide `server_username` with local sudo access before the profile runs.
+- The Rocky profile installs Podman and podman-compose, uses firewalld, preserves SELinux enforcement, and renders the
+  existing Nginx Proxy Manager/Gitea Compose stack with a `podman-compose-server` systemd unit. PostgreSQL and
+  Navidrome are no longer part of the desired Prometheus configuration. The role does not stop or remove legacy
+  containers, delete `/opt/postgres/data`, start the Compose stack, update DNS, or cut over traffic.
+- Firewalld enables SSH, Cockpit (`9090/tcp`), HTTP and HTTPS. Nginx Proxy Manager publishes `80/tcp` and
+  `443/tcp`; bind its administration interface only to `127.0.0.1:81` and use `npm-tunnel` from Ikaros or Nymph.
+  Nextcloud remains disabled; do not provision `/srv/nextcloud` directories.
+- `scripts/migrate_prometheus_data.sh` is the separate, source-host-run NPM/Gitea migration path. It dry-runs by
+  default and requires explicit source-stack quiescing before copying persistent Docker data with rsync.
+- Atlas-only OpenZFS, NFS, Samba, and Syncthing stay selected through Atlas host variables and must not
+  leak into `rocky_server`. Cockpit plus its Navigator and Podman extensions are selected explicitly for
+  Prometheus through its host variables.
+
 ## Atlas NAS Notes
 - `atlas` is a remote Rocky Linux 9 NAS. Keep its connection, LAN, pool and mountpoint values in
   `host_vars/atlas.yml`. Bootstrap it once with `-e atlas_connection_username=<existing-admin>`;
   subsequent runs use the dedicated Atlas account.
-- The pool is pre-existing: never add pool creation, disk partitioning, RAIDZ creation, rollback,
+- The pool is normally pre-existing. A one-time bootstrap may create it only when `atlas_create_pool=true`
-  or destruction to the Atlas profile.
+  is explicitly supplied and `atlas_zpool_disks` contains exactly four real `/dev/disk/by-id/...` paths.
-- `atlas_manage_storage` and `atlas_manage_firewall` remain false until their placeholders are
+  Never partition, force, destroy, roll back, or modify the vdev layout of an existing pool.
-  replaced; only then may the profile manage datasets, shares and LAN-restricted firewall rules.
+- `atlas_manage_storage`, `atlas_manage_sharing`, and `atlas_manage_firewall` are enabled in Atlas host vars as
-- Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit
+  the declared steady state; set one false only for a deliberate suspension. `atlas_manage_media_stack` remains false
-  and, when storage is enabled, `vault_atlas_samba_password`. Never print these values.
+  until the future rootful Immich stack has its required Vault inputs and target validation.
-- Atlas uses NFSv4 for Linux and SMB for Windows/WSL, restricted to the configured LAN. Snapshot,
+- Atlas requires `vault_atlas_admin_password_hash` for Cockpit and, while sharing is enabled,
-  Rclone, Prometheus pull and USB backup automation are intentionally deferred.
+  `vault_atlas_samba_password`. The future rootful media stack also requires
+  `vault_atlas_immich_db_password`. Never print these values.
+- Atlas creates the complete declared hierarchy only under the verified existing or explicitly bootstrapped pool: `archive`,
+  `services`, `services/data`, `services/data/navidrome`, `services/data/syncthing`, `media`, `media/music`,
+  `media/photobook`, `backup`, `backup/hosts`, and `backup/hosts/prometheus`. `backup` has a `500G`
+  reservation covering its descendants. `archive` is the SMB-shared raw-data namespace; container state is never beneath it.
+- The `immich` system account is fixed to UID/GID `1100`, has no login shell or `wheel` membership, and receives only
+  the `video` and `render` supplementary groups. Immich's rootful Quadlets run as `1100:1100`; Server and ML receive
+  `/dev/dri`, while the Photobook external library is read-only at `/external/photobook`.
+- Atlas applies persistent kernel network hardening: redirects and source routes are rejected, martians logged, reverse-path filtering remains loose for WireGuard, and IPv4 forwarding is disabled. SSH permits only the declared administrator using public-key authentication; root login, passwords, agent and remote forwarding
+  are disabled, while local forwarding remains available for private administrative tunnels. Photobook is exported only to the configured Aegis IP with all access squashed to UID/GID
+  `1100`. Targeted SELinux is enforced persistently; a required reboot is reported but never initiated automatically. The primary LAN interface is assigned explicitly to the managed firewalld zone, and firewall rules are applied before NFS or SMB are started; their service state and TCP listeners are then verified. SMB3 exposes `Archive` to Vault-backed authorized accounts on mandatory encrypted, signed SMB3 over TCP/445 only and admits the configured LAN without host-specific exclusions.
+- Atlas NPM and Immich share a rootful Podman network. NPM publishes HTTP/HTTPS, but its administration port remains
+  bound to `127.0.0.1:81`; do not expose it directly to the LAN or Internet.
+- `profile_backend_phase1` temporarily runs rootless Navidrome and Syncthing on Atlas until Uranus replaces
+  them. It binds only to Atlas' LAN IP, never `wg0`; Navidrome and the Syncthing GUI admit only Aegis as
+  the source-NAT gateway, while native Syncthing ports admit the configured LAN. It initializes fresh
+  state only and never migrates or deletes source application data.
+- `wireguard_overlay` manages `wg0` between Prometheus (`10.0.0.1`) and Aegis (`10.0.0.2`). It persists private
+  keys only on their respective hosts, exchanges only derived public keys through Ansible, and verifies a real peer
+  handshake. Prometheus opens `51820/udp`; Aegis is the LAN gateway. Its persistent IPv4 forwarding, narrowly scoped
+  WireGuard-to-LAN firewalld policy, and source masquerading permit Prometheus to reach LAN services without a static
+  route on the router. Prometheus includes `192.168.178.0/24` in Aegis' peer `AllowedIPs`; add the Uranus VIP there
+  when it is assigned. After a firewalld reload, restore Prometheus' rootful Podman networking with
+  `podman network reload --all` so the existing proxy stack retains container DNS.
 
 ## Atlas NAS TODO
-- Replace every Atlas `CHANGEME` value, provide the required Vault variables and validate the first
+Completed validation: the existing RAIDZ2 pool and datasets, SELinux, LAN firewall, SSH, Cockpit with
-  remote bootstrap on the real Rocky Linux 9 host. Enable `atlas_manage_storage` first and
+the selected 45Drives plugins, encrypted SMB3 `Archive`, the Aegis-only NFSv4 `photobook` export, and the
-  `atlas_manage_firewall` only after confirming the pool, mountpoints, LAN subnet and firewalld zone.
+Prometheus--Aegis WireGuard gateway are operational. The gateway handshake, forwarding, source masquerading,
-- Validate the complete baseline on the target: OpenZFS kmod loading, existing pool import, dataset
+and TCP reachability to Atlas were verified. Temporary Navidrome and Syncthing are available through their
-  mounts, SSH reconnect, Cockpit and all selected 45Drives plugins, NFSv4, SMB and Syncthing.
+manual NPM Proxy Hosts; Syncthing uses `/data/Org` backed by the SMB-shared Archive dataset. Aegis has also
-- Finalize dataset properties and the shared UID/GID, group and POSIX ACL model; test the same files
+validated NFSv4.2 read, write, delete, and `all_squash` mapping to UID/GID `1100` end-to-end. The ZFS
-  through both NFS and SMB before considering multiprotocol access complete.
+snapshot timers are active and the first recursive hourly snapshot completed successfully; the first
-- Add Ansible-managed ZFS snapshot retention and scrub timers. Use Cockpit Scheduler for visibility
+scheduled retention prune and monthly scrub remain runtime checks.
-  or manual operations, not as the only source of configuration, and never automate snapshot rollback.
+
-- Manage the Syncthing star topology, device IDs, folders, folder modes, ignore rules and protected GUI
+### Priority 1 - Data protection
-  or API access for the selected clients.
+- [x] Deploy Ansible-managed recursive ZFS snapshots with 24 hourly, 30 daily, 8 weekly, and 12 monthly
-- Add Tailscale or WireGuard and corresponding LAN/VPN-only firewalld rules before enabling remote
+  generations, plus a monthly scrub on the first Sunday at 03:00. The timers and first hourly snapshot were
-  services; never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding.
+  verified on Atlas. Still observe the first scheduled retention prune and scrub; Cockpit Scheduler is for
-- Add the least-privilege Prometheus backup flow: remote dump generation, dedicated SSH identity,
+  visibility or manual operations only, and snapshot rollback is never automated.
-  pinned host key, atomic pull, verification, retention and an Atlas systemd service/timer.
+- [x] Activate and validate the encrypted offsite Borg backup to the Hetzner Storage Box. Atlas uses the
-- Add the encrypted Google Drive backup with Rclone Drive plus Crypt remotes, Vault-managed secrets,
+  dedicated SSH identity, pinned ED25519 host key, Vault-backed `repokey` encryption, and a locked
-  snapshot-consistent sources, retries, logging, retention policy and a tested restore procedure.
+  non-login `borg` account with no sudo or supplementary groups. The initial snapshot-consistent backup,
-- Add the UUID-bound offline USB backup with versioned rsync, locking, capacity checks, verification,
+  Borg repository check, and temporary-directory restore completed successfully; the restored `Archive`
-  safe unmounting and a tested restore procedure; never trigger it for an arbitrary USB disk.
+  tree matched the live data, and temporary snapshots and mounts were removed. The exported recovery key
-- Add monitoring and alerting for pool health, scrub/resilver, SMART data, temperatures, free space and
+  was copied offline. Daily backup retries and logging, 30 daily, 8 weekly and 12 monthly archives,
-  failed backup timers, plus a controlled Rocky kernel/OpenZFS update and reboot procedure.
+  compaction, and monthly repository checks are enabled. Future runs report a ZFS-based estimated
-- Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore
+  percentage, and a post-exit helper handles host-namespace temporary snapshot cleanup. The active
-  from snapshot/USB/cloud, preserve Vault and Rclone recovery material offline, and define RPO/RTO.
+  run predates the new progress logging and still requires an observed final cleanup result.
-- Optionally design iCloud photo ingestion as a separate workflow after the storage and backup layers
+- [x] Populate `/zpool/archive` with the currently available data so offsite and offline backup tests run
-  are validated; do not make it a dependency of the Atlas baseline.
+  against a representative load.
+- [ ] Run and evaluate Borg against the populated pool: duration, repository capacity, deduplication, and
+  a subsequent incremental archive must be observed before considering the offsite path fully validated.
+- [x] Add the UUID-bound offline USB backup with versioned rsync, locking, capacity checks, verification,
+  safe unmounting and a tested restore procedure; never trigger it for an arbitrary USB disk. The
+  LUKS/ext4 identities were read-only verified; the manual service and 45Drives Alerts reminder timer were
+  deployed on Atlas. Interactive LUKS unlock is part of the manual service; only the reminder is
+  scheduled for the first Saturday of each month at 10:00 Europe/Rome via the existing 45Drives
+  notifier. A manual test produced an Alerts notification, not an email. The first USB attempt failed
+  on a `security.selinux` xattr and was interrupted; the xattr filter is deployed and the temporary
+  recursive snapshot and open LUKS mapper were cleaned up. A later run reported checksum verification
+  and published the USB version, but failed while removing host-namespace ZFS snapshot mounts. Those
+  exact mounts and snapshots were cleaned up. An `ExecStopPost` helper now removes only the named
+  temporary snapshot after the backup process exits. A new full run checksum-verified and published a
+  USB version; the service ended successfully, the mapper closed, no temporary USB snapshot remained,
+  and the pool was healthy. On 2026-09-25 an independent, read-only USB restore test copied one file from
+  the published `atlas/latest` version into `/var/tmp` and matched contents, owner, mode, size, mtime and
+  POSIX ACL. The temporary copy and mount were removed, the mapper closed, and the pool remained healthy.
+- [x] Test restores independently from a ZFS snapshot, Borg, and the offline USB backup before relying on
+  any backup path. The earlier Borg temporary-directory restore passed. On 2026-09-25 a separate,
+  read-only ZFS snapshot test restored one file to `/var/tmp`, confirmed matching contents, ownership,
+  mode, mtime and ACL, then removed its temporary copy and on-demand mount. This is a file-level smoke
+  test, not full dataset recovery. An independent USB file restore passed on 2026-09-25 with matching
+  content and metadata; full disaster recovery remains a separate Priority 2 task.
+- [x] Add monitoring and alerting for pool health, scrub/resilver, SMART data, temperatures, free space,
+  snapshot/local-backup growth, Hetzner Storage Box quota, and failed maintenance or backup timers.
+  The half-hourly Atlas health monitor and systemd final-failure hooks are deployed. A live probe
+  found no issues; the service and timer succeeded, and a labelled 45Drives Alerts test notification
+  was submitted. Alerts are deduplicated; email delivery is not claimed. The Storage Box quota probe
+  runs `df -m` over the dedicated pinned-key SSH identity and does not open the Borg repository.
+  Detailed archive size and deduplication remain part of the pending Borg evaluation.
+
+### Priority 2 - NAS operability and recovery
+- [ ] Document and test disaster recovery: rebuild Atlas with Ansible, import the existing pool, restore
+  from snapshot/USB/Hetzner, preserve Vault and Borg recovery material offline, and define RPO/RTO.
+- [ ] Define a controlled Rocky kernel/OpenZFS update and reboot procedure.
+- [ ] Add the Atlas-initiated least-privilege Prometheus backup pull: Prometheus exposes only prepared
+  read-only dumps through a dedicated account and Atlas retains the private SSH key, pinned host key,
+  atomic pull, verification, retention and systemd service/timer.
+- [ ] Decide whether a common SMB/NFS namespace is required. `Archive` (SMB) and `photobook` (NFS) are
+  intentionally distinct today; only if a shared namespace is selected, finalize its UID/GID, group,
+  and POSIX ACL model and test the same files through both protocols.
+
+### Priority 3 - Service expansion
+- [ ] After data protection and recovery are validated, populate `/zpool/media/music` and validate Navidrome.
+- [ ] Design and deploy Nextcloud as another explicitly temporary Atlas service before Uranus. Give it
+  separate persistent application, database, and cache storage; keep credentials in Vault; publish it only
+  through NPM over the Prometheus--Aegis gateway; and define backup, upgrade, and eventual Uranus-migration
+  procedures before exposing user data. Do not deploy Nextcloud before the data-protection checklist is complete.
+- [ ] Keep `atlas_manage_media_stack` disabled until the future Immich deployment has validated `/dev/dri`,
+  container paths, and the required Vault database secret.
+
+### Priority 4 - Optional workflows
+- [ ] After data protection is validated, move iCloudPD photo ingestion from Aegis to Atlas as a
+  temporary service until Uranus is ready. Plan to store photos in `/zpool/archive/Pictures` and
+  persistent application/MFA state outside `Archive`; validate permissions, SELinux, backups and
+  recovery before cutover. Keep the current Aegis service and Photobook NFS export unchanged until
+  the Atlas workflow is tested, then retire them explicitly if no longer needed.
+
+## Cerberus Management Node (Deferred)
+`cerberus` is postponed until the office in the new house is physically set up. It is not an inventory
+host and this section is a design and implementation backlog, not authorization to provision it early.
+
+The planned node is a Lenovo ThinkCentre M700 Tiny with an Intel Core i3-6100T, 8 GB RAM, a 256 GB SSD,
+and native 1 Gbps Ethernet. It will connect to a multi-input KVM switch using a passive DisplayPort-to-HDMI
+cable, sharing the monitor and peripherals with Ikaros. Fedora Sericea (immutable Fedora with the Sway
+Wayland compositor) is the intended OS. Cerberus is an isolated management plane: a dedicated Toolbox
+environment will run Ansible for future `uranus` cluster provisioning. Rootless Podman will host Grafana,
+Prometheus, and Loki. The 256 GB local SSD is the hot tier retaining metrics and logs for 30 days; scheduled,
+validated exports of older historical data will use a dedicated Atlas NFS dataset as cold storage.
+
+### Implementation plan
+- [ ] Confirm the office, KVM switch, passive DisplayPort-to-HDMI path, shared monitor/peripherals, and native
+  1 Gbps Ethernet are physically operational before adding Cerberus to inventory.
+- [ ] Install and update Fedora Sericea with Sway; document the immutable-host lifecycle and keep host changes
+  declarative rather than treating the base OS as a mutable workstation.
+- [ ] Model Cerberus as its own host with independent platform, role, desktop, network, and storage inputs;
+  do not repurpose Ikaros variables or make it a Uranus cluster member.
+- [ ] Provision an isolated Toolbox-based Ansible controller with the required collections and a reproducible
+  project checkout; define its least-privilege SSH access, known-host handling, and Vault workflow without
+  storing secrets in the image or repository.
+- [ ] Define the explicit Uranus provisioning workflow from Cerberus, including inventory boundaries,
+  validation-only runs, and separate approval for any destructive cluster operation.
+- [ ] Design rootless Podman/Quadlet services for Grafana, Prometheus, and Loki, including persistent local
+  state, service ownership, LAN exposure/authentication, resource limits, updates, and backups.
+- [ ] Size and enforce a 30-day local hot-retention policy for metrics and logs on the 256 GB SSD; validate
+  actual disk growth and alert before capacity exhaustion.
+- [ ] Create and validate a dedicated Atlas NFS cold-storage dataset and least-privilege export for Cerberus;
+  do not use a broad existing share or couple it to unrelated Atlas application state.
+- [ ] Implement scheduled, idempotent exports of data older than 30 days to the Atlas NFS cold tier, with
+  locking, capacity checks, integrity verification, retention rules, failure monitoring, and a tested restore.
+- [ ] Validate management-plane recovery: rebuild Cerberus, restore observability history from Atlas, and
+  confirm that Uranus provisioning can resume without depending on unreproducible local state.
 
 ## Coding Agent Notes
-- Shared agent packages live in `ai_agents_npm_packages` in `ansible/inventory/group_vars/all.yml`.
+- Shared agent definitions and lifecycle flags live in `ai_agents` in `ansible/inventory/group_vars/all.yml`.
 - Shared agent dotfiles live in `ai_agents_dotfiles`; rendered configs live in `ai_agents_templates`.
-- Desktop and WSL profiles consume the shared agent package list; do not duplicate package entries in profile-specific vars.
+- Every `ai_agents.<agent>` entry has independent `install_enabled`, `deploy_enabled`, and `uninstall_enabled` flags. Installation and removal must not both be true for the same agent; the common pre-task fails before changes when they conflict.
-- `dotfiles_common` copies common dotfiles plus `ai_agents_dotfiles`, then renders `ai_agents_templates`.
+- Fedora, Void desktop, and WSL workstation profiles consume the shared agent definitions; do not duplicate package entries in profile-specific vars. IBM Bob on the workstation follows its own flags.
+- `dotfiles_common` deploys `ai_agents_dotfiles` and renders `ai_agents_templates` only when deployment is enabled.
+- Removal is limited to the managed npm packages and `/usr/local/bin/bob`; never remove agent dotfiles, instructions, credentials, or user data.
 - Keep `.config/ai/` as the common instruction source; update agent-specific entrypoints to reference it rather than duplicating instruction text.
 
 ## Tooling Notes
@@ -143,3 +312,24 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - Keep `README.md` and `AGENTS.md` aligned when workflows materially change.
 - If you add a new operational area, also add the narrowest validation command for it.
 - Call out checks you could not run and any follow-up verification needed.
+
+## Aegis Fedora IoT Notes
+- `aegis` is a remote Fedora IoT Raspberry Pi 4 node. Bootstrap it once with
+  `ansible/bootstrap/aegis.bu`; the remaining configuration is applied by `profile_aegis` over SSH.
+- Fedora IoT is immutable. Do not add it to mutable Fedora package or shared dotfile roles.
+- `profile_aegis` owns the `nfs-utils` and `wireguard-tools` rpm-ostree layers and reports the required reboot
+  without initiating it. `wireguard_overlay` then configures Aegis as the WireGuard LAN gateway with persistent IPv4
+  forwarding, a scoped inter-zone policy, and source masquerading. It also owns rootful Podman Quadlets, persistent container
+  state under `/var/lib`, the Podman auto-update timer, LAN-restricted firewalld rules, and SSH hardening. Keep
+  `aegis_lan_subnet`, `aegis_adguard_web_port`, and `aegis_network_connection_uuid` host-specific;
+  SSH permits only the declared
+  key-authenticated users, never root or password authentication. Keep Apple IDs and other
+  credentials in Vault and use `no_log` for their rendering.
+- `aegis_adguard_web_port` defaults to `80`. The initial AdGuard Home wizard port `3000` is intentionally unmanaged: open and close it manually only while
+  completing initial setup. Disable the local systemd-resolved stub through `profile_aegis` before
+  AdGuard binds port 53; keep
+  `/etc/resolv.conf` linked to `/run/systemd/resolve/resolv.conf`. LAN clients may use AdGuard, but
+  Aegis must use the independent upstream DNS declared by `aegis_host_dns_servers` so Greenboot does
+  not depend on the AdGuard container during startup.
+- iCloudPD requires post-deployment interactive MFA initialization; its cookie/configuration state is
+  persisted in `/var/lib/icloudpd/config`.

README.it.md

@@ -33,7 +33,6 @@ infra/
 │   ├── common/
 │   ├── desktop/
 │   ├── fedora/
-│   ├── ubuntu/
 │   ├── server/
 │   ├── workstation/
 │   ├── workstation_dev_wsl/
@@ -56,8 +55,8 @@ Il repository è diviso in due componenti principali:
 
 # Macchine gestite
 
-Il repository modella attualmente host Fedora/GNOME, una workstation Fedora WSL, un server Ubuntu e
+Il repository modella attualmente host Fedora/GNOME, una workstation Fedora WSL, un server Rocky
-un NAS Rocky Linux 9. La composizione resta separata in assi indipendenti:
+Linux 9 e un NAS Rocky Linux 9. La composizione resta separata in assi indipendenti:
 
 ```text
 common user environment
@@ -74,8 +73,8 @@ Matrice target:
 | ikaros       | Fedora   | Personal workstation | GNOME   |
 | nymph        | Fedora   | Desktop laptop       | GNOME   |
 | deadalus     | Fedora WSL | Workstation dev    | —       |
-| prometheus   | Ubuntu   | Server               | —       |
+| prometheus   | Rocky Linux | Server            | —       |
-| atlas        | Rocky 9 | NAS                  | —       |
+| atlas        | Rocky Linux | NAS               | —       |
 
 Regola operativa:
 
@@ -93,9 +92,30 @@ Nota sullo stato attuale del playbook principale:
 
 - `ansible/site.yml` applica oggi in automatico Fedora/GNOME su `ikaros` e `nymph`
 - `ansible/site.yml` applica il profilo Fedora WSL alla workstation `deadalus`
-- `ansible/site.yml` applica anche il profilo `ubuntu_server` con baseline apt, systemd, dotfiles server e firewall UFW
+- `ansible/site.yml` applica il profilo server Rocky a `prometheus` con DNF, systemd, dotfiles server e firewalld
 - `ansible/site.yml` applica il profilo NAS Rocky su `atlas` tramite SSH remoto
 
+## Nodo pianificato e posticipato: Cerberus
+
+`cerberus` e un nodo di management **posticipato**, in attesa dell'allestimento
+fisico dell'ufficio nella nuova casa. Non e ancora presente nell'inventory e non
+esistono ruoli o playbook che lo prendano come target.
+
+L'hardware previsto e un Lenovo ThinkCentre M700 Tiny (Intel Core i3-6100T,
+8 GB di RAM e SSD da 256 GB) con Ethernet nativa a 1 Gbps. Condividera monitor
+e periferiche di Ikaros tramite uno switch KVM a ingressi multipli, usando un
+cavo passivo DisplayPort-HDMI per il collegamento video. Il sistema operativo
+previsto e Fedora Sericea, la variante Fedora immutabile con compositor Wayland
+Sway.
+
+Cerberus sara un management plane isolato: Ansible verra eseguito in un ambiente
+Toolbox dedicato per il provisioning del futuro cluster `uranus`, anziche da
+Ikaros o da un host non gestito. Lo stack di osservabilita rootless Podman
+eseguira Grafana, Prometheus e Loki. L'SSD locale sara l'hot storage, con
+metriche e log conservati per 30 giorni; esportazioni programmate trasferiranno
+i dati storici piu vecchi su un dataset Atlas montato via NFS come cold storage.
+Il piano di implementazione, con prerequisiti espliciti, e in `AGENTS.md`.
+
 ## Desktop
 
 Target operativi:
@@ -144,6 +164,7 @@ Lo stato attuale del profilo workstation include:
 
 - installazione pacchetti base Fedora via dnf
 - installazione e configurazione di Docker dal repository ufficiale
+- installazione di Mise dal COPR ufficiale con JDK Eclipse Temurin Java 11 fissato
 - gestione dei dotfiles workstation e rendering dei template dev condivisi
 - preparazione di Fedora WSL con `systemd` per il toolchain di sviluppo
 - attivazione del firewall `firewalld` sui target Fedora che dichiarano regole host-specifiche
@@ -163,7 +184,7 @@ Le applicazioni Windows sono installate e gestite manualmente; il profilo WSL no
 
 Sistema operativo:
 
-- Ubuntu LTS
+- Rocky Linux 9
 
 Configurazione:
 
@@ -177,12 +198,54 @@ Profilo orientato a servizi server e gestione di dotfiles dedicati.
 
 Lo stato attuale del profilo server include:
 
-- installazione pacchetti base Ubuntu via apt
+- installazione pacchetti Rocky via DNF, EPEL e CRB
-- installazione e configurazione di Docker dal repository ufficiale
+- installazione di Podman e podman-compose
 - abilitazione dei servizi systemd dichiarati in inventory/group vars
-- copia dei dotfiles server e rendering dei template server, incluso il `docker-compose.yml` dello stack servizi
+- copia dei dotfiles server e rendering del `docker-compose.yml` per Nginx Proxy Manager e Gitea,
-- attivazione del firewall UFW con regola SSH esplicita
+  piu l'unita `podman-compose-server` (attivazione manuale)
-- apertura delle porte Syncthing `22000/tcp`, `22000/udp` e `21027/udp`, lasciando la GUI non esposta direttamente su UFW
+- attivazione di firewalld con SSH, Cockpit (`9090/tcp`), HTTP e HTTPS abilitati
+- Syncthing escluso dal profilo server Rocky
+
+Il Compose desiderato su Prometheus non include piu Navidrome ne il database PostgreSQL obsoleto.
+Navidrome e Syncthing appartengono ad Atlas; Navidrome ufficiale usa invece SQLite. Il profilo non
+arresta o rimuove automaticamente eventuali container legacy e non elimina `/opt/postgres/data`.
+
+Nginx Proxy Manager pubblica solo `80/tcp` e `443/tcp`; la sua interfaccia di amministrazione e
+associata a `127.0.0.1:81` ed e raggiungibile da Ikaros o Nymph con l'alias Bash `npm-tunnel`.
+Nextcloud resta disabilitato e il profilo non crea directory `/srv/nextcloud`.
+
+La fase 1 su Atlas non modifica questo deployment NPM ne i suoi dati persistenti. Dopo aver attivato
+WireGuard e i servizi Atlas, configurare i proxy host NPM correnti con upstream Navidrome
+`http://10.0.0.2:4533` e upstream per la GUI Syncthing `http://10.0.0.2:8384`. Solo la GUI web di
+Syncthing usa NPM; il traffico di sincronizzazione resta sulle porte native pubblicate esplicitamente solo
+sull'indirizzo WireGuard di Atlas. Configurare l'autenticazione Syncthing e una policy di accesso NPM adeguata prima di pubblicare la GUI.
+
+### DuckDNS
+
+`profile_server` genera `~/duckdns/duck.sh` con permessi `0700`, mantenendo il percorso dello
+script e `duck.log`. Definire `server_duckdns_domain` negli host vars del server e salvare il
+**nuovo token rigenerato** in `vault_duckdns_token`, nel Vault cifrato `secrets/vault.yml`
+(`ansible-vault edit secrets/vault.yml`) oppure negli override non versionati `secrets/vault.local.yml`.
+Non committare lo script generato e non passare il token sulla riga di comando. Il rendering
+nasconde output e diff sensibili; lo script verifica TLS e passa il token a curl tramite stdin.
+Il playbook non esegue lo script e non modifica la sua schedulazione esterna.
+
+```bash
+ansible-playbook ansible/site.yml --limit prometheus --tags duckdns --check --diff
+ansible-playbook ansible/site.yml --limit prometheus --tags duckdns
+```
+
+La cancellazione dalla cronologia non revoca il token: rigenerarlo sul pannello DuckDNS.
+Dopo la bonifica, riclonare gli altri checkout senza unire nuovamente la vecchia storia;
+salvare separatamente eventuali modifiche non committate senza copiare segreti.
+
+### Migrazione dati
+
+Dopo il provisioning Rocky, eseguire `scripts/migrate_prometheus_data.sh` **sul server Ubuntu
+sorgente**. Lo script usa rsync, e in dry-run di default; richiede `--quiesce-source --execute` per
+fermare lo stack sorgente e copiare in modo consistente soltanto i dati di Nginx Proxy Manager e
+Gitea. Non sposta Navidrome o Syncthing, non avvia container, non cancella dati e non esegue il
+cutover.
 
 Utente del profilo server:
 
@@ -204,28 +267,252 @@ ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser -
 
 ## NAS
 
-`atlas` e un NAS Rocky Linux 9 raggiunto tramite SSH. Il pool ZFS esiste gia: il profilo gestisce
+`atlas` è un NAS Rocky Linux 9 raggiunto via SSH. Normalmente il pool esiste già e il profilo gestisce
-solo i dataset figli e non deve mai creare, partizionare, distruggere, fare rollback o modificare il
+solo i dataset figli. La creazione iniziale del RAIDZ2 richiede esplicitamente `atlas_create_pool=true`
-pool. I client Linux usano NFSv4, quelli Windows/WSL SMB; entrambi restano limitati alla LAN
+e quattro percorsi `/dev/disk/by-id/...` verificati in `atlas_zpool_disks`. Il ruolo non partiziona,
-configurata.
+forza, distrugge, ripristina né modifica il layout vdev di un pool esistente. I client Linux usano NFSv4,
+quelli Windows/WSL SMB; l'accesso è limitato alla LAN configurata.
 
-Per il primo avvio sostituire i placeholder Atlas e fornire
+Per il primo avvio servono `vault_atlas_admin_password_hash`, `vault_atlas_samba_password` e
-`vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` e
+`vault_atlas_immich_db_password`; il primo è un hash compatibile con `/etc/shadow`, non una password
-`vault_atlas_samba_password`. Eseguire il bootstrap tramite l'amministratore esistente:
+Cockpit in chiaro. Il bootstrap usa l'amministratore preesistente:
 
 ```bash
 ansible-playbook ansible/site.yml --limit atlas \
   -e atlas_connection_username=<existing-admin>
 ```
 
-`vault_atlas_admin_password_hash` deve essere un hash compatibile con `/etc/shadow`, non una
+Le esecuzioni successive usano `atlas_admin_username`. Storage, condivisioni e firewall LAN sono
-password Cockpit in chiaro. Le esecuzioni successive usano `atlas_admin_username`. Abilitare
+abilitati; prima dell'applicazione verificare pool, mountpoint, subnet e zona firewalld. La creazione
-`atlas_manage_storage` solo dopo aver verificato pool e mountpoint esistenti; abilitare
+del pool è protetta da un gate esplicito e avviene solo se è assente. Atlas non fa più parte della VPN
-`atlas_manage_firewall` solo dopo aver verificato subnet LAN e zona firewalld attiva.
+WireGuard: la vecchia interfaccia è stata ritirata manualmente dopo la verifica del collegamento tra
+Prometheus e Aegis. Le chiavi SSH autorizzate sono in file separati sotto
+`~/.ssh/authorized_keys.d/`. `atlas_manage_media_stack` resta disabilitato finché `/dev/dri`, percorsi
+dei container e segreto del database Immich non sono validati.
 
-Restano da implementare retention delle snapshot, topologia Syncthing, VPN, pull da Prometheus,
+Sotto `zpool` Atlas crea `archive` (SMB), `services/data` con i dataset applicativi
-Rclone, backup USB, monitoraggio e test di disaster recovery. Il backlog operativo dettagliato e in
+`services/data/navidrome` e `services/data/syncthing`, `media`, `media/music`, `media/photobook` e
-`AGENTS.md`.
+`backup/hosts/prometheus`. Archivio e applicazioni usano `zstd`; media, Syncthing e backup host usano
+`lz4`. `backup` ha una riserva di `500G` che copre i discendenti. SELinux targeted è persistente;
+l'eventuale riavvio necessario viene segnalato, non eseguito. Atlas assegna l'interfaccia primaria
+alla zona firewalld gestita, rifiuta redirect e source route, registra i martian, mantiene il reverse-path
+filter loose e disabilita il forwarding IPv4. SSH consente soltanto l'amministratore dichiarato con
+chiave pubblica: root, password, agent forwarding e remote forwarding sono disabilitati, mentre il
+forwarding locale resta disponibile per i tunnel amministrativi. SMB3 espone `Archive` agli account
+autorizzati da Vault sulla LAN, solo su TCP/445 con cifratura e firma obbligatorie. NFSv4 espone
+soltanto `media/photobook` all'IP di Aegis su TCP/2049, con `all_squash` verso UID/GID `1100`.
+
+L'account di sistema `immich` usa UID/GID `1100`, non ha shell di login né gruppo `wheel` e riceve i
+gruppi `video` e `render`. Lo stack Immich futuro prevede Quadlet rootful per Server, ML, cache,
+PostgreSQL e NPM su una rete Podman comune. Immich gira come `1100:1100`, Server e ML ricevono
+`/dev/dri` e Photobook è montato in sola lettura su `/external/photobook`. NPM pubblica `80` e `443`;
+l'interfaccia amministrativa resta su `127.0.0.1:81`, raggiungibile via tunnel SSH.
+
+Atlas ospita temporaneamente Navidrome e Syncthing rootless fino alla sostituzione con Uranus. I
+servizi sono inizializzati **ex novo**, senza migrare lo stato precedente, rispettivamente sotto
+`/zpool/services/data/navidrome` e `/zpool/services/data/syncthing`; la musica in
+`/zpool/media/music` viene popolata separatamente. Sono vincolati all'indirizzo LAN di Atlas
+(`192.168.178.55`), mai a WireGuard. `wireguard_overlay` collega invece Prometheus (`10.0.0.1`)
+e Aegis (`10.0.0.2`): le chiavi private restano sui rispettivi host e Ansible scambia solo le pubbliche.
+Prometheus apre `51820/udp`; Aegis inoltra soltanto il traffico overlay→LAN dichiarato e applica
+source NAT, evitando interfacce VPN su Atlas/Uranus e route statiche sul router. Navidrome (`4533/tcp`)
+e la GUI Syncthing (`8384/tcp`) ammettono solo Aegis, mentre le porte native Syncthing sono limitate
+alla LAN. Dopo la verifica dei servizi, configurare manualmente i Proxy Host NPM verso
+`http://192.168.178.55:4533` e `http://192.168.178.55:8384`. Il peer Prometheus include la LAN
+negli `AllowedIPs`; aggiungere la VIP Uranus quando esisterà. Dopo il reload di firewalld, Ansible
+ricarica le reti Podman rootful di Prometheus per conservare DNS e connettività del proxy.
+
+Validare il gateway con:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit prometheus,aegis --tags wireguard --check --diff
+```
+
+La prima esecuzione reale WireGuard deve includere entrambi i peer. Se Aegis ha appena installato il
+layer `wireguard-tools`, riavviarlo manualmente e rieseguire senza `--check`: il ruolo attende un
+handshake effettivo.
+
+Gli snapshot ZFS ricorsivi coprono l'intero pool: 24 orari al minuto 05, 30 giornalieri alle 00:15,
+8 settimanali la domenica alle 01:00 e 12 mensili il primo giorno alle 02:00. La retention elimina
+solo gli snapshot con prefisso gestito `atlas-auto` e non esegue rollback. Lo scrub OpenZFS mensile è
+previsto la prima domenica alle 03:00; il timer settimanale incompatibile è disabilitato. Il primo
+snapshot orario ricorsivo è riuscito; la prima pulizia pianificata e il primo scrub schedulato
+richiedono ancora una verifica a runtime.
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags snapshots,scrub --check --diff
+```
+
+Il backup Borg cifrato usa il sub-account Hetzner `u660064-sub1`, il repository relativo `./borg-data`
+e Borg remoto 1.4 su SSH porta 23. La chiave ED25519 del server è fissata; una chiave client dedicata
+appartiene all'account `borg`, bloccato e senza login, sudo o gruppi supplementari. La chiave privata
+resta in `/etc/atlas-borg`; la passphrase proviene da `vault_atlas_borg_passphrase` ed è resa in un
+file `0600`. Solo il wrapper root crea snapshot e mount; avvia il client come `borg` con il minimo
+accesso temporaneo in lettura, senza concedergli gestione ZFS o sudo.
+
+Il backup giornaliero parte alle 04:30 con un ritardo casuale fino a 30 minuti. Crea uno snapshot ZFS
+ricorsivo temporaneo e ricostruisce tutti i dataset sotto `/zpool` in un albero di bind mount in sola
+lettura, per inserirli in un unico archivio coerente. Il wrapper smonta ricorsivamente l'albero privato;
+un helper `ExecStopPost` mirato rimuove eventuali mount dello snapshot nel namespace host e lo snapshot
+temporaneo dopo l'uscita del processo. Borg conserva 30 archivi giornalieri, 8 settimanali e 12
+mensili, poi compatta il repository. Il controllo completo di metadati e repository si svolge il 15
+di ogni mese alle 06:00. Le operazioni usano un lock comune, journal e retry systemd limitati. Le
+nuove esecuzioni riportano al massimo una riga di avanzamento al minuto: percentuale **stimata**,
+dataset, file elaborati e byte originali/compressi/deduplicati. Il denominatore è la somma dei
+`logicalreferenced` ZFS dello snapshot, non un totale Borg: può superare il 100% e non comprende
+retention, compattazione o controlli. Le righe di progresso non riportano i nomi dei file; eventuali
+warning possono farlo. Seguire il job con `sudo journalctl -fu atlas-borg-backup.service`; modifiche
+all'helper non cambiano un'esecuzione già avviata.
+
+Attivazione iniziale esplicita:
+
+1. Inserire una passphrase unica in `secrets/vault.yml` con `ansible-vault edit`.
+2. Generare e mostrare solo la chiave pubblica con
+   `ansible-playbook ansible/site.yml --limit atlas --tags borg_key`.
+3. Installarla nel sub-account Hetzner, poi applicare con
+   `ansible-playbook ansible/site.yml --limit atlas --tags packages,borg`.
+4. Copiare `secrets/recovery/atlas-borg-repokey.export` su un supporto davvero offline: la copia
+   locale ignorata da Git non è di per sé un backup offline.
+
+Il ruolo inizializza solo un repository `repokey` assente, non accetta password SSH né host key non
+fissate e non avvia manualmente il primo backup. Validazione:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags packages,borg --check --diff
+```
+
+L'attivazione iniziale è riuscita: backup e controllo del repository, restore completo in una
+directory temporanea confrontato con l'albero `Archive`, esportazione offline della chiave di recupero
+e pulizia di snapshot/mount temporanei. Il 2026-09-25 un test separato da snapshot ZFS giornaliero ha
+copiato un file di `/zpool/archive` in `/var/tmp`, verificando contenuto, proprietario, modalità,
+mtime e ACL POSIX; copia e mount temporanei sono stati rimossi senza interrompere Borg. Non è un test
+di ripristino dell'intero dataset.
+
+Il backup USB offline è distribuito come **servizio solo manuale** (`atlas_manage_usb_backup: true`):
+Ansible non formatta, sblocca, monta né avvia automaticamente il disco. Il disco esistente è stato
+verificato in sola lettura il 2026-09-23: UUID LUKS `577b3c43-ea37-4611-81a9-39d555cdfbd4`,
+UUID ext4 interno `758e2d2e-a427-4797-aad9-39c3a9f17c7e`, mapper `zpool-backup`. All'ispezione
+era montato in `/mnt/zpool-backup`; il servizio richiede invece che il mapper **non sia montato** prima
+dell'avvio. Se serve, `systemd-ask-password` chiede interattivamente la passphrase LUKS tramite
+l'agente di `systemctl start` e la passa direttamente a `cryptsetup`, senza salvarla, esporla negli
+argomenti o memorizzarla nella cache. Lo script monta il disco privatamente, crea uno snapshot ZFS
+ricorsivo, copia tutti i dataset in `atlas/snapshots/<timestamp>/` con `rsync --link-dest`, verifica
+con un dry-run basato sui checksum, aggiorna atomicamente `atlas/latest`, smonta e chiude LUKS. Un
+errore non sostituisce `latest` né cancella versioni complete precedenti. Borg e USB possono operare
+contemporaneamente su snapshot distinti, ma la lettura concorrente può ridurre il throughput.
+
+La copia USB conserva le ACL ma non gli attributi estesi generici, compreso `security.selinux`: la
+policy della destinazione deve ricreare le etichette dopo un restore. Per un percorso esplicito:
+
+```bash
+ansible-playbook ansible/site.yml --limit atlas --tags restorecon \
+  -e '{"atlas_restorecon_paths":["/zpool/archive"]}'
+```
+
+Il task accetta solo percorsi sotto la radice del pool Atlas, esegue `restorecon -RFv` solo su quelli
+indicati ed è altrimenti inattivo; non va lanciato sull'intero pool durante i run ordinari. Le vecchie
+versioni USB non vengono eliminate automaticamente senza una retention deliberata. Il controllo di
+capacità include il trasferimento stimato e una riserva libera di 10 GiB. Dopo un backup riuscito,
+scollegare fisicamente il disco per renderlo davvero offline.
+
+Validare la configurazione senza avviare il backup e, separatamente, un eventuale relabel pianificato:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags usb_backup,usb_reminder --check --diff
+ansible-playbook ansible/site.yml --limit atlas --tags restorecon --check \
+  -e '{"atlas_restorecon_paths":["/zpool/archive"]}'
+```
+
+Prima dell'avvio manuale smontare in sicurezza `/mnt/zpool-backup`, se ancora montato. Con il mapper
+chiuso, `sudo systemctl start atlas-usb-backup.service` chiede la passphrase e avvia il backup; né la
+password LUKS né un keyfile vanno in Ansible. Seguire con
+`sudo journalctl -fu atlas-usb-backup.service`. **Non esiste un timer di backup USB.** Soltanto
+`atlas-usb-reminder.timer` è schedulato il primo sabato del mese alle 10:00 `Europe/Rome`: invia un
+promemoria al notifier 45Drives Houston, senza avviare il backup. Un test manuale ha prodotto una
+notifica in 45Drives Alerts, **non un'email**; il log conferma l'invio della notifica, non la consegna
+di posta. Il primo evento pianificato era il 2026-10-03 alle 10:00 CEST. Controllare timer e risultato
+con `systemctl list-timers atlas-usb-reminder.timer` e in 45Drives Alerts.
+
+Il primo tentativo USB del 2026-09-23 fallì su `security.selinux` e, dopo l'interruzione, lasciò
+snapshot e mapper aperti. Applicato il filtro rsync, furono rimossi lo snapshot fallito, il mapper
+smontato e lo stato failed; non rimase una copia valida di quel tentativo. Un run del 2026-09-24
+pubblicò una versione verificata ma fallì nella distruzione dello snapshot a causa di mount
+`.zfs/snapshot` aperti nel namespace host. Dopo la pulizia non forzata, è stato aggiunto un helper
+`ExecStopPost` mirato e testato con uno snapshot usa-e-getta. Un run successivo del 2026-09-24 ha
+verificato i checksum, pubblicato la versione ed è terminato con successo: mapper chiuso, nessuno
+snapshot USB temporaneo e pool sano. Il 2026-09-25 un test di restore indipendente ha aperto il disco
+in sola lettura, montato ext4 con `ro,noload`, copiato un file di 5.707.945 byte da `atlas/latest` in
+una directory vuota sotto `/var/tmp` e confrontato contenuto, proprietario, modalità, dimensione,
+mtime e ACL POSIX. Il test ha rimosso copia e mount temporanei, chiuso LUKS e lasciato il pool sano
+mentre Borg continuava. È un test su file, non un esercizio completo di disaster recovery.
+
+Il monitoraggio Atlas è eseguito ogni 30 minuti da `atlas-health-monitor.timer`. Sonde in sola
+lettura controllano stato/errori del pool e dei vdev, scrub/resilver, SMART dei quattro dischi del
+pool e dell'NVMe di sistema, temperature dei dischi e CPU, spazio di sistema/pool/snapshot, crescita
+di `zpool/backup` e quota Hetzner tramite `df -m` via SSH con l'account `borg` e la chiave fissata.
+La query remota non apre il repository Borg né il suo lock. Gli alert di crescita richiedono una
+baseline di circa 24 ore. Sono controllati anche attivazione e freschezza dei timer; hook systemd
+`OnFailure` segnalano errori di snapshot, scrub, Borg, USB, promemoria e monitoraggio. Il monitor non
+riavvia Borg; avvisa solo se un run supera 14 giorni. Soglie e percorsi stabili dei dischi sono nelle
+variabili host. Gli avvisi usano 45Drives Houston con deduplicazione; **la consegna email non è stata
+verificata**. Il controllo live del 2026-09-25 non ha trovato problemi; la notifica di prova è stata
+inviata e lo Storage Box risultava occupato al 22%. Dimensione dell'archivio Borg e deduplicazione
+dettagliata richiedono ancora la fine del backup in corso.
+
+```bash
+ansible-playbook ansible/site.yml --limit atlas --tags monitoring --check --diff
+sudo /usr/local/libexec/atlas-health-monitor --dry-run
+sudo journalctl -u atlas-health-monitor.service -n 100 --no-pager
+systemctl list-timers atlas-health-monitor.timer
+```
+
+`--dry-run` non invia alert e non modifica lo stato del monitor. Un controllo reale si avvia con
+`sudo systemctl start atlas-health-monitor.service`, senza avviare servizi di backup. Per una prova
+etichettata di 45Drives Alerts usare
+`sudo /usr/local/libexec/atlas-health-monitor --test-notification`.
+
+### Timer systemd di Atlas
+
+Tutti i nove timer gestiti sono abilitati. Gli orari sono locali ad Atlas (`Europe/Rome`); Borg e
+monitoraggio aggiungono il ritardo casuale indicato. Tutti hanno `Persistent=true`: un evento perso
+viene recuperato quando il timer torna attivo.
+
+| Timer | Pianificazione (`OnCalendar`) | Azione |
+| --- | --- | --- |
+| `atlas-zfs-snapshot-hourly.timer` | `*-*-* *:05:00` — ogni ora al minuto 05 | Snapshot ricorsivo orario e retention |
+| `atlas-zfs-snapshot-daily.timer` | `*-*-* 00:15:00` — ogni giorno alle 00:15 | Snapshot ricorsivo giornaliero e retention |
+| `atlas-zfs-snapshot-weekly.timer` | `Sun *-*-* 01:00:00` — domenica alle 01:00 | Snapshot ricorsivo settimanale e retention |
+| `atlas-zfs-snapshot-monthly.timer` | `*-*-01 02:00:00` — primo giorno del mese alle 02:00 | Snapshot ricorsivo mensile e retention |
+| `zfs-scrub-monthly@zpool.timer` | `Sun *-*-01..07 03:00:00` — prima domenica alle 03:00 | Scrub ZFS |
+| `atlas-borg-backup.timer` | `*-*-* 04:30:00` — ogni giorno alle 04:30, più 0–30 min casuali | Backup cifrato offsite |
+| `atlas-borg-check.timer` | `*-*-15 06:00:00` — giorno 15 alle 06:00, più 0–30 min casuali | Controllo repository Borg |
+| `atlas-usb-reminder.timer` | `Sat *-*-01..07 10:00:00 Europe/Rome` — primo sabato alle 10:00 | Solo promemoria 45Drives Alerts |
+| `atlas-health-monitor.timer` | `*:0/30` — ogni mezz'ora, più 0–5 min casuali | Controlli di salute in sola lettura |
+
+`atlas-usb-backup.service` **non ha timer** e va avviato manualmente. Il timer del fornitore
+`zfs-scrub-weekly@zpool.timer` è disabilitato a favore dello scrub mensile. Il futuro pull del backup
+Prometheus non ha ancora un timer, perché non è implementato. Durante un backup Borg attivo,
+`systemctl list-timers` può mostrare `-` per il prossimo evento senza che il timer sia disabilitato.
+Per vedere la pianificazione corrente: `systemctl list-timers --all` su Atlas.
+
+Nextcloud è previsto come servizio temporaneo su Atlas prima di Uranus, ma solo dopo la validazione
+della protezione dei dati: richiede storage applicativo, database e cache separati, segreti Vault,
+pubblicazione solo tramite NPM e Aegis, procedure di backup, aggiornamento e migrazione. Non
+distribuirlo prima di completare la checklist di protezione dei dati.
+
+La destinazione futura per l'importazione foto iCloud è Atlas, non Aegis. Dopo la validazione dei
+backup, pianificare una migrazione esplicita di iCloudPD con foto sotto `/zpool/archive/Pictures` e
+stato applicativo/MFA fuori da `Archive`; testare permessi, SELinux, backup e restore prima del
+cutover. L'attuale iCloudPD su Aegis e l'export NFS Photobook restano configurati fino
+all'approvazione e alla verifica di questa migrazione separata. Anche il servizio Atlas sarà
+temporaneo in attesa di Uranus.
+
+Il pull dei backup di Prometheus, la valutazione delle dimensioni degli archivi Borg e i test completi
+di disaster recovery restano da fare. Il backlog prioritizzato è in `AGENTS.md`.
 
 ---
 
@@ -273,13 +560,10 @@ I principali ruoli attualmente presenti sono:
 | ------------------------- | ----------------------------------- |
 | base                      | configurazione base comune          |
 | packages_void             | installazione pacchetti su Void     |
-| packages_freebsd          | installazione pacchetti su FreeBSD via pkg |
-| packages_ubuntu           | installazione pacchetti su Ubuntu   |
 | packages_fedora           | installazione pacchetti su Fedora   |
 | packages_rocky            | installazione pacchetti su Rocky Linux 9 |
 | services_runit            | gestione servizi runit              |
 | services_systemd          | gestione servizi systemd            |
-| services_freebsd          | gestione servizi FreeBSD dichiarati per host |
 | profile_desktop_common    | bootstrap desktop Void condiviso    |
 | profile_desktop_gnome     | dotfiles desktop condivisi per Fedora/GNOME |
 | profile_desktop_sway      | sessione desktop sway / SwayFX (Wayland) |
@@ -290,6 +574,8 @@ I principali ruoli attualmente presenti sono:
 | profile_workstation_dev_wsl | configurazione WSL condivisa per sviluppo |
 | profile_server            | configurazione server               |
 | profile_atlas             | configurazione NAS Rocky Linux 9    |
+| profile_backend_phase1    | Navidrome e Syncthing rootless su Atlas |
+| wireguard_overlay         | overlay WireGuard Prometheus/Atlas  |
 | dotfiles_common           | distribuzione dotfiles comuni       |
 | dotfiles                  | distribuzione configurazioni utente |
 
@@ -303,15 +589,16 @@ Il playbook `ansible/site.yml` e attualmente composto da blocchi per asse:
 all -> dotfiles_common
 platform_void -> packages_void + services_runit
 platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_niri + profile_desktop_host
-platform_freebsd -> packages_freebsd + services_freebsd
 platform_fedora -> packages_fedora + services_systemd
 platform_rocky -> packages_rocky + services_systemd
+wireguard_overlay -> wireguard_overlay (dopo platform_rocky)
 atlas -> profile_atlas
+role_backend_phase1 -> profile_backend_phase1 (dopo atlas)
 platform_fedora & role_personal_workstation -> profile_personal_workstation
 platform_fedora & desktop_gnome -> profile_desktop_gnome
 workstation_dev_fedora -> profile_workstation_dev_common
 workstation_dev_wsl -> profile_workstation_dev_wsl (dopo platform_fedora + workstation_dev_fedora)
-ubuntu_server -> packages_ubuntu + services_systemd + profile_server
+rocky_server -> dotfiles_common + profile_server (dopo platform_rocky)
 ```
 
 Questo significa che, allo stato attuale:
@@ -320,9 +607,10 @@ Questo significa che, allo stato attuale:
 - `nymph` riceve Fedora Workstation/GNOME come target laptop
 - il profilo Void resta selezionabile tramite `platform_void + graphical_desktop` per host futuri
 - `deadalus` riceve il profilo Fedora WSL tramite play dev dedicati
-- il server Ubuntu (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewall
+- il server Rocky (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewalld
 - il NAS Rocky (`atlas`) usa un pool ZFS gia esistente, condivisioni NFSv4/SMB limitate alla LAN e Cockpit/45Drives
-- lo stack container server include `navidrome`, `postgres`, `gitea`, `nginx-proxy-manager` e `syncthing`, con GUI Syncthing raggiungibile tramite la rete Docker `web`
+- lo stack Compose server include soltanto `gitea` e `nginx-proxy-manager`; Navidrome e Syncthing
+  della fase 1 sono Quadlet rootless su Atlas
 
 # Dotfiles
 
@@ -334,7 +622,6 @@ dotfiles/
 ├── desktop
 ├── server
 ├── fedora
-├── ubuntu
 ├── workstation
 ├── workstation_dev_wsl
 └── nymph
@@ -392,13 +679,11 @@ Allo stato attuale questo comando:
 - distribuisce i dotfiles comuni a tutti gli host
 - per `platform_void` applica pacchetti Void e servizi runit
 - per `platform_void + graphical_desktop` applica bootstrap desktop condiviso, sessioni Sway/Niri e override specifici per host
-- per `platform_freebsd` non applica nulla finche il gruppo resta senza host
 - per `platform_fedora` applica pacchetti Fedora e servizi systemd a `ikaros`, `nymph` e `deadalus`
 - per `platform_fedora & role_personal_workstation` applica il layer personale a `ikaros`
 - per `platform_fedora & desktop_gnome` applica il profilo GNOME a `ikaros` e `nymph`
 - per `workstation_dev_wsl` applica i tweak WSL dopo il layer Fedora a `deadalus`, escludendo Flatpak e Snap
-- per gli host `ubuntu_server` applica pacchetti Ubuntu, servizi systemd, profilo server, UFW, dotfiles e template dedicati
+- per `platform_rocky` applica pacchetti Rocky e servizi systemd ad `atlas` e `prometheus`; quindi applica il profilo NAS ad `atlas` e il profilo server a `prometheus`
-- per `platform_rocky` applica pacchetti Rocky e servizi systemd ad `atlas`, quindi il profilo NAS dedicato
 - non riavvia automaticamente il display manager
 - carica `secrets/vault.yml` solo se presente
 - carica `secrets/vault.local.yml` solo se presente, dopo `vault.yml`, cosi gli override locali hanno precedenza
@@ -431,7 +716,9 @@ ansible-playbook ansible/site.yml --limit <host> --tags <tag1>,<tag2> --check --
 ansible-playbook ansible/site.yml --limit <host> --start-at-task "<task name>" --check --diff
 ansible-lint ansible/roles/<role>
 yamllint ansible/path/to/file.yml
-docker compose -f /opt/docker/server/docker-compose.yml config
+podman-compose -f /opt/docker/server/docker-compose.yml config
+ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff
 ```
 
 ## Tag supportati dal playbook
@@ -448,6 +735,9 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | --- | --- | --- |
 | `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common |
 | `ai_agents` | installazione agenti AI condivisi | Fedora, WSL |
+| `atlas` | account, storage, condivisioni e container Atlas | NAS Atlas |
+| `backend_phase1` | Quadlet rootless Navidrome e Syncthing | NAS Atlas |
+| `containers` | Quadlet rootful Atlas | NAS Atlas |
 | `dotfiles` | distribuzione/configurazione dotfiles | tutti i profili |
 | `dotfiles:common` | dotfiles comuni condivisi | common, workstation, server |
 | `dotfiles:desktop` | dotfiles desktop | desktop Void, Fedora/GNOME |
@@ -461,16 +751,21 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | `fzf` | configurazione FZF | dotfiles comuni |
 | `git` | configurazione Git e GPG desktop | Fedora/GNOME, desktop Void |
 | `gnome` | configurazione host GNOME | Fedora/GNOME desktop |
+| `immich` | account e Quadlet Immich | NAS Atlas |
 | `sway` | sessione/configurazione sway / SwayFX (Wayland) | desktop Void |
 | `niri` | sessione/configurazione Niri (Wayland) | desktop Void |
 | `npm` | installazione pacchetti npm globali | Fedora/GNOME, desktop Void, WSL |
 | `nvidia` | componenti NVIDIA desktop | desktop Void |
 | `packages` | installazione e aggiornamento pacchetti | tutti i profili |
+| `podman` | integrazione Podman Compose e Quadlet rootless | server |
 | `portal` | configurazione xdg-desktop-portal | desktop Void |
 | `services` | gestione servizi runit/systemd | tutti i profili |
+| `sharing` | condivisioni NFSv4 e SMB3 | NAS Atlas |
+| `storage` | dataset ZFS figli | NAS Atlas |
 | `theme` | configurazione del tema GTK/Qt | desktop Void |
 | `tmux` | configurazione e plugin tmux | desktop Fedora/Void, WSL |
 | `vim` | configurazione Vim | dotfiles comuni |
+| `wireguard` | overlay WireGuard Prometheus/Atlas | Prometheus, NAS Atlas |
 | `wsl` | bootstrap e configurazione WSL | WSL |
 
 Esempi pratici:
@@ -507,10 +802,6 @@ I gruppi legacy `void` e `desktop` sono parent di compatibilita, quindi un host
 in `platform_void` e `graphical_desktop` continua a ricevere anche le variabili
 Void e desktop esistenti.
 
-Per prove in VM sono disponibili gruppi di esempio in
-`ansible/inventory/examples/platform-test-hosts.yml`, da passare esplicitamente
-con `-i` insieme all'inventory principale.
-
 Per il flusso mail desktop esiste inoltre uno script dedicato:
 
 ```bash

README.md

@@ -20,7 +20,6 @@ infra/
 │   ├── common/
 │   ├── desktop/
 │   ├── fedora/
-│   ├── ubuntu/
 │   ├── server/
 │   ├── workstation/
 │   ├── workstation_dev_wsl/
@@ -36,8 +35,9 @@ infra/
 
 ## Managed machines
 
-The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, an Ubuntu server, and
+The repo currently covers Fedora/GNOME desktops, one Fedora WSL workstation, a Fedora IoT LAN
-a Rocky Linux 9 NAS. Configuration is layered instead of being tied to host names:
+node, a Rocky Linux 9 server, and a Rocky Linux 9 NAS. Configuration is layered instead of being tied
+to host names:
 
 ```text
 common user environment
@@ -52,8 +52,9 @@ common user environment
 | `ikaros` | Fedora | Personal workstation | GNOME |
 | `nymph` | Fedora | Desktop laptop | GNOME |
 | `deadalus` | Fedora WSL | Development workstation | — |
-| `prometheus` | Ubuntu | Server | — |
+| `aegis` | Fedora IoT | Always-on LAN node | — |
-| `atlas` | Rocky 9 | NAS | — |
+| `prometheus` | Rocky Linux | Server | — |
+| `atlas` | Rocky Linux | NAS | — |
 
 ```text
 ikaros must be boring
@@ -62,6 +63,31 @@ nymph is allowed to break
 
 `ikaros` is the stable personal Fedora/GNOME desktop. `nymph` is the laptop and gets the same shared desktop dotfiles while GNOME itself stays close to the Fedora defaults. The legacy `void` and `desktop` groups are compatibility parents; the main axes are `platform_*`, `role_*`, and `desktop_*`.
 
+The official ChatGPT desktop RPM is enabled only on `ikaros` and `nymph`. The
+playbook configures OpenAI's signed RPM repository and imports its pinned RPM
+signing key before installation; subsequent updates are handled by DNF.
+
+## Deferred planned node: Cerberus
+
+`cerberus` is a **postponed** management-plane node, pending the physical setup
+of the office in the new house. It is not yet an inventory host and no role or
+playbook targets it.
+
+The planned hardware is a Lenovo ThinkCentre M700 Tiny (Intel Core i3-6100T,
+8 GB RAM, and a 256 GB SSD) with native 1 Gbps Ethernet. It will share Ikaros'
+monitor and peripherals through a multi-input KVM switch, using a passive
+DisplayPort-to-HDMI cable for its video connection. Fedora Sericea, the
+immutable Fedora variant with the Sway Wayland compositor, is the intended
+operating system.
+
+Cerberus will be an isolated management plane: Ansible will run from a
+dedicated Toolbox environment to provision the future `uranus` cluster, rather
+than from Ikaros or an unmanaged host. Its rootless Podman observability stack
+will run Grafana, Prometheus, and Loki. The local SSD is the hot tier and
+retains metrics and logs for 30 days; scheduled exports will place older
+historical data on an NFS-mounted Atlas dataset as the cold tier. The detailed,
+implementation-gated plan is maintained in `AGENTS.md`.
+
 ## Desktop profiles
 
 - `ikaros`: stable Fedora Workstation + GNOME desktop.
@@ -88,7 +114,7 @@ The workstation receives two layers:
 - Fedora development setup through `workstation_dev_fedora`.
 - WSL setup with `systemd` through `workstation_dev_wsl`.
 
-That gives it Fedora packages through DNF, Docker from the official repository, shared workstation dotfiles and templates, tmux helpers, and WSL systemd configuration. Windows applications are installed manually; the WSL profile does not manage Python remoting components for them.
+That gives it Fedora packages through DNF, Docker from the official repository, Mise from its official COPR repository with a pinned Eclipse Temurin Java 11 JDK, shared workstation dotfiles and templates, tmux helpers, and WSL systemd configuration. Windows applications are installed manually; the WSL profile does not manage Python remoting components for them.
 
 ### WSL workflow
 
@@ -99,9 +125,26 @@ That gives it Fedora packages through DNF, Docker from the official repository,
 
 ## Server
 
-`prometheus` is the Ubuntu LTS server. It has no graphical environment and gets server-specific dotfiles and templates.
+`prometheus` is the Rocky Linux 9 server. It has no graphical environment and gets server-specific
+dotfiles and templates. The profile provisions configuration only: it does not transfer data, start
+the Compose stack, update DNS, or perform a cutover.
 
-The server profile installs Ubuntu packages, Docker from the official repository, declared systemd services, UFW rules, and the server Compose stack. Syncthing ports `22000/tcp`, `22000/udp`, and `21027/udp` are opened; the Syncthing GUI is not directly opened in UFW.
+The server profile installs platform-specific packages, Podman and podman-compose, declared systemd
+services, and firewalld. The manually activated `podman-compose-server` unit contains the existing
+Nginx Proxy Manager and Gitea services. The desired Compose file no longer includes Navidrome,
+Syncthing, or the obsolete Navidrome PostgreSQL database; their temporary Atlas deployment is managed
+by `profile_backend_phase1`. Applying the profile does not stop or remove legacy containers and does
+not delete `/opt/postgres/data`.
+
+Firewalld enables SSH, Cockpit (`9090/tcp`), HTTP and HTTPS. Nginx Proxy Manager publishes only
+`80/tcp` and `443/tcp`; its administration interface is bound to `127.0.0.1:81` and can be reached
+from Ikaros or Nymph with the `npm-tunnel` Bash alias. Nextcloud remains disabled and the profile
+does not provision any `/srv/nextcloud` directories.
+
+NPM remains managed only by `profile_server`. Its WireGuard peer is Aegis (`10.0.0.2`), which forwards
+selected requests to LAN addresses and source-NATs them so no static route is required on the router.
+Use an Atlas LAN address for any current NAS-backed upstream; when Uranus receives its VIP, add that VIP
+to Prometheus' Aegis peer `AllowedIPs` and declare the corresponding proxy target separately.
 
 Server identity comes from `server_username`, `server_user_group`, and `server_user_home` in `ansible/inventory/group_vars/server.yml`. `server_username` defaults to `username`, but it can be overridden, for example:
 
@@ -112,30 +155,380 @@ ansible-playbook ansible/site.yml --limit prometheus \
   -e server_user_home=/srv/myuser
 ```
 
-## NAS
+The target must already provide `server_username` with local sudo access.
+Prometheus authorizes its declared SSH public keys through separate files below
+`~/.ssh/authorized_keys.d/`, while `sshd` is configured to read those files directly.
 
-`atlas` is a Rocky Linux 9 NAS reached through SSH. Its pool already exists: the profile only
+### DuckDNS
-manages child datasets and must never create, partition, destroy, roll back, or otherwise alter the
-pool itself. Linux clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the
-configured LAN.
 
-For the first run, replace the Atlas placeholders and provide
+`profile_server` renders `~/duckdns/duck.sh` with mode `0700`, keeping the existing updater path
-`vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`, and
+and `duck.log`. Set `server_duckdns_domain` in the server's host vars and store the **rotated**
-`vault_atlas_samba_password`. Bootstrap the host through its existing administrator:
+`vault_duckdns_token` in encrypted `secrets/vault.yml` (using `ansible-vault edit secrets/vault.yml`)
+or untracked `secrets/vault.local.yml`. Never commit the rendered script or put the token on a
+command line. Rendering hides secret output/diffs; the updater verifies TLS and passes the token
+to curl through stdin. The playbook neither runs the updater nor changes its external schedule.
 
 ```bash
-ansible-playbook ansible/site.yml --limit atlas \
+ansible-playbook ansible/site.yml --limit prometheus --tags duckdns --check --diff
-  -e atlas_connection_username=<existing-admin>
+ansible-playbook ansible/site.yml --limit prometheus --tags duckdns
 ```
 
-`vault_atlas_admin_password_hash` must be an `/etc/shadow`-compatible hash, not a clear-text
+An exposed token must be revoked/regenerated on DuckDNS: deleting it from Git history does not
-Cockpit password. Subsequent runs use `atlas_admin_username`. Enable
+revoke it. After a history cleanup, re-clone other checkouts rather than merging the old history
-`atlas_manage_storage` only after checking the existing pool and mountpoints; enable
+back in; preserve any uncommitted work separately without copying secrets.
-`atlas_manage_firewall` only after checking the LAN subnet and active firewalld zone.
 
-Snapshot retention, Syncthing topology, VPN access, Prometheus pulls, Rclone, USB backup,
+### Data migration
-monitoring, and disaster-recovery tests remain follow-up work. The detailed operational backlog is
+
-kept in `AGENTS.md`.
+Provision Rocky first, then run the migration script **on the retired Ubuntu source host**. It is
+dry-run by default and requires an explicit source-stack stop before it can copy application data:
+
+```bash
+sudo ./scripts/migrate_prometheus_data.sh \
+  --destination rocky@179.237.102.172 \
+  --identity /root/.ssh/id_ed25519
+
+sudo ./scripts/migrate_prometheus_data.sh \
+  --destination rocky@179.237.102.172 \
+  --identity /root/.ssh/id_ed25519 \
+  --quiesce-source --execute
+```
+
+The script copies only Nginx Proxy Manager and Gitea data. It does not delete data, move
+Navidrome/Syncthing, copy `/home/git/.ssh`, start containers, update DNS, or perform a cutover. The
+destination SSH host key must already be trusted and the destination account needs passwordless sudo
+for `rsync`. It preserves ACLs but not extended attributes, so source SELinux labels are not
+transferred; the Rocky Compose bind mounts apply their own `:Z` labels when containers start.
+
+## DNS Filter
+
+`aegis` is a Raspberry Pi 4 running Fedora IoT. Generate Ignition from
+`ansible/bootstrap/aegis.bu` with the included Podman/Butane helper, then write the SD card with
+`arm-image-installer`:
+
+```bash
+ansible/bootstrap/generate-aegis-ign.sh --write IMAGE DEVICE
+```
+
+The controller manages it remotely as `pi@aegis`; unlike local desktop profiles, Aegis is
+intentionally an SSH inventory target. `profile_aegis` manages rootful Podman Quadlets for AdGuard
+Home and iCloudPD, persistent data under `/var/lib`, the Podman auto-update timer, LAN-restricted
+firewalld rules, SSH key-only access for `pi`, the `nfs-utils` and `wireguard-tools` rpm-ostree layers,
+and `wake-ikaros`. `wireguard_overlay` makes Aegis the internal endpoint and LAN gateway for Prometheus:
+it enables persistent IPv4 forwarding, installs a scoped WireGuard-to-LAN firewalld policy, and source-NATs
+forwarded tunnel traffic so the router needs no static route. A new layered package deployment requires a manual reboot; the
+role reports this condition but never reboots Aegis automatically. Set the host-local
+`aegis_lan_subnet`, `aegis_adguard_web_port`, and `aegis_network_connection_uuid` values before
+applying it. The playbook permits
+AdGuard Home HTTP on port `80`; the initial wizard port `3000` is intentionally unmanaged and must be
+opened and closed manually during initial setup. The profile disables the local systemd-resolved DNS
+stub and points `/etc/resolv.conf` to its full resolver data, freeing port 53 for AdGuard. LAN clients
+may use AdGuard on Aegis, while Aegis itself uses the independent upstream DNS declared by
+`aegis_host_dns_servers`; this prevents Greenboot from depending on the AdGuard container during
+startup. Reboot Aegis after changing its NetworkManager DNS profile. Define
+`vault_aegis_icloudpd_apple_id` in Vault before applying it. iCloudPD still requires interactive MFA
+initialization after its first deployment.
+
+New Aegis images create the `admin` account in Butane. Before configuring a newly imaged node, run its
+first playbook execution with `-e ansible_user=admin`; the SSH hardening role then permits that same
+account. Keep the inventory on `pi` until the existing node has been replaced.
+
+Validate the profile before deployment:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit aegis --check --diff --ask-become-pass
+```
+
+Apply only the independent host DNS configuration, then reboot Aegis manually:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit aegis --tags dns --ask-become-pass
+```
+
+Layer the Aegis NFS and WireGuard client tools independently, then reboot Aegis manually when the role reports
+that the new deployment is ready:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit aegis --tags nfs --ask-become-pass
+```
+
+## NAS
+
+`atlas` is a Rocky Linux 9 NAS reached through SSH. Normally its pool already exists and the profile
+only manages child datasets. A one-time RAIDZ2 bootstrap is available only with explicit confirmation
+(`atlas_create_pool=true`) and exactly four verified `/dev/disk/by-id/...` paths in `atlas_zpool_disks`.
+It never partitions, forces, destroys, rolls back, or changes the vdev layout of an existing pool. Linux
+clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the configured LAN.
+
+For the first run, provide `vault_atlas_admin_password_hash`, `vault_atlas_samba_password`, and
+`vault_atlas_immich_db_password`. Bootstrap the host through its
+existing administrator. The explicit pool gate is safe to repeat: the role creates the RAIDZ2 pool only when
+it is absent. Atlas no longer participates in the WireGuard overlay; its old interface is retired manually only after
+Prometheus and Aegis have completed the replacement handshake.
+
+`vault_atlas_admin_password_hash` must be an `/etc/shadow`-compatible hash, not a clear-text
+Cockpit password. Subsequent runs use `atlas_admin_username`. Atlas declares storage, sharing, and its
+LAN firewall rules enabled. Before the first apply, check the existing pool and mountpoints, LAN subnet,
+and active firewalld zone. `atlas_manage_media_stack` remains disabled until `/dev/dri`, the container
+paths, and the Immich database secret are validated. Atlas reads its declared SSH public keys from
+separate files below `~/.ssh/authorized_keys.d/`.
+
+With storage management enabled, Atlas creates the complete dataset hierarchy below the existing or
+explicitly bootstrapped `zpool`: SMB-shared `archive`, private `services/data` with separate
+`services/data/navidrome` and `services/data/syncthing` application datasets, `media`, `media/music`,
+`media/photobook`, and `backup/hosts/prometheus`. Application/archive datasets use `zstd`, while media,
+Syncthing, and host-backup datasets use `lz4`; `backup` has a `500G` reservation covering its descendants.
+Atlas enforces targeted SELinux persistently and reports, without initiating, any reboot required to activate it. It assigns its primary LAN interface explicitly to the managed firewalld zone and applies persistent kernel network hardening: redirects and source routes are rejected, martians logged, reverse-path filtering remains loose for WireGuard, and IPv4 forwarding is disabled. SSH permits only the declared administrator using public-key authentication; root login, passwords,
+agent and remote forwarding are disabled, while local forwarding remains available for private administrative tunnels. SMB3 exposes `Archive` only to the configured Vault-backed
+Samba accounts on encrypted, signed SMB3 over TCP/445 only and admits the configured LAN without host-specific
+exclusions. NFSv4 exports only `media/photobook` to the configured Aegis IP over TCP/2049, using
+`all_squash` with anonymous UID/GID `1100`.
+
+The `immich` system account is fixed to UID/GID `1100`, has no login shell or `wheel` membership, and
+receives `video` and `render` access. The rootful Immich Server, ML, Redis-compatible cache, PostgreSQL,
+and NPM Quadlets share one Podman network. Immich runs as `1100:1100`; Server and ML receive `/dev/dri`,
+and Photobook is mounted read-only at `/external/photobook`. NPM publishes ports `80` and `443`; its
+administration interface remains restricted to `127.0.0.1:81` for SSH-tunnel access.
+
+Atlas temporarily hosts rootless Navidrome and Syncthing until Uranus replaces them. They bind only to
+Atlas' LAN address (`192.168.178.55`); WireGuard remains exclusively between Prometheus (`10.0.0.1`)
+and Aegis (`10.0.0.2`). Their state is initialized ex novo in `/zpool/services/data/navidrome` and
+`/zpool/services/data/syncthing`; no source application state is migrated. The music library at
+`/zpool/media/music` is populated separately.
+
+The separate `wireguard_overlay` role manages `wg0` between Prometheus (`10.0.0.1`) and Aegis
+(`10.0.0.2`), generating private keys once on their respective hosts and exchanging only public keys
+through Ansible. Prometheus alone opens `51820/udp`. Aegis forwards only the declared overlay-to-LAN
+traffic and source-NATs it, so Atlas and future Uranus nodes require neither a VPN interface nor a router
+static route. Atlas permits Navidrome (`4533/tcp`) and the Syncthing GUI (`8384/tcp`) only from Aegis;
+Syncthing native ports are limited to the LAN. Configure NPM manually with
+`http://192.168.178.55:4533` and `http://192.168.178.55:8384` after the services are healthy.
+Prometheus' peer includes the LAN subnet in `AllowedIPs`; add the Uranus VIP there when it exists.
+When the WireGuard zone is created, Ansible reloads firewalld and immediately reloads Prometheus'
+rootful Podman networks so the existing proxy stack retains container DNS and connectivity.
+
+Validate the gateway with:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit prometheus,aegis --tags wireguard --check --diff
+```
+
+The first real WireGuard run must include both peers. If Fedora IoT has just layered `wireguard-tools`,
+reboot Aegis manually and rerun the command without `--check`; the role then waits for a real peer
+handshake.
+
+Atlas declares recursive, systemd-timed ZFS snapshots for the complete pool hierarchy: 24 hourly
+snapshots at minute 05, 30 daily snapshots at 00:15, 8 weekly snapshots on Sunday at 01:00, and 12
+monthly snapshots on the first day at 02:00. The retention helper prunes only snapshots carrying its
+managed `atlas-auto` prefix and never rolls back a dataset. The OpenZFS monthly scrub timer is scheduled
+for the first Sunday at 03:00; the conflicting weekly scrub timer is disabled explicitly. The first recursive
+hourly snapshot completed successfully on Atlas; retention pruning and the first scheduled scrub still await
+live runtime evidence. Validate this layer independently with:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags snapshots,scrub --check --diff
+```
+
+Atlas also declares an encrypted Borg backup to the dedicated Hetzner Storage Box sub-account
+`u660064-sub1`. The repository is the sub-account-relative `./borg-data` path and uses the explicitly
+selected remote Borg 1.4 binary over SSH port 23. The ED25519 server key is pinned; a dedicated client
+key is generated for the locked, non-login `borg` system account, and its private half never leaves
+`/etc/atlas-borg`. The account has no sudo or supplementary groups and owns only its SSH identity,
+passphrase, cache, and Borg state. Borg receives its passphrase through a mode `0600` file rendered from
+`vault_atlas_borg_passphrase`.
+
+The daily backup starts at 04:30 with up to 30 minutes of randomized delay. It creates a temporary,
+recursive ZFS snapshot and reconstructs every dataset below `/zpool` as a read-only bind-mounted tree,
+so parent and child datasets enter one consistent Borg archive. The wrapper recursively unmounts its
+private source tree; a narrowly scoped `ExecStopPost` helper removes any remaining host-namespace ZFS
+snapshot mounts and the named temporary snapshot after the backup process exits. Only the root wrapper
+performs snapshot and mount operations; it launches the Borg client as `borg` with temporary read-search
+capability and no ZFS, sudo, or pool-management privileges. Borg retains 30 daily, 8 weekly, and 12
+monthly archives, then compacts the standard
+read-write repository. A full metadata and repository check runs as `borg` on the fifteenth day of each
+month at 06:00. Both operations use a common lock, journal logging, and bounded systemd retries.
+New backup runs also log the create phase and a compact progress line at most once per minute: an
+**estimated** percentage, dataset, files processed, and original/compressed/deduplicated bytes. The
+denominator is the summed ZFS `logicalreferenced` size of the backup's own recursive snapshot, not a
+Borg-reported total: the estimate can exceed 100% and does not cover retention, compaction, or checks.
+Progress lines omit individual filenames; warnings may still name affected files.
+Follow the current run with
+`sudo journalctl -fu atlas-borg-backup.service` on Atlas; changes to the helper do not alter a run
+already in progress.
+
+Initial activation remains explicit:
+
+1. Add a strong unique `vault_atlas_borg_passphrase` with `ansible-vault edit secrets/vault.yml`.
+2. Generate and display only the dedicated public key with
+   `ansible-playbook ansible/site.yml --limit atlas --tags borg_key`.
+3. Install that public key in the Hetzner sub-account, then apply with
+   `ansible-playbook ansible/site.yml --limit atlas --tags packages,borg`.
+4. Copy the ignored `secrets/recovery/atlas-borg-repokey.export` file to genuinely offline storage.
+   The controller-side copy is not an offline backup by itself.
+
+The role initializes only the missing `repokey` repository and never accepts an unpinned host key or
+password authentication. It does not start the first backup manually. Validate the rendered state with:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags packages,borg --check --diff
+```
+
+Atlas runtime activation is complete: the initial backup and repository check succeeded, a full restore
+to a temporary directory was validated against the live `Archive` tree, the recovery-key export was copied
+to offline storage, and the temporary snapshot and bind mounts were cleaned up.
+On 2026-09-25 a separate ZFS restore smoke test copied a small file from an automatic daily
+`zpool/archive` snapshot to `/var/tmp`, then confirmed matching contents, ownership, mode, mtime and
+POSIX ACL. The temporary copy and on-demand snapshot mount were removed; Borg kept running. This
+does not validate a full dataset recovery.
+
+The offline USB backup is deployed as a manual-only service (`atlas_manage_usb_backup: true`):
+Ansible never formats, unlocks, mounts, backs up to, or schedules the disk. Atlas' existing USB disk was verified
+read-only on 2026-09-23 as LUKS UUID `577b3c43-ea37-4611-81a9-39d555cdfbd4`, containing ext4 UUID
+`758e2d2e-a427-4797-aad9-39c3a9f17c7e` through mapper `zpool-backup`. It was mounted at
+`/mnt/zpool-backup` at inspection time. The service deliberately requires the verified mapper to be
+**not mounted** before starting. When necessary, `systemd-ask-password` requests the LUKS passphrase
+through the `systemctl start` password agent; it is piped directly to `cryptsetup` without saving it,
+passing it as a command argument, or caching it. The service then mounts the disk privately, takes a recursive ZFS snapshot,
+copies every dataset to a versioned `atlas/snapshots/<timestamp>/` directory using `rsync --link-dest`,
+verifies the result with a checksum-based dry run, atomically updates `atlas/latest`, unmounts and closes
+LUKS. A failed run never replaces `latest` or removes an earlier complete version. Borg and the USB
+backup may run concurrently from separate snapshots; both reading the same pool can reduce throughput.
+The USB copy preserves ACLs but not generic extended attributes; `security.selinux` is also intentionally
+excluded because the target SELinux policy must recreate labels during a restore. Do not restore data into
+service paths without relabeling. After restoring an explicit dataset path, apply its destination policy with:
+
+```bash
+ansible-playbook ansible/site.yml --limit atlas --tags restorecon \
+  -e '{"atlas_restorecon_paths":["/zpool/archive"]}'
+```
+
+The task accepts only paths below the Atlas pool mount root, runs `restorecon -RFv` only for the paths
+provided at invocation, and is otherwise a no-op. It must not be used on the whole pool during routine runs.
+Old USB versions are not pruned automatically, to avoid deleting the only offline
+copy without an explicitly chosen retention policy; capacity checks include an estimated transfer size
+and a 10 GiB free-space reserve. The disk must be physically disconnected after a successful backup
+to make the copy offline.
+
+To check the USB backup and reminder configuration without starting a backup, run:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags usb_backup,usb_reminder --check --diff
+```
+
+To validate a planned, explicit post-restore relabel operation without changing labels, run:
+
+```bash
+ansible-playbook ansible/site.yml --limit atlas --tags restorecon --check \
+  -e '{"atlas_restorecon_paths":["/zpool/archive"]}'
+```
+
+Before the first **manual** service start, safely unmount the currently mounted
+`/mnt/zpool-backup`; never run it on an arbitrary mounted disk. Future starts
+can begin with the mapper closed: `sudo systemctl start atlas-usb-backup.service` prompts for the
+passphrase interactively and then performs the backup. Neither the LUKS password nor a key file belongs
+in Ansible. Inspect the run with
+`sudo journalctl -fu atlas-usb-backup.service`. There is intentionally no timer. Independently test a
+read-only mount and restore from `atlas/latest` into an empty temporary directory before marking the
+USB recovery path complete. Only `atlas-usb-reminder.timer` is enabled, for the first Saturday of each
+month at 10:00 Europe/Rome. Its warning notification uses the existing 45Drives Houston notifier.
+A manual test confirmed a notification in 45Drives Alerts, **not** an email. The reminder service log
+reports notification submission, not email delivery; the role does not depend on SMTP/OAuth settings.
+The reminder never starts the backup. Check its schedule with
+`systemctl list-timers atlas-usb-reminder.timer` and the result in 45Drives Alerts.
+The timer was verified active with its first scheduled run at 2026-10-03 10:00 CEST. No email
+delivery is claimed.
+The first manual USB attempt on 2026-09-23 did not complete: rsync was denied while removing
+`security.selinux` on the USB filesystem, then the interrupted service left its recursive
+`atlas-usb-20260923T185748Z-2469168` snapshot and the `zpool-backup` LUKS mapper open. The
+rsync xattr filter was deployed afterward. The incomplete USB directory was absent on inspection;
+the exact failed snapshot was removed, the verified and unmounted mapper closed, and the service
+failed state cleared. A final check found no remnant snapshot, mount, mapper, or staging directory.
+The failed attempt was not a valid backup, and no USB restore had been tested at that point.
+On 2026-09-24 a later run reported a checksum-verified, published USB version and closed the LUKS
+mapper, but the service failed while destroying its temporary ZFS snapshot: OpenZFS still had
+on-demand `.zfs/snapshot` mounts open in the host namespace. Those exact temporary snapshots were
+unmounted normally and removed; no force or rollback was used. The backup service now records its
+snapshot name and runs a narrowly scoped `ExecStopPost` cleanup after the private backup process
+exits. The cleanup helper was tested with a disposable recursive snapshot and an active snapshot
+mount. A complete run on 2026-09-24 later checksum-verified and published a new USB version; the
+service ended successfully, the LUKS mapper closed, no temporary USB snapshot remained, and the pool
+was healthy. On 2026-09-25 an independent restore test opened the configured USB disk read-only, mounted
+ext4 with `ro,noload`, restored a 5,707,945-byte file from the published `atlas/latest` version to an
+empty `/var/tmp` directory, and matched its content, owner, mode, size, mtime, and POSIX ACL against
+the USB source. The test removed its temporary copy and mount, closed the LUKS mapper, and left the
+pool healthy while Borg continued running. This is a file-level recovery smoke test, not a full dataset
+or disaster-recovery exercise.
+
+Atlas health monitoring runs every 30 minutes through `atlas-health-monitor.timer`. Its read-only probes
+check pool/vdev state and errors, scrub/resilver status, four pool disks and the system NVMe via SMART,
+disk and CPU temperatures, system/pool/snapshot space, local `zpool/backup` growth, and the Hetzner
+Storage Box quota via `df -m` over the dedicated `borg` account's pinned-key SSH connection. The remote
+query never opens the Borg repository or its lock. Growth alerts compare against a roughly 24-hour
+baseline and therefore begin only after enough samples exist. The monitor also checks
+maintenance/backup timer activation and freshness; systemd `OnFailure` hooks report snapshot,
+scrub, Borg, USB, reminder, and monitoring services when they enter the failed state. The ongoing
+initial Borg run is never restarted by the monitor; only a run exceeding 14 days raises a warning.
+Thresholds and stable disk paths are declared in Atlas host variables. Alerts use the existing 45Drives
+Houston notifier and repeated issues are deduplicated; **email delivery is not verified**. The
+2026-09-25 live probe found no issues and a labelled test notification was submitted. The Storage Box
+reported 22% used. Detailed Borg archive size and deduplication still require the active run to finish.
+
+```bash
+ansible-playbook ansible/site.yml --limit atlas --tags monitoring --check --diff
+sudo /usr/local/libexec/atlas-health-monitor --dry-run
+sudo journalctl -u atlas-health-monitor.service -n 100 --no-pager
+systemctl list-timers atlas-health-monitor.timer
+```
+
+`--dry-run` sends no alerts and does not change monitor state. A real check is
+`sudo systemctl start atlas-health-monitor.service`; do not start the backup services merely to test
+monitoring. For a labelled 45Drives Alerts delivery test, use
+`sudo /usr/local/libexec/atlas-health-monitor --test-notification`.
+
+### Atlas systemd timers
+
+All nine managed timers below are enabled. Times are local to Atlas (`Europe/Rome`); Borg and monitoring
+add the indicated randomized delay. Every timer has `Persistent=true`, so a missed calendar run is
+scheduled after the timer becomes active again.
+
+| Timer | Schedule (`OnCalendar`) | Action |
+| --- | --- | --- |
+| `atlas-zfs-snapshot-hourly.timer` | `*-*-* *:05:00` — every hour at :05 | Recursive hourly snapshot and retention |
+| `atlas-zfs-snapshot-daily.timer` | `*-*-* 00:15:00` — daily at 00:15 | Recursive daily snapshot and retention |
+| `atlas-zfs-snapshot-weekly.timer` | `Sun *-*-* 01:00:00` — Sunday at 01:00 | Recursive weekly snapshot and retention |
+| `atlas-zfs-snapshot-monthly.timer` | `*-*-01 02:00:00` — first day of the month at 02:00 | Recursive monthly snapshot and retention |
+| `zfs-scrub-monthly@zpool.timer` | `Sun *-*-01..07 03:00:00` — first Sunday at 03:00 | ZFS scrub |
+| `atlas-borg-backup.timer` | `*-*-* 04:30:00` — daily at 04:30, plus 0–30 min random delay | Encrypted offsite backup |
+| `atlas-borg-check.timer` | `*-*-15 06:00:00` — 15th of the month at 06:00, plus 0–30 min random delay | Borg repository check |
+| `atlas-usb-reminder.timer` | `Sat *-*-01..07 10:00:00 Europe/Rome` — first Saturday at 10:00 | 45Drives Alerts reminder only |
+| `atlas-health-monitor.timer` | `*:0/30` — every half-hour, plus 0–5 min random delay | Read-only health checks |
+
+`atlas-usb-backup.service` has **no timer**: the encrypted USB backup must be started manually.
+The vendor's `zfs-scrub-weekly@zpool.timer` is intentionally disabled in favor of the monthly scrub.
+The future Prometheus backup pull has no timer yet because that workflow is not implemented. While a
+Borg backup is still running, `systemctl list-timers` may show `-` for its next trigger; this does not
+mean the timer has been disabled. Inspect the current schedule on Atlas with
+`systemctl list-timers --all`.
+
+A temporary Nextcloud deployment on Atlas is also planned before Uranus: it requires separately
+declared persistent application, database, and cache storage, Vault-backed credentials, NPM-only
+publishing through Aegis, and defined backup, upgrade, and eventual migration procedures. Do not deploy
+it before the data-protection checklist is complete.
+
+The desired future iCloud photo-ingestion host is Atlas, not Aegis. After data-protection validation,
+plan an explicit iCloudPD migration with photos under `/zpool/archive/Pictures` and application/MFA
+state outside `Archive`, then test permissions, SELinux, backups and recovery before cutting over.
+The current Aegis iCloudPD service and Atlas Photobook NFS export remain configured until that
+separate migration is approved and validated; the eventual Atlas service is temporary until Uranus.
+
+Prometheus backup pulls, Borg archive-size evaluation, and full disaster-recovery tests remain follow-up
+work. The prioritized operational backlog is kept in `AGENTS.md`.
 
 ## How layering works
 
@@ -165,18 +558,53 @@ Emacs is enabled on Fedora/GNOME and workstation profiles. `dotfiles_common` dep
 ansible-playbook ansible/site.yml --limit <host> --tags emacs -e emacs_enabled=true
 ```
 
+## AI coding agents
+
+The shared npm-managed agents are OpenCode, Claude Code, Codex, Gemini CLI, and
+GitHub Copilot; IBM Bob is also managed on `deadalus`. Codex Relay is installed
+only on `ikaros`. Each agent has its own lifecycle flags in
+`ansible/inventory/group_vars/all.yml`, so one agent can be installed,
+configured, or removed without affecting the others:
+
+```yaml
+ai_agents:
+  opencode:
+    npm_package: opencode-ai
+    install_enabled: true
+    deploy_enabled: true
+    uninstall_enabled: false
+```
+
+Installation uses the npm `latest` state; deployment copies/renders only the
+configuration belonging to each enabled agent. Removal deletes only the selected
+managed npm package or, for IBM Bob, `/usr/local/bin/bob`; it preserves dotfiles,
+instructions, credentials, and user data. Installation and removal are mutually
+exclusive per agent: the playbook fails before making changes when both flags are
+true for the same agent. Servers set `ai_agents: {}` and therefore manage none.
+
+Run a focused dry run with:
+
+```bash
+ansible-playbook ansible/site.yml --limit ikaros --tags ai_agents --check --diff
+ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --diff
+```
+
+To preview removal, set `install_enabled: false` and `uninstall_enabled: true`
+only in the entry for the agent being removed, then run:
+
+```bash
+ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --diff
+```
+
 ## Main roles
 
 | Role | What it does |
 | --- | --- |
 | `packages_void` | Installs packages on Void. |
-| `packages_freebsd` | Installs packages on FreeBSD with pkg. |
-| `packages_ubuntu` | Installs packages on Ubuntu. |
 | `packages_fedora` | Installs packages on Fedora. |
 | `packages_rocky` | Installs packages on Rocky Linux 9. |
 | `services_runit` | Manages runit services. |
 | `services_systemd` | Manages systemd services. |
-| `services_freebsd` | Manages declared FreeBSD rc services. |
 | `profile_desktop_common` | Shared Void desktop bootstrap. |
 | `profile_desktop_gnome` | Shared Fedora/GNOME desktop dotfiles. |
 | `profile_desktop_sway` | Sway / SwayFX Wayland session. |
@@ -187,32 +615,39 @@ ansible-playbook ansible/site.yml --limit <host> --tags emacs -e emacs_enabled=t
 | `profile_workstation_dev_wsl` | WSL development setup. |
 | `profile_server` | Server setup. |
 | `profile_atlas` | Rocky Linux 9 NAS setup. |
+| `profile_backend_phase1` | Temporary rootless Atlas Navidrome and Syncthing services. |
+| `wireguard_overlay` | Prometheus/Aegis WireGuard LAN gateway. |
+| `profile_aegis` | Fedora IoT always-on LAN node. |
 | `dotfiles_common` | Shared user dotfiles. |
 
 ## What `site.yml` runs
 
 ```text
-all -> dotfiles_common
+all except platform_rocky -> dotfiles_common
 platform_void -> packages_void + services_runit
 platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_niri + profile_desktop_host
-platform_freebsd -> packages_freebsd + services_freebsd
 platform_fedora -> packages_fedora + services_systemd
 platform_rocky -> packages_rocky + services_systemd
+role_aegis -> profile_aegis
+wireguard_overlay -> wireguard_overlay (after Aegis profile and platform_rocky)
 atlas -> profile_atlas
+role_backend_phase1 -> profile_backend_phase1 (after atlas)
+rocky_server -> dotfiles_common + profile_server (after platform_rocky)
 platform_fedora & role_personal_workstation -> profile_personal_workstation
 platform_fedora & desktop_gnome -> profile_desktop_gnome
 workstation_dev_fedora -> profile_workstation_dev_common
 workstation_dev_wsl -> profile_workstation_dev_wsl (after platform_fedora + workstation_dev_fedora)
-ubuntu_server -> packages_ubuntu + services_systemd + profile_server
 ```
 
 So, in practice:
 
 - `platform_fedora` configures `ikaros`, `nymph`, and `deadalus`.
 - `deadalus` gets the Fedora development layer followed by the WSL layer.
-- `ubuntu_server` configures `prometheus`.
+- `rocky_server` configures the Rocky 9 server, `prometheus`.
 - `atlas` receives the Rocky platform layer and the NAS profile through SSH.
-- Empty `platform_void` and `platform_freebsd` groups do nothing until they get a host.
+- `aegis` receives only the immutable Fedora IoT profile through SSH; it does not receive
+  mutable Fedora package or common dotfile roles.
+- Empty `platform_void` groups do nothing until they get a host.
 - The playbook never restarts the display manager during a run.
 - `secrets/vault.yml` and then `secrets/vault.local.yml` are loaded only when present.
 
@@ -251,6 +686,7 @@ ansible-playbook ansible/site.yml --limit nymph --check --diff
 ansible-playbook ansible/site.yml --limit deadalus --check --diff
 ansible-playbook ansible/site.yml --limit prometheus --check --diff
 ansible-playbook ansible/site.yml --limit atlas --check --diff
+ansible-playbook ansible/site.yml --limit aegis --check --diff
 ansible-lint ansible/site.yml
 ansible-lint ansible/roles
 yamllint ansible/
@@ -263,7 +699,8 @@ ansible-playbook ansible/site.yml --limit <host> --tags <tag1>,<tag2> --check --
 ansible-playbook ansible/site.yml --limit <host> --start-at-task "<task name>" --check --diff
 ansible-lint ansible/roles/<role>
 yamllint ansible/path/to/file.yml
-docker compose -f /opt/docker/server/docker-compose.yml config
+podman-compose -f /opt/docker/server/docker-compose.yml config
+ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff
 ```
 
 ## Tags
@@ -277,7 +714,10 @@ ansible-playbook ansible/site.yml --list-tags
 | Tag | Main scope |
 | --- | --- |
 | `always` | Common pre-tasks, including optional vault loading. |
-| `ai_agents` | Shared AI agent installation on Fedora and WSL. |
+| `ai_agents` | AI coding-agent install, configuration deployment, and managed-binary removal. |
+| `atlas` | Atlas NAS account, storage, sharing, and container configuration. |
+| `backend_phase1` | Rootless Atlas Navidrome and Syncthing Quadlets. |
+| `containers` | Rootful Atlas Quadlets. |
 | `dotfiles` | User configuration across all profiles. |
 | `dotfiles:common` | Shared dotfiles. |
 | `dotfiles:desktop` | Void and Fedora/GNOME desktop dotfiles. |
@@ -286,10 +726,15 @@ ansible-playbook ansible/site.yml --list-tags
 | `dotfiles:workstation` | Personal workstation and WSL dotfiles. |
 | `emacs` | Shared Emacs setup and authoring dependencies. |
 | `gnome` | Fedora/GNOME desktop configuration. |
+| `immich` | Atlas Immich account and Quadlets. |
 | `npm` | Global npm packages. |
 | `packages` | Package installation and updates. |
+| `podman` | Podman Compose and rootless Quadlet integration. |
 | `services` | runit and systemd services. |
+| `sharing` | Atlas NFSv4 and SMB3 configuration. |
+| `storage` | Atlas child ZFS datasets. |
 | `tmux` | tmux configuration and plugins. |
+| `wireguard` | Prometheus/Aegis WireGuard LAN gateway. |
 | `wsl` | WSL bootstrap and configuration. |
 
 ## Bootstrapping a new machine

ansible/bootstrap/aegis.bu

@@ -0,0 +1,57 @@
+# One-time bootstrap for Fedora IoT on Aegis (Raspberry Pi 4).
+# Generate only: ./generate-aegis-ign.sh
+# Generate and write an SD card: ./generate-aegis-ign.sh --write IMAGE DEVICE
+# The write mode uses arm-image-installer with the RPi4 target and embeds
+# config.ign; it prompts for Wi-Fi credentials unless supplied through its
+# WIFI_SSID and WIFI_PASS environment variables.
+# For WiFi, the UEFI 'System Table Selection' must be DeviceTree (Esc at boot).
+variant: fiot
+version: 1.0.0
+passwd:
+  users:
+    - name: admin
+      password_hash: "$6$bNDsU0XC5BxNJS5U$ENDGpdOUPJM3wcXBgNESCQkOqqQ9gN72/xEQoJsAI6QdsaY6mD4G5DBVIv7nHwHQOP35IH1oGRl.Uy3R2iUYQ1"
+      groups:
+        - wheel
+      ssh_authorized_keys:
+        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
+systemd:
+  units:
+    - name: sshd.service
+      enabled: true
+    - name: rpm-ostree-install-wifi.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Layer WiFi packages (driver, firmware, NetworkManager-wifi)
+        Wants=network-online.target
+        After=network-online.target
+        Before=zincati.service
+        ConditionPathExists=!/var/lib/%N.stamp
+
+        [Service]
+        Type=oneshot
+        RemainAfterExit=yes
+        ExecStart=/usr/bin/rpm-ostree install -y --allow-inactive NetworkManager-wifi NetworkManager-wwan wpa_supplicant wireless-regdb iw brcmfmac-firmware
+        ExecStart=/bin/touch /var/lib/%N.stamp
+        ExecStart=/bin/systemctl --no-block reboot
+
+        [Install]
+        WantedBy=multi-user.target
+storage:
+  files:
+    - path: /etc/hostname
+      mode: 0644
+      contents:
+        inline: |
+          aegis
+    - path: /etc/sysctl.d/99-ip-forward.conf
+      mode: 0644
+      contents:
+        inline: |
+          net.ipv4.ip_forward = 1
+  links:
+    - path: /etc/localtime
+      target: ../usr/share/zoneinfo/Europe/Rome

ansible/bootstrap/generate-aegis-ign.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env sh
+
+set -eu
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname "$0")" && pwd)
+BUTANE_IMAGE=${BUTANE_IMAGE:-quay.io/coreos/butane:release}
+BUTANE_SOURCE=${BUTANE_SOURCE:-"$SCRIPT_DIR/aegis.bu"}
+IGNITION_OUTPUT=${IGNITION_OUTPUT:-"$SCRIPT_DIR/config.ign"}
+SSH_PUBLIC_KEY=${SSH_PUBLIC_KEY:-"$HOME/.ssh/id_ed25519.pub"}
+WIFI_SECURITY=${WIFI_SECURITY:-wpa-psk}
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  generate-aegis-ign.sh
+  generate-aegis-ign.sh --write IMAGE DEVICE
+
+Environment overrides:
+  BUTANE_IMAGE       Butane container image (default: quay.io/coreos/butane:release)
+  BUTANE_SOURCE      Butane source path (default: aegis.bu beside this script)
+  IGNITION_OUTPUT    Ignition output path (default: config.ign beside this script)
+  SSH_PUBLIC_KEY     SSH public key passed to arm-image-installer
+  WIFI_SSID          Wi-Fi SSID; prompted if unset in --write mode
+  WIFI_PASS          Wi-Fi password; prompted if unset in --write mode
+  WIFI_SECURITY      Wi-Fi security type (default: wpa-psk)
+USAGE
+}
+
+require_command() {
+  if ! command -v "$1" >/dev/null 2>&1; then
+    printf 'Error: required command not found: %s\n' "$1" >&2
+    exit 1
+  fi
+}
+
+read_required() {
+  prompt=$1
+  value=$2
+
+  if [ -z "$value" ]; then
+    printf '%s' "$prompt" >&2
+    IFS= read -r value
+  fi
+
+  if [ -z "$value" ]; then
+    printf '%s\n' 'Error: a value is required.' >&2
+    exit 1
+  fi
+
+  printf '%s' "$value"
+}
+
+read_secret() {
+  value=$1
+
+  if [ -z "$value" ]; then
+    printf '%s' 'Wi-Fi password: ' >&2
+    stty -echo
+    IFS= read -r value
+    stty echo
+    printf '\n' >&2
+  fi
+
+  if [ -z "$value" ]; then
+    printf '%s\n' 'Error: a value is required.' >&2
+    exit 1
+  fi
+
+  printf '%s' "$value"
+}
+
+write_image=false
+case $# in
+  0)
+    ;;
+  3)
+    if [ "$1" != '--write' ]; then
+      usage >&2
+      exit 2
+    fi
+    write_image=true
+    IMAGE=$2
+    DEVICE=$3
+    ;;
+  *)
+    usage >&2
+    exit 2
+    ;;
+esac
+
+require_command podman
+
+if [ ! -f "$BUTANE_SOURCE" ]; then
+  printf 'Error: Butane source not found: %s\n' "$BUTANE_SOURCE" >&2
+  exit 1
+fi
+
+OUTPUT_DIR=$(dirname "$IGNITION_OUTPUT")
+if [ ! -d "$OUTPUT_DIR" ]; then
+  printf 'Error: output directory not found: %s\n' "$OUTPUT_DIR" >&2
+  exit 1
+fi
+
+umask 077
+TEMP_OUTPUT=$(mktemp "$OUTPUT_DIR/.config.ign.XXXXXX")
+trap 'rm -f "$TEMP_OUTPUT"' EXIT HUP INT TERM
+
+podman run --rm -i "$BUTANE_IMAGE" --strict < "$BUTANE_SOURCE" > "$TEMP_OUTPUT"
+mv "$TEMP_OUTPUT" "$IGNITION_OUTPUT"
+trap - EXIT HUP INT TERM
+
+printf 'Generated Ignition config: %s\n' "$IGNITION_OUTPUT"
+
+if [ "$write_image" = false ]; then
+  exit 0
+fi
+
+if [ ! -f "$IMAGE" ]; then
+  printf 'Error: image not found: %s\n' "$IMAGE" >&2
+  exit 1
+fi
+
+if [ ! -b "$DEVICE" ]; then
+  printf 'Error: target is not a block device: %s\n' "$DEVICE" >&2
+  exit 1
+fi
+
+if [ ! -f "$SSH_PUBLIC_KEY" ]; then
+  printf 'Error: SSH public key not found: %s\n' "$SSH_PUBLIC_KEY" >&2
+  exit 1
+fi
+
+require_command arm-image-installer
+WIFI_SSID=$(read_required 'Wi-Fi SSID: ' "${WIFI_SSID:-}")
+WIFI_PASS=$(read_secret "${WIFI_PASS:-}")
+
+printf 'Writing %s to %s.\n' "$IMAGE" "$DEVICE" >&2
+sudo arm-image-installer \
+  --image="$IMAGE" \
+  --target=rpi4 \
+  --media="$DEVICE" \
+  --ignition="$IGNITION_OUTPUT" \
+  --addkey="$SSH_PUBLIC_KEY" \
+  --resizefs \
+  --wifi-ssid="$WIFI_SSID" \
+  --wifi-pass="$WIFI_PASS" \
+  --wifi-security="$WIFI_SECURITY"

ansible/inventory/examples/platform-test-hosts.yml

@@ -1,8 +0,0 @@
----
-# Optional inventory overlay for VM tests. It is not loaded by ansible.cfg.
-all:
-  children:
-    platform_freebsd:
-      hosts:
-        freebsdtest:
-          ansible_connection: local

ansible/inventory/group_vars/all.yml

@@ -90,40 +90,82 @@ common_dotfiles:
     dest: .config/bat/
     mode: preserve
 
-ai_agents_npm_packages:
+# AI coding-agent lifecycle controls are independent for every agent.
-  - name: "opencode-ai"
+# Installation and removal are mutually exclusive per agent; the common
-    state: latest
+# pre-task enforces this before any changes are made.
-  - name: "@anthropic-ai/claude-code"
+codex_relay_install_enabled: false
-    state: latest
-  - name: "@openai/codex"
-    state: latest
-  - name: "@google/gemini-cli"
-    state: latest
-  - name: "@githubnext/github-copilot-cli"
-    state: latest
 
-ai_agents_enabled: true
+ai_agents:
+  opencode:
+    npm_package: opencode-ai
+    install_enabled: true
+    deploy_enabled: true
+    uninstall_enabled: false
+  claude_code:
+    npm_package: "@anthropic-ai/claude-code"
+    install_enabled: false
+    deploy_enabled: false
+    uninstall_enabled: true
+  codex:
+    npm_package: "@openai/codex"
+    install_enabled: true
+    deploy_enabled: true
+    uninstall_enabled: false
+  codex_relay:
+    npm_package: codex-relay
+    install_enabled: "{{ codex_relay_install_enabled }}"
+    deploy_enabled: false
+    uninstall_enabled: false
+  gemini_cli:
+    npm_package: "@google/gemini-cli"
+    install_enabled: true
+    deploy_enabled: true
+    uninstall_enabled: false
+  github_copilot:
+    npm_package: "@github/copilot"
+    install_enabled: false
+    deploy_enabled: false
+    uninstall_enabled: true
+  ibm_bob:
+    install_enabled: true
+    deploy_enabled: false
+    uninstall_enabled: false
+
+ai_agents_deploy_enabled_names: >-
+  {{ ai_agents | dict2items | selectattr('value.deploy_enabled') | map(attribute='key') | list }}
 
 ai_agents_dotfiles:
   - name: AI common config
     src: .config/ai/
     dest: .config/ai/
     mode: preserve
+    agents:
+      - opencode
+      - codex
+      - gemini_cli
   - name: Gemini CLI config
     src: .gemini/
     dest: .gemini/
     mode: preserve
+    agents:
+      - gemini_cli
   - name: OpenCode config
     src: .config/opencode/
     dest: .config/opencode/
     mode: preserve
+    agents:
+      - opencode
   - name: Claude Code memory
     src: .claude/
     dest: .claude/
     mode: preserve
+    agents:
+      - claude_code
 
 ai_agents_templates:
   - name: Codex config
     src: .codex/config.toml.j2
     dest: .codex/config.toml
     mode: "0644"
+    agents:
+      - codex

ansible/inventory/group_vars/desktop.yml

@@ -31,8 +31,7 @@ desktop_binary_tools: []
 
 desktop_npm_packages: >-
   {{
-    ai_agents_npm_packages
+    [
-    + [
       {'name': '@mermaid-js/mermaid-cli', 'state': 'latest'},
       {'name': 'vscode-langservers-extracted', 'state': 'latest'}
     ]

ansible/inventory/group_vars/desktop_gnome.yml

@@ -11,6 +11,7 @@ fedora_desktop_packages:
   # Fedora equivalents of the development/tooling packages previously pulled by
   # the Void desktop profile.
   - 7zip
+  - arm-image-installer
   - nodejs-bash-language-server
   - bluez
   - bridge-utils
@@ -51,6 +52,7 @@ fedora_desktop_packages:
   - qemu-tools
   - rclone
   - remmina
+  - rpi-imager
   - ruff
   - rustup
   - rsync
@@ -84,5 +86,3 @@ fedora_flatpak_packages:
   - com.spotify.Client
   - org.onlyoffice.desktopeditors
   - org.telegram.desktop
-
-fedora_npm_packages: "{{ ai_agents_npm_packages }}"

ansible/inventory/group_vars/fedora.yml

@@ -9,6 +9,7 @@ fedora_packages_base:
   - jq
   - make
   - nodejs
+  - openssl
   - ripgrep
 
 fedora_manage_docker_repo: true
@@ -58,3 +59,13 @@ fedora_dev_packages:
 
 fedora_flatpak_remote_name: flathub
 fedora_flatpak_remote_url: https://dl.flathub.org/repo/flathub.flatpakrepo
+
+chatgpt_desktop_enabled: false
+chatgpt_desktop_supported_fedora_versions:
+  - "43"
+  - "44"
+chatgpt_desktop_supported_architectures:
+  - x86_64
+  - aarch64
+chatgpt_desktop_rpm_gpg_key: RPM-GPG-KEY-chatgpt-3BFA0E4AE8B8CC16A2D9BA684A3B4A566C4660E4.asc
+chatgpt_desktop_rpm_repository: https://persistent.oaistatic.com/codex-app-prod/linux/rpm/$basearch

ansible/inventory/group_vars/platform_fedora_iot.yml

@@ -0,0 +1,2 @@
+---
+# Fedora IoT is immutable: do not attach the mutable Fedora package roles.

ansible/inventory/group_vars/platform_freebsd.yml

@@ -1,55 +0,0 @@
----
-platform_profile: freebsd
-platform_family: freebsd
-platform_package_manager: pkg
-platform_service_manager: rc
-ansible_python_interpreter: /usr/local/bin/python3
-
-vim_plugin_distro_packages:
-  - fzf
-vim_plugin_source_plugins:
-  - name: fzf
-    repo: https://github.com/junegunn/fzf.git
-    version: v0.72.0
-  - name: fzf.vim
-    repo: https://github.com/junegunn/fzf.vim.git
-    version: 34a564c81f36047f50e593c1656f4580ff75ccca
-  - name: vim-fugitive
-    repo: https://github.com/tpope/vim-fugitive.git
-    version: 3b753cf8c6a4dcde6edee8827d464ba9b8c4a6f0
-
-effective_user_group: "{{ user_group }}"
-effective_user_home: "/home/{{ effective_username }}"
-user_home: "/home/{{ username }}"
-
-freebsd_packages_base:
-  - bash
-  - bash-completion
-  - bat
-  - curl
-  - fzf
-  - git
-  - jq
-  - python3
-  - ripgrep
-  - rsync
-  - tmux
-  - tree
-  - unzip
-  - vim
-  - wget
-  - zip
-  - zoxide
-
-freebsd_development_packages:
-  - clang
-  - cmake
-  - gdb
-  - go
-  - gmake
-  - node
-  - npm
-  - pkgconf
-  - py311-pip
-  - rust
-  - shellcheck

ansible/inventory/group_vars/platform_rocky.yml

@@ -5,6 +5,9 @@ platform_package_manager: dnf
 platform_service_manager: systemd
 
 rocky_openzfs_release_rpm: https://zfsonlinux.org/epel/zfs-release-3-0.el9.noarch.rpm
+rocky_openzfs_gpg_key_url: >-
+  https://raw.githubusercontent.com/zfsonlinux/zfsonlinux.github.com/master/zfs-release/RPM-GPG-KEY-openzfs-key2
+rocky_openzfs_gpg_key_fingerprint: 7DC7 299D CF7C 7FD9 CD87 701B A599 FD5E 9DB8 4141
 rocky_syncthing_version: 2.1.3
 rocky_syncthing_archive_checksum: sha256:f929eb8e5b72a85543eeeefb2c38f34a68e0c530e70758a2905b78840c76602c
 rocky_syncthing_archive_url: >-
@@ -16,17 +19,37 @@ rocky_syncthing_archive_url: >-
     ~ '.tar.gz'
   }}
 
+rocky_manage_openzfs_repo: false
+rocky_manage_syncthing_binary: false
+rocky_manage_podman: false
+rocky_manage_github_cli_repo: false
+
+rocky_github_cli_repo_url: https://cli.github.com/packages/rpm/gh-cli.repo
+rocky_github_cli_repo_file: /etc/yum.repos.d/gh-cli.repo
+
 enabled_services:
   - firewalld
 
+rocky_common_packages:
+  - bash-completion
+  - bat
+  - fzf
+  - git
+  - jq
+  - tree
+  - unzip
+  - vim-enhanced
+  - wget
+  - zip
+  - zoxide
+
 rocky_packages_base:
-  - cockpit
   - dnf-plugins-core
   - firewalld
-  - nfs-utils
   - openssh-server
-  - policycoreutils-python-utils
   - rsync
-  - samba
+  - selinux-policy-targeted
   - sudo
-  - zfs
+
+rocky_profile_packages: []
+rocky_podman_packages: []

ansible/inventory/group_vars/rocky_server.yml

@@ -0,0 +1,42 @@
+---
+rocky_manage_podman: true
+rocky_manage_github_cli_repo: true
+
+rocky_profile_packages:
+  - avahi
+  - curl
+  - dmidecode
+  - dosfstools
+  - gcc
+  - gcc-c++
+  - git-delta
+  - gh
+  - gnupg2
+  - htop
+  - make
+  - nmap-ncat
+  - nodejs
+  - parted
+  - pciutils
+  - pinentry
+  - ranger
+  - ripgrep
+
+rocky_podman_packages:
+  - podman
+  - podman-compose
+
+enabled_services:
+  - firewalld
+  - podman.socket
+
+server_firewall_backend: firewalld
+server_firewalld_zone: public
+server_firewalld_services:
+  - ssh
+  - cockpit
+  - http
+  - https
+server_firewalld_ports: []
+server_sshd_service_name: sshd
+server_compose_selinux_mount_option: Z

ansible/inventory/group_vars/role_personal_workstation.yml

@@ -13,12 +13,4 @@ personal_workstation_directories:
   - path: "{{ user_home }}/Remotes"
     mode: "0755"
 
-personal_workstation_dotfiles:
-  - src: .gitignore_global
-    dest: .gitignore_global
-    mode: "0644"
-  - src: .themes.gitignore
-    dest: .themes.gitignore
-    mode: "0644"
-
 personal_workstation_flatpak_packages: []

ansible/inventory/group_vars/server.yml

@@ -6,7 +6,7 @@ effective_username: "{{ server_username }}"
 effective_user_group: "{{ server_user_group }}"
 effective_user_home: "{{ server_user_home }}"
 server_container_stack_dir: /opt/docker/server
-ai_agents_enabled: false
+ai_agents: {}
 vim_plugins_enabled: false
 
 profile_packages:
@@ -25,6 +25,9 @@ profile_packages:
   - rsync
 
 server_dotfiles:
+  - src: .bashrc.d/20-editor-server.sh
+    dest: .bashrc.d/20-editor-server.sh
+    mode: "0644"
   - src: .gnupg/gpg-agent.conf
     dest: .gnupg/gpg-agent.conf
     mode: "0600"
@@ -34,9 +37,6 @@ server_dotfiles:
   - src: .themes.gitignore
     dest: .themes.gitignore
     mode: "0644"
-  - src: duckdns/
-    dest: duckdns/
-    mode: preserve
 
 server_templates:
   - src: server/.gitconfig.j2
@@ -50,6 +50,10 @@ server_templates:
     no_log: true
 
 server_directories:
+  - path: "{{ server_user_home }}/.bashrc.d"
+    owner: "{{ server_username }}"
+    group: "{{ server_user_group }}"
+    mode: "0755"
   - path: "{{ server_user_home }}/.gnupg"
     owner: "{{ server_username }}"
     group: "{{ server_user_group }}"
@@ -58,14 +62,6 @@ server_directories:
     owner: root
     group: root
     mode: "0755"
-  - path: /opt/navidrome/data
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0755"
-  - path: /opt/music
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0755"
   - path: /opt/npm/data
     owner: root
     group: root
@@ -74,53 +70,15 @@ server_directories:
     owner: root
     group: root
     mode: "0755"
-  - path: /opt/postgres/data
-    owner: root
-    group: root
-    mode: "0755"
   - path: /opt/gitea/data
     owner: root
     group: root
     mode: "0755"
-  - path: /opt/syncthing/config
-    owner: root
-    group: root
-    mode: "0755"
-  - path: /srv/syncthing
-    owner: root
-    group: root
-    mode: "0755"
-  - path: /srv/syncthing/data
-    owner: "1000"
-    group: "1000"
-    mode: "0755"
-  - path: /srv/nextcloud
-    owner: root
-    group: root
-    mode: "0755"
-  - path: /srv/nextcloud/data
-    owner: root
-    group: root
-    mode: "0755"
-
-server_ufw_rules:
-  - rule: allow
-    name: OpenSSH
-  - rule: allow
-    port: "22000"
-    proto: tcp
-    comment: Syncthing sync traffic
-  - rule: allow
-    port: "22000"
-    proto: udp
-    comment: Syncthing QUIC sync traffic
-  - rule: allow
-    port: "21027"
-    proto: udp
-    comment: Syncthing local discovery
 
 server_sshd_settings:
   PermitRootLogin: "no"
 
 server_sshd_allow_users:
   - "{{ server_username }}"
+server_ssh_authorized_keys: []
+server_ssh_authorized_key_directory: "{{ server_user_home }}/.ssh/authorized_keys.d"

ansible/inventory/group_vars/ubuntu.yml

@@ -1,37 +0,0 @@
----
-ubuntu_packages_base:
-  - curl
-  - ufw
-  - htop
-  - build-essential
-  - nodejs
-  - git-delta
-  - jq
-  - ripgrep
-
-ubuntu_manage_docker_repo: true
-
-ubuntu_emacs_packages:
-  - emacs
-  - pandoc
-  - latexmk
-  - texlive-luatex
-  - texlive-latex-base
-  - texlive-latex-recommended
-  - texlive-fonts-recommended
-
-ubuntu_docker_packages:
-  - docker-ce
-  - docker-ce-cli
-  - containerd.io
-  - docker-buildx-plugin
-  - docker-compose-plugin
-
-enabled_services:
-  - ufw
-  - docker
-
-ubuntu_dotfiles:
-  - src: .bashrc.d/
-    dest: .bashrc.d/
-    mode: preserve

ansible/inventory/group_vars/workstation.yml

@@ -1,5 +1,3 @@
 ---
-workstation_manage_opencode: true
 workstation_manage_ibm_bob: true
 workstation_ibm_bob_install_url: "https://bob.ibm.com/download/bobshell.sh"
-workstation_npm_packages: "{{ ai_agents_npm_packages + [] }}"

ansible/inventory/group_vars/workstation_dev_wsl.yml

@@ -3,12 +3,30 @@ enabled_services:
   - docker
 
 workstation_dev_wsl_packages:
+  - buildah
+  - helm
+  # Fedora ships the kubectl client binary in the kubernetes-client package.
+  - kubernetes-client
+  - mise
   - pinentry-curses
   - python3-pip
   - tmux
+
+# Java 11, Java 25 and Maven are managed by Mise on this Fedora WSL profile.
+# Keep their versions pinned; update them deliberately.
+workstation_mise_java_version: temurin-11.0.31+11
+workstation_mise_java_25_version: 25.0.2
+workstation_mise_maven_version: 3.9.16
+
 workstation_is_wsl: true
 workstation_wsl_systemd_enabled: true
 workstation_dev_wsl_dotfiles:
+  - src: .bashrc.d/30-mise.sh
+    dest: .bashrc.d/30-mise.sh
+    mode: "0644"
+  - src: .config/mise/
+    dest: .config/mise/
+    mode: preserve
   - src: .gnupg/gpg-agent.conf
     dest: .gnupg/gpg-agent.conf
     mode: "0600"

ansible/inventory/host_vars/aegis.yml

@@ -0,0 +1,46 @@
+---
+ansible_host: aegis
+ansible_connection: ssh
+ansible_user: pi
+ansible_become: true
+ansible_python_interpreter: /usr/bin/python3
+# Avoid PTY framing around module JSON on this remote Fedora IoT host.
+ansible_ssh_use_tty: false
+
+aegis_lan_subnet: 192.168.178.0/24
+aegis_adguard_web_port: 80
+aegis_network_connection_name: FRITZ!Box 7530 NR
+aegis_network_connection_uuid: a52fda3d-3eb6-351f-bf04-753edcb76944
+aegis_host_dns_servers:
+  - 192.168.178.1
+aegis_host_dns_search_domains:
+  - fritz.box
+
+# Aegis is the internal WireGuard endpoint and NAT gateway for the LAN.
+wireguard_overlay_enabled: true
+wireguard_address: 10.0.0.2/24
+wireguard_enable_ipv4_forwarding: true
+wireguard_reload_rootful_podman_networks: true
+wireguard_forwarding_policies:
+  - name: aegis-wireguard-to-lan
+    ingress_zone: wireguard
+    egress_zone: public
+    source: 10.0.0.0/24
+    destination: "{{ aegis_lan_subnet }}"
+    masquerade: true
+wireguard_peers:
+  - name: prometheus
+    host: prometheus
+    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
+    allowed_ips:
+      - 10.0.0.0/24
+    persistent_keepalive: 25
+aegis_ssh_authorized_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
+
+aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"

ansible/inventory/host_vars/atlas.yml

@@ -1,50 +1,202 @@
 ---
-# Replace every CHANGEME value before enabling Atlas storage management.
+# Atlas declares its intended steady state; set a feature flag false only for a deliberate suspension.
 hostname: atlas
-ansible_host: CHANGEME_ATLAS_HOST
+ansible_host: 192.168.178.55
 ansible_user: "{{ atlas_connection_username }}"
 ansible_port: 22
-ansible_ssh_private_key_file: CHANGEME_ATLAS_SSH_PRIVATE_KEY_PATH
+ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 
-atlas_admin_username: CHANGEME_ATLAS_ADMIN
+atlas_admin_username: admin
 atlas_connection_username: "{{ atlas_admin_username }}"
 atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
-atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
+atlas_admin_ssh_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
 atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"
+atlas_ssh_allow_tcp_forwarding: local
 
-atlas_lan_subnet: CHANGEME_LAN_SUBNET
+atlas_lan_subnet: 192.168.178.0/24
-atlas_manage_firewall: false
+atlas_aegis_ip: 192.168.178.54
+atlas_manage_firewall: true
 atlas_firewalld_zone: public
-atlas_zfs_pool: CHANGEME_ZFS_POOL
+atlas_zfs_pool: zpool
-atlas_zfs_dataset_work: work
+# Populate only for the first pool bootstrap with four real persistent disk paths.
-atlas_zfs_dataset_syncthing: syncthing
+# Confirmed empty 4 TB IronWolf data disks; the NVMe system disk is intentionally excluded.
-atlas_zfs_dataset_backup_prometheus: backup_prometheus
+atlas_zpool_disks:
-atlas_zfs_dataset_icloud_photos: icloud_photos
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1XM
-atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A73T2
-atlas_manage_storage: false
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6A6VJK
+  - /dev/disk/by-id/ata-ST4000VN006-3CW104_WW6AC1LM
+atlas_create_pool: false
+atlas_zfs_dataset_archive: archive
+atlas_zfs_dataset_services: services
+atlas_zfs_dataset_app_data: services/data
+atlas_zfs_dataset_navidrome: services/data/navidrome
+atlas_zfs_dataset_syncthing: services/data/syncthing
+atlas_zfs_dataset_media: media
+atlas_zfs_dataset_music: media/music
+atlas_zfs_dataset_backup: backup
+atlas_zfs_dataset_host_backups: backup/hosts
+atlas_zfs_dataset_backup_prometheus: backup/hosts/prometheus
+atlas_zfs_backup_reservation: 500G
+atlas_zfs_dataset_photobook: media/photobook
+atlas_mount_root: /zpool
+atlas_manage_storage: true
+atlas_manage_zfs_snapshots: true
+atlas_zfs_snapshot_prefix: atlas-auto
+atlas_zfs_snapshot_policies:
+  - name: hourly
+    calendar: "*-*-* *:05:00"
+    keep: 24
+  - name: daily
+    calendar: "*-*-* 00:15:00"
+    keep: 30
+  - name: weekly
+    calendar: "Sun *-*-* 01:00:00"
+    keep: 8
+  - name: monthly
+    calendar: "*-*-01 02:00:00"
+    keep: 12
+atlas_manage_zfs_scrub: true
+atlas_zfs_scrub_calendar: "Sun *-*-01..07 03:00:00"
+atlas_manage_borg_backup: true
+atlas_borg_repository_host: u660064-sub1.your-storagebox.de
+atlas_borg_repository_user: u660064-sub1
+atlas_borg_repository_port: 23
+atlas_borg_repository_path: ./borg-data
+atlas_borg_remote_path: borg-1.4
+# Verified against Hetzner's published ED25519 fingerprint on 2026-09-17:
+# SHA256:XqONwb1S0zuj5A1CDxpOSuD2hnAArV1A3wKY7Z3sdgM
+atlas_borg_host_key: >-
+  [u660064-sub1.your-storagebox.de]:23 ssh-ed25519
+  AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs
+atlas_borg_backup_calendar: "*-*-* 04:30:00"
+atlas_borg_check_calendar: "*-*-15 06:00:00"
+atlas_borg_randomized_delay: 30m
+atlas_borg_keep_daily: 30
+atlas_borg_keep_weekly: 8
+atlas_borg_keep_monthly: 12
+atlas_manage_usb_backup: true
+# Read-only lsblk verification on Atlas, 2026-09-23. Never store the LUKS password here.
+atlas_usb_backup_luks_uuid: 577b3c43-ea37-4611-81a9-39d555cdfbd4
+atlas_usb_backup_fs_uuid: 758e2d2e-a427-4797-aad9-39c3a9f17c7e
+atlas_usb_backup_mapper_name: zpool-backup
+atlas_manage_usb_reminder: true
+atlas_usb_reminder_calendar: "Sat *-*-01..07 10:00:00 Europe/Rome"
+atlas_manage_monitoring: true
+# Physical pool disks and the system NVMe; the disconnected USB disk is intentionally excluded.
+atlas_monitor_smart_devices:
+  - { name: pool-1, path: "{{ atlas_zpool_disks[0] }}", warning_c: 50, critical_c: 55 }
+  - { name: pool-2, path: "{{ atlas_zpool_disks[1] }}", warning_c: 50, critical_c: 55 }
+  - { name: pool-3, path: "{{ atlas_zpool_disks[2] }}", warning_c: 50, critical_c: 55 }
+  - { name: pool-4, path: "{{ atlas_zpool_disks[3] }}", warning_c: 50, critical_c: 55 }
+  - name: system-nvme
+    path: /dev/disk/by-id/nvme-Patriot_M.2_P320_256GB_P320ADB26011606111
+    warning_c: 70
+    critical_c: 85
+atlas_monitor_timers:
+  - { name: atlas-zfs-snapshot-hourly.timer, max_age_hours: 3 }
+  - { name: atlas-zfs-snapshot-daily.timer, max_age_hours: 36 }
+  - { name: atlas-zfs-snapshot-weekly.timer, max_age_hours: 216 }
+  - { name: atlas-zfs-snapshot-monthly.timer, max_age_hours: 960 }
+  - { name: zfs-scrub-monthly@zpool.timer, max_age_hours: 960 }
+  - { name: atlas-borg-backup.timer, max_age_hours: 48 }
+  - { name: atlas-borg-check.timer, max_age_hours: 960 }
+  # The first manual USB reminder is not due until October; activation is checked, not age.
+  - { name: atlas-usb-reminder.timer, max_age_hours: 0 }
+atlas_monitor_failure_units:
+  - atlas-zfs-snapshot@.service
+  - zfs-scrub@zpool.service
+  - atlas-borg-backup.service
+  - atlas-borg-check.service
+  - atlas-usb-backup.service
+  - atlas-usb-reminder.service
+  - atlas-health-monitor.service
+atlas_monitor_remote_capacity:
+  user: "{{ atlas_borg_repository_user }}"
+  host: "{{ atlas_borg_repository_host }}"
+  run_as: "{{ atlas_borg_username }}"
+  ssh_wrapper: "{{ atlas_borg_ssh_wrapper_path }}"
+  warning_percent: 80
+  critical_percent: 90
+  growth_warning_gib_day: 500
+atlas_manage_sharing: true
+atlas_manage_media_stack: false
+# Planned after data-protection validation: move iCloudPD photo ingestion from
+# Aegis to Atlas, with photos under /zpool/archive/Pictures and persistent
+# application/MFA state outside Archive. Do not deploy or cut over yet.
+
+# WireGuard is retired on Atlas. These rootless services are a temporary home
+# until Uranus replaces them.
+backend_phase1_enabled: true
+backend_phase1_start_services: true
+backend_phase1_bind_address: "{{ ansible_host }}"
+backend_phase1_firewalld_zone: "{{ atlas_firewalld_zone }}"
+backend_phase1_npm_source_ip: "{{ atlas_aegis_ip }}"
+backend_phase1_syncthing_native_subnet: "{{ atlas_lan_subnet }}"
+
+rocky_manage_openzfs_repo: true
+rocky_manage_syncthing_binary: false
+rocky_manage_podman: true
+rocky_podman_packages:
+  - podman
+
+host_packages:
+  - cockpit
+  - cockpit-podman
+  - cockpit-storaged
+  - realmd
+  - pcp
+  - python3-pcp
+  - cryptsetup
+  - nfs-utils
+  - policycoreutils
+  - policycoreutils-python-utils
+  - python3-libselinux
+  - setroubleshoot-server
+  - samba
+  - samba-client
+  - samba-common-tools
+  - borgbackup
+  - zfs
 
 atlas_nfs_exports:
-  - path: "{{ atlas_work_mountpoint }}"
+  - path: "{{ atlas_photobook_mountpoint }}"
-    clients: "{{ atlas_lan_subnet }}(rw,sync,no_subtree_check,root_squash)"
+    client: "{{ atlas_aegis_ip }}"
+    options:
+      - rw
+      - sync
+      - no_subtree_check
+      - all_squash
+      - "anonuid={{ atlas_immich_uid }}"
+      - "anongid={{ atlas_immich_gid }}"
 
-atlas_samba_share_name: work
+atlas_samba_share_name: Archive
 atlas_samba_workgroup: WORKGROUP
-atlas_samba_valid_users:
+atlas_samba_encryption: required
-  - "{{ atlas_admin_username }}"
+# Append any pre-existing laptop Unix account here and keep its Samba password in Vault.
-atlas_samba_password: "{{ vault_atlas_samba_password | default('') }}"
+atlas_samba_accounts:
+  - username: "{{ atlas_admin_username }}"
+    password: "{{ vault_atlas_samba_password | default('') }}"
+atlas_samba_valid_users: "{{ atlas_samba_accounts | map(attribute='username') | list }}"
+
+atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"
 
 atlas_firewalld_rich_rules:
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="ssh" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="22" protocol="tcp" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="cockpit" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="9090" protocol="tcp" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="2049" protocol="tcp" accept'
+  - 'rule family="ipv4" source address="{{ atlas_aegis_ip }}" port port="2049" protocol="tcp" accept'
-  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="samba" accept'
+  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" port port="445" protocol="tcp" accept'
 
 host_enabled_services:
   - sshd
   - cockpit.socket
-  - nfs-server
+  - pmlogger.service
-  - smb
   - zfs.target

ansible/inventory/host_vars/ikaros.yml

@@ -1,6 +1,9 @@
 ---
 hostname: ikaros
 
+codex_relay_install_enabled: true
+chatgpt_desktop_enabled: true
+
 host_packages:
   - openssh-clients
   - openssh-server
@@ -229,7 +232,7 @@ gnome_gsettings_settings:
   - schema: org.gnome.shell
     key: app-picker-layout
     value: >-
-      [{'System': <{'position': <0>}>, 'Utilities': <{'position': <1>}>, 'org.fedoraproject.MediaWriter.desktop': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Calendar.desktop': <{'position': <4>}>, 'org.gnome.Calculator.desktop': <{'position': <5>}>, 'org.gnome.Weather.desktop': <{'position': <6>}>, 'org.gnome.clocks.desktop': <{'position': <7>}>, 'org.gnome.Maps.desktop': <{'position': <8>}>, 'org.gnome.SimpleScan.desktop': <{'position': <9>}>, 'org.gnome.TextEditor.desktop': <{'position': <10>}>, 'org.gnome.Settings.desktop': <{'position': <11>}>, 'org.gnome.Boxes.desktop': <{'position': <12>}>, 'org.gnome.Showtime.desktop': <{'position': <13>}>, 'org.gnome.Snapshot.desktop': <{'position': <14>}>, 'org.gnome.Characters.desktop': <{'position': <15>}>, 'org.gnome.Tour.desktop': <{'position': <16>}>, 'org.gnome.Yelp.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>, 'be.alexandervanhee.gradia.desktop': <{'position': <19>}>, 'com.github.jeromerobert.pdfarranger.desktop': <{'position': <20>}>, 'org.onlyoffice.desktopeditors.desktop': <{'position': <21>}>, 'org.gnome.Meld.desktop': <{'position': <22>}>, 'com.mattjakeman.ExtensionManager.desktop': <{'position': <23>}>}, {'org.remmina.Remmina.desktop': <{'position': <0>}>, 'ch.protonmail.protonmail-bridge.desktop': <{'position': <1>}>, 'syncthing-start.desktop': <{'position': <2>}>, 'syncthing-ui.desktop': <{'position': <3>}>, 'emacs.desktop': <{'position': <4>}>, 'emacs-client.desktop': <{'position': <5>}>, 'org.gnome.gitlab.somas.Apostrophe.desktop': <{'position': <6>}>, 'mpv.desktop': <{'position': <7>}>, 'htop.desktop': <{'position': <8>}>, 'org.mozilla.thunderbird.desktop': <{'position': <9>}>}]
+      [{'System': <{'position': <0>}>, 'Utilities': <{'position': <1>}>, 'org.fedoraproject.MediaWriter.desktop': <{'position': <2>}>, 'org.gnome.Contacts.desktop': <{'position': <3>}>, 'org.gnome.Calendar.desktop': <{'position': <4>}>, 'org.gnome.Calculator.desktop': <{'position': <5>}>, 'org.gnome.Weather.desktop': <{'position': <6>}>, 'org.gnome.clocks.desktop': <{'position': <7>}>, 'org.gnome.Maps.desktop': <{'position': <8>}>, 'org.gnome.SimpleScan.desktop': <{'position': <9>}>, 'org.gnome.TextEditor.desktop': <{'position': <10>}>, 'org.gnome.Settings.desktop': <{'position': <11>}>, 'org.gnome.Boxes.desktop': <{'position': <12>}>, 'org.gnome.Showtime.desktop': <{'position': <13>}>, 'org.gnome.Snapshot.desktop': <{'position': <14>}>, 'org.gnome.Characters.desktop': <{'position': <15>}>, 'org.gnome.Tour.desktop': <{'position': <16>}>, 'org.gnome.Yelp.desktop': <{'position': <17>}>, 'org.gnome.Software.desktop': <{'position': <18>}>, 'be.alexandervanhee.gradia.desktop': <{'position': <19>}>, 'com.github.jeromerobert.pdfarranger.desktop': <{'position': <20>}>, 'org.onlyoffice.desktopeditors.desktop': <{'position': <21>}>, 'org.gnome.Meld.desktop': <{'position': <22>}>, 'com.mattjakeman.ExtensionManager.desktop': <{'position': <23>}>}, {'org.remmina.Remmina.desktop': <{'position': <0>}>, 'ch.protonmail.protonmail-bridge.desktop': <{'position': <1>}>, 'syncthing-start.desktop': <{'position': <2>}>, 'syncthing-ui.desktop': <{'position': <3>}>, 'emacs.desktop': <{'position': <4>}>, 'emacs-client.desktop': <{'position': <5>}>, 'org.gnome.gitlab.somas.Apostrophe.desktop': <{'position': <6>}>, 'mpv.desktop': <{'position': <7>}>, 'htop.desktop': <{'position': <8>}>, 'com.raspberrypi.rpi-imager.desktop': <{'position': <9>}>}]
   - schema: org.gnome.shell
     key: disabled-extensions
     value: >-
@@ -241,7 +244,7 @@ gnome_gsettings_settings:
   - schema: org.gnome.shell
     key: favorite-apps
     value: >-
-      ['org.gnome.Nautilus.desktop', 'org.mozilla.firefox.desktop', 'com.spotify.Client.desktop', 'org.gnome.Evolution.desktop', 'org.telegram.desktop.desktop', 'org.gnome.Ptyxis.desktop', 'virt-manager.desktop']
+      ['org.gnome.Nautilus.desktop', 'org.mozilla.firefox.desktop', 'com.spotify.Client.desktop', 'org.gnome.Evolution.desktop', 'org.telegram.desktop.desktop', 'chatgpt.desktop', 'org.gnome.Ptyxis.desktop', 'virt-manager.desktop']
   - schema: org.gnome.shell
     key: remember-mount-password
     value: "true"

ansible/inventory/host_vars/nymph.yml

@@ -1,6 +1,8 @@
 ---
 hostname: nymph
 
+chatgpt_desktop_enabled: true
+
 # Fedora Workstation/GNOME laptop target. GNOME is provided by the base Fedora
 # Workstation install; Ansible deploys shared desktop dotfiles but leaves GNOME
 # settings unmanaged for now.

ansible/inventory/host_vars/prometheus.yml

@@ -1,5 +1,43 @@
 ---
 hostname: prometheus
+ansible_host: 179.237.102.172
+ansible_user: rocky
+ansible_port: 22
+ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 
-host_packages: []
+server_username: rocky
-host_enabled_services: []
+server_duckdns_domain: fscotto
+server_ssh_authorized_keys:
+  - name: ikaros
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
+  - name: nymph
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
+  - name: siren
+    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"
+
+wireguard_overlay_enabled: true
+wireguard_address: 10.0.0.1/24
+wireguard_listen_port: 51820
+wireguard_enable_ipv4_forwarding: true
+wireguard_reload_rootful_podman_networks: true
+wireguard_peers:
+  - name: aegis
+    host: aegis
+    # TODO: Aggiungere VIP di Uranus in futuro
+    allowed_ips:
+      - 10.0.0.2/32
+      - 192.168.178.0/24
+
+host_packages:
+  - cockpit
+  - cockpit-navigator
+  - cockpit-podman
+  - cockpit-storaged
+  - realmd
+  - pcp
+  - python3-pcp
+  - setroubleshoot-server
+
+host_enabled_services:
+  - cockpit.socket
+  - pmlogger.service

ansible/inventory/hosts.yml

@@ -13,12 +13,15 @@ all:
         deadalus:
           ansible_connection: local
 
-    platform_freebsd:
+    platform_fedora_iot:
-      hosts: {}
+      hosts:
+        aegis:
 
     platform_rocky:
       hosts:
         atlas:
+      children:
+        rocky_server:
 
     void:
       children:
@@ -27,6 +30,7 @@ all:
     fedora:
       children:
         platform_fedora:
+        platform_fedora_iot:
 
     rocky:
       children:
@@ -48,6 +52,10 @@ all:
         ikaros:
           ansible_connection: local
 
+    role_aegis:
+      hosts:
+        aegis:
+
     desktop_sway:
       hosts: {}
 
@@ -61,10 +69,6 @@ all:
         nymph:
           ansible_connection: local
 
-    ubuntu:
-      children:
-        ubuntu_server:
-
     workstation:
       children:
         workstation_dev:
@@ -76,7 +80,7 @@ all:
 
     server:
       children:
-        ubuntu_server:
+        rocky_server:
 
     workstation_dev_fedora:
       hosts:
@@ -88,7 +92,15 @@ all:
         deadalus:
           ansible_connection: local
 
-    ubuntu_server:
+    rocky_server:
       hosts:
         prometheus:
-          ansible_connection: local
+
+    wireguard_overlay:
+      hosts:
+        prometheus:
+        aegis:
+
+    role_backend_phase1:
+      hosts:
+        atlas:

ansible/roles/dotfiles_common/tasks/main.yml

@@ -23,6 +23,7 @@
     dest: "{{ effective_user_home }}/Templates"
     owner: "{{ effective_username }}"
     group: "{{ effective_user_group }}"
+    creates: "{{ effective_user_home }}/Templates/code/main.c"
   when: "'desktop' in group_names"
 
 - name: Ensure Emacs authoring directories exist
@@ -86,13 +87,25 @@
     group: "{{ effective_user_group }}"
     mode: "{{ item.mode }}"
   loop: >-
-    {{
+    {{ common_dotfiles | default([]) }}
-      (common_dotfiles | default([]))
-      + ((ai_agents_dotfiles | default([])) if (ai_agents_enabled | default(false)) else [])
-    }}
   loop_control:
     label: "{{ item.dest }}"
 
+- name: Deploy AI coding-agent dotfiles
+  tags: [dotfiles, dotfiles:common, ai_agents]
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../dotfiles/common/{{ item.src }}"
+    dest: "{{ effective_user_home }}/{{ item.dest }}"
+    owner: "{{ effective_username }}"
+    group: "{{ effective_user_group }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ ai_agents_dotfiles | default([]) }}"
+  loop_control:
+    label: "{{ item.dest }}"
+  when:
+    - (item.agents | intersect(ai_agents_deploy_enabled_names)) | length > 0
+    - (ai_agents_dotfiles | default([])) | length > 0
+
 - name: Install distro packages for Vim plugins
   tags: [packages, vim, fzf]
   ansible.builtin.package:
@@ -141,7 +154,7 @@
     - (vim_plugin_source_plugins | default([])) | length > 0
 
 - name: Ensure AI config directories exist
-  tags: [dotfiles, dotfiles:common]
+  tags: [dotfiles, dotfiles:common, ai_agents]
   ansible.builtin.file:
     path: "{{ effective_user_home }}/{{ item }}"
     state: directory
@@ -151,11 +164,11 @@
   loop:
     - .codex
   when:
-    - ai_agents_enabled | default(false)
+    - "'codex' in ai_agents_deploy_enabled_names"
     - (ai_agents_templates | default([])) | length > 0
 
-- name: Render AI agent templates
+- name: Render AI coding-agent templates
-  tags: [dotfiles, dotfiles:common]
+  tags: [dotfiles, dotfiles:common, ai_agents]
   ansible.builtin.template:
     src: "{{ playbook_dir }}/../dotfiles/common/{{ item.src }}"
     dest: "{{ effective_user_home }}/{{ item.dest }}"
@@ -165,7 +178,9 @@
   loop: "{{ ai_agents_templates | default([]) }}"
   loop_control:
     label: "{{ item.dest }}"
-  when: ai_agents_enabled | default(false)
+  when:
+    - (item.agents | intersect(ai_agents_deploy_enabled_names)) | length > 0
+    - (ai_agents_templates | default([])) | length > 0
 
 - name: Refresh bat cache
   tags: [dotfiles, dotfiles:common]

ansible/roles/packages_fedora/files/RPM-GPG-KEY-chatgpt-3BFA0E4AE8B8CC16A2D9BA684A3B4A566C4660E4.asc

@@ -0,0 +1,28 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGpypFUBEACi1Vvzq9pIpA6lj7chbqELuxJtVuzUzxrasa6ZU0yF4yhq7jf8
+3YkJRHwbezBKeQyzJ5lkX0EhXS8aXxUhMAm3PFpAlwcInfKzmV7atJwvaxIw6Rmd
+GYe9fBWKjTN/SmPIjtyxrTznZY97+TfD1AeGZpLaJ8fsnhrC+HkiN2TACiTocgpe
+hFiP0OWK7mWZeTWnY2scpIYXP1Ro7nQv4KacmY4JacTQ7m/HM0Qej/3olhuEv2Cw
+lMVWw57/oHhmTllfLDQOogFQyIVqaaR98y/Eu6cAabSfcsqAAZ2A8vfHYD27z28J
+vLO2PZEJd5ThlnX4Zqv0eIpZdBj//8Sl/MSqTshFZ1NDsRoqwdqw284X5MpnOJ4k
+4Sc2Se8tJxt/nCeibH3dJ504Fb1X/mnOqhCAQ6pVJz4RB5HRlFPSkxVPyag1v1m/
+7T4vie+OR4eqFQNz6mudrOoMmeVIfyL5fbe4cOr4fk/FyvEE2xMgkFatPqXn7vM9
+og+zremPCfwRAFpBPyX74VowFY7llcdaj/w8K5T8PzM14Hb3E4ZKizMluKmTvTq9
+WE1/eSQJLLQqXD5VmtmdUaC/VyE/1ZlIxcA1LWqvEQ327UXREvX/nHsrkKrl956W
+jzkiHFUTsD1NJ0dMfs+csOt8Furb5jZj+HsMmCm9jLdfz5b/4WKLPbvxIwARAQAB
+tBZDb2RleCBMaW51eCBSZXBvc2l0b3J5iQJRBBMBCgA7FiEEO/oOSui4zBai2bpo
+SjtKVmxGYOQFAmpypFUCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQ
+SjtKVmxGYORlCQ/9FyikZo8HQcJBP9E/oXVPds/fQnIFB2qJR2z3DrfYEonNt/ev
+SAySkPPq4/mEOjaI0pFlDDGSaps+FTcJFgoVRTasBIF7JJivvjW9ap8iWEbhhVLe
+IrFLbMLpUcTRntUx7R4fVMJ/1/cGn+NWZmNwS9ORorzSyCH0IAgCw1Xc3ZrjuMbF
+VjdToMC1TiXXCEmlYpQakmQ3Ay1cH0FHC2BBNn1MNVkJdPhpZIZCdhaMPHfYFpyo
+pg8wFvZ5iIcvlbMgyuy8CPJVRWUcYy2dOhEOGnYJnXRPkE3E1hf8YOHNzRlduH89
+6lT9qcEK2+fpLfrVGoc4zscLZ+Ey+Ko6iQRdVE1j67+wNR3hX8ukue574v1N/xxu
+i575jumSE19lEj1sH4+P4gFHOtTbF0JhKKzLctbga0IAwTPKhnt3qzj1U5Yj/MZS
+uEVjrLhdRauOuFBXUclgyVf2w/lE85UUOdlcollsYA6Huq7xDamqf8SslZQGre3E
+I+lhpqJR1cOwDMUzzcl40uTyhrxXXd/bk4QSlhZbwHR25Pnt+ZMtWavlQWS0eDEV
+8djuXAURCmx5WOqAFB/TJe1mn5EvyWg4VFzrY/NVNOpzgY5+Xp7J28z7f637r712
+Eu9j4imVcdPigwS+jf/0f81i2o9b82Y26TN8+EtDLCY841MJ1lrjDrX/dno=
+=Y+3h
+-----END PGP PUBLIC KEY BLOCK-----

ansible/roles/packages_fedora/tasks/main.yml

@@ -25,6 +25,20 @@
     - "'workstation_dev_fedora' in group_names"
     - fedora_manage_docker_repo | default(false)
 
+- name: Install COPR support on Fedora WSL
+  tags: [packages, mise]
+  ansible.builtin.dnf:
+    name: dnf-plugins-core
+    state: present
+  when: "'workstation_dev_wsl' in group_names"
+
+- name: Configure Mise COPR repository on Fedora WSL
+  tags: [packages, mise]
+  community.general.copr:
+    name: jdxcode/mise
+    state: enabled
+  when: "'workstation_dev_wsl' in group_names"
+
 - name: Refresh dnf package metadata
   tags: [packages]
   ansible.builtin.dnf:
@@ -90,16 +104,81 @@
     - "'workstation_dev_fedora' in group_names"
     - (fedora_docker_packages | default([])) | length > 0
 
-- name: Install Fedora npm packages
+- name: Install shared AI coding agents on Fedora
   tags: [packages, npm, ai_agents]
   community.general.npm:
-    name: "{{ item.name }}"
+    name: "{{ item.value.npm_package }}"
     global: true
-    state: "{{ item.state | default('present') }}"
+    state: latest
-  loop: "{{ fedora_npm_packages | default([]) }}"
+  loop: "{{ ai_agents | dict2items | selectattr('value.npm_package', 'defined') | list }}"
-  when: (fedora_npm_packages | default([])) | length > 0
+  when:
+    - item.value.install_enabled | bool
+    - "'workstation_dev_fedora' not in group_names"
   loop_control:
-    label: "{{ item.name }}"
+    label: "{{ item.key }}"
+
+- name: Uninstall shared AI coding agents on Fedora
+  tags: [packages, npm, ai_agents]
+  community.general.npm:
+    name: "{{ item.value.npm_package }}"
+    global: true
+    state: absent
+  loop: "{{ ai_agents | dict2items | selectattr('value.npm_package', 'defined') | list }}"
+  when:
+    - item.value.uninstall_enabled | bool
+    - "'workstation_dev_fedora' not in group_names"
+  loop_control:
+    label: "{{ item.key }}"
+
+- name: Validate ChatGPT desktop architecture on Fedora
+  tags: [packages, chatgpt]
+  ansible.builtin.assert:
+    that:
+      - ansible_facts['architecture'] in chatgpt_desktop_supported_architectures
+      - ansible_facts['distribution_major_version'] in chatgpt_desktop_supported_fedora_versions
+    fail_msg: >-
+      ChatGPT desktop supports Fedora {{ chatgpt_desktop_supported_fedora_versions | join(' and ') }}
+      on x86_64 or aarch64; detected Fedora {{ ansible_facts['distribution_major_version'] }}
+      on {{ ansible_facts['architecture'] }}.
+  when: chatgpt_desktop_enabled | bool
+
+- name: Install ChatGPT desktop RPM signing key
+  tags: [packages, chatgpt]
+  ansible.builtin.copy:
+    src: "{{ chatgpt_desktop_rpm_gpg_key }}"
+    dest: "/etc/pki/rpm-gpg/{{ chatgpt_desktop_rpm_gpg_key }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: chatgpt_desktop_enabled | bool
+
+- name: Import ChatGPT desktop RPM signing key
+  tags: [packages, chatgpt]
+  ansible.builtin.rpm_key:
+    state: present
+    key: "/etc/pki/rpm-gpg/{{ chatgpt_desktop_rpm_gpg_key }}"
+  when: chatgpt_desktop_enabled | bool
+
+- name: Configure ChatGPT desktop RPM repository
+  tags: [packages, chatgpt]
+  ansible.builtin.yum_repository:
+    name: openai-chatgpt
+    description: ChatGPT
+    baseurl: "{{ chatgpt_desktop_rpm_repository }}"
+    enabled: true
+    gpgcheck: true
+    repo_gpgcheck: true
+    gpgkey: "file:///etc/pki/rpm-gpg/{{ chatgpt_desktop_rpm_gpg_key }}"
+    state: present
+  when: chatgpt_desktop_enabled | bool
+
+- name: Install ChatGPT desktop on selected Fedora hosts
+  tags: [packages, chatgpt]
+  ansible.builtin.dnf:
+    name: chatgpt
+    state: latest
+    update_cache: true
+  when: chatgpt_desktop_enabled | bool
 
 - name: Define Fedora Flatpak applications
   tags: [packages]

ansible/roles/packages_freebsd/tasks/main.yml

@@ -1,14 +0,0 @@
----
-- name: Install packages on FreeBSD
-  tags: [packages]
-  community.general.pkgng:
-    name: >-
-      {{
-        (
-          (freebsd_packages_base | default([]))
-          + (freebsd_development_packages | default([]))
-          + (host_packages | default([]))
-        )
-        | unique
-      }}
-    state: present

ansible/roles/packages_rocky/tasks/main.yml

@@ -27,11 +27,20 @@
     name: epel-release
     state: present
 
+- name: Import official OpenZFS EL9+ signing key
+  tags: [packages, storage]
+  ansible.builtin.rpm_key:
+    state: present
+    key: "{{ rocky_openzfs_gpg_key_url }}"
+    fingerprint: "{{ rocky_openzfs_gpg_key_fingerprint }}"
+  when: rocky_manage_openzfs_repo | bool
+
 - name: Install official OpenZFS repository package
   tags: [packages, storage]
   ansible.builtin.dnf:
     name: "{{ rocky_openzfs_release_rpm }}"
     state: present
+  when: rocky_manage_openzfs_repo | bool
 
 - name: Disable OpenZFS DKMS repository
   tags: [packages, storage]
@@ -39,6 +48,7 @@
     name:
       - zfs
     state: disabled
+  when: rocky_manage_openzfs_repo | bool
 
 - name: Enable OpenZFS kmod repository
   tags: [packages, storage]
@@ -46,6 +56,17 @@
     name:
       - zfs-kmod
     state: enabled
+  when: rocky_manage_openzfs_repo | bool
+
+- name: Configure official GitHub CLI RPM repository
+  tags: [packages]
+  ansible.builtin.get_url:
+    url: "{{ rocky_github_cli_repo_url }}"
+    dest: "{{ rocky_github_cli_repo_file }}"
+    owner: root
+    group: root
+    mode: "0644"
+  when: rocky_manage_github_cli_repo | bool
 
 - name: Refresh Rocky package metadata
   tags: [packages]
@@ -58,20 +79,32 @@
     name: >-
       {{
         (
-          (common_packages | default([]))
+          (rocky_common_packages | default([]))
           + (rocky_packages_base | default([]))
-          + (profile_packages | default([]))
+          + (rocky_profile_packages | default([]))
+          + (rocky_podman_packages | default([]))
           + (host_packages | default([]))
         ) | unique
       }}
     state: present
 
+- name: Ensure Podman runtime socket directory exists
+  tags: [packages, podman]
+  ansible.builtin.file:
+    path: /run/podman
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  when: rocky_manage_podman | bool
+
 - name: Require supported architecture for Syncthing
   tags: [packages, syncthing]
   ansible.builtin.assert:
     that:
       - ansible_facts['architecture'] == 'x86_64'
     fail_msg: The pinned Atlas Syncthing binary currently supports x86_64 only.
+  when: rocky_manage_syncthing_binary | bool
 
 - name: Read installed Syncthing version
   tags: [packages, syncthing]
@@ -83,6 +116,7 @@
   changed_when: false
   failed_when: false
   check_mode: false
+  when: rocky_manage_syncthing_binary | bool
 
 - name: Determine whether Syncthing must be installed
   tags: [packages, syncthing]
@@ -92,6 +126,7 @@
         ('syncthing v' ~ rocky_syncthing_version ~ ' ')
         not in (rocky_syncthing_version_check.stdout | default(''))
       }}
+  when: rocky_manage_syncthing_binary | bool
 
 - name: Create temporary Syncthing extraction directory
   tags: [packages, syncthing]
@@ -101,7 +136,9 @@
     owner: root
     group: root
     mode: "0755"
-  when: rocky_syncthing_install_required | bool
+  when:
+    - rocky_manage_syncthing_binary | bool
+    - rocky_syncthing_install_required | bool
 
 - name: Download pinned Syncthing release
   tags: [packages, syncthing]
@@ -112,7 +149,9 @@
     owner: root
     group: root
     mode: "0644"
-  when: rocky_syncthing_install_required | bool
+  when:
+    - rocky_manage_syncthing_binary | bool
+    - rocky_syncthing_install_required | bool
 
 - name: Extract pinned Syncthing release
   tags: [packages, syncthing]
@@ -120,7 +159,9 @@
     src: "/tmp/syncthing-{{ rocky_syncthing_version }}.tar.gz"
     dest: "/tmp/syncthing-{{ rocky_syncthing_version }}"
     remote_src: true
-  when: rocky_syncthing_install_required | bool
+  when:
+    - rocky_manage_syncthing_binary | bool
+    - rocky_syncthing_install_required | bool
 
 - name: Install pinned Syncthing binary
   tags: [packages, syncthing]
@@ -136,16 +177,20 @@
     owner: root
     group: root
     mode: "0755"
-  when: rocky_syncthing_install_required | bool
+  when:
+    - rocky_manage_syncthing_binary | bool
+    - rocky_syncthing_install_required | bool
 
 - name: Remove Syncthing release archive
   tags: [packages, syncthing]
   ansible.builtin.file:
     path: "/tmp/syncthing-{{ rocky_syncthing_version }}.tar.gz"
     state: absent
+  when: rocky_manage_syncthing_binary | bool
 
 - name: Remove Syncthing extraction directory
   tags: [packages, syncthing]
   ansible.builtin.file:
     path: "/tmp/syncthing-{{ rocky_syncthing_version }}"
     state: absent
+  when: rocky_manage_syncthing_binary | bool

ansible/roles/packages_ubuntu/tasks/main.yml

@@ -1,82 +0,0 @@
----
-- name: Copy Ubuntu dotfiles
-  tags: [dotfiles, dotfiles:common]
-  ansible.builtin.copy:
-    src: "{{ playbook_dir }}/../dotfiles/ubuntu/{{ item.src }}"
-    dest: "{{ effective_user_home }}/{{ item.dest }}"
-    owner: "{{ effective_username }}"
-    group: "{{ effective_user_group }}"
-    mode: "{{ item.mode }}"
-  loop: "{{ ubuntu_dotfiles | default([]) }}"
-  loop_control:
-    label: "{{ item.dest }}"
-
-- name: Ensure Docker apt keyrings directory exists
-  tags: [packages]
-  ansible.builtin.file:
-    path: /etc/apt/keyrings
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-  when: ubuntu_manage_docker_repo | default(false)
-
-- name: Download Docker apt repository signing key
-  tags: [packages]
-  ansible.builtin.get_url:
-    url: https://download.docker.com/linux/ubuntu/gpg
-    dest: /etc/apt/keyrings/docker.asc
-    owner: root
-    group: root
-    mode: "0644"
-  when: ubuntu_manage_docker_repo | default(false)
-
-- name: Configure Docker apt repository
-  tags: [packages]
-  ansible.builtin.apt_repository:
-    repo: >-
-      deb [arch={{ 'amd64' if ansible_facts['architecture'] == 'x86_64'
-      else 'arm64' if ansible_facts['architecture'] in ['aarch64', 'arm64']
-      else ansible_facts['architecture'] }}
-      signed-by=/etc/apt/keyrings/docker.asc]
-      https://download.docker.com/linux/ubuntu
-      {{ ansible_facts['distribution_release'] }} stable
-    filename: docker
-    state: present
-    update_cache: true
-  when: ubuntu_manage_docker_repo | default(false)
-
-- name: Refresh apt package cache
-  tags: [packages]
-  ansible.builtin.apt:
-    update_cache: true
-    cache_valid_time: 3600
-
-- name: Install packages on Ubuntu
-  tags: [packages]
-  ansible.builtin.apt:
-    name: >-
-      {{
-        (
-          (common_packages | default([]))
-        + (ubuntu_packages_base | default([]))
-        + (ubuntu_docker_packages | default([]))
-        + (profile_packages | default([]))
-        + (
-            (ubuntu_emacs_packages | default([]))
-            if (emacs_enabled | default(false) | bool)
-            else []
-          )
-        + (host_packages | default([]))
-        )
-        | unique
-      }}
-    state: present
-
-- name: Add user to docker group
-  tags: [packages]
-  ansible.builtin.user:
-    name: "{{ effective_username }}"
-    groups: docker
-    append: true
-  when: (ubuntu_docker_packages | default([])) | length > 0

ansible/roles/profile_aegis/defaults/main.yml

@@ -0,0 +1,24 @@
+---
+aegis_hostname: aegis
+aegis_layered_packages:
+  - nfs-utils
+  - wireguard-tools
+aegis_network_connection_name: ""
+aegis_network_connection_uuid: ""
+aegis_host_dns_servers: []
+aegis_host_dns_search_domains: []
+aegis_adguard_image: docker.io/adguard/adguardhome:latest
+aegis_icloudpd_image: docker.io/boredazfcuk/icloudpd:latest
+aegis_icloudpd_folder_structure: '{:%Y/%m/%d}'
+aegis_icloudpd_synchronisation_interval: 86400
+aegis_icloudpd_apple_id: ""
+aegis_ikaros_mac_address: aa:bb:cc:dd:ee:ff
+aegis_wol_port: 9
+
+aegis_lan_subnet: CHANGEME_LAN_SUBNET
+aegis_firewalld_zone: public
+aegis_adguard_web_port: 80
+aegis_ssh_allowed_users:
+  - "{{ ansible_user }}"
+aegis_ssh_user_home: "/var/home/{{ ansible_user }}"
+aegis_ssh_authorized_keys: []

ansible/roles/profile_aegis/handlers/main.yml

@@ -0,0 +1,21 @@
+---
+- name: Restart Aegis systemd-resolved
+  ansible.builtin.systemd:
+    name: systemd-resolved.service
+    state: restarted
+
+- name: Reload Aegis SSH
+  ansible.builtin.systemd:
+    name: sshd.service
+    state: reloaded
+
+- name: Restart Aegis Quadlet services
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    state: restarted
+    daemon_reload: true
+  loop:
+    - adguardhome.service
+    - icloudpd.service
+  loop_control:
+    label: "{{ item }}"

ansible/roles/profile_aegis/tasks/main.yml

@@ -0,0 +1,376 @@
+---
+- name: Manage Aegis layered packages
+  tags: [aegis, packages, nfs, wireguard]
+  community.general.rpm_ostree_pkg:
+    name: "{{ aegis_layered_packages }}"
+    state: present
+  register: aegis_layered_packages_result
+  when: aegis_layered_packages | length > 0
+
+- name: Report reboot required for Aegis layered packages
+  tags: [aegis, packages, nfs, wireguard]
+  ansible.builtin.debug:
+    msg: Reboot Aegis to activate the newly layered packages, then rerun the playbook.
+  when: aegis_layered_packages_result.needs_reboot | default(false)
+
+- name: Require Aegis iCloudPD Apple ID
+  tags: [aegis, icloudpd]
+  ansible.builtin.assert:
+    that:
+      - aegis_icloudpd_apple_id | length > 0
+    fail_msg: Define vault_aegis_icloudpd_apple_id before applying the Aegis profile.
+  no_log: true
+
+- name: Require completed Aegis network placeholders
+  tags: [aegis, dns, firewall, network, services]
+  ansible.builtin.assert:
+    that:
+      - aegis_lan_subnet != 'CHANGEME_LAN_SUBNET'
+      - aegis_firewalld_zone | length > 0
+      - aegis_adguard_web_port | int > 0
+      - aegis_adguard_web_port | int < 65536
+      - aegis_network_connection_name | length > 0
+      - aegis_network_connection_uuid | length > 0
+      - aegis_host_dns_servers | length > 0
+      - ansible_facts["default_ipv4"]["address"] not in aegis_host_dns_servers
+      - aegis_ssh_allowed_users | length > 0
+    fail_msg: >-
+      Define the Aegis LAN subnet, firewalld zone, AdGuard web port, independent host DNS,
+      NetworkManager connection, and SSH users. Aegis must not use its own address as upstream DNS.
+
+- name: Verify the declared Aegis NetworkManager connection exists
+  tags: [aegis, dns, network, services]
+  ansible.builtin.command:
+    argv:
+      - nmcli
+      - --get-values
+      - connection.id
+      - connection
+      - show
+      - uuid
+      - "{{ aegis_network_connection_uuid }}"
+  register: aegis_network_connection
+  changed_when: false
+  failed_when: >-
+    aegis_network_connection.rc != 0
+    or aegis_network_connection.stdout != aegis_network_connection_name
+
+- name: Read the current Aegis host DNS configuration
+  tags: [aegis, dns, network, services]
+  ansible.builtin.command:
+    argv:
+      - nmcli
+      - --get-values
+      - ipv4.ignore-auto-dns,ipv4.dns,ipv4.dns-search,ipv6.ignore-auto-dns
+      - connection
+      - show
+      - uuid
+      - "{{ aegis_network_connection_uuid }}"
+  register: aegis_host_dns_current
+  changed_when: false
+
+- name: Configure independent upstream DNS for the Aegis host
+  tags: [aegis, dns, network, services]
+  ansible.builtin.command:
+    argv:
+      - nmcli
+      - connection
+      - modify
+      - uuid
+      - "{{ aegis_network_connection_uuid }}"
+      - ipv4.ignore-auto-dns
+      - "yes"
+      - ipv4.dns
+      - "{{ aegis_host_dns_servers | join(',') }}"
+      - ipv4.dns-search
+      - "{{ aegis_host_dns_search_domains | join(',') }}"
+      - ipv6.ignore-auto-dns
+      - "yes"
+  register: aegis_host_dns_profile
+  when: >-
+    aegis_host_dns_current.stdout_lines !=
+    [
+      'yes',
+      aegis_host_dns_servers | join(','),
+      aegis_host_dns_search_domains | join(','),
+      'yes'
+    ]
+  changed_when: true
+
+- name: Report Aegis reboot required for host DNS changes
+  tags: [aegis, dns, network, services]
+  ansible.builtin.debug:
+    msg: Reboot Aegis to activate its independent upstream DNS before testing another OS update.
+  when: aegis_host_dns_profile.changed | default(false)
+
+- name: Set Aegis hostname
+  tags: [aegis, services]
+  ansible.builtin.hostname:
+    name: "{{ aegis_hostname }}"
+
+- name: Create Aegis persistent container directories
+  tags: [aegis, containers]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop:
+    - /var/lib/adguard/work
+    - /var/lib/adguard/conf
+    - /var/lib/icloudpd/data
+    - /var/lib/icloudpd/config
+
+- name: Create Quadlet configuration directory
+  tags: [aegis, containers]
+  ansible.builtin.file:
+    path: /etc/containers/systemd
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Render Aegis Quadlet units
+  tags: [aegis, containers]
+  ansible.builtin.template:
+    src: "{{ item.src }}"
+    dest: "/etc/containers/systemd/{{ item.dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - src: adguardhome.container.j2
+      dest: adguardhome.container
+    - src: icloudpd.container.j2
+      dest: icloudpd.container
+  loop_control:
+    label: "{{ item.dest }}"
+  no_log: "{{ item.dest == 'icloudpd.container' }}"
+  notify: Restart Aegis Quadlet services
+
+- name: Create Aegis systemd-resolved configuration directory
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    path: /etc/systemd/resolved.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Disable Aegis systemd-resolved DNS stub listener
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.template:
+    src: 10-adguard-dns.conf.j2
+    dest: /etc/systemd/resolved.conf.d/10-adguard-dns.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify:
+    - Restart Aegis systemd-resolved
+    - Restart Aegis Quadlet services
+
+- name: Point Aegis resolver at the full systemd-resolved configuration
+  tags: [aegis, adguard, dns, services]
+  ansible.builtin.file:
+    src: ../run/systemd/resolve/resolv.conf
+    dest: /etc/resolv.conf
+    state: link
+    force: true
+  notify: Restart Aegis systemd-resolved
+
+- name: Enable Aegis firewalld
+  tags: [aegis, firewall, services]
+  ansible.builtin.systemd:
+    name: firewalld.service
+    enabled: true
+    state: started
+
+- name: Render Aegis AdGuard web firewalld service
+  tags: [aegis, firewall]
+  ansible.builtin.template:
+    src: aegis-adguard-web.xml.j2
+    dest: /etc/firewalld/services/aegis-adguard-web.xml
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Reload firewalld custom services
+  tags: [aegis, firewall]
+  ansible.builtin.command:
+    argv:
+      - firewall-cmd
+      - --reload
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Remove unrestricted Aegis services from firewalld zone
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    service: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: disabled
+    zone: "{{ aegis_firewalld_zone }}"
+  loop:
+    - ssh
+    - dns
+    - http
+    - aegis-adguard-web
+  loop_control:
+    label: "{{ item }}"
+
+- name: Remove retired Aegis TLS access rule
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    rich_rule: 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" port port="853" protocol="tcp" accept'
+    permanent: true
+    immediate: true
+    state: disabled
+    zone: "{{ aegis_firewalld_zone }}"
+
+- name: Allow Aegis services from the LAN only
+  tags: [aegis, firewall]
+  ansible.posix.firewalld:
+    rich_rule: "{{ item }}"
+    permanent: true
+    immediate: true
+    state: enabled
+    zone: "{{ aegis_firewalld_zone }}"
+  loop:
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="ssh" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="dns" accept'
+    - 'rule family="ipv4" source address="{{ aegis_lan_subnet }}" service name="aegis-adguard-web" accept'
+  loop_control:
+    label: "{{ item }}"
+
+- name: Check the standard Aegis SSH authorized keys file
+  tags: [aegis, ssh, services]
+  ansible.builtin.stat:
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys"
+  register: aegis_authorized_keys
+
+- name: Ensure Aegis SSH authorized key fragments directory exists
+  tags: [aegis, ssh, services]
+  ansible.builtin.file:
+    path: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
+    state: directory
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0700"
+  when: aegis_ssh_authorized_keys | length > 0
+
+- name: Manage Aegis SSH authorized key fragments
+  tags: [aegis, ssh, services]
+  ansible.builtin.copy:
+    content: "{{ item.key }}\n"
+    dest: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d/{{ item.name }}"
+    owner: "{{ ansible_user }}"
+    group: "{{ ansible_user }}"
+    mode: "0600"
+  loop: "{{ aegis_ssh_authorized_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when: aegis_ssh_authorized_keys | length > 0
+
+- name: Find Aegis SSH authorized key fragments
+  tags: [aegis, ssh, services]
+  ansible.builtin.find:
+    paths: "{{ aegis_ssh_user_home }}/.ssh/authorized_keys.d"
+    file_type: file
+    recurse: false
+  register: aegis_authorized_key_fragments
+
+- name: Require an Aegis SSH authorized key before hardening
+  tags: [aegis, ssh, services]
+  ansible.builtin.assert:
+    that:
+      - >-
+        (aegis_ssh_authorized_keys | length > 0)
+        or (aegis_authorized_keys.stat.exists and aegis_authorized_keys.stat.size | int > 0)
+        or aegis_authorized_key_fragments.matched | int > 0
+    fail_msg: Add a public key for the Ansible SSH user before disabling password authentication.
+
+- name: Ensure Aegis SSH configuration drop-in directory exists
+  tags: [aegis, ssh, services]
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Ensure Aegis SSH drop-ins are loaded before other settings
+  tags: [aegis, ssh, services]
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^\s*Include\s+/etc/ssh/sshd_config\.d/\*\.conf\s*$'
+    line: Include /etc/ssh/sshd_config.d/*.conf
+    insertbefore: BOF
+    state: present
+    validate: "sshd -t -f %s"
+
+- name: Render Aegis SSH hardening drop-in
+  tags: [aegis, ssh, services]
+  ansible.builtin.template:
+    src: 00-aegis-hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/00-aegis-hardening.conf
+    owner: root
+    group: root
+    mode: "0600"
+  notify: Reload Aegis SSH
+
+- name: Validate Aegis SSH configuration
+  tags: [aegis, ssh, services]
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -t
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Read effective Aegis SSH daemon configuration
+  tags: [aegis, ssh, services]
+  ansible.builtin.command:
+    argv:
+      - sshd
+      - -T
+      - -C
+      - "user={{ ansible_user }},host={{ aegis_hostname }},addr=127.0.0.1"
+  register: aegis_sshd_effective_configuration
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Verify effective Aegis SSH hardening
+  tags: [aegis, ssh, services]
+  ansible.builtin.assert:
+    that:
+      - "'permitrootlogin no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'pubkeyauthentication yes' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'passwordauthentication no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'kbdinteractiveauthentication no' in aegis_sshd_effective_configuration.stdout_lines"
+      - "'allowusers ' + (aegis_ssh_allowed_users | join(' ')) in aegis_sshd_effective_configuration.stdout_lines"
+  when: not ansible_check_mode
+
+- name: Install Wake-on-LAN helper for Ikaros
+  tags: [aegis, wol]
+  ansible.builtin.template:
+    src: wake-ikaros.j2
+    dest: /usr/local/bin/wake-ikaros
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Enable Aegis Quadlet services and automatic updates
+  tags: [aegis, containers, services]
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+    daemon_reload: true
+  loop:
+    - adguardhome.service
+    - icloudpd.service
+    - podman-auto-update.timer
+  loop_control:
+    label: "{{ item }}"

ansible/roles/profile_aegis/templates/00-aegis-hardening.conf.j2

@@ -0,0 +1,6 @@
+# Managed by Ansible. Do not edit manually.
+PermitRootLogin no
+PubkeyAuthentication yes
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+AllowUsers {{ aegis_ssh_allowed_users | join(' ') }}

ansible/roles/profile_aegis/templates/10-adguard-dns.conf.j2

@@ -0,0 +1,3 @@
+# Managed by Ansible. Do not edit manually.
+[Resolve]
+DNSStubListener=no

ansible/roles/profile_aegis/templates/adguardhome.container.j2

@@ -0,0 +1,18 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=AdGuard Home DNS sinkhole
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image={{ aegis_adguard_image }}
+Network=host
+Volume=/var/lib/adguard/work:/opt/adguardhome/work:Z
+Volume=/var/lib/adguard/conf:/opt/adguardhome/conf:Z
+AutoUpdate=registry
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_aegis/templates/aegis-adguard-web.xml.j2

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<service>
+  <short>Aegis AdGuard Home web interface</short>
+  <description>AdGuard Home administrative web interface on Aegis.</description>
+  <port protocol="tcp" port="{{ aegis_adguard_web_port }}"/>
+</service>

ansible/roles/profile_aegis/templates/icloudpd.container.j2

@@ -0,0 +1,20 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=iCloud Photos Downloader
+Wants=network-online.target
+After=network-online.target
+
+[Container]
+Image={{ aegis_icloudpd_image }}
+Environment=apple_id={{ aegis_icloudpd_apple_id }}
+Environment=folder_structure={{ aegis_icloudpd_folder_structure }}
+Environment=synchronisation_interval={{ aegis_icloudpd_synchronisation_interval }}
+Volume=/var/lib/icloudpd/data:/home/root/iCloud:Z
+Volume=/var/lib/icloudpd/config:/config:Z
+AutoUpdate=registry
+
+[Service]
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_aegis/templates/wake-ikaros.j2

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Managed by Ansible. Do not edit manually.
+set -euo pipefail
+
+mac='{{ aegis_ikaros_mac_address }}'
+port='{{ aegis_wol_port }}'
+mac_hex="${mac//:/}"
+
+if [[ ! $mac_hex =~ ^[[:xdigit:]]{12}$ ]]; then
+  printf 'Indirizzo MAC non valido: %s\n' "$mac" >&2
+  exit 1
+fi
+
+packet='\xFF\xFF\xFF\xFF\xFF\xFF'
+for _ in {1..16}; do
+  packet+="$(printf '\\x%s\\x%s\\x%s\\x%s\\x%s\\x%s' \
+    "${mac_hex:0:2}" "${mac_hex:2:2}" "${mac_hex:4:2}" \
+    "${mac_hex:6:2}" "${mac_hex:8:2}" "${mac_hex:10:2}")"
+done
+
+printf '%b' "$packet" > "/dev/udp/255.255.255.255/${port}"

ansible/roles/profile_atlas/defaults/main.yml

@@ -1,29 +1,147 @@
 ---
 atlas_manage_storage: false
+atlas_manage_sharing: false
+# Destructive first-boot action; normally false once the pool exists.
+atlas_create_pool: false
+atlas_zpool_disks: []
 atlas_admin_username: CHANGEME_ATLAS_ADMIN
 atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
 atlas_admin_uid: 1000
 atlas_admin_gid: 1000
 atlas_admin_ssh_keys: []
+atlas_admin_ssh_key_directory: "{{ atlas_admin_home }}/.ssh/authorized_keys.d"
 atlas_admin_password_hash: "!"
+# Local forwarding permits an administrator to tunnel a private service without allowing remote forwards.
+atlas_ssh_allow_tcp_forwarding: local
+
+atlas_immich_username: immich
+atlas_immich_group: immich
+atlas_immich_uid: 1100
+atlas_immich_gid: 1100
+atlas_immich_supplementary_groups:
+  - video
+  - render
 
 atlas_lan_subnet: CHANGEME_LAN_SUBNET
+atlas_aegis_ip: CHANGEME_AEGIS_IP
 atlas_manage_firewall: false
 atlas_firewalld_zone: public
+atlas_hardening_sysctls:
+  net.ipv4.conf.all.accept_redirects: "0"
+  net.ipv4.conf.default.accept_redirects: "0"
+  net.ipv4.conf.all.send_redirects: "0"
+  net.ipv4.conf.default.send_redirects: "0"
+  net.ipv4.conf.all.accept_source_route: "0"
+  net.ipv4.conf.default.accept_source_route: "0"
+  net.ipv4.conf.all.log_martians: "1"
+  net.ipv4.conf.default.log_martians: "1"
+  net.ipv4.conf.all.rp_filter: "2"
+  net.ipv4.conf.default.rp_filter: "2"
+  net.ipv4.tcp_syncookies: "1"
+  net.ipv4.icmp_echo_ignore_broadcasts: "1"
+  net.ipv4.icmp_ignore_bogus_error_responses: "1"
+  net.ipv4.ip_forward: "0"
+  net.ipv6.conf.all.accept_redirects: "0"
+  net.ipv6.conf.default.accept_redirects: "0"
+  net.ipv6.conf.all.accept_source_route: "0"
+  net.ipv6.conf.default.accept_source_route: "0"
 atlas_zfs_pool: CHANGEME_ZFS_POOL
-atlas_zfs_dataset_work: work
+atlas_zfs_dataset_archive: archive
-atlas_zfs_dataset_syncthing: syncthing
+atlas_zfs_dataset_services: services
-atlas_zfs_dataset_backup_prometheus: backup_prometheus
+atlas_zfs_dataset_app_data: services/data
-atlas_zfs_dataset_icloud_photos: icloud_photos
+atlas_zfs_dataset_navidrome: services/data/navidrome
+atlas_zfs_dataset_syncthing: services/data/syncthing
+atlas_zfs_dataset_media: media
+atlas_zfs_dataset_music: media/music
+atlas_zfs_dataset_backup: backup
+atlas_zfs_dataset_host_backups: backup/hosts
+atlas_zfs_dataset_backup_prometheus: backup/hosts/prometheus
+atlas_zfs_backup_reservation: 500G
+atlas_zfs_dataset_photobook: media/photobook
 atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT
 
-atlas_work_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_work }}"
+atlas_manage_zfs_snapshots: false
+atlas_zfs_snapshot_prefix: atlas-auto
+atlas_zfs_snapshot_policies: []
+atlas_manage_zfs_scrub: false
+atlas_zfs_scrub_calendar: ""
+
+atlas_manage_borg_backup: false
+atlas_borg_username: borg
+atlas_borg_group: borg
+atlas_borg_home: /var/lib/atlas-borg
+atlas_borg_repository_host: CHANGEME_BORG_HOST
+atlas_borg_repository_user: CHANGEME_BORG_USER
+atlas_borg_repository_port: 23
+atlas_borg_repository_path: ./borg-data
+atlas_borg_remote_path: borg-1.4
+atlas_borg_host_key: ""
+atlas_borg_ssh_private_key_path: /etc/atlas-borg/id_ed25519
+atlas_borg_known_hosts_path: /etc/atlas-borg/known_hosts
+atlas_borg_passphrase_path: /etc/atlas-borg/passphrase
+atlas_borg_ssh_wrapper_path: /usr/local/libexec/atlas-borg-ssh
+atlas_borg_passphrase: "{{ vault_atlas_borg_passphrase | default('') }}"
+atlas_borg_encryption_mode: repokey
+atlas_borg_archive_prefix: atlas
+atlas_borg_snapshot_prefix: atlas-borg
+atlas_borg_compression: auto,zstd,3
+atlas_borg_backup_calendar: ""
+atlas_borg_check_calendar: ""
+atlas_borg_randomized_delay: 30m
+atlas_borg_keep_daily: 30
+atlas_borg_keep_weekly: 8
+atlas_borg_keep_monthly: 12
+atlas_borg_config_dir: /var/lib/atlas-borg
+atlas_borg_cache_dir: /var/cache/atlas-borg
+atlas_borg_lock_path: /var/lib/atlas-borg/backup.lock
+atlas_borg_recovery_export_path: "{{ playbook_dir }}/../secrets/recovery/atlas-borg-repokey.export"
+
+# Manual-only offline backup. No USB device is formatted or mounted by Ansible.
+atlas_manage_usb_backup: false
+atlas_usb_backup_luks_uuid: ""
+atlas_usb_backup_fs_uuid: ""
+atlas_usb_backup_mapper_name: atlas-usb-backup
+atlas_usb_backup_min_free_bytes: 10737418240
+atlas_usb_backup_snapshot_prefix: atlas-usb
+atlas_manage_usb_reminder: false
+atlas_usb_reminder_calendar: ""
+atlas_usb_reminder_notifier: /opt/45drives/houston/houston-notify
+
+# Read-only health probes and 45Drives Alerts; disabled outside Atlas host vars.
+atlas_manage_monitoring: false
+atlas_monitor_calendar: "*:0/30"
+atlas_monitor_notifier: "{{ atlas_usb_reminder_notifier }}"
+atlas_monitor_smart_devices: []
+atlas_monitor_timers: []
+atlas_monitor_failure_units: []
+atlas_monitor_remote_capacity: {}
+atlas_monitor_pool_warning_percent: 80
+atlas_monitor_pool_critical_percent: 90
+atlas_monitor_root_warning_percent: 80
+atlas_monitor_root_critical_percent: 90
+atlas_monitor_snapshot_warning_percent: 10
+atlas_monitor_snapshot_critical_percent: 20
+atlas_monitor_snapshot_growth_warning_gib_day: 100
+atlas_monitor_backup_growth_warning_gib_day: 100
+atlas_monitor_cpu_warning_c: 85
+atlas_monitor_cpu_critical_c: 95
+atlas_monitor_borg_max_runtime_days: 14
+
+# Explicit post-restore relabeling only; never relabel datasets during ordinary runs.
+atlas_restorecon_paths: []
+
+atlas_archive_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_archive }}"
+atlas_services_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_services }}"
+atlas_app_data_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
+atlas_navidrome_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
 atlas_syncthing_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
+atlas_media_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_media }}"
+atlas_music_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
+atlas_backup_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_backup }}"
+atlas_host_backups_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_host_backups }}"
 atlas_backup_prometheus_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_backup_prometheus }}"
-atlas_icloud_photos_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_icloud_photos }}"
+atlas_photobook_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_photobook }}"
-atlas_syncthing_config_dir: "{{ atlas_admin_home }}/.local/state/syncthing"
-atlas_syncthing_default_dir: "{{ atlas_syncthing_mountpoint }}/Sync"
 
 atlas_45drives_repo_url: https://repo.45drives.com/repofiles/rocky/45drives-enterprise.repo
 atlas_45drives_repo_file: /etc/yum.repos.d/45drives-enterprise.repo
@@ -34,18 +152,61 @@ atlas_45drives_packages:
   - cockpit-zfs
   - cockpit-scheduler
 
-atlas_nfs_exports: []
+atlas_nfs_exports:
-atlas_samba_share_name: work
+  - path: "{{ atlas_photobook_mountpoint }}"
+    client: "{{ atlas_aegis_ip }}"
+    options:
+      - rw
+      - sync
+      - no_subtree_check
+      - all_squash
+      - "anonuid={{ atlas_immich_uid }}"
+      - "anongid={{ atlas_immich_gid }}"
+atlas_samba_share_name: Archive
 atlas_samba_workgroup: WORKGROUP
+# Keep encryption mandatory unless a verified client-compatibility exception is explicitly required.
+atlas_samba_encryption: required
 atlas_samba_valid_users: []
-atlas_samba_password: ""
+atlas_samba_accounts: []
-atlas_samba_password_marker: /var/lib/samba/private/.atlas-password.sha256
+atlas_samba_password_marker_dir: /var/lib/samba/private/ansible-passwords
 atlas_firewalld_rich_rules: []
 atlas_firewalld_restricted_services:
   - ssh
   - cockpit
   - nfs
   - samba
+  - http
+  - https
 atlas_selinux_booleans:
   - samba_export_all_rw
   - nfs_export_all_rw
+
+atlas_manage_media_stack: false
+atlas_container_quadlet_dir: /etc/containers/systemd
+atlas_container_data_root: /var/lib/atlas-containers
+atlas_npm_data_dir: "{{ atlas_container_data_root }}/npm/data"
+atlas_npm_letsencrypt_dir: "{{ atlas_container_data_root }}/npm/letsencrypt"
+atlas_npm_admin_bind_address: 127.0.0.1
+atlas_timezone: Europe/Rome
+atlas_immich_upload_dir: "{{ atlas_container_data_root }}/immich/upload"
+atlas_immich_model_cache_dir: "{{ atlas_container_data_root }}/immich/model-cache"
+atlas_immich_machine_learning_config_dir: "{{ atlas_container_data_root }}/immich/machine-learning-config"
+atlas_immich_machine_learning_cache_dir: "{{ atlas_container_data_root }}/immich/machine-learning-cache"
+atlas_immich_redis_data_dir: "{{ atlas_container_data_root }}/immich/redis"
+atlas_immich_postgres_data_dir: "{{ atlas_container_data_root }}/immich/postgres"
+
+atlas_npm_image: docker.io/jc21/nginx-proxy-manager:latest
+atlas_immich_version: release
+atlas_immich_server_image: "ghcr.io/immich-app/immich-server:{{ atlas_immich_version }}"
+atlas_immich_machine_learning_image: "ghcr.io/immich-app/immich-machine-learning:{{ atlas_immich_version }}-openvino"
+atlas_immich_redis_image: docker.io/valkey/valkey:9
+atlas_immich_postgres_image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
+atlas_immich_db_username: postgres
+atlas_immich_db_name: immich
+atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"
+atlas_media_quadlet_services:
+  - atlas-immich-redis.service
+  - atlas-immich-postgres.service
+  - atlas-immich-machine-learning.service
+  - atlas-immich-server.service
+  - atlas-npm.service

ansible/roles/profile_atlas/files/atlas-borg-progress.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Turn Borg's JSON progress stream into bounded, readable journal entries."""
+
+import argparse
+import json
+import sys
+import time
+
+
+def size(value):
+    if not isinstance(value, (int, float)):
+        return "unknown"
+    return f"{value / (1024 ** 3):.2f} GiB"
+
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--estimated-total-bytes", type=int, required=True)
+args = parser.parse_args()
+if args.estimated_total_bytes <= 0:
+    parser.error("estimated total must be positive")
+
+last_progress = 0.0
+for line in sys.stdin:
+    try:
+        event = json.loads(line)
+    except json.JSONDecodeError:
+        print(line.rstrip(), flush=True)
+        continue
+
+    kind = event.get("type")
+    if kind == "archive_progress":
+        now = time.monotonic()
+        if now - last_progress < 60 and not event.get("finished"):
+            continue
+        path = event.get("path") or ""
+        parts = path.split("/")
+        dataset = parts[1] if len(parts) > 1 and parts[0] == "source" else "unknown"
+        original_size = event.get("original_size")
+        if isinstance(original_size, (int, float)) and original_size >= 0:
+            percent = original_size / args.estimated_total_bytes * 100
+            estimated_progress = (
+                f"{percent:.1f}%" if percent < 100 else ">=100% (ZFS estimate exceeded)"
+            )
+        else:
+            estimated_progress = "unknown"
+        print(
+            "Borg create progress: "
+            f"estimated={estimated_progress} dataset={dataset} "
+            f"files={event.get('nfiles', 'unknown')} "
+            f"original={size(original_size)} "
+            f"compressed={size(event.get('compressed_size'))} "
+            f"deduplicated={size(event.get('deduplicated_size'))}",
+            flush=True,
+        )
+        last_progress = now
+    elif kind == "log_message":
+        print(f"Borg {event.get('levelname', 'INFO')}: {event.get('message', '')}", flush=True)
+    elif kind == "progress_message" and event.get("message"):
+        print(f"Borg: {event['message']}", flush=True)

ansible/roles/profile_atlas/files/atlas-health-monitor.py

@@ -0,0 +1,396 @@
+#!/usr/bin/python3
+"""Read-only Atlas health probes with deduplicated 45Drives Alerts."""
+
+import argparse
+import fcntl
+import json
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import time
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+CONFIG_PATH = Path("/etc/atlas-health-monitor.json")
+STATE_DIR = Path("/var/lib/atlas-health-monitor")
+STATE_PATH = STATE_DIR / "state.json"
+GIB = 1024**3
+
+
+def run(*argv, timeout=40):
+    return subprocess.run(argv, capture_output=True, text=True, timeout=timeout, check=False)
+
+
+def issue(issues, key, severity, message):
+    issues[key] = {"severity": severity, "message": message}
+
+
+def notify(config, event, severity, subject, message):
+    now = datetime.now(timezone.utc)
+    payload = {
+        "timestamp": now.isoformat(timespec="seconds"),
+        "unixtime": int(now.timestamp()),
+        "event": event,
+        "severity": severity,
+        "subject": subject,
+        "email_message": message,
+    }
+    result = run(config["notifier"], json.dumps(payload, ensure_ascii=False), timeout=30)
+    if result.returncode:
+        raise RuntimeError(f"45Drives notifier exited {result.returncode}: {result.stderr.strip()}")
+
+
+def parse_fields(text):
+    return dict(line.split("=", 1) for line in text.splitlines() if "=" in line)
+
+
+def systemd_fields(unit, *properties):
+    result = run("systemctl", "show", unit, *(f"-p{item}" for item in properties))
+    if result.returncode:
+        raise RuntimeError(f"systemctl show {unit} exited {result.returncode}")
+    return parse_fields(result.stdout)
+
+
+def unix_time(text):
+    if not text or text == "n/a":
+        return None
+    result = run("date", "-d", text, "+%s")
+    if result.returncode:
+        raise ValueError(f"Cannot parse systemd timestamp: {text}")
+    return int(result.stdout.strip())
+
+
+def check_pool(config, issues, measurements):
+    pool = config["pool"]
+    listing = run("zpool", "list", "-H", "-p", "-o", "size,alloc,capacity,health", pool)
+    if listing.returncode:
+        issue(issues, "pool.probe", "critical", f"Cannot query ZFS pool {pool}")
+        return
+    try:
+        size, alloc, capacity, health = listing.stdout.strip().split("\t")
+        size, alloc, capacity = int(size), int(alloc), int(capacity)
+    except (ValueError, TypeError):
+        issue(issues, "pool.probe", "critical", "Invalid ZFS pool capacity response")
+        return
+    measurements.update(pool_size_bytes=size, pool_alloc_bytes=alloc, pool_capacity_percent=capacity)
+    if health != "ONLINE":
+        issue(issues, "pool.health", "critical", f"ZFS pool {pool} state is {health}")
+    if capacity >= config["pool_critical_percent"]:
+        issue(issues, "pool.capacity", "critical", f"ZFS pool {pool} is {capacity}% full")
+    elif capacity >= config["pool_warning_percent"]:
+        issue(issues, "pool.capacity", "warning", f"ZFS pool {pool} is {capacity}% full")
+
+    status = run("zpool", "status", "-P", pool)
+    if status.returncode:
+        issue(issues, "pool.status", "critical", f"Cannot query detailed ZFS status for {pool}")
+        return
+    bad_vdevs = []
+    for line in status.stdout.splitlines():
+        match = re.match(r"^\s*(\S+)\s+(ONLINE|DEGRADED|FAULTED|OFFLINE|UNAVAIL|REMOVED)\s+(\d+)\s+(\d+)\s+(\d+)", line)
+        if match:
+            name, state, reads, writes, checksums = match.groups()
+            if state != "ONLINE" or any(int(value) for value in (reads, writes, checksums)):
+                bad_vdevs.append(f"{name}: {state}, READ={reads}, WRITE={writes}, CKSUM={checksums}")
+    if bad_vdevs:
+        issue(issues, "pool.vdevs", "critical", "ZFS vdev errors: " + "; ".join(bad_vdevs))
+    errors = re.search(r"^errors:\s*(.*)$", status.stdout, re.MULTILINE)
+    if not errors or errors.group(1).strip() != "No known data errors":
+        issue(issues, "pool.data_errors", "critical", "ZFS status reports data errors; inspect zpool status -v")
+    if re.search(r"^\s*scan:\s*resilver in progress", status.stdout, re.MULTILINE | re.IGNORECASE):
+        issue(issues, "pool.resilver", "warning", "ZFS resilver is in progress; inspect zpool status")
+    scan = re.search(r"^\s*scan:\s*(.*)$", status.stdout, re.MULTILINE)
+    if scan and re.search(r"\bwith [1-9][0-9]* errors\b", scan.group(1)):
+        issue(issues, "pool.scan_errors", "critical", f"ZFS scan reported errors: {scan.group(1)}")
+
+
+def check_capacity(config, issues, measurements):
+    pool = config["pool"]
+    listing = run("zfs", "list", "-H", "-p", "-o", "name,usedbysnapshots", "-r", pool)
+    if listing.returncode:
+        issue(issues, "snapshot.probe", "warning", "Cannot query ZFS snapshot space")
+    else:
+        try:
+            snapshots = sum(int(line.split("\t")[1]) for line in listing.stdout.splitlines())
+            measurements["snapshots_bytes"] = snapshots
+            size = measurements.get("pool_size_bytes")
+            if size:
+                percent = snapshots * 100 // size
+                measurements["snapshots_percent"] = percent
+                if percent >= config["snapshot_critical_percent"]:
+                    issue(issues, "snapshot.capacity", "critical", f"Snapshots use {percent}% of pool size")
+                elif percent >= config["snapshot_warning_percent"]:
+                    issue(issues, "snapshot.capacity", "warning", f"Snapshots use {percent}% of pool size")
+        except (ValueError, IndexError):
+            issue(issues, "snapshot.probe", "warning", "Invalid ZFS snapshot-space response")
+    backup = run("zfs", "list", "-H", "-p", "-o", "used", config["backup_dataset"])
+    if backup.returncode:
+        issue(issues, "backup.capacity_probe", "warning", "Cannot query local backup dataset space")
+    else:
+        try:
+            measurements["backup_bytes"] = int(backup.stdout.strip())
+        except ValueError:
+            issue(issues, "backup.capacity_probe", "warning", "Invalid local backup space response")
+
+    try:
+        filesystem = os.statvfs("/")
+        total = filesystem.f_blocks * filesystem.f_frsize
+        available = filesystem.f_bavail * filesystem.f_frsize
+        used_percent = (total - available) * 100 // total
+        measurements["root_capacity_percent"] = used_percent
+        if used_percent >= config["root_critical_percent"]:
+            issue(issues, "root.capacity", "critical", f"Atlas system filesystem is {used_percent}% full")
+        elif used_percent >= config["root_warning_percent"]:
+            issue(issues, "root.capacity", "warning", f"Atlas system filesystem is {used_percent}% full")
+    except (OSError, ZeroDivisionError):
+        issue(issues, "root.capacity_probe", "warning", "Cannot query Atlas system filesystem space")
+
+
+def check_remote_capacity(config, issues, measurements):
+    """Query only the Storage Box quota; do not open or inspect the Borg repository."""
+    remote = config["remote_capacity"]
+    try:
+        result = run("runuser", "-u", remote["run_as"], "--", remote["ssh_wrapper"],
+                     f"{remote['user']}@{remote['host']}", "df", "-m", timeout=65)
+        if result.returncode:
+            raise ValueError(f"SSH df exited {result.returncode}")
+        lines = result.stdout.strip().splitlines()
+        if len(lines) != 2:
+            raise ValueError("Unexpected Storage Box df output")
+        fields = lines[1].split()
+        if len(fields) < 5:
+            raise ValueError("Incomplete Storage Box df output")
+        total_mib, used_mib, available_mib = (int(value) for value in fields[1:4])
+        percent = int(fields[4].rstrip("%"))
+        if total_mib <= 0 or not 0 <= percent <= 100 or available_mib < 0:
+            raise ValueError("Invalid Storage Box quota values")
+    except (OSError, ValueError, subprocess.TimeoutExpired):
+        issue(issues, "remote.capacity_probe", "warning", "Cannot query Hetzner Storage Box quota via pinned-key SSH")
+        return
+    measurements.update(remote_capacity_percent=percent, remote_bytes=used_mib * 1024**2,
+                        remote_available_bytes=available_mib * 1024**2)
+    if percent >= remote["critical_percent"]:
+        issue(issues, "remote.capacity", "critical", f"Hetzner Storage Box quota is {percent}% full")
+    elif percent >= remote["warning_percent"]:
+        issue(issues, "remote.capacity", "warning", f"Hetzner Storage Box quota is {percent}% full")
+
+
+def check_smart(config, issues, measurements):
+    for device in config["smart_devices"]:
+        name, path = device["name"], device["path"]
+        try:
+            result = run("smartctl", "-j", "-a", path, timeout=60)
+            data = json.loads(result.stdout)
+            status = int(data.get("smartctl", {}).get("exit_status", result.returncode))
+        except (subprocess.TimeoutExpired, json.JSONDecodeError, ValueError) as exc:
+            issue(issues, f"smart.{name}.probe", "critical", f"SMART probe failed for {name}: {type(exc).__name__}")
+            continue
+        if status:
+            severity = "critical" if status & 0b00001111 else "warning"
+            issue(issues, f"smart.{name}.status", severity, f"SMART reported exit status {status} for {name}")
+        passed = data.get("smart_status", {}).get("passed")
+        if passed is False:
+            issue(issues, f"smart.{name}.health", "critical", f"SMART self-assessment failed for {name}")
+        elif passed is None:
+            issue(issues, f"smart.{name}.health", "warning", f"SMART self-assessment unavailable for {name}")
+        temperature = data.get("temperature", {}).get("current")
+        if isinstance(temperature, (int, float)):
+            measurements[f"smart_{name}_c"] = temperature
+            if temperature >= device["critical_c"]:
+                issue(issues, f"smart.{name}.temperature", "critical", f"{name} temperature is {temperature} C")
+            elif temperature >= device["warning_c"]:
+                issue(issues, f"smart.{name}.temperature", "warning", f"{name} temperature is {temperature} C")
+        else:
+            issue(issues, f"smart.{name}.temperature", "warning", f"Temperature unavailable for {name}")
+        for attribute in data.get("ata_smart_attributes", {}).get("table", []):
+            attribute_id = attribute.get("id")
+            if attribute_id in (5, 187, 197, 198):
+                raw = attribute.get("raw", {}).get("value", 0)
+                if isinstance(raw, int) and raw > 0:
+                    severity = "critical" if attribute_id in (197, 198) else "warning"
+                    issue(issues, f"smart.{name}.ata_{attribute_id}", severity,
+                          f"{name} SMART attribute {attribute_id} raw count is {raw}")
+        nvme = data.get("nvme_smart_health_information_log", {})
+        if isinstance(nvme, dict):
+            if int(nvme.get("critical_warning", 0)):
+                issue(issues, f"smart.{name}.nvme_warning", "critical", f"{name} NVMe critical warning is nonzero")
+            if int(nvme.get("media_errors", 0)):
+                issue(issues, f"smart.{name}.nvme_media", "critical", f"{name} NVMe media errors are nonzero")
+
+
+def check_cpu(config, issues, measurements):
+    sensors = []
+    for hwmon in Path("/sys/class/hwmon").glob("hwmon*"):
+        try:
+            if (hwmon / "name").read_text().strip() != "coretemp":
+                continue
+            sensors.extend(int(path.read_text().strip()) / 1000 for path in hwmon.glob("temp*_input"))
+        except (OSError, ValueError):
+            continue
+    if not sensors:
+        issue(issues, "cpu.temperature_probe", "warning", "CPU temperature sensors are unavailable")
+        return
+    hottest = max(sensors)
+    measurements["cpu_max_c"] = hottest
+    if hottest >= config["cpu_critical_c"]:
+        issue(issues, "cpu.temperature", "critical", f"CPU temperature is {hottest:g} C")
+    elif hottest >= config["cpu_warning_c"]:
+        issue(issues, "cpu.temperature", "warning", f"CPU temperature is {hottest:g} C")
+
+
+def check_jobs(config, issues, measurements, now):
+    for timer in config["timers"]:
+        name = timer["name"]
+        try:
+            fields = systemd_fields(name, "ActiveState", "UnitFileState", "LastTriggerUSec", "ActiveEnterTimestamp")
+            if fields.get("ActiveState") != "active" or fields.get("UnitFileState") != "enabled":
+                issue(issues, f"timer.{name}", "critical", f"Timer {name} is not active and enabled")
+            max_age = int(timer["max_age_hours"]) * 3600
+            if max_age:
+                last = unix_time(fields.get("LastTriggerUSec"))
+                if last is None:
+                    last = unix_time(fields.get("ActiveEnterTimestamp"))
+                if last is not None and now - last > max_age:
+                    issue(issues, f"timer.{name}.stale", "warning",
+                          f"Timer {name} has not fired in {int((now-last)/3600)} hours")
+        except (RuntimeError, ValueError, subprocess.TimeoutExpired):
+            issue(issues, f"timer.{name}.probe", "warning", f"Cannot query timer {name}")
+    for unit in config["failure_units"]:
+        if unit.endswith("@.service"):
+            continue
+        try:
+            fields = systemd_fields(unit, "ActiveState", "Result", "ExecMainStartTimestamp")
+            state = fields.get("ActiveState")
+            if state == "failed" or (state == "inactive" and fields.get("Result") not in (None, "", "success")):
+                issue(issues, f"service.{unit}", "critical", f"Service {unit} failed: {fields.get('Result')}")
+            if unit == "atlas-borg-backup.service" and fields.get("ActiveState") == "activating":
+                started = unix_time(fields.get("ExecMainStartTimestamp"))
+                if started is not None and now - started > config["borg_max_runtime_days"] * 86400:
+                    issue(issues, "backup.borg_long_running", "warning",
+                          "Borg has run longer than its configured limit")
+        except (RuntimeError, ValueError, subprocess.TimeoutExpired):
+            issue(issues, f"service.{unit}.probe", "warning", f"Cannot query service {unit}")
+
+
+def check_growth(config, issues, measurements, samples, now):
+    previous = [sample for sample in samples if 20 * 3600 <= now - sample.get("time", now) <= 48 * 3600]
+    if previous:
+        baseline = min(previous, key=lambda sample: abs(now - sample["time"] - 86400))
+        days = (now - baseline["time"]) / 86400
+        for name, threshold in (("snapshots", config["snapshot_growth_warning_gib_day"]),
+                                ("backup", config["backup_growth_warning_gib_day"]),
+                                ("remote", config["remote_capacity"]["growth_warning_gib_day"])):
+            current, old = measurements.get(f"{name}_bytes"), baseline.get(f"{name}_bytes")
+            if isinstance(current, int) and isinstance(old, int) and days > 0:
+                growth_gib_day = (current - old) / GIB / days
+                measurements[f"{name}_growth_gib_day"] = round(growth_gib_day, 1)
+                if growth_gib_day >= threshold:
+                    issue(issues, f"{name}.growth", "warning",
+                          f"Local {name} usage grew {growth_gib_day:.1f} GiB/day over {days:.1f} days")
+
+
+def allowed_failure_unit(config, unit):
+    for allowed in config["failure_units"]:
+        if allowed == unit:
+            return True
+        if allowed.endswith("@.service") and unit.startswith(allowed[:-9] + "@") and unit.endswith(".service"):
+            return True
+    return False
+
+
+def load_state():
+    if not STATE_PATH.exists():
+        return {"active": {}, "samples": []}
+    with STATE_PATH.open(encoding="utf-8") as stream:
+        state = json.load(stream)
+    if not isinstance(state.get("active"), dict) or not isinstance(state.get("samples"), list):
+        raise ValueError("Invalid Atlas monitor state; refusing to overwrite it")
+    return state
+
+
+def save_state(state):
+    with tempfile.NamedTemporaryFile("w", dir=STATE_DIR, prefix=".state-", delete=False,
+                                     encoding="utf-8") as stream:
+        path = Path(stream.name)
+        os.chmod(path, 0o600)
+        json.dump(state, stream, sort_keys=True)
+        stream.write("\n")
+        stream.flush()
+        os.fsync(stream.fileno())
+    os.replace(path, STATE_PATH)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--dry-run", action="store_true", help="probe without notifications or state changes")
+    parser.add_argument("--test-notification", action="store_true", help="submit a labelled test alert")
+    parser.add_argument("--job-failed", metavar="UNIT", help="notify about a failed configured service")
+    args = parser.parse_args()
+    with CONFIG_PATH.open(encoding="utf-8") as stream:
+        config = json.load(stream)
+    if args.test_notification:
+        notify(config, "atlas_monitor_test", "warning", "Test monitoraggio Atlas",
+               "Notifica di prova: il monitoraggio Atlas raggiunge 45Drives Alerts. Non conferma l'invio email.")
+        print("Atlas monitor test submitted to 45Drives Alerts; email delivery is not verified.")
+        return 0
+    if args.job_failed:
+        if not allowed_failure_unit(config, args.job_failed):
+            raise ValueError("Unconfigured Atlas failure unit")
+        notify(config, "atlas_job_failed", "critical", f"Job Atlas fallito: {args.job_failed}",
+               f"Il servizio {args.job_failed} e' fallito. Controlla: "
+               f"sudo journalctl -u {args.job_failed} -n 100 --no-pager")
+        print(f"Atlas job failure submitted to 45Drives Alerts: {args.job_failed}")
+        return 0
+
+    now = int(time.time())
+    issues, measurements = {}, {}
+    check_pool(config, issues, measurements)
+    check_capacity(config, issues, measurements)
+    check_remote_capacity(config, issues, measurements)
+    check_smart(config, issues, measurements)
+    check_cpu(config, issues, measurements)
+    check_jobs(config, issues, measurements, now)
+    if args.dry_run:
+        print(json.dumps({"issues": issues, "measurements": measurements}, sort_keys=True))
+        return 0
+
+    STATE_DIR.mkdir(mode=0o700, exist_ok=True)
+    with (STATE_DIR / "monitor.lock").open("w") as lock:
+        fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        state = load_state()
+        check_growth(config, issues, measurements, state["samples"], now)
+        active, failed_notifications = state["active"], []
+        for key, details in issues.items():
+            old = active.get(key)
+            if old is None or old.get("severity") != details["severity"]:
+                try:
+                    notify(config, "atlas_health_issue", details["severity"],
+                           f"Atlas: {key}", details["message"])
+                    active[key] = details
+                    print(f"ALERT {details['severity']} {key}: {details['message']}", flush=True)
+                except (RuntimeError, subprocess.TimeoutExpired) as exc:
+                    failed_notifications.append(key)
+                    print(f"NOTIFICATION FAILED {key}: {exc}", file=sys.stderr, flush=True)
+        for key in set(active) - set(issues):
+            print(f"RECOVERED {key}", flush=True)
+            del active[key]
+        state["samples"] = [sample for sample in state["samples"] if now - sample.get("time", 0) < 48 * 3600]
+        state["samples"].append({"time": now, **{key: value for key, value in measurements.items()
+                                                 if key in ("snapshots_bytes", "backup_bytes", "remote_bytes")}})
+        save_state(state)
+        print(f"Atlas health: issues={len(issues)} notifications_failed={len(failed_notifications)} "
+              f"pool={measurements.get('pool_capacity_percent', 'unknown')}% "
+              f"remote={measurements.get('remote_capacity_percent', 'unknown')}% "
+              f"snapshots={measurements.get('snapshots_bytes', 'unknown')} bytes "
+              f"backup={measurements.get('backup_bytes', 'unknown')} bytes", flush=True)
+        return 1 if failed_notifications else 0
+
+
+if __name__ == "__main__":
+    try:
+        sys.exit(main())
+    except (OSError, RuntimeError, ValueError, subprocess.TimeoutExpired) as error:
+        print(f"Atlas health monitor failed: {error}", file=sys.stderr)
+        sys.exit(1)

ansible/roles/profile_atlas/handlers/main.yml

@@ -28,7 +28,26 @@
     name: smb
     state: restarted
 
-- name: Restart Atlas Syncthing service
+- name: Restart Atlas Borg timers
   ansible.builtin.systemd:
-    name: atlas-syncthing
+    name: "{{ item }}"
     state: restarted
+    daemon_reload: true
+  loop:
+    - atlas-borg-backup.timer
+    - atlas-borg-check.timer
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Restart Atlas media Quadlets
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    state: restarted
+    daemon_reload: true
+  loop: "{{ atlas_media_quadlet_services }}"
+  loop_control:
+    label: "{{ item }}"
+  when:
+    - atlas_manage_media_stack | bool
+    - not ansible_check_mode

ansible/roles/profile_atlas/tasks/account.yml

@@ -6,9 +6,11 @@
       - atlas_admin_username != 'CHANGEME_ATLAS_ADMIN'
       - (atlas_admin_ssh_keys | default([])) | length > 0
       - atlas_admin_password_hash not in ['', '!', '*']
+      - atlas_ssh_allow_tcp_forwarding in ['no', 'yes', 'local', 'remote', 'all']
+      - "'wheel' not in atlas_immich_supplementary_groups"
     fail_msg: >-
-      Define atlas_admin_username, vault_atlas_authorized_ssh_keys and
+      Define atlas_admin_username, atlas_admin_ssh_keys and vault_atlas_admin_password_hash
-      vault_atlas_admin_password_hash before applying the Atlas profile.
+      before applying the Atlas profile.
   no_log: true
 
 - name: Create Atlas administrator group
@@ -31,6 +33,41 @@
     state: present
   no_log: true
 
+- name: Create Immich primary group
+  tags: [atlas, accounts, containers, immich]
+  ansible.builtin.group:
+    name: "{{ atlas_immich_group }}"
+    gid: "{{ atlas_immich_gid }}"
+    state: present
+
+- name: Ensure Immich hardware-access groups exist
+  tags: [atlas, accounts, containers, immich]
+  ansible.builtin.group:
+    name: "{{ item }}"
+    state: present
+  loop: "{{ atlas_immich_supplementary_groups }}"
+  loop_control:
+    label: "{{ item }}"
+
+- name: Create unprivileged Immich account
+  tags: [atlas, accounts, containers, immich]
+  ansible.builtin.user:
+    name: "{{ atlas_immich_username }}"
+    uid: "{{ atlas_immich_uid }}"
+    group: "{{ atlas_immich_group }}"
+    groups: "{{ atlas_immich_supplementary_groups }}"
+    append: false
+    home: /nonexistent
+    create_home: false
+    shell: /sbin/nologin
+    system: true
+    state: present
+
+- name: Read Immich hardware-access group IDs
+  tags: [atlas, accounts, containers, immich]
+  ansible.builtin.getent:
+    database: group
+
 - name: Grant Atlas administrator passwordless sudo
   tags: [atlas, services]
   ansible.builtin.copy:
@@ -41,13 +78,26 @@
     mode: "0440"
     validate: "visudo -cf %s"
 
-- name: Manage Atlas administrator authorized SSH keys exclusively
+- name: Ensure Atlas administrator SSH authorized key fragments directory exists
   tags: [atlas, services]
-  ansible.posix.authorized_key:
+  ansible.builtin.file:
-    user: "{{ atlas_admin_username }}"
+    path: "{{ atlas_admin_ssh_key_directory }}"
-    key: "{{ atlas_admin_ssh_keys | join('\n') }}"
+    state: directory
-    state: present
+    owner: "{{ atlas_admin_username }}"
-    exclusive: true
+    group: "{{ atlas_admin_group }}"
+    mode: "0700"
+
+- name: Manage Atlas administrator SSH authorized key fragments
+  tags: [atlas, services]
+  ansible.builtin.copy:
+    content: "{{ item.key }}\n"
+    dest: "{{ atlas_admin_ssh_key_directory }}/{{ item.name }}"
+    owner: "{{ atlas_admin_username }}"
+    group: "{{ atlas_admin_group }}"
+    mode: "0600"
+  loop: "{{ atlas_admin_ssh_keys }}"
+  loop_control:
+    label: "{{ item.name }}"
 
 - name: Check whether the Atlas SSH host key exists
   tags: [atlas, services]
@@ -113,6 +163,18 @@
       - "'pubkeyauthentication yes' in atlas_sshd_effective_configuration.stdout_lines"
       - "'passwordauthentication no' in atlas_sshd_effective_configuration.stdout_lines"
       - "'kbdinteractiveauthentication no' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'authenticationmethods publickey' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'x11forwarding no' in atlas_sshd_effective_configuration.stdout_lines"
+      - "('allowtcpforwarding ' ~ atlas_ssh_allow_tcp_forwarding) in atlas_sshd_effective_configuration.stdout_lines"
+      - "'allowagentforwarding no' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'gatewayports no' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'permittunnel no' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'permituserenvironment no' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'maxauthtries 3' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'logingracetime 30' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'clientaliveinterval 300' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'clientalivecountmax 2' in atlas_sshd_effective_configuration.stdout_lines"
+      - "'loglevel VERBOSE' in atlas_sshd_effective_configuration.stdout_lines"
       - "('allowusers ' ~ atlas_admin_username) in atlas_sshd_effective_configuration.stdout_lines"
     fail_msg: The effective Atlas SSH configuration does not match the required hardening.
   when: not ansible_check_mode

ansible/roles/profile_atlas/tasks/borg_backup.yml

@@ -0,0 +1,538 @@
+---
+- name: Validate Atlas Borg backup configuration
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.assert:
+    that:
+      - atlas_manage_storage | bool
+      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
+      - atlas_mount_root.startswith('/')
+      - atlas_borg_username is match('^[a-z_][a-z0-9_-]*$')
+      - atlas_borg_group is match('^[a-z_][a-z0-9_-]*$')
+      - atlas_borg_username not in ['root', atlas_admin_username]
+      - atlas_borg_group != 'wheel'
+      - atlas_borg_home.startswith('/var/lib/')
+      - atlas_borg_repository_host is match('^[A-Za-z0-9.-]+$')
+      - atlas_borg_repository_user is match('^[A-Za-z0-9_-]+$')
+      - atlas_borg_repository_port | int > 0
+      - atlas_borg_repository_port | int < 65536
+      - atlas_borg_repository_path is match('^\./[A-Za-z0-9][A-Za-z0-9._/-]*$')
+      - "'/../' not in ('/' ~ atlas_borg_repository_path ~ '/')"
+      - atlas_borg_remote_path is match('^borg-[0-9]+\.[0-9]+$')
+      - atlas_borg_host_key.startswith(
+          '[' ~ atlas_borg_repository_host ~ ']:' ~ (atlas_borg_repository_port | string) ~ ' ssh-ed25519 '
+        )
+      - atlas_borg_ssh_private_key_path.startswith('/etc/atlas-borg/')
+      - atlas_borg_known_hosts_path.startswith('/etc/atlas-borg/')
+      - atlas_borg_passphrase_path.startswith('/etc/atlas-borg/')
+      - atlas_borg_ssh_wrapper_path.startswith('/usr/local/libexec/')
+      - atlas_borg_encryption_mode == 'repokey'
+      - atlas_borg_archive_prefix is match('^[a-z0-9][a-z0-9_-]*$')
+      - atlas_borg_snapshot_prefix is match('^[a-z0-9][a-z0-9_-]*$')
+      - atlas_borg_keep_daily | int > 0
+      - atlas_borg_keep_weekly | int > 0
+      - atlas_borg_keep_monthly | int > 0
+    fail_msg: >-
+      Atlas Borg needs a safe relative repository path, a pinned ED25519 host
+      key, positive retention counts, and valid dedicated SSH settings.
+  when: atlas_manage_borg_backup | bool
+
+- name: Create the Atlas Borg system group
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.group:
+    name: "{{ atlas_borg_group }}"
+    system: true
+    state: present
+  when: atlas_manage_borg_backup | bool
+
+- name: Create the least-privilege Atlas Borg account
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.user:
+    name: "{{ atlas_borg_username }}"
+    group: "{{ atlas_borg_group }}"
+    groups: []
+    append: false
+    comment: Atlas Borg backup service
+    home: "{{ atlas_borg_home }}"
+    create_home: false
+    shell: /sbin/nologin
+    password_lock: true
+    system: true
+    state: present
+  when: atlas_manage_borg_backup | bool
+
+- name: Read Atlas Borg account group membership
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.command:
+    argv:
+      - id
+      - -nG
+      - "{{ atlas_borg_username }}"
+  register: atlas_borg_account_groups
+  changed_when: false
+  check_mode: false
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Require the Atlas Borg account to have no supplementary groups
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.assert:
+    that:
+      - atlas_borg_account_groups.stdout.split() == [atlas_borg_group]
+    fail_msg: >-
+      The Atlas Borg service account must belong only to its private primary
+      group and must never receive wheel or other supplementary membership.
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Validate Atlas Borg systemd calendars
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.command:
+    argv:
+      - systemd-analyze
+      - calendar
+      - "{{ item }}"
+  loop:
+    - "{{ atlas_borg_backup_calendar }}"
+    - "{{ atlas_borg_check_calendar }}"
+  changed_when: false
+  check_mode: false
+  when: atlas_manage_borg_backup | bool
+
+- name: Create Atlas Borg configuration directory
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.file:
+    path: /etc/atlas-borg
+    state: directory
+    owner: root
+    group: "{{ atlas_borg_group }}"
+    mode: "0750"
+  when: atlas_manage_borg_backup | bool
+
+- name: Generate the dedicated Atlas Borg SSH identity
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.command:
+    argv:
+      - ssh-keygen
+      - -q
+      - -t
+      - ed25519
+      - -N
+      - ""
+      - -C
+      - atlas-borg@atlas
+      - -f
+      - "{{ atlas_borg_ssh_private_key_path }}"
+    creates: "{{ atlas_borg_ssh_private_key_path }}"
+  when: atlas_manage_borg_backup | bool
+
+- name: Protect the Atlas Borg private SSH identity
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.file:
+    path: "{{ atlas_borg_ssh_private_key_path }}"
+    owner: "{{ atlas_borg_username }}"
+    group: "{{ atlas_borg_group }}"
+    mode: "0600"
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Set permissions on the Atlas Borg public SSH identity
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.file:
+    path: "{{ atlas_borg_ssh_private_key_path }}.pub"
+    owner: "{{ atlas_borg_username }}"
+    group: "{{ atlas_borg_group }}"
+    mode: "0644"
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Read the dedicated Atlas Borg public SSH identity
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.slurp:
+    src: "{{ atlas_borg_ssh_private_key_path }}.pub"
+  register: atlas_borg_public_key
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Report the public SSH identity to install in the Hetzner sub-account
+  tags: [atlas, storage, backup, borg, borg_key]
+  ansible.builtin.debug:
+    msg: "{{ atlas_borg_public_key.content | b64decode | trim }}"
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Pin the Hetzner Storage Box SSH host key
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.copy:
+    content: "{{ atlas_borg_host_key }}\n"
+    dest: "{{ atlas_borg_known_hosts_path }}"
+    owner: "{{ atlas_borg_username }}"
+    group: "{{ atlas_borg_group }}"
+    mode: "0600"
+  when: atlas_manage_borg_backup | bool
+
+- name: Create Atlas Borg state directories
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ atlas_borg_username }}"
+    group: "{{ atlas_borg_group }}"
+    mode: "0700"
+  loop:
+    - "{{ atlas_borg_config_dir }}"
+    - "{{ atlas_borg_cache_dir }}"
+  when: atlas_manage_borg_backup | bool
+
+- name: Create the shared Atlas Borg operation lock
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.copy:
+    content: ""
+    dest: "{{ atlas_borg_lock_path }}"
+    owner: "{{ atlas_borg_username }}"
+    group: "{{ atlas_borg_group }}"
+    mode: "0600"
+    force: false
+  when: atlas_manage_borg_backup | bool
+
+- name: Require the Atlas Borg encryption passphrase from Vault
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.assert:
+    that:
+      - atlas_borg_passphrase | length >= 20
+    fail_msg: >-
+      Define vault_atlas_borg_passphrase with a strong unique value in the
+      encrypted Vault before activating the Borg repository.
+  no_log: true
+  when: atlas_manage_borg_backup | bool
+
+- name: Install the Atlas Borg passphrase
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.copy:
+    content: "{{ atlas_borg_passphrase }}\n"
+    dest: "{{ atlas_borg_passphrase_path }}"
+    owner: "{{ atlas_borg_username }}"
+    group: "{{ atlas_borg_group }}"
+    mode: "0600"
+  diff: false
+  no_log: true
+  when: atlas_manage_borg_backup | bool
+
+- name: Install the Atlas Borg backup helper
+  tags: [atlas, storage, backup, borg, borg_logging]
+  ansible.builtin.template:
+    src: atlas-borg-backup.sh.j2
+    dest: /usr/local/sbin/atlas-borg-backup
+    owner: root
+    group: root
+    mode: "0750"
+  when: atlas_manage_borg_backup | bool
+
+- name: Install the Atlas Borg snapshot cleanup helper
+  tags: [atlas, storage, backup, borg, borg_logging]
+  ansible.builtin.template:
+    src: atlas-borg-snapshot-cleanup.sh.j2
+    dest: /usr/local/sbin/atlas-borg-snapshot-cleanup
+    owner: root
+    group: root
+    mode: "0750"
+  when: atlas_manage_borg_backup | bool
+
+- name: Install the Atlas Borg check helper
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.template:
+    src: atlas-borg-check.sh.j2
+    dest: /usr/local/sbin/atlas-borg-check
+    owner: root
+    group: "{{ atlas_borg_group }}"
+    mode: "0750"
+  when: atlas_manage_borg_backup | bool
+
+- name: Create the local libexec directory for the Atlas Borg SSH wrapper
+  tags: [atlas, storage, backup, borg, borg_logging]
+  ansible.builtin.file:
+    path: "{{ atlas_borg_ssh_wrapper_path | dirname }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_borg_backup | bool
+
+- name: Install the Atlas Borg progress formatter
+  tags: [atlas, storage, backup, borg, borg_logging]
+  ansible.builtin.copy:
+    src: atlas-borg-progress.py
+    dest: /usr/local/libexec/atlas-borg-progress
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_borg_backup | bool
+
+- name: Install the capability-dropping Atlas Borg SSH wrapper
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.template:
+    src: atlas-borg-ssh.sh.j2
+    dest: "{{ atlas_borg_ssh_wrapper_path }}"
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_borg_backup | bool
+
+- name: Install Atlas Borg systemd units
+  tags: [atlas, storage, backup, borg, borg_logging]
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - atlas-borg-backup.service
+    - atlas-borg-backup.timer
+    - atlas-borg-check.service
+    - atlas-borg-check.timer
+  notify: Restart Atlas Borg timers
+  when: atlas_manage_borg_backup | bool
+
+- name: Verify dedicated SSH access to the Hetzner Storage Box
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.command:
+    argv:
+      - ssh
+      - -T
+      - -i
+      - "{{ atlas_borg_ssh_private_key_path }}"
+      - -p
+      - "{{ atlas_borg_repository_port | string }}"
+      - -o
+      - BatchMode=yes
+      - -o
+      - IdentitiesOnly=yes
+      - -o
+      - StrictHostKeyChecking=yes
+      - -o
+      - "UserKnownHostsFile={{ atlas_borg_known_hosts_path }}"
+      - "{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}"
+      - pwd
+  register: atlas_borg_ssh_probe
+  become: true
+  become_user: "{{ atlas_borg_username }}"
+  changed_when: false
+  failed_when: false
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Require the dedicated public key on the Hetzner sub-account
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.assert:
+    that:
+      - atlas_borg_ssh_probe.rc == 0
+    fail_msg: >-
+      Install the reported Atlas Borg public key in the Hetzner sub-account
+      before rerunning the Borg tasks. Password authentication is never used.
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Probe the remote Atlas Borg repository path
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.command:
+    argv:
+      - ssh
+      - -T
+      - -i
+      - "{{ atlas_borg_ssh_private_key_path }}"
+      - -p
+      - "{{ atlas_borg_repository_port | string }}"
+      - -o
+      - BatchMode=yes
+      - -o
+      - IdentitiesOnly=yes
+      - -o
+      - StrictHostKeyChecking=yes
+      - -o
+      - "UserKnownHostsFile={{ atlas_borg_known_hosts_path }}"
+      - "{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}"
+      - stat
+      - "{{ atlas_borg_repository_path }}"
+  register: atlas_borg_repository_path_probe
+  become: true
+  become_user: "{{ atlas_borg_username }}"
+  changed_when: false
+  failed_when: false
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Probe the Atlas Borg repository
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/borg
+      - --remote-path
+      - "{{ atlas_borg_remote_path }}"
+      - info
+      - >-
+        ssh://{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}:
+        {{- atlas_borg_repository_port }}/{{ atlas_borg_repository_path }}
+  environment:
+    BORG_CACHE_DIR: "{{ atlas_borg_cache_dir }}"
+    BORG_CONFIG_DIR: "{{ atlas_borg_config_dir }}"
+    BORG_PASSCOMMAND: "cat {{ atlas_borg_passphrase_path }}"
+    BORG_RSH: "{{ atlas_borg_ssh_wrapper_path }}"
+  register: atlas_borg_repository_probe
+  become: true
+  become_user: "{{ atlas_borg_username }}"
+  changed_when: false
+  failed_when: false
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+    - atlas_borg_repository_path_probe.rc == 0
+
+- name: Reject an existing path that is not the configured Borg repository
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.assert:
+    that:
+      - atlas_borg_repository_probe.rc == 0
+    fail_msg: >-
+      The remote repository path already exists but Borg could not open it.
+      Refusing to initialize over existing data; verify the path, passphrase,
+      and repository state manually.
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+    - atlas_borg_repository_path_probe.rc == 0
+
+- name: Initialize the encrypted Atlas Borg repository
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/borg
+      - --remote-path
+      - "{{ atlas_borg_remote_path }}"
+      - init
+      - --encryption
+      - "{{ atlas_borg_encryption_mode }}"
+      - >-
+        ssh://{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}:
+        {{- atlas_borg_repository_port }}/{{ atlas_borg_repository_path }}
+  environment:
+    BORG_CACHE_DIR: "{{ atlas_borg_cache_dir }}"
+    BORG_CONFIG_DIR: "{{ atlas_borg_config_dir }}"
+    BORG_PASSCOMMAND: "cat {{ atlas_borg_passphrase_path }}"
+    BORG_RSH: "{{ atlas_borg_ssh_wrapper_path }}"
+  become: true
+  become_user: "{{ atlas_borg_username }}"
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+    - atlas_borg_repository_path_probe.rc != 0
+
+- name: Verify the encrypted Atlas Borg repository
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/borg
+      - --remote-path
+      - "{{ atlas_borg_remote_path }}"
+      - info
+      - >-
+        ssh://{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}:
+        {{- atlas_borg_repository_port }}/{{ atlas_borg_repository_path }}
+  environment:
+    BORG_CACHE_DIR: "{{ atlas_borg_cache_dir }}"
+    BORG_CONFIG_DIR: "{{ atlas_borg_config_dir }}"
+    BORG_PASSCOMMAND: "cat {{ atlas_borg_passphrase_path }}"
+    BORG_RSH: "{{ atlas_borg_ssh_wrapper_path }}"
+  become: true
+  become_user: "{{ atlas_borg_username }}"
+  changed_when: false
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Check for the local Atlas Borg recovery-key export
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.stat:
+    path: "{{ atlas_borg_recovery_export_path }}"
+  register: atlas_borg_recovery_export
+  delegate_to: localhost
+  become: false
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+
+- name: Export the Atlas Borg recovery key for offline preservation
+  tags: [atlas, storage, backup, borg]
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode
+    - not atlas_borg_recovery_export.stat.exists
+  no_log: true
+  block:
+    - name: Create the local recovery-material directory
+      ansible.builtin.file:
+        path: "{{ atlas_borg_recovery_export_path | dirname }}"
+        state: directory
+        mode: "0700"
+      delegate_to: localhost
+      become: false
+
+    - name: Export the encrypted Borg repository key on Atlas
+      ansible.builtin.command:
+        argv:
+          - /usr/bin/borg
+          - --remote-path
+          - "{{ atlas_borg_remote_path }}"
+          - key
+          - export
+          - >-
+            ssh://{{ atlas_borg_repository_user }}@{{ atlas_borg_repository_host }}:
+            {{- atlas_borg_repository_port }}/{{ atlas_borg_repository_path }}
+          - "{{ atlas_borg_config_dir }}/atlas-borg-repokey.export"
+      environment:
+        BORG_CACHE_DIR: "{{ atlas_borg_cache_dir }}"
+        BORG_CONFIG_DIR: "{{ atlas_borg_config_dir }}"
+        BORG_PASSCOMMAND: "cat {{ atlas_borg_passphrase_path }}"
+        BORG_RSH: "{{ atlas_borg_ssh_wrapper_path }}"
+      become: true
+      become_user: "{{ atlas_borg_username }}"
+
+    - name: Fetch the encrypted Borg recovery key from Atlas
+      ansible.builtin.fetch:
+        src: "{{ atlas_borg_config_dir }}/atlas-borg-repokey.export"
+        dest: "{{ atlas_borg_recovery_export_path }}"
+        flat: true
+
+    - name: Protect the local Borg recovery-key export
+      ansible.builtin.file:
+        path: "{{ atlas_borg_recovery_export_path }}"
+        mode: "0600"
+      delegate_to: localhost
+      become: false
+  always:
+    - name: Remove the temporary recovery-key export from Atlas
+      ansible.builtin.file:
+        path: "{{ atlas_borg_config_dir }}/atlas-borg-repokey.export"
+        state: absent
+
+- name: Enable Atlas Borg backup and check timers
+  tags: [atlas, storage, backup, borg]
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+    daemon_reload: true
+  loop:
+    - atlas-borg-backup.timer
+    - atlas-borg-check.timer
+  when:
+    - atlas_manage_borg_backup | bool
+    - not ansible_check_mode

ansible/roles/profile_atlas/tasks/containers.yml

@@ -0,0 +1,140 @@
+---
+- name: Require completed Atlas media-stack configuration
+  tags: [atlas, containers, immich]
+  ansible.builtin.assert:
+    that:
+      - atlas_manage_storage | bool
+      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
+      - atlas_mount_root != '/CHANGEME_ATLAS_MOUNT_ROOT'
+      - atlas_immich_db_password | length > 0
+      - atlas_npm_admin_bind_address == '127.0.0.1'
+    fail_msg: >-
+      Enable and configure Atlas storage, provide vault_atlas_immich_db_password,
+      and keep the NPM administration port bound to loopback before enabling the media stack.
+  no_log: true
+  when: atlas_manage_media_stack | bool
+
+- name: Check Atlas Intel graphics device
+  tags: [atlas, containers, immich]
+  ansible.builtin.stat:
+    path: /dev/dri
+  register: atlas_dri_device
+  when: atlas_manage_media_stack | bool
+
+- name: Require Atlas Intel graphics device
+  tags: [atlas, containers, immich]
+  ansible.builtin.assert:
+    that:
+      - atlas_dri_device.stat.isdir | default(false)
+    fail_msg: /dev/dri is required for Immich QuickSync and OpenVINO acceleration.
+  when: atlas_manage_media_stack | bool
+
+- name: Create Atlas rootful Quadlet directory
+  tags: [atlas, containers]
+  ansible.builtin.file:
+    path: "{{ atlas_container_quadlet_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_media_stack | bool
+
+- name: Create Atlas Immich configuration directory
+  tags: [atlas, containers, immich]
+  ansible.builtin.file:
+    path: /etc/immich
+    state: directory
+    owner: root
+    group: "{{ atlas_immich_group }}"
+    mode: "0750"
+  when: atlas_manage_media_stack | bool
+
+- name: Create Atlas Immich persistent directories
+  tags: [atlas, containers, immich]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ atlas_immich_username }}"
+    group: "{{ atlas_immich_group }}"
+    mode: "0750"
+  loop:
+    - "{{ atlas_immich_upload_dir }}"
+    - "{{ atlas_immich_model_cache_dir }}"
+    - "{{ atlas_immich_machine_learning_config_dir }}"
+    - "{{ atlas_immich_machine_learning_cache_dir }}"
+    - "{{ atlas_immich_redis_data_dir }}"
+    - "{{ atlas_immich_postgres_data_dir }}"
+  loop_control:
+    label: "{{ item }}"
+  when: atlas_manage_media_stack | bool
+
+- name: Create Atlas NPM persistent directories
+  tags: [atlas, containers, npm]
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+  loop:
+    - "{{ atlas_npm_data_dir }}"
+    - "{{ atlas_npm_letsencrypt_dir }}"
+  loop_control:
+    label: "{{ item }}"
+  when: atlas_manage_media_stack | bool
+
+- name: Allow confined containers to use Atlas graphics devices
+  tags: [atlas, containers, immich]
+  ansible.posix.seboolean:
+    name: container_use_devices
+    state: true
+    persistent: true
+  when:
+    - atlas_manage_media_stack | bool
+    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
+
+- name: Render Vault-backed Immich environment
+  tags: [atlas, containers, immich]
+  ansible.builtin.template:
+    src: immich.env.j2
+    dest: /etc/immich/immich.env
+    owner: root
+    group: "{{ atlas_immich_group }}"
+    mode: "0640"
+  no_log: true
+  diff: false
+  notify: Restart Atlas media Quadlets
+  when: atlas_manage_media_stack | bool
+
+- name: Render Atlas media Quadlets
+  tags: [atlas, containers]
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "{{ atlas_container_quadlet_dir }}/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - atlas-media.network
+    - atlas-immich-redis.container
+    - atlas-immich-postgres.container
+    - atlas-immich-machine-learning.container
+    - atlas-immich-server.container
+    - atlas-npm.container
+  loop_control:
+    label: "{{ item }}"
+  notify: Restart Atlas media Quadlets
+  when: atlas_manage_media_stack | bool
+
+- name: Start Atlas media Quadlet services
+  tags: [atlas, containers, services]
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    state: started
+    daemon_reload: true
+  loop: "{{ atlas_media_quadlet_services }}"
+  loop_control:
+    label: "{{ item }}"
+  when:
+    - atlas_manage_media_stack | bool
+    - not ansible_check_mode

ansible/roles/profile_atlas/tasks/hardening.yml

@@ -0,0 +1,45 @@
+---
+- name: Enforce targeted SELinux on Atlas
+  tags: [atlas, hardening, security]
+  ansible.posix.selinux:
+    policy: targeted
+    state: enforcing
+    update_kernel_param: true
+  register: atlas_selinux_enforcement
+
+- name: Report when Atlas requires a reboot for SELinux enforcement
+  tags: [atlas, hardening, security]
+  ansible.builtin.debug:
+    msg: Reboot Atlas before relying on SELinux enforcement.
+  when: atlas_selinux_enforcement.reboot_required | default(false)
+
+- name: Apply Atlas network-kernel hardening
+  tags: [atlas, hardening, security]
+  ansible.posix.sysctl:
+    name: "{{ item.key }}"
+    value: "{{ item.value }}"
+    state: present
+    sysctl_set: true
+    reload: true
+  loop: "{{ atlas_hardening_sysctls | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}={{ item.value }}"
+
+- name: Read active Atlas SELinux mode
+  tags: [atlas, hardening, security]
+  ansible.builtin.command:
+    argv:
+      - getenforce
+  register: atlas_selinux_mode
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: Require active SELinux enforcement on Atlas
+  tags: [atlas, hardening, security]
+  ansible.builtin.assert:
+    that:
+      - atlas_selinux_mode.stdout == 'Enforcing'
+    fail_msg: >-
+      Atlas SELinux is not enforcing. Reboot if requested by the preceding
+      SELinux task, then rerun the hardening role before enabling services.
+  when: not ansible_check_mode

ansible/roles/profile_atlas/tasks/main.yml

@@ -5,11 +5,32 @@
 - name: Import Atlas 45Drives tasks
   ansible.builtin.import_tasks: cockpit.yml
 
+- name: Import Atlas network hardening tasks
+  ansible.builtin.import_tasks: hardening.yml
+
+- name: Import Atlas pool bootstrap tasks
+  ansible.builtin.import_tasks: pool.yml
+
 - name: Import Atlas storage tasks
   ansible.builtin.import_tasks: storage.yml
 
+- name: Import Atlas ZFS maintenance tasks
+  ansible.builtin.import_tasks: zfs_maintenance.yml
+
+- name: Import Atlas Borg backup tasks
+  ansible.builtin.import_tasks: borg_backup.yml
+
+- name: Import Atlas offline USB backup tasks
+  ansible.builtin.import_tasks: usb_backup.yml
+
+- name: Import Atlas health monitoring tasks
+  ansible.builtin.import_tasks: monitoring.yml
+
+- name: Import Atlas post-restore SELinux relabeling tasks
+  ansible.builtin.import_tasks: restorecon.yml
+
 - name: Import Atlas file sharing tasks
   ansible.builtin.import_tasks: sharing.yml
 
-- name: Import Atlas Syncthing tasks
+- name: Import Atlas media-container tasks
-  ansible.builtin.import_tasks: syncthing.yml
+  ansible.builtin.import_tasks: containers.yml

ansible/roles/profile_atlas/tasks/monitoring.yml

@@ -0,0 +1,201 @@
+---
+- name: Validate Atlas health monitoring policy
+  tags: [atlas, monitoring]
+  ansible.builtin.assert:
+    that:
+      - atlas_manage_storage | bool
+      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
+      - atlas_monitor_calendar | length > 0
+      - atlas_monitor_smart_devices | length > 0
+      - atlas_monitor_timers | length > 0
+      - atlas_monitor_failure_units | length > 0
+      - atlas_monitor_remote_capacity.user == atlas_borg_repository_user
+      - atlas_monitor_remote_capacity.host == atlas_borg_repository_host
+      - atlas_monitor_remote_capacity.run_as == atlas_borg_username
+      - atlas_monitor_remote_capacity.ssh_wrapper == atlas_borg_ssh_wrapper_path
+      - >-
+        0 < atlas_monitor_remote_capacity.warning_percent | int
+        < atlas_monitor_remote_capacity.critical_percent | int < 100
+      - atlas_monitor_remote_capacity.growth_warning_gib_day | int > 0
+      - atlas_monitor_notifier.startswith('/opt/45drives/houston/')
+      - 0 < atlas_monitor_pool_warning_percent | int < atlas_monitor_pool_critical_percent | int < 100
+      - 0 < atlas_monitor_root_warning_percent | int < atlas_monitor_root_critical_percent | int < 100
+      - 0 < atlas_monitor_snapshot_warning_percent | int < atlas_monitor_snapshot_critical_percent | int < 100
+      - atlas_monitor_snapshot_growth_warning_gib_day | int > 0
+      - atlas_monitor_backup_growth_warning_gib_day | int > 0
+      - 0 < atlas_monitor_cpu_warning_c | int < atlas_monitor_cpu_critical_c | int
+      - atlas_monitor_borg_max_runtime_days | int > 0
+    fail_msg: >-
+      Atlas health monitoring needs real devices, job units, a valid calendar,
+      positive ordered thresholds, and the existing Houston notifier.
+  when: atlas_manage_monitoring | bool
+
+- name: Validate monitored Atlas SMART devices
+  tags: [atlas, monitoring]
+  ansible.builtin.assert:
+    that:
+      - item.name is match('^[a-z0-9][a-z0-9_-]*$')
+      - item.path.startswith('/dev/disk/by-id/')
+      - 0 < item.warning_c | int < item.critical_c | int
+    fail_msg: "Every monitored disk needs a stable by-id path and ordered temperature thresholds."
+  loop: "{{ atlas_monitor_smart_devices }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when: atlas_manage_monitoring | bool
+
+- name: Validate monitored Atlas timer names and age thresholds
+  tags: [atlas, monitoring]
+  ansible.builtin.assert:
+    that:
+      - item.name is match('^[a-zA-Z0-9@_.-]+\\.timer$')
+      - item.max_age_hours | int >= 0
+  loop: "{{ atlas_monitor_timers }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when: atlas_manage_monitoring | bool
+
+- name: Validate monitored Atlas failure unit names
+  tags: [atlas, monitoring]
+  ansible.builtin.assert:
+    that:
+      - item is match('^[a-zA-Z0-9@_.-]+\\.service$')
+  loop: "{{ atlas_monitor_failure_units }}"
+  when: atlas_manage_monitoring | bool
+
+- name: Validate Atlas health monitor calendar
+  tags: [atlas, monitoring]
+  ansible.builtin.command:
+    argv: [systemd-analyze, calendar, "{{ atlas_monitor_calendar }}"]
+  changed_when: false
+  check_mode: false
+  when: atlas_manage_monitoring | bool
+
+- name: Install SMART tooling for Atlas health checks
+  tags: [atlas, monitoring, packages]
+  ansible.builtin.dnf:
+    name: smartmontools
+    state: present
+  when: atlas_manage_monitoring | bool
+
+- name: Inspect the existing 45Drives notifier for monitoring
+  tags: [atlas, monitoring]
+  ansible.builtin.stat:
+    path: "{{ atlas_monitor_notifier }}"
+  register: atlas_monitor_notifier_file
+  when: atlas_manage_monitoring | bool
+
+- name: Require the existing 45Drives notifier for monitoring
+  tags: [atlas, monitoring]
+  ansible.builtin.assert:
+    that:
+      - atlas_monitor_notifier_file.stat.executable | default(false)
+    fail_msg: "The existing 45Drives Houston notifier must be executable."
+  when: atlas_manage_monitoring | bool
+
+- name: Create private Atlas health monitor state directory
+  tags: [atlas, monitoring]
+  ansible.builtin.file:
+    path: /var/lib/atlas-health-monitor
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  when: atlas_manage_monitoring | bool
+
+- name: Install Atlas health monitor configuration
+  tags: [atlas, monitoring]
+  ansible.builtin.template:
+    src: atlas-health-monitor.json.j2
+    dest: /etc/atlas-health-monitor.json
+    owner: root
+    group: root
+    mode: "0600"
+  when: atlas_manage_monitoring | bool
+
+- name: Install Atlas health monitor helper
+  tags: [atlas, monitoring]
+  ansible.builtin.copy:
+    src: atlas-health-monitor.py
+    dest: /usr/local/libexec/atlas-health-monitor
+    owner: root
+    group: root
+    mode: "0750"
+  when: atlas_manage_monitoring | bool
+
+- name: Install Atlas health monitoring units
+  tags: [atlas, monitoring]
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - atlas-health-monitor.service
+    - atlas-health-monitor.timer
+    - atlas-monitor-failure@.service
+  when: atlas_manage_monitoring | bool
+
+- name: Create failure hook directories for monitored Atlas jobs
+  tags: [atlas, monitoring]
+  ansible.builtin.file:
+    path: "/etc/systemd/system/{{ item }}.d"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  loop: "{{ atlas_monitor_failure_units }}"
+  when: atlas_manage_monitoring | bool
+
+- name: Notify 45Drives Alerts when an Atlas job fails
+  tags: [atlas, monitoring]
+  ansible.builtin.template:
+    src: atlas-monitor-failure.conf.j2
+    dest: "/etc/systemd/system/{{ item }}.d/atlas-monitor.conf"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ atlas_monitor_failure_units }}"
+  when: atlas_manage_monitoring | bool
+
+- name: Reload systemd after installing Atlas monitoring
+  tags: [atlas, monitoring]
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when:
+    - atlas_manage_monitoring | bool
+    - not ansible_check_mode
+
+- name: Enable the Atlas health monitoring timer
+  tags: [atlas, monitoring]
+  ansible.builtin.systemd:
+    name: atlas-health-monitor.timer
+    enabled: true
+    state: started
+  when:
+    - atlas_manage_monitoring | bool
+    - not ansible_check_mode
+
+- name: Validate the deployed Atlas health monitoring units
+  tags: [atlas, monitoring]
+  ansible.builtin.command:
+    argv:
+      - systemd-analyze
+      - verify
+      - atlas-health-monitor.service
+      - atlas-health-monitor.timer
+      - atlas-monitor-failure@.service
+  changed_when: false
+  when:
+    - atlas_manage_monitoring | bool
+    - not ansible_check_mode
+
+- name: Probe Atlas health without sending notifications
+  tags: [atlas, monitoring]
+  ansible.builtin.command:
+    argv: [/usr/local/libexec/atlas-health-monitor, --dry-run]
+  register: atlas_monitor_dry_run
+  changed_when: false
+  when:
+    - atlas_manage_monitoring | bool
+    - not ansible_check_mode

ansible/roles/profile_atlas/tasks/pool.yml

@@ -0,0 +1,57 @@
+---
+- name: Bootstrap Atlas ZFS pool
+  tags: [atlas, storage, pool]
+  when: atlas_create_pool | bool
+  block:
+    - name: Validate Atlas pool bootstrap inputs
+      ansible.builtin.assert:
+        that:
+          - atlas_zpool_disks | length == 4
+          - atlas_zpool_disks | unique | length == 4
+          - atlas_zpool_disks | select('match', '^/dev/disk/by-id/') | list | length == 4
+        fail_msg: >-
+          Set exactly four distinct persistent /dev/disk/by-id paths in
+          atlas_zpool_disks before creating the RAIDZ2 pool.
+
+    - name: Inspect declared Atlas pool disks
+      ansible.builtin.stat:
+        path: "{{ item }}"
+        follow: true
+      loop: "{{ atlas_zpool_disks }}"
+      loop_control:
+        label: "{{ item }}"
+      register: atlas_zpool_disk_stats
+
+    - name: Require every declared Atlas pool disk
+      ansible.builtin.assert:
+        that:
+          - item.stat.exists
+          - item.stat.isblk | default(false)
+        fail_msg: "Declared Atlas pool disk is unavailable or is not a block device: {{ item.item }}"
+      loop: "{{ atlas_zpool_disk_stats.results }}"
+      loop_control:
+        label: "{{ item.item }}"
+
+    - name: Check whether the Atlas ZFS pool already exists
+      ansible.builtin.command:
+        argv:
+          - zpool
+          - list
+          - -H
+          - -o
+          - name
+          - "{{ atlas_zfs_pool }}"
+      register: atlas_zpool_bootstrap_check
+      changed_when: false
+      failed_when: atlas_zpool_bootstrap_check.rc not in [0, 1]
+
+    - name: Create the Atlas RAIDZ2 pool when absent
+      community.general.zpool:
+        name: "{{ atlas_zfs_pool }}"
+        state: present
+        mountpoint: "{{ atlas_mount_root }}"
+        force: false
+        vdevs:
+          - type: raidz2
+            disks: "{{ atlas_zpool_disks }}"
+      when: atlas_zpool_bootstrap_check.rc == 1

ansible/roles/profile_atlas/tasks/restorecon.yml

@@ -0,0 +1,27 @@
+---
+- name: Validate requested Atlas post-restore relabel paths
+  tags: [atlas, restorecon, recovery]
+  ansible.builtin.assert:
+    that:
+      - item is string
+      - item.startswith(atlas_mount_root ~ '/')
+      - item != atlas_mount_root
+    fail_msg: >-
+      Post-restore relabeling accepts only explicit paths below the Atlas pool
+      mount root. Do not relabel the whole pool during routine provisioning.
+  loop: "{{ atlas_restorecon_paths }}"
+  when: atlas_restorecon_paths | length > 0
+
+- name: Restore SELinux labels on explicitly restored Atlas paths
+  tags: [atlas, restorecon, recovery]
+  ansible.builtin.command:
+    argv:
+      - restorecon
+      - -RFv
+      - "{{ item }}"
+  register: atlas_restorecon_result
+  changed_when: atlas_restorecon_result.stdout | length > 0
+  loop: "{{ atlas_restorecon_paths }}"
+  when:
+    - atlas_restorecon_paths | length > 0
+    - not ansible_check_mode

ansible/roles/profile_atlas/tasks/samba_account.yml

@@ -0,0 +1,64 @@
+---
+- name: Require an existing Unix account for Atlas Samba
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ atlas_samba_account.username }}"
+
+- name: Read Atlas Samba account
+  ansible.builtin.command:
+    argv:
+      - pdbedit
+      - --list
+      - --user
+      - "{{ atlas_samba_account.username }}"
+  register: atlas_samba_account_check
+  changed_when: false
+  failed_when: false
+
+- name: Check Atlas Samba password marker
+  ansible.builtin.stat:
+    path: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
+  register: atlas_samba_password_marker_stat
+
+- name: Read Atlas Samba password marker
+  ansible.builtin.slurp:
+    src: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
+  register: atlas_samba_password_marker_content
+  no_log: true
+  when: atlas_samba_password_marker_stat.stat.exists
+
+- name: Determine whether Atlas Samba credentials must change
+  ansible.builtin.set_fact:
+    atlas_samba_password_digest: "{{ atlas_samba_account.password | hash('sha256') }}"
+    atlas_samba_password_update_required: >-
+      {{
+        atlas_samba_account_check.rc != 0
+        or not atlas_samba_password_marker_stat.stat.exists
+        or (
+          atlas_samba_password_marker_content.content | default('')
+          | b64decode | trim
+        ) != (atlas_samba_account.password | hash('sha256'))
+      }}
+  no_log: true
+
+- name: Set Atlas Samba account password
+  ansible.builtin.command:
+    argv:
+      - smbpasswd
+      - -s
+      - -a
+      - "{{ atlas_samba_account.username }}"
+    stdin: "{{ atlas_samba_account.password }}\n{{ atlas_samba_account.password }}"
+  changed_when: true
+  no_log: true
+  when: atlas_samba_password_update_required | bool
+
+- name: Record managed Atlas Samba password digest
+  ansible.builtin.copy:
+    content: "{{ atlas_samba_password_digest }}\n"
+    dest: "{{ atlas_samba_password_marker_dir }}/{{ atlas_samba_account.username }}.sha256"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+  when: atlas_samba_password_update_required | bool

ansible/roles/profile_atlas/tasks/sharing.yml

@@ -1,187 +1,12 @@
----
-- name: Render Atlas NFS exports
-  tags: [atlas, sharing]
-  ansible.builtin.template:
-    src: atlas.exports.j2
-    dest: /etc/exports.d/atlas.exports
-    owner: root
-    group: root
-    mode: "0644"
-  notify: Reload NFS exports
-  when: atlas_manage_storage | bool
-
-- name: Configure Atlas NFSv4-only service
-  tags: [atlas, sharing]
-  ansible.builtin.template:
-    src: atlas-nfs.conf.j2
-    dest: /etc/nfs.conf.d/atlas.conf
-    owner: root
-    group: root
-    mode: "0644"
-  notify: Restart NFS server
-  when: atlas_manage_storage | bool
-
-- name: Mask Atlas NFSv3 RPC services
-  tags: [atlas, sharing, services]
-  ansible.builtin.systemd:
-    name: "{{ item }}"
-    enabled: false
-    state: stopped
-    masked: true
-  loop:
-    - rpc-statd.service
-    - rpcbind.service
-    - rpcbind.socket
-  loop_control:
-    label: "{{ item }}"
-  when: atlas_manage_storage | bool
-
-- name: Ensure Atlas NFS mount daemon drop-in directory exists
-  tags: [atlas, sharing, services]
-  ansible.builtin.file:
-    path: /etc/systemd/system/nfs-mountd.service.d
-    state: directory
-    owner: root
-    group: root
-    mode: "0755"
-  when: atlas_manage_storage | bool
-
-- name: Disable Atlas NFSv3 mount daemon listeners
-  tags: [atlas, sharing, services]
-  ansible.builtin.template:
-    src: nfs-mountd-v4only.conf.j2
-    dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
-    owner: root
-    group: root
-    mode: "0644"
-  notify: Restart NFS mount daemon
-  when: atlas_manage_storage | bool
-
-- name: Enable SELinux access for Atlas file sharing
-  tags: [atlas, sharing, services]
-  ansible.posix.seboolean:
-    name: "{{ item }}"
-    state: true
-    persistent: true
-  loop: "{{ atlas_selinux_booleans }}"
-  loop_control:
-    label: "{{ item }}"
-  when:
-    - atlas_manage_storage | bool
-    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
-
-- name: Render Atlas Samba configuration
-  tags: [atlas, sharing]
-  ansible.builtin.template:
-    src: smb.conf.j2
-    dest: /etc/samba/smb.conf
-    owner: root
-    group: root
-    mode: "0644"
-    validate: "testparm --suppress-prompt %s"
-  notify: Restart Samba service
-  when: atlas_manage_storage | bool
-
-- name: Require Atlas Samba password
-  tags: [atlas, sharing]
-  ansible.builtin.assert:
-    that:
-      - atlas_samba_password | length > 0
-    fail_msg: Define vault_atlas_samba_password before enabling Atlas storage.
-  no_log: true
-  when: atlas_manage_storage | bool
-
-- name: Read Atlas Samba account
-  tags: [atlas, sharing]
-  ansible.builtin.command:
-    argv:
-      - pdbedit
-      - --list
-      - --user
-      - "{{ atlas_admin_username }}"
-  register: atlas_samba_account
-  changed_when: false
-  failed_when: false
-  when: atlas_manage_storage | bool
-
-- name: Ensure Atlas Samba private state directory exists
-  tags: [atlas, sharing]
-  ansible.builtin.file:
-    path: "{{ atlas_samba_password_marker | dirname }}"
-    state: directory
-    owner: root
-    group: root
-    mode: "0700"
-  when: atlas_manage_storage | bool
-
-- name: Check Atlas Samba password marker
-  tags: [atlas, sharing]
-  ansible.builtin.stat:
-    path: "{{ atlas_samba_password_marker }}"
-  register: atlas_samba_password_marker_stat
-  when: atlas_manage_storage | bool
-
-- name: Read Atlas Samba password marker
-  tags: [atlas, sharing]
-  ansible.builtin.slurp:
-    src: "{{ atlas_samba_password_marker }}"
-  register: atlas_samba_password_marker_content
-  no_log: true
-  when:
-    - atlas_manage_storage | bool
-    - atlas_samba_password_marker_stat.stat.exists
-
-- name: Determine whether Atlas Samba credentials must change
-  tags: [atlas, sharing]
-  ansible.builtin.set_fact:
-    atlas_samba_password_digest: "{{ atlas_samba_password | hash('sha256') }}"
-    atlas_samba_password_update_required: >-
-      {{
-        atlas_samba_account.rc != 0
-        or not atlas_samba_password_marker_stat.stat.exists
-        or (
-          atlas_samba_password_marker_content.content | default('')
-          | b64decode | trim
-        ) != (atlas_samba_password | hash('sha256'))
-      }}
-  no_log: true
-  when: atlas_manage_storage | bool
-
-- name: Set Atlas Samba account password
-  tags: [atlas, sharing]
-  ansible.builtin.command:
-    argv:
-      - smbpasswd
-      - -s
-      - -a
-      - "{{ atlas_admin_username }}"
-    stdin: "{{ atlas_samba_password }}\n{{ atlas_samba_password }}"
-  changed_when: true
-  no_log: true
-  when:
-    - atlas_manage_storage | bool
-    - atlas_samba_password_update_required | bool
-
-- name: Record managed Atlas Samba password digest
-  tags: [atlas, sharing]
-  ansible.builtin.copy:
-    content: "{{ atlas_samba_password_digest }}\n"
-    dest: "{{ atlas_samba_password_marker }}"
-    owner: root
-    group: root
-    mode: "0600"
-  no_log: true
-  when:
-    - atlas_manage_storage | bool
-    - atlas_samba_password_update_required | bool
-
 - name: Require completed Atlas firewall placeholders
   tags: [atlas, sharing, services]
   ansible.builtin.assert:
     that:
       - atlas_lan_subnet != 'CHANGEME_LAN_SUBNET'
+      - atlas_aegis_ip != 'CHANGEME_AEGIS_IP'
       - atlas_firewalld_zone | length > 0
-    fail_msg: Replace the Atlas LAN subnet and firewall zone placeholders.
+      - ansible_facts.default_ipv4.interface | default('') | length > 0
+    fail_msg: Replace the Atlas LAN, Aegis and firewall-zone placeholders.
   when: atlas_manage_firewall | bool
 
 - name: Apply Atlas firewalld rich rules
@@ -197,6 +22,16 @@
     label: "{{ item }}"
   when: atlas_manage_firewall | bool
 
+- name: Assign primary Atlas LAN interface to managed firewalld zone
+  tags: [atlas, sharing, services]
+  ansible.posix.firewalld:
+    interface: "{{ ansible_facts.default_ipv4.interface }}"
+    zone: "{{ atlas_firewalld_zone }}"
+    state: enabled
+    permanent: true
+    immediate: true
+  when: atlas_manage_firewall | bool
+
 - name: Remove unrestricted Atlas services from firewalld zone
   tags: [atlas, sharing, services]
   ansible.posix.firewalld:
@@ -209,3 +44,228 @@
   loop_control:
     label: "{{ item }}"
   when: atlas_manage_firewall | bool
+
+- name: Render Atlas NFS exports
+  tags: [atlas, sharing]
+  ansible.builtin.template:
+    src: atlas.exports.j2
+    dest: /etc/exports.d/atlas.exports
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload NFS exports
+  when: atlas_manage_sharing | bool
+
+- name: Ensure Atlas NFS configuration drop-in directory exists
+  tags: [atlas, sharing]
+  ansible.builtin.file:
+    path: /etc/nfs.conf.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_sharing | bool
+
+- name: Configure Atlas NFSv4-only service
+  tags: [atlas, sharing]
+  ansible.builtin.template:
+    src: atlas-nfs.conf.j2
+    dest: /etc/nfs.conf.d/atlas.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart NFS server
+  when: atlas_manage_sharing | bool
+
+- name: Mask Atlas NFSv3 RPC services
+  tags: [atlas, sharing, services]
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: false
+    state: stopped
+    masked: true
+  loop:
+    - rpc-statd.service
+    - rpcbind.service
+    - rpcbind.socket
+  loop_control:
+    label: "{{ item }}"
+  when: atlas_manage_sharing | bool
+
+- name: Ensure Atlas NFS mount daemon drop-in directory exists
+  tags: [atlas, sharing, services]
+  ansible.builtin.file:
+    path: /etc/systemd/system/nfs-mountd.service.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_sharing | bool
+
+- name: Disable Atlas NFSv3 mount daemon listeners
+  tags: [atlas, sharing, services]
+  ansible.builtin.template:
+    src: nfs-mountd-v4only.conf.j2
+    dest: /etc/systemd/system/nfs-mountd.service.d/v4only.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Restart NFS mount daemon
+  when: atlas_manage_sharing | bool
+
+- name: Enable SELinux access for Atlas file sharing
+  tags: [atlas, sharing, services]
+  ansible.posix.seboolean:
+    name: "{{ item }}"
+    state: true
+    persistent: true
+  loop: "{{ atlas_selinux_booleans }}"
+  loop_control:
+    label: "{{ item }}"
+  when:
+    - atlas_manage_sharing | bool
+    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'
+
+- name: Render Atlas Samba configuration
+  tags: [atlas, sharing]
+  ansible.builtin.template:
+    src: smb.conf.j2
+    dest: /etc/samba/smb.conf
+    owner: root
+    group: root
+    mode: "0644"
+    validate: "testparm --suppress-prompt %s"
+  notify: Restart Samba service
+  when: atlas_manage_sharing | bool
+
+- name: Require Vault-backed Atlas Samba accounts
+  tags: [atlas, sharing]
+  ansible.builtin.assert:
+    that:
+      - atlas_samba_encryption in ['required', 'desired']
+      - atlas_samba_accounts | length > 0
+      - >-
+        atlas_samba_accounts | map(attribute='username') | list
+        | difference(atlas_samba_valid_users) | length == 0
+      - >-
+        atlas_samba_valid_users
+        | difference(atlas_samba_accounts | map(attribute='username') | list) | length == 0
+      - atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
+    fail_msg: Define every authorized Samba account and its Vault-backed password.
+  no_log: true
+  when: atlas_manage_sharing | bool
+
+- name: Ensure Atlas Samba private state directory exists
+  tags: [atlas, sharing]
+  ansible.builtin.file:
+    path: "{{ atlas_samba_password_marker_dir }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  when: atlas_manage_sharing | bool
+
+- name: Manage Vault-backed Atlas Samba credentials
+  tags: [atlas, sharing]
+  ansible.builtin.include_tasks: samba_account.yml
+  loop: "{{ atlas_samba_accounts }}"
+  loop_control:
+    loop_var: atlas_samba_account
+    label: "{{ atlas_samba_account.username }}"
+  no_log: true
+  when: atlas_manage_sharing | bool
+
+- name: Enable Atlas file-sharing services
+  tags: [atlas, sharing, services]
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+  loop:
+    - nfs-server.service
+    - smb.service
+  loop_control:
+    label: "{{ item }}"
+  when: atlas_manage_sharing | bool
+
+- name: Gather effective Atlas firewalld zone configuration
+  tags: [atlas, sharing, services, security]
+  ansible.posix.firewalld_info:
+    zones:
+      - "{{ atlas_firewalld_zone }}"
+  register: atlas_firewalld_info
+  when:
+    - atlas_manage_firewall | bool
+    - not ansible_check_mode
+
+- name: Verify effective Atlas firewalld restrictions
+  tags: [atlas, sharing, services, security]
+  ansible.builtin.assert:
+    that:
+      - atlas_firewalld_zone in atlas_firewalld_info.firewalld_info.zones
+      - >-
+        ansible_facts.default_ipv4.interface
+        in atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].interfaces
+      - >-
+        atlas_firewalld_restricted_services
+        | intersect(atlas_firewalld_info.firewalld_info.zones[atlas_firewalld_zone].services)
+        | length == 0
+    fail_msg: >-
+      The effective Atlas firewalld zone does not restrict the primary LAN
+      interface and unmanaged service exposure as declared.
+  when:
+    - atlas_manage_firewall | bool
+    - not ansible_check_mode
+
+- name: Apply pending Atlas sharing handlers before verification
+  tags: [atlas, sharing, services, security]
+  ansible.builtin.meta: flush_handlers
+  when:
+    - atlas_manage_sharing | bool
+    - not ansible_check_mode
+
+- name: Check active Atlas file-sharing services
+  tags: [atlas, sharing, services, security]
+  ansible.builtin.command:
+    argv:
+      - systemctl
+      - is-active
+      - --quiet
+      - "{{ item }}"
+  loop:
+    - nfs-server.service
+    - smb.service
+  loop_control:
+    label: "{{ item }}"
+  register: atlas_file_sharing_service_activity
+  changed_when: false
+  failed_when: false
+  when:
+    - atlas_manage_sharing | bool
+    - not ansible_check_mode
+
+- name: Require active Atlas file-sharing services
+  tags: [atlas, sharing, services, security]
+  ansible.builtin.assert:
+    that:
+      - atlas_file_sharing_service_activity.results | map(attribute='rc') | list == [0, 0]
+    fail_msg: Atlas NFSv4 or SMB3 did not start after its managed configuration was applied.
+  when:
+    - atlas_manage_sharing | bool
+    - not ansible_check_mode
+
+- name: Require Atlas file-sharing TCP listeners
+  tags: [atlas, sharing, services, security]
+  ansible.builtin.wait_for:
+    host: 127.0.0.1
+    port: "{{ item }}"
+    state: started
+    timeout: 15
+  loop:
+    - 2049
+    - 445
+  loop_control:
+    label: "{{ item }}/tcp"
+  when:
+    - atlas_manage_sharing | bool
+    - not ansible_check_mode

ansible/roles/profile_atlas/tasks/storage.yml

@@ -3,14 +3,84 @@
   tags: [atlas, storage]
   ansible.builtin.set_fact:
     atlas_zfs_datasets:
-      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_work }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_archive }}"
-        mountpoint: "{{ atlas_work_mountpoint }}"
+        mountpoint: "{{ atlas_archive_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: zstd
+          mountpoint: "{{ atlas_archive_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_services }}"
+        mountpoint: "{{ atlas_services_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: zstd
+          mountpoint: "{{ atlas_services_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
+        mountpoint: "{{ atlas_app_data_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: zstd
+          mountpoint: "{{ atlas_app_data_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
+        mountpoint: "{{ atlas_navidrome_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: zstd
+          mountpoint: "{{ atlas_navidrome_mountpoint }}"
       - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
         mountpoint: "{{ atlas_syncthing_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_syncthing_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_media }}"
+        mountpoint: "{{ atlas_media_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_media_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
+        mountpoint: "{{ atlas_music_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_music_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_backup }}"
+        mountpoint: "{{ atlas_backup_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_backup_mountpoint }}"
+          reservation: "{{ atlas_zfs_backup_reservation }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_host_backups }}"
+        mountpoint: "{{ atlas_host_backups_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_host_backups_mountpoint }}"
       - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_backup_prometheus }}"
         mountpoint: "{{ atlas_backup_prometheus_mountpoint }}"
-      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_icloud_photos }}"
+        owner: "{{ atlas_admin_username }}"
-        mountpoint: "{{ atlas_icloud_photos_mountpoint }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_backup_prometheus_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_photobook }}"
+        mountpoint: "{{ atlas_photobook_mountpoint }}"
+        owner: "{{ atlas_immich_username }}"
+        group: "{{ atlas_immich_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_photobook_mountpoint }}"
 
 - name: Require completed Atlas storage placeholders
   tags: [atlas, storage]
@@ -56,8 +126,7 @@
   community.general.zfs:
     name: "{{ item.name }}"
     state: present
-    extra_zfs_properties:
+    extra_zfs_properties: "{{ item.properties }}"
-      mountpoint: "{{ item.mountpoint }}"
   loop: "{{ atlas_zfs_datasets }}"
   loop_control:
     label: "{{ item.name }}"
@@ -68,8 +137,8 @@
   ansible.builtin.file:
     path: "{{ item.mountpoint }}"
     state: directory
-    owner: "{{ atlas_admin_username }}"
+    owner: "{{ item.owner }}"
-    group: "{{ atlas_admin_group }}"
+    group: "{{ item.group }}"
     mode: "0770"
   loop: "{{ atlas_zfs_datasets }}"
   loop_control:

ansible/roles/profile_atlas/tasks/syncthing.yml

@@ -1,40 +0,0 @@
----
-- name: Create Atlas Syncthing configuration directory
-  tags: [atlas, syncthing]
-  ansible.builtin.file:
-    path: "{{ atlas_syncthing_config_dir }}"
-    state: directory
-    owner: "{{ atlas_admin_username }}"
-    group: "{{ atlas_admin_group }}"
-    mode: "0700"
-  when: atlas_manage_storage | bool
-
-- name: Create Atlas Syncthing default data directory
-  tags: [atlas, syncthing]
-  ansible.builtin.file:
-    path: "{{ atlas_syncthing_default_dir }}"
-    state: directory
-    owner: "{{ atlas_admin_username }}"
-    group: "{{ atlas_admin_group }}"
-    mode: "0770"
-  when: atlas_manage_storage | bool
-
-- name: Render Atlas Syncthing systemd service
-  tags: [atlas, syncthing]
-  ansible.builtin.template:
-    src: atlas-syncthing.service.j2
-    dest: /etc/systemd/system/atlas-syncthing.service
-    owner: root
-    group: root
-    mode: "0644"
-  notify: Restart Atlas Syncthing service
-  when: atlas_manage_storage | bool
-
-- name: Enable Atlas Syncthing service
-  tags: [atlas, syncthing]
-  ansible.builtin.systemd:
-    name: atlas-syncthing
-    enabled: true
-    state: started
-    daemon_reload: true
-  when: atlas_manage_storage | bool

ansible/roles/profile_atlas/tasks/usb_backup.yml

@@ -0,0 +1,145 @@
+---
+- name: Validate Atlas offline USB backup configuration
+  tags: [atlas, storage, backup, usb_backup]
+  ansible.builtin.assert:
+    that:
+      - atlas_manage_storage | bool
+      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
+      - atlas_mount_root.startswith('/')
+      - atlas_usb_backup_luks_uuid is match('^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$')
+      - atlas_usb_backup_fs_uuid is match('^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$')
+      - atlas_usb_backup_luks_uuid != atlas_usb_backup_fs_uuid
+      - atlas_usb_backup_mapper_name is match('^[a-z][a-z0-9_-]*$')
+      - atlas_usb_backup_min_free_bytes | int > 0
+      - atlas_usb_backup_snapshot_prefix is match('^[a-z0-9][a-z0-9_-]*$')
+      - atlas_usb_backup_snapshot_prefix != atlas_borg_snapshot_prefix
+      - atlas_usb_backup_snapshot_prefix != atlas_zfs_snapshot_prefix
+    fail_msg: >-
+      The manual Atlas USB backup needs verified LUKS and ext4 UUIDs, a safe
+      mapper name, positive free-space reserve, and a unique snapshot prefix.
+  when: atlas_manage_usb_backup | bool
+
+- name: Install rsync for the Atlas offline USB backup
+  tags: [atlas, storage, backup, usb_backup]
+  ansible.builtin.dnf:
+    name: rsync
+    state: present
+  when: atlas_manage_usb_backup | bool
+
+- name: Install the manual Atlas offline USB backup helper
+  tags: [atlas, storage, backup, usb_backup]
+  ansible.builtin.template:
+    src: atlas-usb-backup.sh.j2
+    dest: /usr/local/sbin/atlas-usb-backup
+    owner: root
+    group: root
+    mode: "0750"
+  when: atlas_manage_usb_backup | bool
+
+- name: Install the Atlas USB snapshot cleanup helper
+  tags: [atlas, storage, backup, usb_backup]
+  ansible.builtin.template:
+    src: atlas-usb-snapshot-cleanup.sh.j2
+    dest: /usr/local/sbin/atlas-usb-snapshot-cleanup
+    owner: root
+    group: root
+    mode: "0750"
+  when: atlas_manage_usb_backup | bool
+
+- name: Install the manual Atlas offline USB backup service
+  tags: [atlas, storage, backup, usb_backup]
+  ansible.builtin.template:
+    src: atlas-usb-backup.service.j2
+    dest: /etc/systemd/system/atlas-usb-backup.service
+    owner: root
+    group: root
+    mode: "0644"
+  when: atlas_manage_usb_backup | bool
+
+- name: Reload systemd for the Atlas offline USB backup service
+  tags: [atlas, storage, backup, usb_backup]
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when:
+    - atlas_manage_usb_backup | bool
+    - not ansible_check_mode
+
+- name: Validate the 45Drives Atlas USB reminder configuration
+  tags: [atlas, backup, usb_reminder]
+  ansible.builtin.assert:
+    that:
+      - atlas_manage_usb_backup | bool
+      - atlas_usb_reminder_calendar | length > 0
+      - atlas_usb_reminder_notifier.startswith('/opt/45drives/houston/')
+    fail_msg: >-
+      Enable the manual USB backup and declare a systemd calendar before
+      enabling its 45Drives Alerts reminder.
+  when: atlas_manage_usb_reminder | bool
+
+- name: Validate the Atlas USB reminder calendar
+  tags: [atlas, backup, usb_reminder]
+  ansible.builtin.command:
+    argv:
+      - systemd-analyze
+      - calendar
+      - "{{ atlas_usb_reminder_calendar }}"
+  changed_when: false
+  check_mode: false
+  when: atlas_manage_usb_reminder | bool
+
+- name: Inspect the existing 45Drives notifier
+  tags: [atlas, backup, usb_reminder]
+  ansible.builtin.stat:
+    path: "{{ atlas_usb_reminder_notifier }}"
+  register: atlas_usb_reminder_notifier_file
+  when: atlas_manage_usb_reminder | bool
+
+- name: Require the configured 45Drives notifier for USB reminders
+  tags: [atlas, backup, usb_reminder]
+  ansible.builtin.assert:
+    that:
+      - atlas_usb_reminder_notifier_file.stat.executable | default(false)
+    fail_msg: >-
+      The existing 45Drives Houston notifier must be executable.
+  when: atlas_manage_usb_reminder | bool
+
+- name: Install the 45Drives Atlas USB reminder helper
+  tags: [atlas, backup, usb_reminder]
+  ansible.builtin.template:
+    src: atlas-usb-reminder.py.j2
+    dest: /usr/local/libexec/atlas-usb-reminder
+    owner: root
+    group: root
+    mode: "0750"
+  when: atlas_manage_usb_reminder | bool
+
+- name: Install the 45Drives Atlas USB reminder service
+  tags: [atlas, backup, usb_reminder]
+  ansible.builtin.template:
+    src: atlas-usb-reminder.service.j2
+    dest: /etc/systemd/system/atlas-usb-reminder.service
+    owner: root
+    group: root
+    mode: "0644"
+  when: atlas_manage_usb_reminder | bool
+
+- name: Install the 45Drives Atlas USB reminder timer
+  tags: [atlas, backup, usb_reminder]
+  ansible.builtin.template:
+    src: atlas-usb-reminder.timer.j2
+    dest: /etc/systemd/system/atlas-usb-reminder.timer
+    owner: root
+    group: root
+    mode: "0644"
+  when: atlas_manage_usb_reminder | bool
+
+- name: Enable only the Atlas USB notification reminder timer
+  tags: [atlas, backup, usb_reminder]
+  ansible.builtin.systemd:
+    name: atlas-usb-reminder.timer
+    enabled: true
+    state: started
+    daemon_reload: true
+  when:
+    - atlas_manage_usb_reminder | bool
+    - not ansible_check_mode

ansible/roles/profile_atlas/tasks/zfs_maintenance.yml

@@ -0,0 +1,175 @@
+---
+- name: Validate Atlas ZFS snapshot policy
+  tags: [atlas, storage, snapshots]
+  ansible.builtin.assert:
+    that:
+      - atlas_manage_storage | bool
+      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
+      - atlas_zfs_snapshot_prefix is match('^[a-z0-9][a-z0-9_-]*$')
+      - atlas_zfs_snapshot_policies | length > 0
+      - >-
+        (atlas_zfs_snapshot_policies | map(attribute='name') | unique | list | length)
+        == (atlas_zfs_snapshot_policies | length)
+    fail_msg: >-
+      Enable Atlas storage and declare a non-empty snapshot policy with a safe
+      prefix and unique policy names before managing automatic snapshots.
+  when: atlas_manage_zfs_snapshots | bool
+
+- name: Validate Atlas ZFS snapshot policy entries
+  tags: [atlas, storage, snapshots]
+  ansible.builtin.assert:
+    that:
+      - item.name is match('^[a-z][a-z0-9_-]*$')
+      - item.keep | int > 0
+      - item.calendar | length > 0
+    fail_msg: >-
+      Every Atlas snapshot policy needs a safe name, a positive retention
+      count, and a systemd calendar expression.
+  loop: "{{ atlas_zfs_snapshot_policies }}"
+  loop_control:
+    label: "{{ item.name | default('unnamed') }}"
+  when: atlas_manage_zfs_snapshots | bool
+
+- name: Validate Atlas ZFS snapshot calendars
+  tags: [atlas, storage, snapshots]
+  ansible.builtin.command:
+    argv:
+      - systemd-analyze
+      - calendar
+      - "{{ item.calendar }}"
+  loop: "{{ atlas_zfs_snapshot_policies }}"
+  loop_control:
+    label: "{{ item.name }}: {{ item.calendar }}"
+  changed_when: false
+  check_mode: false
+  when: atlas_manage_zfs_snapshots | bool
+
+- name: Install Atlas ZFS snapshot and retention helper
+  tags: [atlas, storage, snapshots]
+  ansible.builtin.template:
+    src: atlas-zfs-snapshot.sh.j2
+    dest: /usr/local/sbin/atlas-zfs-snapshot
+    owner: root
+    group: root
+    mode: "0750"
+  when: atlas_manage_zfs_snapshots | bool
+
+- name: Install Atlas ZFS snapshot systemd service
+  tags: [atlas, storage, snapshots]
+  ansible.builtin.template:
+    src: atlas-zfs-snapshot@.service.j2
+    dest: /etc/systemd/system/atlas-zfs-snapshot@.service
+    owner: root
+    group: root
+    mode: "0644"
+  when: atlas_manage_zfs_snapshots | bool
+
+- name: Install Atlas ZFS snapshot systemd timers
+  tags: [atlas, storage, snapshots]
+  ansible.builtin.template:
+    src: atlas-zfs-snapshot.timer.j2
+    dest: "/etc/systemd/system/atlas-zfs-snapshot-{{ item.name }}.timer"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ atlas_zfs_snapshot_policies }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when: atlas_manage_zfs_snapshots | bool
+
+- name: Enable Atlas ZFS snapshot systemd timers
+  tags: [atlas, storage, snapshots]
+  ansible.builtin.systemd:
+    name: "atlas-zfs-snapshot-{{ item.name }}.timer"
+    enabled: true
+    state: started
+    daemon_reload: true
+  loop: "{{ atlas_zfs_snapshot_policies }}"
+  loop_control:
+    label: "{{ item.name }}"
+  when:
+    - atlas_manage_zfs_snapshots | bool
+    - not ansible_check_mode
+
+- name: Validate Atlas ZFS scrub policy
+  tags: [atlas, storage, scrub]
+  ansible.builtin.assert:
+    that:
+      - atlas_manage_storage | bool
+      - atlas_zfs_pool != 'CHANGEME_ZFS_POOL'
+      - atlas_zfs_scrub_calendar | length > 0
+    fail_msg: >-
+      Enable Atlas storage and declare a systemd calendar expression before
+      managing periodic ZFS scrubs.
+  when: atlas_manage_zfs_scrub | bool
+
+- name: Validate Atlas ZFS scrub calendar
+  tags: [atlas, storage, scrub]
+  ansible.builtin.command:
+    argv:
+      - systemd-analyze
+      - calendar
+      - "{{ atlas_zfs_scrub_calendar }}"
+  changed_when: false
+  check_mode: false
+  when: atlas_manage_zfs_scrub | bool
+
+- name: Require OpenZFS scrub systemd units
+  tags: [atlas, storage, scrub]
+  ansible.builtin.command:
+    argv:
+      - systemctl
+      - cat
+      - "{{ item }}"
+  loop:
+    - "zfs-scrub@{{ atlas_zfs_pool }}.service"
+    - "zfs-scrub-monthly@{{ atlas_zfs_pool }}.timer"
+    - "zfs-scrub-weekly@{{ atlas_zfs_pool }}.timer"
+  loop_control:
+    label: "{{ item }}"
+  changed_when: false
+  check_mode: false
+  when: atlas_manage_zfs_scrub | bool
+
+- name: Create Atlas ZFS scrub timer override directory
+  tags: [atlas, storage, scrub]
+  ansible.builtin.file:
+    path: "/etc/systemd/system/zfs-scrub-monthly@{{ atlas_zfs_pool }}.timer.d"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+  when: atlas_manage_zfs_scrub | bool
+
+- name: Configure Atlas ZFS monthly scrub schedule
+  tags: [atlas, storage, scrub]
+  ansible.builtin.template:
+    src: atlas-zfs-scrub-timer.conf.j2
+    dest: >-
+      /etc/systemd/system/zfs-scrub-monthly@{{ atlas_zfs_pool }}.timer.d/override.conf
+    owner: root
+    group: root
+    mode: "0644"
+  when: atlas_manage_zfs_scrub | bool
+
+- name: Disable the conflicting weekly OpenZFS scrub timer
+  tags: [atlas, storage, scrub]
+  ansible.builtin.systemd:
+    name: "zfs-scrub-weekly@{{ atlas_zfs_pool }}.timer"
+    enabled: false
+    state: stopped
+    daemon_reload: true
+  when:
+    - atlas_manage_zfs_scrub | bool
+    - not ansible_check_mode
+
+- name: Enable the Atlas monthly OpenZFS scrub timer
+  tags: [atlas, storage, scrub]
+  ansible.builtin.systemd:
+    name: "zfs-scrub-monthly@{{ atlas_zfs_pool }}.timer"
+    enabled: true
+    state: started
+    daemon_reload: true
+  when:
+    - atlas_manage_zfs_scrub | bool
+    - not ansible_check_mode

ansible/roles/profile_atlas/templates/00-atlas-hardening.conf.j2

@@ -3,4 +3,22 @@ PermitRootLogin no
 PubkeyAuthentication yes
 PasswordAuthentication no
 KbdInteractiveAuthentication no
+AuthenticationMethods publickey
+AuthorizedKeysFile {{
+  atlas_admin_ssh_keys
+  | map(attribute='name')
+  | map('regex_replace', '^', '%h/.ssh/authorized_keys.d/')
+  | join(' ')
+}}
+X11Forwarding no
+AllowTcpForwarding {{ atlas_ssh_allow_tcp_forwarding }}
+AllowAgentForwarding no
+GatewayPorts no
+PermitTunnel no
+PermitUserEnvironment no
+MaxAuthTries 3
+LoginGraceTime 30
+ClientAliveInterval 300
+ClientAliveCountMax 2
+LogLevel VERBOSE
 AllowUsers {{ atlas_admin_username }}

ansible/roles/profile_atlas/templates/atlas-borg-backup.service.j2

@@ -0,0 +1,41 @@
+[Unit]
+Description=Back up Atlas ZFS datasets to the encrypted Borg repository
+Documentation=man:borg-create(1) man:borg-prune(1) man:borg-compact(1)
+Requires=zfs.target
+Wants=network-online.target
+After=zfs.target network-online.target
+StartLimitIntervalSec=6h
+StartLimitBurst=3
+ConditionFileIsExecutable=/usr/local/sbin/atlas-borg-backup
+ConditionPathExists={{ atlas_borg_passphrase_path }}
+ConditionPathExists={{ atlas_borg_ssh_private_key_path }}
+ConditionPathExists={{ atlas_borg_known_hosts_path }}
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/atlas-borg-backup
+ExecStopPost=+/usr/local/sbin/atlas-borg-snapshot-cleanup
+User=root
+Group=root
+UMask=0077
+SuccessExitStatus=1
+Restart=on-failure
+RestartSec=30m
+TimeoutStartSec=infinity
+RuntimeDirectory=atlas-borg
+RuntimeDirectoryMode=0750
+Nice=15
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+NoNewPrivileges=true
+PrivateMounts=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths={{ atlas_borg_cache_dir }} {{ atlas_borg_config_dir }} /run/atlas-borg /run/lock
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictRealtime=true
+LockPersonality=true

ansible/roles/profile_atlas/templates/atlas-borg-backup.sh.j2

@@ -0,0 +1,212 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+export LC_ALL=C.utf8
+export PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export BORG_CACHE_DIR={{ atlas_borg_cache_dir | quote }}
+export BORG_CONFIG_DIR={{ atlas_borg_config_dir | quote }}
+export BORG_PASSCOMMAND={{ ('cat ' ~ atlas_borg_passphrase_path) | quote }}
+export BORG_RSH={{ atlas_borg_ssh_wrapper_path | quote }}
+
+readonly pool={{ atlas_zfs_pool | quote }}
+readonly mount_root={{ atlas_mount_root | quote }}
+readonly repository={{ ('ssh://' ~ atlas_borg_repository_user ~ '@' ~ atlas_borg_repository_host
+  ~ ':' ~ (atlas_borg_repository_port | string) ~ '/' ~ atlas_borg_repository_path) | quote }}
+readonly remote_path={{ atlas_borg_remote_path | quote }}
+readonly archive_prefix={{ atlas_borg_archive_prefix | quote }}
+readonly snapshot_prefix={{ atlas_borg_snapshot_prefix | quote }}
+readonly compression={{ atlas_borg_compression | quote }}
+readonly stage=/run/atlas-borg/source
+readonly snapshot_marker=/run/atlas-borg/snapshot-name
+readonly borg_user={{ atlas_borg_username | quote }}
+readonly borg_group={{ atlas_borg_group | quote }}
+readonly borg_home={{ atlas_borg_home | quote }}
+readonly borg_lock={{ atlas_borg_lock_path | quote }}
+readonly progress_filter=/usr/local/libexec/atlas-borg-progress
+
+snapshot_name=""
+mounted_targets=()
+
+# Invoked through the EXIT trap below.
+# shellcheck disable=SC2329
+cleanup() {
+  local status=$?
+  local cleanup_status=0
+  local index
+  local source_mount_failed=false
+  trap - EXIT HUP INT TERM
+  set +e
+
+{% raw %}
+  for ((index = ${#mounted_targets[@]} - 1; index >= 0; index--)); do
+{% endraw %}
+    if mountpoint -q "${mounted_targets[$index]}" && ! umount -R "${mounted_targets[$index]}"; then
+      printf 'Source snapshot mount cleanup failed: %s\n' "${mounted_targets[$index]}" >&2
+      source_mount_failed=true
+    fi
+    if mountpoint -q "${mounted_targets[$index]}"; then
+      printf 'Source snapshot mount is still active: %s\n' "${mounted_targets[$index]}" >&2
+      source_mount_failed=true
+    else
+      rmdir -- "${mounted_targets[$index]}" 2>/dev/null || true
+    fi
+  done
+  if [[ "$source_mount_failed" == false ]]; then
+    if [[ -d "$stage" ]]; then
+      rmdir -- "$stage" 2>/dev/null || cleanup_status=2
+    fi
+  else
+    cleanup_status=2
+    printf 'Source bind mount cleanup failed; keeping the snapshot for recovery\n' >&2
+  fi
+
+  if ((status == 0 && cleanup_status != 0)); then
+    status=$cleanup_status
+  fi
+  exit "$status"
+}
+
+trap cleanup EXIT
+trap 'exit 143' HUP INT TERM
+
+run_as_borg() {
+  setpriv \
+    --reuid "$borg_user" \
+    --regid "$borg_group" \
+    --clear-groups \
+    --inh-caps=-all,+dac_read_search \
+    --ambient-caps=-all,+dac_read_search \
+    --bounding-set=-all,+dac_read_search \
+    -- env HOME="$borg_home" USER="$borg_user" LOGNAME="$borg_user" "$@"
+}
+
+exec 8>"$borg_lock"
+flock 8
+exec 9>/run/lock/atlas-zfs-snapshot.lock
+
+zpool list -H -o name "$pool" >/dev/null
+rm -rf "$stage"
+mkdir -p "$stage"
+chown root:"$borg_group" /run/atlas-borg "$stage"
+chmod 0750 /run/atlas-borg "$stage"
+
+flock 9
+while IFS= read -r stale_snapshot; do
+  stale_suffix="${stale_snapshot#"${pool}@${snapshot_prefix}-"}"
+  if [[ "$stale_suffix" =~ ^[0-9]{8}T[0-9]{6}Z$ ]]; then
+    zfs destroy -r "$stale_snapshot"
+    printf 'Removed stale Borg source snapshot %s\n' "$stale_snapshot"
+  fi
+done < <(
+  zfs list -H -t snapshot -o name -r "$pool" |
+    grep -E "^${pool}@${snapshot_prefix}-[0-9]{8}T[0-9]{6}Z$" || true
+)
+
+timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+readonly timestamp
+snapshot_name="${snapshot_prefix}-${timestamp}"
+readonly snapshot_name
+printf '%s\n' "$snapshot_name" >"$snapshot_marker"
+zfs snapshot -r "${pool}@${snapshot_name}"
+flock -u 9
+printf 'Created recursive Borg source snapshot %s@%s\n' "$pool" "$snapshot_name"
+
+while IFS=$'\t' read -r dataset dataset_mountpoint mounted; do
+  if [[ "$mounted" != yes ]]; then
+    printf 'Dataset %s is not mounted; refusing an incomplete backup\n' "$dataset" >&2
+    exit 65
+  fi
+  if [[ "$dataset_mountpoint" != "$mount_root" && "$dataset_mountpoint" != "$mount_root/"* ]]; then
+    printf 'Dataset %s has unexpected mountpoint %s\n' "$dataset" "$dataset_mountpoint" >&2
+    exit 65
+  fi
+
+  dataset_suffix="${dataset#"$pool"}"
+  source_path="${dataset_mountpoint}/.zfs/snapshot/${snapshot_name}"
+  target_path="${stage}${dataset_suffix}"
+  mkdir -p "$target_path"
+  mount --bind "$source_path" "$target_path"
+  mounted_targets+=("$target_path")
+  mount -o remount,bind,ro "$target_path"
+done < <(zfs list -H -o name,mountpoint,mounted -s name -r "$pool")
+
+estimated_source_bytes=0
+while IFS=$'\t' read -r source_snapshot logical_bytes; do
+  if [[ "$source_snapshot" == *"@${snapshot_name}" ]]; then
+    [[ "$logical_bytes" =~ ^[0-9]+$ ]] || {
+      printf 'Invalid logical size for Borg source snapshot %s\n' "$source_snapshot" >&2
+      exit 74
+    }
+    estimated_source_bytes=$((estimated_source_bytes + logical_bytes))
+  fi
+done < <(zfs list -H -p -t snapshot -o name,logicalreferenced -r "$pool")
+((estimated_source_bytes > 0)) || {
+  printf 'Could not estimate the Borg source snapshot size\n' >&2
+  exit 74
+}
+printf 'Estimated Borg source logical size: %s bytes (ZFS; progress percentage is approximate)\n' \
+  "$estimated_source_bytes"
+
+archive="${archive_prefix}-${timestamp}"
+readonly archive
+borg_status=0
+
+printf 'Starting Borg archive %s from snapshot %s@%s\n' "$archive" "$pool" "$snapshot_name"
+set +e
+(
+  cd /run/atlas-borg
+  run_as_borg borg --remote-path "$remote_path" --lock-wait 600 --log-json --progress create \
+    --show-rc \
+    --stats \
+    --checkpoint-interval 900 \
+    --compression "$compression" \
+    "${repository}::${archive}" \
+    source 2>&1
+) | /usr/bin/python3 -u "$progress_filter" --estimated-total-bytes "$estimated_source_bytes"
+create_pipeline_status=("${PIPESTATUS[@]}")
+set -e
+create_status=${create_pipeline_status[0]}
+if ((create_pipeline_status[1] != 0)); then
+  printf 'Borg progress logging failed with status %s\n' "${create_pipeline_status[1]}" >&2
+  exit 2
+fi
+if ((create_status >= 2)); then
+  exit "$create_status"
+fi
+borg_status=$create_status
+
+printf 'Borg archive %s created; applying retention\n' "$archive"
+set +e
+run_as_borg borg --remote-path "$remote_path" --lock-wait 600 prune \
+  --show-rc \
+  --list \
+  --glob-archives "${archive_prefix}-*" \
+  --keep-daily {{ atlas_borg_keep_daily | int }} \
+  --keep-weekly {{ atlas_borg_keep_weekly | int }} \
+  --keep-monthly {{ atlas_borg_keep_monthly | int }} \
+  "$repository"
+prune_status=$?
+set -e
+if ((prune_status >= 2)); then
+  exit "$prune_status"
+fi
+if ((prune_status > borg_status)); then
+  borg_status=$prune_status
+fi
+
+printf 'Borg retention complete; compacting repository\n'
+set +e
+run_as_borg borg --remote-path "$remote_path" --lock-wait 600 compact \
+  --show-rc \
+  "$repository"
+compact_status=$?
+set -e
+if ((compact_status >= 2)); then
+  exit "$compact_status"
+fi
+if ((compact_status > borg_status)); then
+  borg_status=$compact_status
+fi
+
+printf 'Borg backup %s completed with status %s\n' "$archive" "$borg_status"
+exit "$borg_status"

ansible/roles/profile_atlas/templates/atlas-borg-backup.timer.j2

@@ -0,0 +1,12 @@
+[Unit]
+Description=Schedule the encrypted Atlas Borg backup
+
+[Timer]
+OnCalendar={{ atlas_borg_backup_calendar }}
+Persistent=true
+RandomizedDelaySec={{ atlas_borg_randomized_delay }}
+AccuracySec=1min
+Unit=atlas-borg-backup.service
+
+[Install]
+WantedBy=timers.target

ansible/roles/profile_atlas/templates/atlas-borg-check.service.j2

@@ -0,0 +1,32 @@
+[Unit]
+Description=Check the encrypted Atlas Borg repository
+Documentation=man:borg-check(1)
+Wants=network-online.target
+After=network-online.target atlas-borg-backup.service
+ConditionFileIsExecutable=/usr/local/sbin/atlas-borg-check
+ConditionPathExists={{ atlas_borg_passphrase_path }}
+ConditionPathExists={{ atlas_borg_ssh_private_key_path }}
+ConditionPathExists={{ atlas_borg_known_hosts_path }}
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/atlas-borg-check
+User={{ atlas_borg_username }}
+Group={{ atlas_borg_group }}
+UMask=0077
+SuccessExitStatus=1
+TimeoutStartSec=infinity
+Nice=15
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths={{ atlas_borg_cache_dir }} {{ atlas_borg_config_dir }}
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictRealtime=true
+LockPersonality=true

ansible/roles/profile_atlas/templates/atlas-borg-check.sh.j2

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+export LC_ALL=C
+export PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export BORG_CACHE_DIR={{ atlas_borg_cache_dir | quote }}
+export BORG_CONFIG_DIR={{ atlas_borg_config_dir | quote }}
+export BORG_PASSCOMMAND={{ ('cat ' ~ atlas_borg_passphrase_path) | quote }}
+export BORG_RSH={{ atlas_borg_ssh_wrapper_path | quote }}
+
+readonly repository={{ ('ssh://' ~ atlas_borg_repository_user ~ '@' ~ atlas_borg_repository_host
+  ~ ':' ~ (atlas_borg_repository_port | string) ~ '/' ~ atlas_borg_repository_path) | quote }}
+readonly remote_path={{ atlas_borg_remote_path | quote }}
+readonly archive_prefix={{ atlas_borg_archive_prefix | quote }}
+readonly borg_lock={{ atlas_borg_lock_path | quote }}
+
+exec 8>"$borg_lock"
+flock 8
+
+exec borg --remote-path "$remote_path" --lock-wait 600 check \
+  --show-rc \
+  --glob-archives "${archive_prefix}-*" \
+  "$repository"

ansible/roles/profile_atlas/templates/atlas-borg-check.timer.j2

@@ -0,0 +1,12 @@
+[Unit]
+Description=Schedule checks of the encrypted Atlas Borg repository
+
+[Timer]
+OnCalendar={{ atlas_borg_check_calendar }}
+Persistent=true
+RandomizedDelaySec={{ atlas_borg_randomized_delay }}
+AccuracySec=1min
+Unit=atlas-borg-check.service
+
+[Install]
+WantedBy=timers.target

ansible/roles/profile_atlas/templates/atlas-borg-snapshot-cleanup.sh.j2

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+export PATH=/usr/sbin:/usr/bin:/sbin:/bin
+
+readonly pool={{ atlas_zfs_pool | quote }}
+readonly mount_root={{ atlas_mount_root | quote }}
+readonly snapshot_prefix={{ atlas_borg_snapshot_prefix | quote }}
+readonly marker=/run/atlas-borg/snapshot-name
+
+[[ -e "$marker" ]] || exit 0
+[[ -f "$marker" && ! -L "$marker" ]] || {
+  printf 'Unsafe Atlas Borg snapshot marker; leaving snapshots unchanged\n' >&2
+  exit 2
+}
+IFS= read -r snapshot_name <"$marker"
+[[ "$snapshot_name" =~ ^${snapshot_prefix}-[0-9]{8}T[0-9]{6}Z$ ]] || {
+  printf 'Invalid Atlas Borg snapshot marker; leaving snapshots unchanged\n' >&2
+  exit 2
+}
+
+exec 9>/run/lock/atlas-zfs-snapshot.lock
+flock 9
+if zfs list -H -t snapshot -o name "${pool}@${snapshot_name}" >/dev/null 2>&1; then
+  # The private bind mounts are gone, but ZFS may leave its on-demand
+  # .zfs/snapshot mounts in the host namespace until explicitly unmounted.
+  snapshot_mounts=()
+  snapshot_sources=()
+  while IFS=$'\t' read -r dataset dataset_mountpoint; do
+    [[ "$dataset_mountpoint" == "$mount_root" || "$dataset_mountpoint" == "$mount_root/"* ]] || continue
+    snapshot_mounts+=("${dataset_mountpoint}/.zfs/snapshot/${snapshot_name}")
+    snapshot_sources+=("${dataset}@${snapshot_name}")
+  done < <(zfs list -H -o name,mountpoint -s name -r "$pool")
+
+{% raw %}
+  for ((index = ${#snapshot_mounts[@]} - 1; index >= 0; index--)); do
+{% endraw %}
+    mounted_source="$(findmnt -rn -M "${snapshot_mounts[$index]}" -o SOURCE || true)"
+    [[ -n "$mounted_source" ]] || continue
+    [[ "$mounted_source" == "${snapshot_sources[$index]}" ]] || {
+      printf 'Unexpected source on Atlas Borg snapshot mount: %s\n' \
+        "${snapshot_mounts[$index]}" >&2
+      exit 2
+    }
+    umount "${snapshot_mounts[$index]}"
+  done
+
+  zfs destroy -r "${pool}@${snapshot_name}"
+  printf 'Removed recursive Atlas Borg source snapshot %s@%s after backup exit\n' \
+    "$pool" "$snapshot_name"
+fi

ansible/roles/profile_atlas/templates/atlas-borg-ssh.sh.j2

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Borg receives CAP_DAC_READ_SEARCH only for local snapshot traversal. Drop it
+# before starting the network transport so SSH runs as the plain service user.
+exec setpriv \
+  --inh-caps=-all \
+  --ambient-caps=-all \
+  -- /usr/bin/ssh \
+  -i {{ atlas_borg_ssh_private_key_path | quote }} \
+  -p {{ atlas_borg_repository_port | int }} \
+  -o BatchMode=yes \
+  -o IdentitiesOnly=yes \
+  -o StrictHostKeyChecking=yes \
+  -o UserKnownHostsFile={{ atlas_borg_known_hosts_path | quote }} \
+  -o ConnectTimeout=30 \
+  -o ServerAliveInterval=60 \
+  -o ServerAliveCountMax=3 \
+  "$@"

ansible/roles/profile_atlas/templates/atlas-health-monitor.json.j2

@@ -0,0 +1,20 @@
+{
+  "pool": {{ atlas_zfs_pool | to_json }},
+  "backup_dataset": {{ (atlas_zfs_pool ~ '/' ~ atlas_zfs_dataset_backup) | to_json }},
+  "notifier": {{ atlas_monitor_notifier | to_json }},
+  "smart_devices": {{ atlas_monitor_smart_devices | to_json }},
+  "timers": {{ atlas_monitor_timers | to_json }},
+  "failure_units": {{ atlas_monitor_failure_units | to_json }},
+  "remote_capacity": {{ atlas_monitor_remote_capacity | to_json }},
+  "pool_warning_percent": {{ atlas_monitor_pool_warning_percent | int }},
+  "pool_critical_percent": {{ atlas_monitor_pool_critical_percent | int }},
+  "root_warning_percent": {{ atlas_monitor_root_warning_percent | int }},
+  "root_critical_percent": {{ atlas_monitor_root_critical_percent | int }},
+  "snapshot_warning_percent": {{ atlas_monitor_snapshot_warning_percent | int }},
+  "snapshot_critical_percent": {{ atlas_monitor_snapshot_critical_percent | int }},
+  "snapshot_growth_warning_gib_day": {{ atlas_monitor_snapshot_growth_warning_gib_day | int }},
+  "backup_growth_warning_gib_day": {{ atlas_monitor_backup_growth_warning_gib_day | int }},
+  "cpu_warning_c": {{ atlas_monitor_cpu_warning_c | int }},
+  "cpu_critical_c": {{ atlas_monitor_cpu_critical_c | int }},
+  "borg_max_runtime_days": {{ atlas_monitor_borg_max_runtime_days | int }}
+}

ansible/roles/profile_atlas/templates/atlas-health-monitor.service.j2

@@ -0,0 +1,25 @@
+[Unit]
+Description=Check Atlas pool, disks, capacity, temperatures and maintenance jobs
+Wants=houston-dbus.service network-online.target
+After=zfs.target houston-dbus.service network-online.target
+ConditionFileIsExecutable=/usr/local/libexec/atlas-health-monitor
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/libexec/atlas-health-monitor
+User=root
+Group=root
+UMask=0077
+StateDirectory=atlas-health-monitor
+StateDirectoryMode=0700
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/var/lib/atlas-health-monitor
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictRealtime=true
+LockPersonality=true

ansible/roles/profile_atlas/templates/atlas-health-monitor.timer.j2

@@ -0,0 +1,11 @@
+[Unit]
+Description=Schedule Atlas health checks
+
+[Timer]
+OnCalendar={{ atlas_monitor_calendar }}
+Persistent=true
+RandomizedDelaySec=5min
+Unit=atlas-health-monitor.service
+
+[Install]
+WantedBy=timers.target

ansible/roles/profile_atlas/templates/atlas-immich-machine-learning.container.j2

@@ -0,0 +1,27 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas Immich machine learning
+
+[Container]
+ContainerName=atlas-immich-machine-learning
+Image={{ atlas_immich_machine_learning_image }}
+User={{ atlas_immich_uid }}:{{ atlas_immich_gid }}
+{% for group_name in atlas_immich_supplementary_groups %}
+GroupAdd={{ ansible_facts['getent_group'][group_name][1] }}
+{% endfor %}
+AddDevice=/dev/dri
+Network=atlas-media.network
+NetworkAlias=atlas-immich-machine-learning
+Environment=TZ={{ atlas_timezone }}
+Volume={{ atlas_immich_model_cache_dir }}:/cache:Z
+Volume={{ atlas_immich_machine_learning_config_dir }}:/.config:Z
+Volume={{ atlas_immich_machine_learning_cache_dir }}:/.cache:Z
+NoNewPrivileges=true
+DropCapability=NET_RAW
+
+[Service]
+Restart=always
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_atlas/templates/atlas-immich-postgres.container.j2

@@ -0,0 +1,22 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas Immich PostgreSQL database
+
+[Container]
+ContainerName=atlas-immich-postgres
+Image={{ atlas_immich_postgres_image }}
+User={{ atlas_immich_uid }}:{{ atlas_immich_gid }}
+Network=atlas-media.network
+NetworkAlias=atlas-immich-postgres
+EnvironmentFile=/etc/immich/immich.env
+Volume={{ atlas_immich_postgres_data_dir }}:/var/lib/postgresql/data:Z
+ShmSize=128m
+NoNewPrivileges=true
+DropCapability=NET_RAW
+
+[Service]
+Restart=always
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_atlas/templates/atlas-immich-redis.container.j2

@@ -0,0 +1,20 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas Immich Redis-compatible cache
+
+[Container]
+ContainerName=atlas-immich-redis
+Image={{ atlas_immich_redis_image }}
+User={{ atlas_immich_uid }}:{{ atlas_immich_gid }}
+Network=atlas-media.network
+NetworkAlias=atlas-immich-redis
+Volume={{ atlas_immich_redis_data_dir }}:/data:Z
+NoNewPrivileges=true
+DropCapability=NET_RAW
+
+[Service]
+Restart=always
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_atlas/templates/atlas-immich-server.container.j2

@@ -0,0 +1,29 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas Immich server
+Requires=atlas-immich-redis.service atlas-immich-postgres.service atlas-immich-machine-learning.service
+After=atlas-immich-redis.service atlas-immich-postgres.service atlas-immich-machine-learning.service
+
+[Container]
+ContainerName=atlas-immich-server
+Image={{ atlas_immich_server_image }}
+User={{ atlas_immich_uid }}:{{ atlas_immich_gid }}
+{% for group_name in atlas_immich_supplementary_groups %}
+GroupAdd={{ ansible_facts['getent_group'][group_name][1] }}
+{% endfor %}
+AddDevice=/dev/dri
+Network=atlas-media.network
+NetworkAlias=atlas-immich-server
+EnvironmentFile=/etc/immich/immich.env
+Volume={{ atlas_immich_upload_dir }}:/data:Z
+Volume={{ atlas_photobook_mountpoint }}:/external/photobook:ro,Z
+Volume=/etc/localtime:/etc/localtime:ro
+NoNewPrivileges=true
+DropCapability=NET_RAW
+
+[Service]
+Restart=always
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_atlas/templates/atlas-media.network.j2

@@ -0,0 +1,3 @@
+# Managed by Ansible. Do not edit manually.
+[Network]
+NetworkName=atlas-media

ansible/roles/profile_atlas/templates/atlas-monitor-failure.conf.j2

@@ -0,0 +1,2 @@
+[Unit]
+OnFailure=atlas-monitor-failure@%n.service

ansible/roles/profile_atlas/templates/atlas-monitor-failure@.service.j2

@@ -0,0 +1,19 @@
+[Unit]
+Description=Submit a 45Drives Alert for failed Atlas job %I
+Requires=houston-dbus.service
+After=houston-dbus.service
+ConditionFileIsExecutable=/usr/local/libexec/atlas-health-monitor
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/libexec/atlas-health-monitor --job-failed %I
+User=root
+Group=root
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+RestrictAddressFamilies=AF_UNIX
+RestrictRealtime=true
+LockPersonality=true

ansible/roles/profile_atlas/templates/atlas-npm.container.j2

@@ -0,0 +1,21 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas Nginx Proxy Manager
+
+[Container]
+ContainerName=atlas-npm
+Image={{ atlas_npm_image }}
+Network=atlas-media.network
+NetworkAlias=atlas-npm
+PublishPort=80:80
+PublishPort=443:443
+PublishPort={{ atlas_npm_admin_bind_address }}:81:81
+Volume={{ atlas_npm_data_dir }}:/data:Z
+Volume={{ atlas_npm_letsencrypt_dir }}:/etc/letsencrypt:Z
+
+[Service]
+Restart=always
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target

ansible/roles/profile_atlas/templates/atlas-syncthing.service.j2

@@ -1,16 +0,0 @@
-[Unit]
-Description=Atlas Syncthing service
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-User={{ atlas_admin_username }}
-Group={{ atlas_admin_group }}
-WorkingDirectory={{ atlas_syncthing_mountpoint }}
-Environment=HOME={{ atlas_syncthing_mountpoint }}
-ExecStart=/usr/local/bin/syncthing serve --no-browser --no-restart --no-upgrade --home={{ atlas_syncthing_config_dir }}
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target

ansible/roles/profile_atlas/templates/atlas-usb-backup.service.j2

@@ -0,0 +1,30 @@
+[Unit]
+Description=Run a manual, UUID-bound offline USB backup of Atlas ZFS datasets
+Requires=zfs.target
+After=zfs.target
+ConditionFileIsExecutable=/usr/local/sbin/atlas-usb-backup
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/atlas-usb-backup
+ExecStopPost=+/usr/local/sbin/atlas-usb-snapshot-cleanup
+User=root
+Group=root
+UMask=0077
+TimeoutStartSec=infinity
+RuntimeDirectory=atlas-usb-backup
+RuntimeDirectoryMode=0700
+Nice=15
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+PrivateMounts=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/run/atlas-usb-backup /run/lock
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX
+RestrictRealtime=true
+LockPersonality=true

ansible/roles/profile_atlas/templates/atlas-usb-backup.sh.j2

@@ -0,0 +1,242 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+export LC_ALL=C.utf8
+export PATH=/usr/sbin:/usr/bin:/sbin:/bin
+
+readonly pool={{ atlas_zfs_pool | quote }}
+readonly mount_root={{ atlas_mount_root | quote }}
+readonly luks_uuid={{ atlas_usb_backup_luks_uuid | quote }}
+readonly fs_uuid={{ atlas_usb_backup_fs_uuid | quote }}
+readonly mapper_name={{ atlas_usb_backup_mapper_name | quote }}
+readonly snapshot_prefix={{ atlas_usb_backup_snapshot_prefix | quote }}
+readonly min_free_bytes={{ atlas_usb_backup_min_free_bytes | int }}
+readonly mapper="/dev/mapper/${mapper_name}"
+readonly outer="/dev/disk/by-uuid/${luks_uuid}"
+readonly runtime_dir=/run/atlas-usb-backup
+readonly snapshot_marker="${runtime_dir}/snapshot-name"
+readonly source_dir="${runtime_dir}/source"
+readonly usb_mount="${runtime_dir}/target"
+readonly backup_root="${usb_mount}/atlas"
+
+snapshot_name=""
+mapper_opened_by_script=false
+usb_mounted=false
+published=false
+partial=""
+mounted_targets=()
+
+# shellcheck disable=SC2329
+cleanup() {
+  local status=$?
+  local cleanup_status=0
+  local index
+  local source_mount_failed=false
+  trap - EXIT HUP INT TERM
+  set +e
+
+  if [[ -n "$partial" && "$published" == false && "$usb_mounted" == true ]]; then
+    rm -rf -- "$partial" || cleanup_status=2
+  fi
+  if [[ "$usb_mounted" == true ]]; then
+    umount "$usb_mount" || cleanup_status=2
+  fi
+
+{% raw %}
+  for ((index = ${#mounted_targets[@]} - 1; index >= 0; index--)); do
+{% endraw %}
+    if mountpoint -q "${mounted_targets[$index]}" && ! umount -R "${mounted_targets[$index]}"; then
+      printf 'Source snapshot mount cleanup failed: %s\n' "${mounted_targets[$index]}" >&2
+      source_mount_failed=true
+    fi
+    if mountpoint -q "${mounted_targets[$index]}"; then
+      printf 'Source snapshot mount is still active: %s\n' "${mounted_targets[$index]}" >&2
+      source_mount_failed=true
+    else
+      rmdir -- "${mounted_targets[$index]}" 2>/dev/null || true
+    fi
+  done
+  if [[ "$source_mount_failed" == false ]]; then
+    rmdir -- "$source_dir" 2>/dev/null || true
+  else
+    cleanup_status=2
+    printf 'Source bind mount cleanup failed; keeping the snapshot for recovery\n' >&2
+  fi
+
+  if [[ "$usb_mounted" == true || "$mapper_opened_by_script" == true ]] &&
+      ! mountpoint -q "$usb_mount" &&
+      ! findmnt -rn -S "$mapper" >/dev/null; then
+    cryptsetup close "$mapper_name" || cleanup_status=2
+  fi
+  rmdir -- "$usb_mount" 2>/dev/null || true
+
+  if ((status == 0 && cleanup_status != 0)); then
+    status=$cleanup_status
+  fi
+  exit "$status"
+}
+
+trap cleanup EXIT
+trap 'exit 143' HUP INT TERM
+
+exec 8>/run/lock/atlas-usb-backup.lock
+flock -n 8 || { printf 'Atlas USB backup is already running\n' >&2; exit 75; }
+exec 9>/run/lock/atlas-zfs-snapshot.lock
+
+zpool list -H -o name "$pool" >/dev/null
+[[ -b "$outer" ]] || { printf 'Configured LUKS UUID is not connected\n' >&2; exit 66; }
+[[ "$(blkid -s TYPE -o value "$outer")" == crypto_LUKS ]] || {
+  printf 'Configured outer UUID is not a LUKS container\n' >&2
+  exit 65
+}
+[[ "$(blkid -s UUID -o value "$outer")" == "$luks_uuid" ]] || exit 65
+if ! cryptsetup status "$mapper_name" >/dev/null; then
+  printf 'Requesting the LUKS passphrase for the configured USB disk\n'
+  systemd-ask-password -n --no-tty --timeout=300 \
+    --id="atlas-usb-backup:${luks_uuid}" \
+    'Atlas offline USB backup LUKS passphrase:' |
+    cryptsetup open --type luks2 --key-file - "$outer" "$mapper_name"
+  mapper_opened_by_script=true
+fi
+backing_device="$(cryptsetup status "$mapper_name" | awk '$1 == "device:" { print $2 }')"
+[[ -n "$backing_device" && "$(readlink -f "$backing_device")" == "$(readlink -f "$outer")" ]] || {
+  printf 'The unlocked mapper does not belong to the configured LUKS UUID\n' >&2
+  exit 65
+}
+[[ "$(blkid -s TYPE -o value "$mapper")" == ext4 ]] || {
+  printf 'The unlocked USB filesystem is not ext4\n' >&2
+  exit 65
+}
+[[ "$(blkid -s UUID -o value "$mapper")" == "$fs_uuid" ]] || {
+  printf 'The unlocked USB filesystem UUID does not match\n' >&2
+  exit 65
+}
+if findmnt -rn -S "$mapper" >/dev/null; then
+  printf 'The USB filesystem is already mounted elsewhere\n' >&2
+  exit 65
+fi
+[[ ! -e "$source_dir" && ! -e "$usb_mount" ]] || {
+  printf 'USB backup staging directories already exist; inspect them manually\n' >&2
+  exit 65
+}
+
+mkdir -m 0700 "$usb_mount"
+mount -t ext4 -o nodev,nosuid,noexec "$mapper" "$usb_mount"
+usb_mounted=true
+[[ "$(readlink -f "$(findmnt -nro SOURCE --target "$usb_mount")")" == "$(readlink -f "$mapper")" ]] || {
+  printf 'Mounted USB source does not match the verified mapper\n' >&2
+  exit 65
+}
+
+for path in "$backup_root" "$backup_root/snapshots"; do
+  [[ ! -L "$path" ]] || { printf 'Unsafe symlink in USB backup destination\n' >&2; exit 65; }
+  mkdir -p -- "$path"
+  [[ -d "$path" ]] || exit 65
+  chown root:root -- "$path"
+  chmod 0700 -- "$path"
+done
+
+free_bytes="$(df -B1 --output=avail "$usb_mount" | tail -n 1 | tr -d ' ')"
+if ((free_bytes < min_free_bytes)); then
+  printf 'USB free space (%s bytes) is below the required reserve (%s bytes)\n' \
+    "$free_bytes" "$min_free_bytes" >&2
+  exit 73
+fi
+
+mkdir -m 0700 "$source_dir"
+flock 9
+timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+snapshot_name="${snapshot_prefix}-${timestamp}-$$"
+printf '%s\n' "$snapshot_name" >"$snapshot_marker"
+zfs snapshot -r "${pool}@${snapshot_name}"
+flock -u 9
+printf 'Created recursive USB source snapshot %s@%s\n' "$pool" "$snapshot_name"
+
+while IFS=$'\t' read -r dataset dataset_mountpoint mounted; do
+  if [[ "$mounted" != yes ]]; then
+    printf 'Dataset %s is not mounted; refusing an incomplete backup\n' "$dataset" >&2
+    exit 65
+  fi
+  if [[ "$dataset_mountpoint" != "$mount_root" && "$dataset_mountpoint" != "$mount_root/"* ]]; then
+    printf 'Dataset %s has unexpected mountpoint %s\n' "$dataset" "$dataset_mountpoint" >&2
+    exit 65
+  fi
+  dataset_suffix="${dataset#"$pool"}"
+  source_path="${dataset_mountpoint}/.zfs/snapshot/${snapshot_name}"
+  target_path="${source_dir}${dataset_suffix}"
+  mkdir -p "$target_path"
+  mount --bind "$source_path" "$target_path"
+  mounted_targets+=("$target_path")
+  mount -o remount,bind,ro "$target_path"
+done < <(zfs list -H -o name,mountpoint,mounted -s name -r "$pool")
+
+previous=""
+if [[ -e "$backup_root/latest" || -L "$backup_root/latest" ]]; then
+  [[ -L "$backup_root/latest" ]] || { printf 'latest is not a symlink\n' >&2; exit 65; }
+  previous="$(readlink -e "$backup_root/latest")"
+  [[ -n "$previous" && "$previous" == "$backup_root/snapshots/"* && -d "$previous" ]] || {
+    printf 'latest does not point to a complete snapshot on the USB disk\n' >&2
+    exit 65
+  }
+fi
+
+backup_name="${timestamp}-$$"
+candidate_partial="${backup_root}/snapshots/.incomplete-${backup_name}"
+complete="${backup_root}/snapshots/${backup_name}"
+[[ ! -e "$candidate_partial" && ! -L "$candidate_partial" && ! -e "$complete" && ! -L "$complete" ]] || exit 65
+mkdir -m 0700 "$candidate_partial"
+partial="$candidate_partial"
+
+printf 'Copying the consistent pool tree to USB backup %s\n' "$backup_name"
+# Preserve POSIX ACLs, ownership, modes, timestamps, hard links, and sparse
+# files.  Do not preserve generic xattrs: Rocky 9's rsync 3.2.7 fails when
+# combining xattrs with --link-dest, while SELinux labels were intentionally
+# excluded because restores must relabel for their destination host.
+rsync_args=(-aHAS --numeric-ids "--info=progress2,stats2")
+estimate_args=(-aHAS --numeric-ids --dry-run --stats)
+if [[ -n "$previous" ]]; then
+  rsync_args+=("--link-dest=$previous")
+  estimate_args+=("--link-dest=$previous")
+fi
+
+# The rsync dry run estimates changed file bytes after link-dest deduplication.
+# Metadata and filesystem allocation still require the separate free-space reserve.
+estimate="$(rsync "${estimate_args[@]}" "${source_dir}/" "${partial}/")"
+transfer_bytes="$(printf '%s\n' "$estimate" | awk -F: \
+  '/^Total transferred file size:/ { gsub(/[^0-9]/, "", $2); print $2 }')"
+[[ "$transfer_bytes" =~ ^[0-9]+$ ]] || {
+  printf 'Could not determine the USB transfer size\n' >&2
+  exit 74
+}
+if ((free_bytes - transfer_bytes < min_free_bytes)); then
+  printf 'Insufficient USB space: %s bytes free, %s estimated transfer, %s reserved\n' \
+    "$free_bytes" "$transfer_bytes" "$min_free_bytes" >&2
+  exit 73
+fi
+
+rsync "${rsync_args[@]}" "${source_dir}/" "${partial}/"
+
+printf 'Verifying USB backup %s with a checksum-based dry run\n' "$backup_name"
+verification="${runtime_dir}/verification.out"
+rsync -aHAS --numeric-ids \
+  --checksum --dry-run --delete --itemize-changes \
+  "${source_dir}/" "${partial}/" >"$verification"
+if [[ -s "$verification" ]]; then
+  printf 'USB verification found mismatches; refusing to publish the backup\n' >&2
+  exit 74
+fi
+
+free_bytes="$(df -B1 --output=avail "$usb_mount" | tail -n 1 | tr -d ' ')"
+if ((free_bytes < min_free_bytes)); then
+  printf 'USB backup completed below the free-space reserve; refusing to publish it\n' >&2
+  exit 73
+fi
+
+mv -- "$partial" "$complete"
+partial=""
+ln -s "snapshots/${backup_name}" "${backup_root}/.latest-${backup_name}"
+mv -Tf -- "${backup_root}/.latest-${backup_name}" "${backup_root}/latest"
+published=true
+sync -f "$complete"
+sync -f "$backup_root"
+printf 'USB backup %s verified and published; unmounting and closing LUKS\n' "$backup_name"

ansible/roles/profile_atlas/templates/atlas-usb-reminder.py.j2

@@ -0,0 +1,31 @@
+#!/usr/bin/python3
+"""Submit a manual-backup reminder through Atlas' existing Houston notifier."""
+
+import json
+import subprocess
+from datetime import datetime, timezone
+
+
+now = datetime.now(timezone.utc)
+message = {
+    "timestamp": now.isoformat(timespec="seconds"),
+    "unixtime": int(now.timestamp()),
+    "event": "atlas_usb_backup_reminder",
+    "severity": "warning",
+    "subject": "Promemoria backup USB offline Atlas",
+    "email_message": (
+        "Collega il disco USB di backup ad Atlas ed esegui manualmente il backup offline.\n"
+        "Il promemoria non avvia il backup. Controlla che il disco non sia\n"
+        "montato; poi esegui:\n\n"
+        "  sudo systemctl start atlas-usb-backup.service\n\n"
+        "Verifica l'esito con:\n"
+        "  sudo journalctl -u atlas-usb-backup.service -n 100 --no-pager\n\n"
+        "Dopo la riuscita, scollega fisicamente il disco."
+    ),
+}
+
+subprocess.run(
+    [{{ atlas_usb_reminder_notifier | to_json }}, json.dumps(message)],
+    check=True,
+)
+print("Atlas USB backup reminder submitted to 45Drives Alerts; email delivery is not verified.", flush=True)

ansible/roles/profile_atlas/templates/atlas-usb-reminder.service.j2

@@ -0,0 +1,22 @@
+[Unit]
+Description=45Drives Alerts reminder to run the manual Atlas offline USB backup
+Requires=houston-dbus.service
+After=houston-dbus.service
+ConditionFileIsExecutable=/usr/local/libexec/atlas-usb-reminder
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/libexec/atlas-usb-reminder
+User=root
+Group=root
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictAddressFamilies=AF_UNIX
+RestrictRealtime=true
+LockPersonality=true

ansible/roles/profile_atlas/templates/atlas-usb-reminder.timer.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Remind the administrator to run the manual Atlas offline USB backup
+
+[Timer]
+OnCalendar={{ atlas_usb_reminder_calendar }}
+Persistent=true
+Unit=atlas-usb-reminder.service
+
+[Install]
+WantedBy=timers.target

ansible/roles/profile_atlas/templates/atlas-usb-snapshot-cleanup.sh.j2

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+export PATH=/usr/sbin:/usr/bin:/sbin:/bin
+
+readonly pool={{ atlas_zfs_pool | quote }}
+readonly mount_root={{ atlas_mount_root | quote }}
+readonly snapshot_prefix={{ atlas_usb_backup_snapshot_prefix | quote }}
+readonly marker=/run/atlas-usb-backup/snapshot-name
+
+[[ -e "$marker" ]] || exit 0
+[[ -f "$marker" && ! -L "$marker" ]] || {
+  printf 'Unsafe Atlas USB snapshot marker; leaving snapshots unchanged\n' >&2
+  exit 2
+}
+IFS= read -r snapshot_name <"$marker"
+[[ "$snapshot_name" =~ ^${snapshot_prefix}-[0-9]{8}T[0-9]{6}Z-[0-9]+$ ]] || {
+  printf 'Invalid Atlas USB snapshot marker; leaving snapshots unchanged\n' >&2
+  exit 2
+}
+
+exec 9>/run/lock/atlas-zfs-snapshot.lock
+flock 9
+if zfs list -H -t snapshot -o name "${pool}@${snapshot_name}" >/dev/null 2>&1; then
+  # ZFS can leave its on-demand .zfs/snapshot mounts in the host namespace
+  # even after the backup's private bind mounts and process have exited.
+  snapshot_mounts=()
+  snapshot_sources=()
+  while IFS=$'\t' read -r dataset dataset_mountpoint; do
+    [[ "$dataset_mountpoint" == "$mount_root" || "$dataset_mountpoint" == "$mount_root/"* ]] || continue
+    snapshot_mounts+=("${dataset_mountpoint}/.zfs/snapshot/${snapshot_name}")
+    snapshot_sources+=("${dataset}@${snapshot_name}")
+  done < <(zfs list -H -o name,mountpoint -s name -r "$pool")
+
+{% raw %}
+  for ((index = ${#snapshot_mounts[@]} - 1; index >= 0; index--)); do
+{% endraw %}
+    mounted_source="$(findmnt -rn -M "${snapshot_mounts[$index]}" -o SOURCE || true)"
+    [[ -n "$mounted_source" ]] || continue
+    [[ "$mounted_source" == "${snapshot_sources[$index]}" ]] || {
+      printf 'Unexpected source on Atlas USB snapshot mount: %s\n' \
+        "${snapshot_mounts[$index]}" >&2
+      exit 2
+    }
+    umount "${snapshot_mounts[$index]}"
+  done
+
+  zfs destroy -r "${pool}@${snapshot_name}"
+  printf 'Removed recursive Atlas USB source snapshot %s@%s after backup exit\n' \
+    "$pool" "$snapshot_name"
+fi

ansible/roles/profile_atlas/templates/atlas-zfs-scrub-timer.conf.j2

@@ -0,0 +1,6 @@
+[Timer]
+OnCalendar=
+OnCalendar={{ atlas_zfs_scrub_calendar }}
+Persistent=true
+RandomizedDelaySec=0
+AccuracySec=1min

ansible/roles/profile_atlas/templates/atlas-zfs-snapshot.sh.j2

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export LC_ALL=C
+export PATH=/usr/sbin:/usr/bin:/sbin:/bin
+
+if [[ $# -ne 1 ]]; then
+  printf 'Usage: %s <policy>\n' "$0" >&2
+  exit 64
+fi
+
+readonly pool={{ atlas_zfs_pool | quote }}
+readonly prefix={{ atlas_zfs_snapshot_prefix | quote }}
+readonly period="$1"
+
+case "$period" in
+{% for policy in atlas_zfs_snapshot_policies %}
+  {{ policy.name | quote }})
+    keep={{ policy.keep | int }}
+    ;;
+{% endfor %}
+  *)
+    printf 'Unknown Atlas ZFS snapshot policy: %s\n' "$period" >&2
+    exit 64
+    ;;
+esac
+readonly keep
+
+zpool list -H -o name "$pool" >/dev/null
+
+exec 9>/run/lock/atlas-zfs-snapshot.lock
+flock 9
+
+timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+readonly timestamp
+readonly snapshot_prefix="${pool}@${prefix}-${period}-"
+readonly snapshot="${snapshot_prefix}${timestamp}"
+
+zfs snapshot -r "$snapshot"
+printf 'Created recursive ZFS snapshot %s\n' "$snapshot"
+
+snapshot_listing="$(zfs list -H -t snapshot -o name -s creation -r "$pool")"
+managed_snapshots=()
+while IFS= read -r snapshot_name; do
+  if [[ "$snapshot_name" == "$snapshot_prefix"* ]]; then
+    snapshot_suffix="${snapshot_name#"$snapshot_prefix"}"
+    if [[ "$snapshot_suffix" =~ ^[0-9]{8}T[0-9]{6}Z$ ]]; then
+      managed_snapshots+=("$snapshot_name")
+    fi
+  fi
+done <<< "$snapshot_listing"
+
+{% raw %}
+managed_snapshot_count="${#managed_snapshots[@]}"
+{% endraw %}
+prune_count=$((managed_snapshot_count - keep))
+if ((prune_count <= 0)); then
+  printf 'Retaining %d of %d managed %s snapshots\n' \
+    "$managed_snapshot_count" "$keep" "$period"
+  exit 0
+fi
+
+for ((index = 0; index < prune_count; index++)); do
+  candidate="${managed_snapshots[$index]}"
+  if [[ "$candidate" != "$snapshot_prefix"* ]]; then
+    printf 'Refusing to destroy unexpected snapshot: %s\n' "$candidate" >&2
+    exit 65
+  fi
+
+  zfs destroy -r "$candidate"
+  printf 'Pruned recursive ZFS snapshot %s\n' "$candidate"
+done

ansible/roles/profile_atlas/templates/atlas-zfs-snapshot.timer.j2

@@ -0,0 +1,11 @@
+[Unit]
+Description=Schedule {{ item.name }} ZFS snapshots for {{ atlas_zfs_pool }}
+
+[Timer]
+OnCalendar={{ item.calendar }}
+Persistent=true
+AccuracySec=1min
+Unit=atlas-zfs-snapshot@{{ item.name }}.service
+
+[Install]
+WantedBy=timers.target

ansible/roles/profile_atlas/templates/atlas-zfs-snapshot@.service.j2

@@ -0,0 +1,25 @@
+[Unit]
+Description=Create and retain %i ZFS snapshots for {{ atlas_zfs_pool }}
+Documentation=man:zfs-snapshot(8) man:zfs-destroy(8)
+Requires=zfs.target
+After=zfs.target
+ConditionFileIsExecutable=/usr/local/sbin/atlas-zfs-snapshot
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/atlas-zfs-snapshot %i
+User=root
+Group=root
+UMask=0077
+Nice=10
+IOSchedulingClass=best-effort
+IOSchedulingPriority=7
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+RestrictRealtime=true
+LockPersonality=true

ansible/roles/profile_atlas/templates/atlas.exports.j2

@@ -1,4 +1,4 @@
 # Managed by Ansible. Do not edit manually.
 {% for export in atlas_nfs_exports %}
-{{ export.path }} {{ export.clients }}
+{{ export.path }} {{ export.client }}({{ export.options | join(',') }})
 {% endfor %}

ansible/roles/profile_atlas/templates/immich.env.j2

@@ -0,0 +1,13 @@
+# Managed by Ansible. Contains a Vault secret; do not edit or copy.
+TZ={{ atlas_timezone | to_json }}
+DB_HOSTNAME="atlas-immich-postgres"
+DB_USERNAME={{ atlas_immich_db_username | to_json }}
+DB_PASSWORD={{ atlas_immich_db_password | to_json }}
+DB_DATABASE_NAME={{ atlas_immich_db_name | to_json }}
+DB_VECTOR_EXTENSION="vectorchord"
+POSTGRES_USER={{ atlas_immich_db_username | to_json }}
+POSTGRES_PASSWORD={{ atlas_immich_db_password | to_json }}
+POSTGRES_DB={{ atlas_immich_db_name | to_json }}
+POSTGRES_INITDB_ARGS="--data-checksums"
+REDIS_HOSTNAME="atlas-immich-redis"
+IMMICH_MACHINE_LEARNING_URL="http://atlas-immich-machine-learning:3003"

ansible/roles/profile_atlas/templates/smb.conf.j2

@@ -3,11 +3,16 @@
   workgroup = {{ atlas_samba_workgroup }}
   security = user
   map to guest = Never
-  server min protocol = SMB2
+  server min protocol = SMB3
+  server signing = mandatory
+  smb encrypt = {{ atlas_samba_encryption }}
+  disable netbios = yes
+  smb ports = 445
+  hosts allow = {{ atlas_lan_subnet }}
   include = registry
 
 [{{ atlas_samba_share_name }}]
-  path = {{ atlas_work_mountpoint }}
+  path = {{ atlas_archive_mountpoint }}
   browseable = yes
   read only = no
   valid users = {{ atlas_samba_valid_users | join(' ') }}

ansible/roles/profile_backend_phase1/defaults/main.yml

@@ -0,0 +1,32 @@
+---
+backend_phase1_enabled: false
+backend_phase1_start_services: false
+backend_phase1_username: "{{ atlas_admin_username }}"
+backend_phase1_user_group: "{{ atlas_admin_group }}"
+backend_phase1_user_home: "{{ atlas_admin_home }}"
+backend_phase1_quadlet_dir: "{{ backend_phase1_user_home }}/.config/containers/systemd"
+backend_phase1_bind_address: CHANGEME_ATLAS_BIND_ADDRESS
+backend_phase1_firewalld_zone: public
+backend_phase1_npm_source_ip: CHANGEME_AEGIS_IP
+backend_phase1_syncthing_native_subnet: CHANGEME_LAN_SUBNET
+backend_phase1_music_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
+backend_phase1_archive_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_archive }}"
+backend_phase1_syncthing_folder_path: "{{ backend_phase1_archive_dir }}/Org"
+backend_phase1_app_data_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
+backend_phase1_navidrome_data_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
+backend_phase1_syncthing_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
+backend_phase1_music_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
+backend_phase1_archive_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_archive }}"
+backend_phase1_app_data_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
+backend_phase1_navidrome_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
+backend_phase1_syncthing_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
+backend_phase1_navidrome_image: docker.io/deluan/navidrome:0.63.2
+backend_phase1_syncthing_image: docker.io/syncthing/syncthing:2.1.3
+backend_phase1_navidrome_port: 4533
+backend_phase1_syncthing_gui_port: 8384
+backend_phase1_syncthing_transfer_port: 22000
+backend_phase1_syncthing_discovery_port: 21027
+backend_phase1_timezone: Europe/Rome
+backend_phase1_services:
+  - atlas-navidrome.service
+  - atlas-syncthing.service

ansible/roles/profile_backend_phase1/handlers/main.yml

@@ -0,0 +1,32 @@
+---
+- name: Restart Atlas Navidrome Quadlet
+  tags: [backend_phase1, navidrome, podman, services]
+  become_user: "{{ backend_phase1_username }}"
+  ansible.builtin.systemd:
+    name: atlas-navidrome.service
+    scope: user
+    state: restarted
+    daemon_reload: true
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+  when:
+    - backend_phase1_enabled | bool
+    - backend_phase1_start_services | bool
+    - not ansible_check_mode
+
+- name: Restart Atlas Syncthing Quadlet
+  tags: [backend_phase1, syncthing, podman, services]
+  become_user: "{{ backend_phase1_username }}"
+  ansible.builtin.systemd:
+    name: atlas-syncthing.service
+    scope: user
+    state: restarted
+    daemon_reload: true
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+  when:
+    - backend_phase1_enabled | bool
+    - backend_phase1_start_services | bool
+    - not ansible_check_mode

ansible/roles/profile_backend_phase1/tasks/main.yml

@@ -0,0 +1,188 @@
+---
+- name: Configure Atlas phase-one backend services
+  tags: [backend_phase1, podman]
+  when: backend_phase1_enabled | bool
+  block:
+    - name: Validate phase-one backend inputs
+      ansible.builtin.assert:
+        that:
+          - not (atlas_manage_media_stack | bool)
+          - backend_phase1_bind_address != 'CHANGEME_ATLAS_BIND_ADDRESS'
+          - backend_phase1_bind_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}$')
+          - backend_phase1_firewalld_zone | length > 0
+          - backend_phase1_npm_source_ip != 'CHANGEME_AEGIS_IP'
+          - backend_phase1_syncthing_native_subnet != 'CHANGEME_LAN_SUBNET'
+          - backend_phase1_music_dir.startswith('/')
+          - backend_phase1_archive_dir.startswith('/')
+          - backend_phase1_syncthing_folder_path.startswith(backend_phase1_archive_dir + '/')
+          - backend_phase1_app_data_root.startswith('/')
+          - backend_phase1_navidrome_data_dir.startswith(backend_phase1_app_data_root + '/')
+          - backend_phase1_syncthing_root.startswith(backend_phase1_app_data_root + '/')
+        fail_msg: >-
+          Disable the rootful media-stack gate and provide the Atlas LAN bind
+          address, firewall sources, and absolute ZFS-backed paths before
+          enabling phase one. This role does not manage Prometheus or migrate
+          application data.
+
+    - name: Read the rootless service account
+      ansible.builtin.getent:
+        database: passwd
+        key: "{{ backend_phase1_username }}"
+
+    - name: Record rootless service account IDs
+      ansible.builtin.set_fact:
+        backend_phase1_uid: "{{ ansible_facts['getent_passwd'][backend_phase1_username][1] }}"
+        backend_phase1_gid: "{{ ansible_facts['getent_passwd'][backend_phase1_username][2] }}"
+
+    - name: Read system service state before starting rootless Syncthing
+      ansible.builtin.service_facts:
+
+    - name: Refuse to overlap a system-level Atlas Syncthing service
+      ansible.builtin.assert:
+        that:
+          - >-
+            ansible_facts.services['atlas-syncthing.service'] is not defined
+            or ansible_facts.services['atlas-syncthing.service'].state != 'running'
+        fail_msg: >-
+          Remove or stop the system-level atlas-syncthing.service before
+          enabling the rootless Syncthing Quadlet.
+
+    - name: Inspect required ZFS datasets
+      community.general.zfs_facts:
+        name: "{{ item.dataset }}"
+        properties: name,mounted,mountpoint
+      loop:
+        - dataset: "{{ backend_phase1_music_dataset }}"
+          mountpoint: "{{ backend_phase1_music_dir }}"
+        - dataset: "{{ backend_phase1_archive_dataset }}"
+          mountpoint: "{{ backend_phase1_archive_dir }}"
+        - dataset: "{{ backend_phase1_app_data_dataset }}"
+          mountpoint: "{{ backend_phase1_app_data_root }}"
+        - dataset: "{{ backend_phase1_navidrome_dataset }}"
+          mountpoint: "{{ backend_phase1_navidrome_data_dir }}"
+        - dataset: "{{ backend_phase1_syncthing_dataset }}"
+          mountpoint: "{{ backend_phase1_syncthing_root }}"
+      loop_control:
+        label: "{{ item.dataset }}"
+      register: backend_phase1_zfs_facts
+
+    - name: Require mounted datasets at the declared paths
+      ansible.builtin.assert:
+        that:
+          - item.ansible_facts.ansible_zfs_datasets | length == 1
+          - item.ansible_facts.ansible_zfs_datasets[0].mounted == 'yes'
+          - item.ansible_facts.ansible_zfs_datasets[0].mountpoint == item.item.mountpoint
+        fail_msg: >-
+          {{ item.item.dataset }} must already be mounted at
+          {{ item.item.mountpoint }}. The phase-one role never creates or
+          imports the pool.
+      loop: "{{ backend_phase1_zfs_facts.results }}"
+      loop_control:
+        label: "{{ item.item.dataset }}"
+
+    - name: Enable lingering for the rootless service account
+      ansible.builtin.command:
+        argv:
+          - loginctl
+          - enable-linger
+          - "{{ backend_phase1_username }}"
+        creates: "/var/lib/systemd/linger/{{ backend_phase1_username }}"
+
+    - name: Start the rootless user systemd manager
+      ansible.builtin.systemd:
+        name: "user@{{ backend_phase1_uid }}.service"
+        state: started
+      when: not ansible_check_mode
+
+    - name: Create rootless Quadlet and application directories
+      ansible.builtin.file:
+        path: "{{ item.path }}"
+        state: directory
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "{{ item.mode }}"
+      loop:
+        - path: "{{ backend_phase1_quadlet_dir }}"
+          mode: "0700"
+        - path: "{{ backend_phase1_navidrome_data_dir }}"
+          mode: "0750"
+        - path: "{{ backend_phase1_syncthing_root }}"
+          mode: "0750"
+        - path: "{{ backend_phase1_syncthing_folder_path }}"
+          mode: "0770"
+      loop_control:
+        label: "{{ item.path }}"
+
+    - name: Render the rootless Navidrome Quadlet
+      ansible.builtin.template:
+        src: atlas-navidrome.container.j2
+        dest: "{{ backend_phase1_quadlet_dir }}/atlas-navidrome.container"
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "0644"
+      notify: Restart Atlas Navidrome Quadlet
+
+    - name: Render the rootless Syncthing Quadlet
+      ansible.builtin.template:
+        src: atlas-syncthing.container.j2
+        dest: "{{ backend_phase1_quadlet_dir }}/atlas-syncthing.container"
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "0644"
+      notify: Restart Atlas Syncthing Quadlet
+
+    - name: Reload the rootless user systemd manager
+      become_user: "{{ backend_phase1_username }}"
+      ansible.builtin.systemd:
+        scope: user
+        daemon_reload: true
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+      when: not ansible_check_mode
+
+    - name: Permit NPM access to phase-one web interfaces through Aegis
+      ansible.posix.firewalld:
+        rich_rule: >-
+          rule family="ipv4" source address="{{ backend_phase1_npm_source_ip }}"
+          port port="{{ item }}" protocol="tcp" accept
+        zone: "{{ backend_phase1_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+      loop:
+        - "{{ backend_phase1_navidrome_port }}"
+        - "{{ backend_phase1_syncthing_gui_port }}"
+
+    - name: Permit native Syncthing traffic from the LAN
+      ansible.posix.firewalld:
+        rich_rule: >-
+          rule family="ipv4" source address="{{ backend_phase1_syncthing_native_subnet }}"
+          port port="{{ item.port }}" protocol="{{ item.protocol }}" accept
+        zone: "{{ backend_phase1_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+      loop:
+        - port: "{{ backend_phase1_syncthing_transfer_port }}"
+          protocol: tcp
+        - port: "{{ backend_phase1_syncthing_transfer_port }}"
+          protocol: udp
+        - port: "{{ backend_phase1_syncthing_discovery_port }}"
+          protocol: udp
+
+    - name: Start rootless phase-one Quadlets
+      become_user: "{{ backend_phase1_username }}"
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        scope: user
+        state: started
+        enabled: true
+        daemon_reload: true
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+      loop: "{{ backend_phase1_services }}"
+      when:
+        - backend_phase1_start_services | bool
+        - not ansible_check_mode

ansible/roles/profile_backend_phase1/templates/atlas-navidrome.container.j2

@@ -0,0 +1,28 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas rootless Navidrome backend
+
+[Container]
+ContainerName=atlas-navidrome
+Image={{ backend_phase1_navidrome_image }}
+UserNS=keep-id
+User={{ backend_phase1_uid }}
+Group={{ backend_phase1_gid }}
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_navidrome_port }}:4533
+Environment=ND_LOGLEVEL=info
+Environment=ND_SCANSCHEDULE=1h
+Environment=ND_SESSIONTIMEOUT=24h
+Environment=ND_ENABLETRANSCODING=true
+Environment=TZ={{ backend_phase1_timezone }}
+Volume={{ backend_phase1_navidrome_data_dir }}:/data:Z
+Volume={{ backend_phase1_music_dir }}:/music:ro,z
+NoNewPrivileges=true
+DropCapability=all
+
+[Service]
+Restart=always
+RestartSec=10
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target

ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2

@@ -0,0 +1,32 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas rootless Syncthing backend
+
+[Container]
+ContainerName=atlas-syncthing
+Image={{ backend_phase1_syncthing_image }}
+HostName=atlas-syncthing
+UserNS=keep-id
+User={{ backend_phase1_uid }}
+Group={{ backend_phase1_gid }}
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_gui_port }}:{{ backend_phase1_syncthing_gui_port }}
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_transfer_port }}:{{ backend_phase1_syncthing_transfer_port }}
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_transfer_port }}:{{ backend_phase1_syncthing_transfer_port }}/udp
+PublishPort={{ backend_phase1_bind_address }}:{{ backend_phase1_syncthing_discovery_port }}:{{ backend_phase1_syncthing_discovery_port }}/udp
+Environment=HOME=/var/syncthing
+Environment=STHOMEDIR=/var/syncthing/config
+Environment=STGUIADDRESS=0.0.0.0:{{ backend_phase1_syncthing_gui_port }}
+Environment=TZ={{ backend_phase1_timezone }}
+Volume={{ backend_phase1_syncthing_root }}:/var/syncthing:Z
+# Archive is intentionally shared with Samba; use a shared SELinux container label.
+Volume={{ backend_phase1_archive_dir }}:/data:z
+NoNewPrivileges=true
+DropCapability=all
+
+[Service]
+Restart=always
+RestartSec=10
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target

ansible/roles/profile_desktop_common/tasks/main.yml

@@ -556,6 +556,30 @@
   loop_control:
     label: "{{ item.name }}"
 
+- name: Install shared AI coding agents on Void desktop
+  tags: [packages, npm, ai_agents]
+  community.general.npm:
+    name: "{{ item.value.npm_package }}"
+    global: true
+    state: latest
+  loop: "{{ ai_agents | dict2items | selectattr('value.npm_package', 'defined') | list }}"
+  when:
+    - item.value.install_enabled | bool
+  loop_control:
+    label: "{{ item.key }}"
+
+- name: Uninstall shared AI coding agents on Void desktop
+  tags: [packages, npm, ai_agents]
+  community.general.npm:
+    name: "{{ item.value.npm_package }}"
+    global: true
+    state: absent
+  loop: "{{ ai_agents | dict2items | selectattr('value.npm_package', 'defined') | list }}"
+  when:
+    - item.value.uninstall_enabled | bool
+  loop_control:
+    label: "{{ item.key }}"
+
 - name: Install desktop Python tools with uv
   tags: [packages]
   ansible.builtin.command:

ansible/roles/profile_personal_workstation/tasks/main.yml

@@ -10,15 +10,3 @@
   loop: "{{ personal_workstation_directories | default([]) }}"
   loop_control:
     label: "{{ item.path }}"
-
-- name: Copy personal workstation dotfiles
-  tags: [dotfiles, dotfiles:workstation]
-  ansible.builtin.copy:
-    src: "{{ playbook_dir }}/../dotfiles/workstation/{{ item.src }}"
-    dest: "{{ user_home }}/{{ item.dest }}"
-    owner: "{{ username }}"
-    group: "{{ user_group }}"
-    mode: "{{ item.mode }}"
-  loop: "{{ personal_workstation_dotfiles | default([]) }}"
-  loop_control:
-    label: "{{ item.dest }}"