Enable Atlas NAS management and document bootstrap workflow

Document Atlas backend phase one and WireGuard deployment
2026-09-27 11:02:47 +00:00 · 2026-09-12 18:53:21 +02:00 · 2026-09-12 17:19:20 +02:00
37 changed files with 883 additions and 597 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -55,8 +55,10 @@ Ansible-driven personal infrastructure repo for Fedora and Void desktops, Fedora
  - Server compose render: `podman-compose -f /opt/docker/server/docker-compose.yml config` and `systemctl status podman-compose-server`
  - Atlas media stack:
    `ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff`
-  - Prometheus media mount:
-    `ansible-playbook ansible/site.yml --limit prometheus --tags rclone,navidrome --check --diff`
+  - Atlas phase-one rootless services:
+    `ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff`
+  - Prometheus/Atlas WireGuard overlay:
+    `ansible-playbook ansible/site.yml --limit prometheus,atlas --tags wireguard --check --diff`
  - DuckDNS config only: `ansible-playbook ansible/site.yml --limit prometheus --tags duckdns --check --diff`

 ## Conventions
@@ -108,16 +110,13 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `rocky_server` is a child of both `platform_rocky` and `server`; `prometheus` is its active target.
 - The target must already provide `server_username` with local sudo access before the profile runs.
 - The Rocky profile installs Podman and podman-compose, uses firewalld, preserves SELinux enforcement, and renders the
-  Nginx Proxy Manager/Gitea/Navidrome-PostgreSQL Compose stack with a `podman-compose-server` systemd unit. It does not
-  start or enable that Compose stack, transfer data, update DNS, or cut over traffic; activating it remains manual.
- Prometheus has a gated system `rclone-music.service` and rootless Navidrome Quadlet. They remain disabled until the
-  Atlas WireGuard address, pinned SSH host key and Vault-backed SFTP private key are configured. The rclone mount is
-  read-only at `/mnt/music_atlas`; Navidrome must not start against the underlying empty mountpoint or while the legacy
-  rootful Navidrome container is still running. The role never removes that legacy container or its data.
+  existing Nginx Proxy Manager/Gitea Compose stack with a `podman-compose-server` systemd unit. PostgreSQL and
+  Navidrome are no longer part of the desired Prometheus configuration. The role does not stop or remove legacy
+  containers, delete `/opt/postgres/data`, start the Compose stack, update DNS, or cut over traffic.
 - Firewalld enables SSH, Cockpit (`9090/tcp`), HTTP and HTTPS. Nginx Proxy Manager publishes `80/tcp` and
  `443/tcp`; bind its administration interface only to `127.0.0.1:81` and use `npm-tunnel` from Ikaros or Nymph.
  Nextcloud remains disabled; do not provision `/srv/nextcloud` directories.
- `scripts/migrate_prometheus_data.sh` is the separate, source-host-run migration path. It dry-runs by
+- `scripts/migrate_prometheus_data.sh` is the separate, source-host-run NPM/Gitea migration path. It dry-runs by
  default and requires explicit source-stack quiescing before copying persistent Docker data with rsync.
 - Atlas-only OpenZFS, NFS, Samba, and Syncthing stay selected through Atlas host variables and must not
  leak into `rocky_server`. Cockpit plus its Navigator and Podman extensions are selected explicitly for
@@ -127,30 +126,45 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
 - `atlas` is a remote Rocky Linux 9 NAS. Keep its connection, LAN, pool and mountpoint values in
  `host_vars/atlas.yml`. Bootstrap it once with `-e atlas_connection_username=<existing-admin>`;
  subsequent runs use the dedicated Atlas account.
- The pool is pre-existing: never add pool creation, disk partitioning, RAIDZ creation, rollback,
-  or destruction to the Atlas profile.
- `atlas_manage_storage`, `atlas_manage_firewall`, and `atlas_manage_media_stack` remain false until their placeholders
-  and Vault inputs are replaced; only then may the profile manage datasets, shares, LAN-restricted firewall rules, and
-  rootful media Quadlets.
+- The pool is normally pre-existing. A one-time bootstrap may create it only when `atlas_create_pool=true`
+  is explicitly supplied and `atlas_zpool_disks` contains exactly four real `/dev/disk/by-id/...` paths.
+  Never partition, force, destroy, roll back, or modify the vdev layout of an existing pool.
+- `atlas_manage_storage`, `atlas_manage_sharing`, and `atlas_manage_firewall` are enabled in Atlas host vars as
+  the declared steady state; set one false only for a deliberate suspension. `atlas_manage_media_stack` remains false
+  until the future rootful Immich stack has its required Vault inputs and target validation.
 - Atlas requires `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash` for Cockpit
-  and, when the relevant gates are enabled, `vault_atlas_samba_password` and `vault_atlas_immich_db_password`. Never
-  print these values.
- Atlas creates `archive`, `media/music`, `media/icloud_photos`, and `backups/services` only under the verified
-  pre-existing pool; `backups/services` has a `500G` refreservation. Existing Work, Syncthing, and
-  Prometheus-backup datasets remain managed and separate.
+  and, while sharing is enabled, `vault_atlas_samba_password`. The future rootful media stack also requires
+  `vault_atlas_immich_db_password`. Never print these values.
+- Atlas creates the complete declared hierarchy only under the verified existing or explicitly bootstrapped pool: `work`, `archive`,
+  `archive/app_data`, `archive/app_data/navidrome`, `archive/app_data/syncthing`, `media`, `media/music`,
+  `media/photobook`, `backups`, `backups/services`, and `backup_prometheus`. `backups/services` has a `500G`
+  refreservation. There is no separate legacy `zpool/syncthing` dataset.
 - The `immich` system account is fixed to UID/GID `1100`, has no login shell or `wheel` membership, and receives only
  the `video` and `render` supplementary groups. Immich's rootful Quadlets run as `1100:1100`; Server and ML receive
-  `/dev/dri`, while the iCloud Photos external library is read-only.
- Atlas exports iCloud Photos only to the configured Aegis IP with all access squashed to UID/GID `1100`. SMB3 exposes
+  `/dev/dri`, while the Photobook external library is read-only at `/external/photobook`.
+- Atlas exports Photobook only to the configured Aegis IP with all access squashed to UID/GID `1100`. SMB3 exposes
  `Archive` to Vault-backed authorized accounts and admits the configured LAN without host-specific exclusions.
 - Atlas NPM and Immich share a rootful Podman network. NPM publishes HTTP/HTTPS, but its administration port remains
  bound to `127.0.0.1:81`; do not expose it directly to the LAN or Internet.
+- `profile_backend_phase1` is limited to rootless Navidrome and Syncthing user Quadlets on Atlas. Official Navidrome
+  `0.63.2` uses SQLite below `/data` and does not support `ND_DATABASE_URL` or an external PostgreSQL backend; do not
+  recreate the obsolete Prometheus `navidromedb` service. The role requires the storage role's `zpool/media/music`,
+  `zpool/archive/app_data`, `zpool/archive/app_data/navidrome`, and `zpool/archive/app_data/syncthing` datasets at
+  their exact paths. It never creates the pool.
+- Keep `backend_phase1_start_services` false until the stopped Prometheus Navidrome data directory has been copied to
+  Atlas and its SQLite database verified. The playbook renders the target but never migrates or deletes application
+  data; after cutover, set the flag true to enable and start Navidrome and Syncthing.
+- Phase 1 must not change Prometheus' existing NPM deployment. NPM continues to be managed exactly by `profile_server`;
+  use `10.0.0.2:4533` for Navidrome and `10.0.0.2:8384` for the Syncthing GUI. Native Syncthing transfer/discovery does
+  not use the HTTP proxy.
+- `wireguard_overlay` manages the required `wg0` path between Prometheus and Atlas, persists private keys only on their
+  respective hosts, and exchanges only derived public keys. The initial run must include both hosts. Prometheus
+  opens `51820/udp`; the Atlas backend role admits service ports only in the WireGuard firewalld zone.

 ## Atlas NAS TODO
- Replace every Atlas `CHANGEME` value, provide the required Vault variables and validate the first
-  remote bootstrap on the real Rocky Linux 9 host. Enable `atlas_manage_storage` first and
-  `atlas_manage_firewall` only after confirming the pool, mountpoints, LAN subnet and firewalld zone. Enable
-  `atlas_manage_media_stack` last, after validating `/dev/dri`, the container paths and the Immich database secret.
+- Provide the required Vault variables and validate the first remote bootstrap on the real Rocky Linux 9 host.
+  Before the first apply, confirm the pool, mountpoints, LAN subnet and firewalld zone. Keep
+  `atlas_manage_media_stack` disabled until `/dev/dri`, the container paths and the Immich database secret are validated.
 - Validate the complete baseline on the target: OpenZFS kmod loading, existing pool import, dataset
  mounts, SSH reconnect, Cockpit and all selected 45Drives plugins, NFSv4, SMB and Syncthing.
 - Finalize dataset properties and the shared UID/GID, group and POSIX ACL model; test the same files
@@ -159,7 +173,7 @@ The dotfile vars follow the same split: `desktop_common_dotfiles` carries mode-i
  or manual operations, not as the only source of configuration, and never automate snapshot rollback.
 - Manage the Syncthing star topology, device IDs, folders, folder modes, ignore rules and protected GUI
  or API access for the selected clients.
- Validate the existing WireGuard path and add its LAN/VPN-only firewalld rules before enabling remote services;
+- Validate the managed WireGuard path and its LAN/VPN-only firewalld rules before enabling remote services;
  never expose SSH, Cockpit, NFS, SMB or Syncthing through public port forwarding.
 - Add the least-privilege Prometheus backup flow: remote dump generation, dedicated SSH identity,
  pinned host key, atomic pull, verification, retention and an Atlas systemd service/timer.
--- a/README.it.md
+++ b/README.it.md
@@ -180,28 +180,24 @@ Lo stato attuale del profilo server include:
 - installazione pacchetti Rocky via DNF, EPEL e CRB
 - installazione di Podman e podman-compose
 - abilitazione dei servizi systemd dichiarati in inventory/group vars
- copia dei dotfiles server e rendering del `docker-compose.yml` per Nginx Proxy Manager, Gitea e il
-  database PostgreSQL esistente di Navidrome, piu l'unita `podman-compose-server` (attivazione manuale)
- mount di `/pool/media/music` da Atlas su `/mnt/music_atlas` tramite il servizio di sistema
-  `rclone-music.service`, e Navidrome tramite Quadlet utente rootless
+- copia dei dotfiles server e rendering del `docker-compose.yml` per Nginx Proxy Manager e Gitea,
+  piu l'unita `podman-compose-server` (attivazione manuale)
 - attivazione di firewalld con SSH, Cockpit (`9090/tcp`), HTTP e HTTPS abilitati
 - Syncthing escluso dal profilo server Rocky

+Il Compose desiderato su Prometheus non include piu Navidrome ne il database PostgreSQL obsoleto.
+Navidrome e Syncthing appartengono ad Atlas; Navidrome ufficiale usa invece SQLite. Il profilo non
+arresta o rimuove automaticamente eventuali container legacy e non elimina `/opt/postgres/data`.
+
 Nginx Proxy Manager pubblica solo `80/tcp` e `443/tcp`; la sua interfaccia di amministrazione e
 associata a `127.0.0.1:81` ed e raggiungibile da Ikaros o Nymph con l'alias Bash `npm-tunnel`.
 Nextcloud resta disabilitato e il profilo non crea directory `/srv/nextcloud`.

-Il mount musicale e protetto da `server_atlas_music_enabled`. Prima di abilitarlo, sostituire
-l'indirizzo WireGuard e la chiave host SSH fissata in `host_vars/prometheus.yml`, quindi fornire
-`vault_prometheus_atlas_sftp_private_key` tramite Vault cifrato o variabili locali non tracciate. La
-chiave pubblica corrispondente deve essere gia presente nelle chiavi autorizzate gestite su Atlas.
-Rclone usa il percorso remoto esatto `/pool/media/music` in sola lettura e una cache VFS completa da
-`15G`; systemd lingering mantiene disponibile il manager utente per il Quadlet rootless.
-Configurare il proxy host NPM di Prometheus per Navidrome come `host.containers.internal:4533`; la
-porta Navidrome non viene aperta in firewalld.
-Prima della prima attivazione, arrestare il vecchio container rootful `navidrome`. Il ruolo rifiuta
-di avviare il sostituto rootless mentre il container precedente e in esecuzione e non rimuove mai
-automaticamente il container o i dati esistenti.
+La fase 1 su Atlas non modifica questo deployment NPM ne i suoi dati persistenti. Dopo aver attivato
+WireGuard e i servizi Atlas, configurare i proxy host NPM correnti con upstream Navidrome
+`http://10.0.0.2:4533` e upstream per la GUI Syncthing `http://10.0.0.2:8384`. Solo la GUI web di
+Syncthing usa NPM; il traffico di sincronizzazione resta sulle porte native limitate a WireGuard.
+Configurare l'autenticazione Syncthing e una policy di accesso NPM adeguata prima di pubblicare la GUI.

 ### DuckDNS

@@ -226,8 +222,9 @@ salvare separatamente eventuali modifiche non committate senza copiare segreti.

 Dopo il provisioning Rocky, eseguire `scripts/migrate_prometheus_data.sh` **sul server Ubuntu
 sorgente**. Lo script usa rsync, e in dry-run di default; richiede `--quiesce-source --execute` per
-fermare lo stack sorgente e copiare in modo consistente i dati PostgreSQL. Non avvia container, non
-cancella dati e non esegue il cutover.
+fermare lo stack sorgente e copiare in modo consistente soltanto i dati di Nginx Proxy Manager e
+Gitea. Non sposta Navidrome o Syncthing, non avvia container, non cancella dati e non esegue il
+cutover.

 Utente del profilo server:

@@ -249,13 +246,14 @@ ansible-playbook ansible/site.yml --limit prometheus -e server_username=myuser -

 ## NAS

-`atlas` e un NAS Rocky Linux 9 raggiunto tramite SSH. Il pool ZFS esiste gia: il profilo gestisce
-solo i dataset figli e non deve mai creare, partizionare, distruggere, fare rollback o modificare il
-pool. I client Linux usano NFSv4, quelli Windows/WSL SMB; entrambi restano limitati alla LAN
+`atlas` e un NAS Rocky Linux 9 raggiunto tramite SSH. Normalmente il pool ZFS esiste gia e il profilo
+gestisce solo i dataset figli. Un bootstrap RAIDZ2 una tantum e disponibile solo con conferma esplicita
+(`atlas_create_pool=true`) e quattro percorsi reali e verificati `/dev/disk/by-id/...` in
+`atlas_zpool_disks`. Non partiziona, forza, distrugge, esegue rollback o modifica il layout vdev di un
+pool esistente. I client Linux usano NFSv4, quelli Windows/WSL SMB; entrambi restano limitati alla LAN
 configurata.

-Per il primo avvio sostituire i placeholder di host, pool, mount root, LAN e IP di Aegis e
-fornire `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
+Per il primo avvio fornire `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
 `vault_atlas_samba_password` e `vault_atlas_immich_db_password`. Eseguire il bootstrap tramite
 l'amministratore esistente:

@@ -265,25 +263,69 @@ ansible-playbook ansible/site.yml --limit atlas \
 ```

 `vault_atlas_admin_password_hash` deve essere un hash compatibile con `/etc/shadow`, non una
-password Cockpit in chiaro. Le esecuzioni successive usano `atlas_admin_username`. Abilitare
-`atlas_manage_storage` solo dopo aver verificato pool e mountpoint esistenti; abilitare
-`atlas_manage_firewall` solo dopo aver verificato subnet LAN e zona firewalld attiva. Abilitare
-`atlas_manage_media_stack` per ultimo, dopo aver verificato `/dev/dri`, i percorsi dei container e il
-segreto del database Immich.
+password Cockpit in chiaro. Le esecuzioni successive usano `atlas_admin_username`. Atlas dichiara
+abilitati storage, condivisioni e regole firewall LAN. Prima della prima applicazione verificare pool e
+mountpoint esistenti, subnet LAN e zona firewalld attiva. `atlas_manage_media_stack` resta disabilitato
+finche non saranno validati `/dev/dri`, i percorsi dei container e il segreto del database Immich.

-Con la gestione storage attiva, Atlas crea `archive` (`zstd`), `media/music` (`lz4`),
-`media/icloud_photos` (`lz4`) e `backups/services` (`lz4`, `refreservation=500G`) sotto il pool
-preesistente. I dataset esistenti Work, Syncthing e backup Prometheus restano gestiti e separati.
+Con la gestione storage attiva, Atlas crea l'intera gerarchia sotto il pool `zpool` esistente o creato esplicitamente:
+`work`, `archive`, `archive/app_data`, i dataset applicativi separati
+`archive/app_data/navidrome` e `archive/app_data/syncthing`, `media`, `media/music`,
+`media/photobook`, `backups`, `backups/services` e `backup_prometheus`. I dataset applicativi e
+di archivio usano `zstd`; media, Syncthing e backup dei servizi usano `lz4`;
+`backups/services` mantiene inoltre una `refreservation` di `500G`.
 SMB3 pubblica `Archive` solo agli account Samba configurati con password in Vault e ammette la LAN
 configurata senza esclusioni specifiche per host. NFSv4 esporta soltanto
-`media/icloud_photos` all'IP configurato di Aegis con `all_squash` verso UID/GID anonimi `1100`.
+`media/photobook` all'IP configurato di Aegis con `all_squash` verso UID/GID anonimi `1100`.

 L'account di sistema `immich` usa UID/GID `1100`, shell senza login, nessuna appartenenza a `wheel` e
 i gruppi supplementari `video` e `render`. I Quadlet rootful di Immich Server, ML, cache compatibile
 Redis, PostgreSQL e NPM condividono una rete Podman. Immich viene eseguito come `1100:1100`; Server e
-ML ricevono `/dev/dri` e la libreria iCloud Photos e montata in sola lettura. NPM pubblica `80` e
+ML ricevono `/dev/dri` e Photobook e montato in sola lettura su `/external/photobook`. NPM pubblica `80` e
 `443`, mentre l'amministrazione resta vincolata a `127.0.0.1:81` per l'accesso tramite tunnel SSH.

+La fase 1 e limitata ai Quadlet utente rootless di Navidrome e Syncthing su Atlas. E abilitata nella
+configurazione host di Atlas e puo essere impostata a `false` solo per una sospensione intenzionale. Navidrome ufficiale `0.63.2` usa il database SQLite sotto `/data` e
+non supporta `ND_DATABASE_URL` ne un backend PostgreSQL esterno. Il servizio obsoleto `navidromedb`
+e quindi rimosso da Prometheus invece di essere replicato su Atlas. Il ruolo deriva i percorsi dal
+pool `zpool`, montato in `/zpool`: musica in sola lettura da `/zpool/media/music`, stato
+applicativo Navidrome e `navidrome.db` in `/zpool/archive/app_data/navidrome` e dati Syncthing in
+`/zpool/archive/app_data/syncthing`. `profile_atlas` crea questi dataset quando
+`atlas_manage_storage` e attivo; il ruolo backend verifica i mountpoint esatti prima di avviare i
+container. Il ruolo backend non crea mai il pool. Il ruolo separato `wireguard_overlay`
+gestisce `wg0` tra Prometheus (`10.0.0.1`) e Atlas (`10.0.0.2`), genera una sola volta le chiavi
+private sui rispettivi host e scambia tramite Ansible soltanto quelle pubbliche. Solo Prometheus apre
+pubblicamente `51820/udp`. Le porte backend sono ammesse esclusivamente nella zona firewalld WireGuard.
+
+`backend_phase1_start_services` resta falso durante il trasferimento dello stato applicativo, quindi
+la prima esecuzione reale del backend genera i Quadlet senza creare un database Atlas vuoto. Dopo aver
+arrestato Navidrome su Prometheus, copiare l'intera directory `/opt/navidrome/data/` in
+`/zpool/archive/app_data/navidrome/`, preservando `navidrome.db` e gli eventuali file SQLite laterali.
+Impostare quindi questa variabile a vero e rieseguire il ruolo per abilitare e avviare Navidrome e
+Syncthing. Il playbook non copia e non elimina mai i dati applicativi.
+
+Validare e generare i servizi Atlas con:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags storage
+
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit prometheus,atlas --tags wireguard
+
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff
+
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1
+```
+
+Per il cutover, arrestare il vecchio Navidrome prima di copiare la sua directory dati, verificare
+l'ownership dell'account `admin` su Atlas e confermare la presenza del database SQLite copiato prima
+di impostare `backend_phase1_start_services: true` in `host_vars/atlas.yml`. Conservare i dati sorgente
+e il container legacy `navidromedb` fermo finche Navidrome su Atlas e una prova di restore non sono
+stati validati.
+
 Restano da completare retention delle snapshot, topologia Syncthing, validazione WireGuard/firewall,
 pull di backup da Prometheus, backup cifrati con Borg su una Hetzner Storage Box, backup USB,
 monitoraggio e test di disaster recovery. Il backlog operativo dettagliato e in `AGENTS.md`.
@@ -348,6 +390,8 @@ I principali ruoli attualmente presenti sono:
 | profile_workstation_dev_wsl | configurazione WSL condivisa per sviluppo |
 | profile_server            | configurazione server               |
 | profile_atlas             | configurazione NAS Rocky Linux 9    |
+| profile_backend_phase1    | Navidrome e Syncthing rootless su Atlas |
+| wireguard_overlay         | overlay WireGuard Prometheus/Atlas  |
 | dotfiles_common           | distribuzione dotfiles comuni       |
 | dotfiles                  | distribuzione configurazioni utente |

@@ -363,7 +407,9 @@ platform_void -> packages_void + services_runit
 platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_niri + profile_desktop_host
 platform_fedora -> packages_fedora + services_systemd
 platform_rocky -> packages_rocky + services_systemd
+wireguard_overlay -> wireguard_overlay (dopo platform_rocky)
 atlas -> profile_atlas
+role_backend_phase1 -> profile_backend_phase1 (dopo atlas)
 platform_fedora & role_personal_workstation -> profile_personal_workstation
 platform_fedora & desktop_gnome -> profile_desktop_gnome
 workstation_dev_fedora -> profile_workstation_dev_common
@@ -379,8 +425,8 @@ Questo significa che, allo stato attuale:
 - `deadalus` riceve il profilo Fedora WSL tramite play dev dedicati
 - il server Rocky (`prometheus`) e gestito con pacchetti, servizi, dotfiles server e firewalld
 - il NAS Rocky (`atlas`) usa un pool ZFS gia esistente, condivisioni NFSv4/SMB limitate alla LAN e Cockpit/45Drives
- lo stack Compose server include `gitea`, `nginx-proxy-manager` e il database PostgreSQL di
-  Navidrome; Navidrome usa un Quadlet rootless separato e legge il mount rclone di Atlas
+- lo stack Compose server include soltanto `gitea` e `nginx-proxy-manager`; Navidrome e Syncthing
+  della fase 1 sono Quadlet rootless su Atlas

 # Dotfiles

@@ -488,7 +534,7 @@ ansible-lint ansible/roles/<role>
 yamllint ansible/path/to/file.yml
 podman-compose -f /opt/docker/server/docker-compose.yml config
 ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff
-ansible-playbook ansible/site.yml --limit prometheus --tags rclone,navidrome --check --diff
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff
 ```

 ## Tag supportati dal playbook
@@ -506,6 +552,7 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | `always` | pre-task sempre eseguiti, inclusi caricamento vault e validazioni preliminari | common |
 | `ai_agents` | installazione agenti AI condivisi | Fedora, WSL |
 | `atlas` | account, storage, condivisioni e container Atlas | NAS Atlas |
+| `backend_phase1` | Quadlet rootless Navidrome e Syncthing | NAS Atlas |
 | `containers` | Quadlet rootful Atlas | NAS Atlas |
 | `dotfiles` | distribuzione/configurazione dotfiles | tutti i profili |
 | `dotfiles:common` | dotfiles comuni condivisi | common, workstation, server |
@@ -521,14 +568,12 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | `git` | configurazione Git e GPG desktop | Fedora/GNOME, desktop Void |
 | `gnome` | configurazione host GNOME | Fedora/GNOME desktop |
 | `immich` | account e Quadlet Immich | NAS Atlas |
-| `navidrome` | mount rclone e Quadlet Navidrome rootless | Prometheus |
 | `sway` | sessione/configurazione sway / SwayFX (Wayland) | desktop Void |
 | `niri` | sessione/configurazione Niri (Wayland) | desktop Void |
 | `npm` | installazione pacchetti npm globali | Fedora/GNOME, desktop Void, WSL |
 | `nvidia` | componenti NVIDIA desktop | desktop Void |
 | `packages` | installazione e aggiornamento pacchetti | tutti i profili |
 | `podman` | integrazione Podman Compose e Quadlet rootless | server |
-| `rclone` | mount musica Atlas | Prometheus |
 | `portal` | configurazione xdg-desktop-portal | desktop Void |
 | `services` | gestione servizi runit/systemd | tutti i profili |
 | `sharing` | condivisioni NFSv4 e SMB3 | NAS Atlas |
@@ -536,6 +581,7 @@ Allo stato attuale `ansible/site.yml` espone questi tag:
 | `theme` | configurazione del tema GTK/Qt | desktop Void |
 | `tmux` | configurazione e plugin tmux | desktop Fedora/Void, WSL |
 | `vim` | configurazione Vim | dotfiles comuni |
+| `wireguard` | overlay WireGuard Prometheus/Atlas | Prometheus, NAS Atlas |
 | `wsl` | bootstrap e configurazione WSL | WSL |

 Esempi pratici:
--- a/README.md
+++ b/README.md
@@ -105,29 +105,23 @@ dotfiles and templates. The profile provisions configuration only: it does not t
 the Compose stack, update DNS, or perform a cutover.

 The server profile installs platform-specific packages, Podman and podman-compose, declared systemd
-services, and firewalld. The manually activated `podman-compose-server` unit now contains Nginx Proxy
-Manager, Gitea, and the existing Navidrome PostgreSQL database. Navidrome itself runs as a rootless
-user Quadlet and reads the Atlas music dataset from the system `rclone-music.service` mount at
-`/mnt/music_atlas`. The Rocky server excludes Syncthing.
-Rocky bind mounts use private SELinux relabeling where supported; the read-only FUSE music mount is
-passed to Navidrome without relabeling.
-
-The Atlas music path is gated by `server_atlas_music_enabled`. Before enabling it, replace the
-WireGuard address and pinned SSH host-key placeholders in `host_vars/prometheus.yml`, and provide
-`vault_prometheus_atlas_sftp_private_key` through encrypted Vault or untracked local vars. The SFTP
-key's public half must already be present in Atlas' managed authorized keys. Rclone mounts the exact
-remote path `/pool/media/music` read-only and uses a `15G` full VFS cache; the rootless user manager is
-kept alive through systemd lingering.
-Configure the Prometheus NPM proxy host for Navidrome as `host.containers.internal:4533`; the
-Navidrome port is not opened through firewalld.
-Before the first enablement, stop the legacy rootful `navidrome` container. The role refuses to start
-the rootless replacement while that container is running and never removes the old container or data.
+services, and firewalld. The manually activated `podman-compose-server` unit contains the existing
+Nginx Proxy Manager and Gitea services. The desired Compose file no longer includes Navidrome,
+Syncthing, or the obsolete Navidrome PostgreSQL database. Navidrome and Syncthing belong to Atlas;
+official Navidrome uses SQLite instead. Applying the profile does not stop or remove legacy
+containers and does not delete `/opt/postgres/data`.

 Firewalld enables SSH, Cockpit (`9090/tcp`), HTTP and HTTPS. Nginx Proxy Manager publishes only
 `80/tcp` and `443/tcp`; its administration interface is bound to `127.0.0.1:81` and can be reached
 from Ikaros or Nymph with the `npm-tunnel` Bash alias. Nextcloud remains disabled and the profile
 does not provision any `/srv/nextcloud` directories.

+The Atlas phase-one work does not change this NPM deployment or its persistent data. Once WireGuard
+and the Atlas services are active, configure the current NPM proxy hosts with Navidrome upstream
+`http://10.0.0.2:4533` and Syncthing GUI upstream `http://10.0.0.2:8384`. Only the Syncthing web GUI
+uses NPM; synchronization traffic remains on its native WireGuard-restricted ports. Configure both
+Syncthing authentication and an appropriate NPM access policy before publishing its GUI.
+
 Server identity comes from `server_username`, `server_user_group`, and `server_user_home` in `ansible/inventory/group_vars/server.yml`. `server_username` defaults to `username`, but it can be overridden, for example:

 ```bash
@@ -160,7 +154,7 @@ back in; preserve any uncommitted work separately without copying secrets.
 ### Data migration

 Provision Rocky first, then run the migration script **on the retired Ubuntu source host**. It is
-dry-run by default and requires an explicit source-stack stop before it can copy PostgreSQL data:
+dry-run by default and requires an explicit source-stack stop before it can copy application data:

 ```bash
 sudo ./scripts/migrate_prometheus_data.sh \
@@ -173,11 +167,11 @@ sudo ./scripts/migrate_prometheus_data.sh \
  --quiesce-source --execute
 ```

-The script copies Navidrome, music, Nginx Proxy Manager, PostgreSQL and Gitea data. It does not
-delete data, move Syncthing, copy `/home/git/.ssh`, start containers, update DNS, or perform a
-cutover. The destination SSH host key must already be trusted and the destination account needs
-passwordless sudo for `rsync`. It preserves ACLs but not extended attributes, so source SELinux labels
-are not transferred; the Rocky Compose bind mounts apply their own `:Z` labels when containers start.
+The script copies only Nginx Proxy Manager and Gitea data. It does not delete data, move
+Navidrome/Syncthing, copy `/home/git/.ssh`, start containers, update DNS, or perform a cutover. The
+destination SSH host key must already be trusted and the destination account needs passwordless sudo
+for `rsync`. It preserves ACLs but not extended attributes, so source SELinux labels are not
+transferred; the Rocky Compose bind mounts apply their own `:Z` labels when containers start.

 ## DNS Filter

@@ -210,13 +204,13 @@ ansible-playbook ansible/site.yml --limit aegis --check --diff --ask-become-pass

 ## NAS

-`atlas` is a Rocky Linux 9 NAS reached through SSH. Its pool already exists: the profile only
-manages child datasets and must never create, partition, destroy, roll back, or otherwise alter the
-pool itself. Linux clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the
-configured LAN.
+`atlas` is a Rocky Linux 9 NAS reached through SSH. Normally its pool already exists and the profile
+only manages child datasets. A one-time RAIDZ2 bootstrap is available only with explicit confirmation
+(`atlas_create_pool=true`) and exactly four verified `/dev/disk/by-id/...` paths in `atlas_zpool_disks`.
+It never partitions, forces, destroys, rolls back, or changes the vdev layout of an existing pool. Linux
+clients use NFSv4 and Windows/WSL clients use SMB; both are restricted to the configured LAN.

-For the first run, replace the Atlas host, pool, mount-root, LAN, and Aegis-IP
-placeholders and provide `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
+For the first run, provide `vault_atlas_authorized_ssh_keys`, `vault_atlas_admin_password_hash`,
 `vault_atlas_samba_password`, and `vault_atlas_immich_db_password`. Bootstrap the host through its
 existing administrator:

@@ -226,24 +220,68 @@ ansible-playbook ansible/site.yml --limit atlas \
 ```

 `vault_atlas_admin_password_hash` must be an `/etc/shadow`-compatible hash, not a clear-text
-Cockpit password. Subsequent runs use `atlas_admin_username`. Enable `atlas_manage_storage` only after
-checking the existing pool and mountpoints; enable `atlas_manage_firewall` only after checking the LAN
-subnet and active firewalld zone. Enable `atlas_manage_media_stack` last, after validating `/dev/dri`,
-the container paths and the Immich database secret.
+Cockpit password. Subsequent runs use `atlas_admin_username`. Atlas declares storage, sharing, and its
+LAN firewall rules enabled. Before the first apply, check the existing pool and mountpoints, LAN subnet,
+and active firewalld zone. `atlas_manage_media_stack` remains disabled until `/dev/dri`, the container
+paths, and the Immich database secret are validated.

-With storage management enabled, Atlas creates `archive` (`zstd`), `media/music` (`lz4`),
-`media/icloud_photos` (`lz4`), and `backups/services` (`lz4`, `refreservation=500G`) beneath the
-pre-existing pool. The existing Work, Syncthing, and Prometheus-backup datasets remain managed and
-separate. SMB3 exposes `Archive` only to the configured Vault-backed Samba accounts and admits the
-configured LAN without host-specific exclusions. NFSv4 exports only
-`media/icloud_photos` to the configured Aegis IP, using `all_squash` with anonymous UID/GID `1100`.
+With storage management enabled, Atlas creates the complete dataset hierarchy below the existing or
+explicitly bootstrapped `zpool`: `work`, `archive`, `archive/app_data`, the separate `archive/app_data/navidrome` and
+`archive/app_data/syncthing` application datasets, `media`, `media/music`, `media/photobook`,
+`backups`, `backups/services`, and `backup_prometheus`. Application/archive datasets use `zstd`,
+while media, Syncthing and service-backup datasets use `lz4`; `backups/services` also has a `500G`
+refreservation. SMB3 exposes `Archive` only to the configured Vault-backed Samba accounts and admits
+the configured LAN without host-specific exclusions. NFSv4 exports only
+`media/photobook` to the configured Aegis IP, using `all_squash` with anonymous UID/GID `1100`.

 The `immich` system account is fixed to UID/GID `1100`, has no login shell or `wheel` membership, and
 receives `video` and `render` access. The rootful Immich Server, ML, Redis-compatible cache, PostgreSQL,
 and NPM Quadlets share one Podman network. Immich runs as `1100:1100`; Server and ML receive `/dev/dri`,
-and iCloud Photos is mounted read-only as an external library. NPM publishes ports `80` and `443`; its
+and Photobook is mounted read-only at `/external/photobook`. NPM publishes ports `80` and `443`; its
 administration interface remains restricted to `127.0.0.1:81` for SSH-tunnel access.

+Phase 1 is limited to rootless Navidrome and Syncthing user Quadlets on Atlas. It is enabled in the
+Atlas host configuration and can be set to `false` only for a deliberate suspension. Official Navidrome `0.63.2` uses its SQLite database below `/data`; it does
+not support `ND_DATABASE_URL` or an external PostgreSQL backend. The obsolete `navidromedb` service
+was therefore removed from Prometheus instead of being reproduced on Atlas. The role derives all
+storage paths from the `zpool` mounted at `/zpool`: music is read-only at
+`/zpool/media/music`, Navidrome application state and `navidrome.db` are stored at
+`/zpool/archive/app_data/navidrome`, and Syncthing persists at
+`/zpool/archive/app_data/syncthing`. `profile_atlas` creates these datasets when
+`atlas_manage_storage` is enabled; the backend role verifies their exact mountpoints before starting
+containers. The backend role never creates the pool. The separate `wireguard_overlay` role manages `wg0`
+between Prometheus (`10.0.0.1`) and Atlas (`10.0.0.2`), generating private keys once
+on their respective hosts and exchanging only public keys through Ansible. Prometheus alone opens
+`51820/udp` publicly. Backend ports are admitted only in the WireGuard firewalld zone.
+
+`backend_phase1_start_services` stays false during the application-state transfer, so the first real
+backend run renders the Quadlets without creating an empty Atlas database. After stopping Navidrome
+on Prometheus, copy the complete `/opt/navidrome/data/` directory into
+`/zpool/archive/app_data/navidrome/`, preserving `navidrome.db` and any SQLite sidecar files. Then set
+this variable to true and rerun the role to enable and start Navidrome and Syncthing. The playbook
+never copies or deletes application data.
+
+Validate and render the Atlas services with:
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags storage
+
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit prometheus,atlas --tags wireguard
+
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1 --check --diff
+
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-local \
+ansible-playbook ansible/site.yml --limit atlas --tags backend_phase1
+```
+
+For the cutover, stop the old Navidrome writer before copying its data directory, verify ownership by
+the Atlas `admin` account and confirm that the copied SQLite database is present before changing
+`backend_phase1_start_services: true` in `host_vars/atlas.yml`. Keep the source data and the stopped
+legacy `navidromedb` container until Navidrome on Atlas and a restore test have been validated.
+
 Snapshot retention, Syncthing topology, WireGuard/firewall validation, Prometheus backup pulls,
 encrypted Borg backups to a Hetzner Storage Box, USB backup, monitoring, and disaster-recovery tests
 remain follow-up work. The detailed operational backlog is kept in `AGENTS.md`.
@@ -332,6 +370,8 @@ ansible-playbook ansible/site.yml --limit deadalus --tags ai_agents --check --di
 | `profile_workstation_dev_wsl` | WSL development setup. |
 | `profile_server` | Server setup. |
 | `profile_atlas` | Rocky Linux 9 NAS setup. |
+| `profile_backend_phase1` | Rootless Navidrome and Syncthing on Atlas. |
+| `wireguard_overlay` | Prometheus/Atlas WireGuard overlay. |
 | `profile_aegis` | Fedora IoT always-on LAN node. |
 | `dotfiles_common` | Shared user dotfiles. |

@@ -343,8 +383,10 @@ platform_void -> packages_void + services_runit
 platform_void & graphical_desktop -> profile_desktop_common + profile_desktop_sway + profile_desktop_niri + profile_desktop_host
 platform_fedora -> packages_fedora + services_systemd
 platform_rocky -> packages_rocky + services_systemd
+wireguard_overlay -> wireguard_overlay (after platform_rocky)
 role_aegis -> profile_aegis
 atlas -> profile_atlas
+role_backend_phase1 -> profile_backend_phase1 (after atlas)
 rocky_server -> dotfiles_common + profile_server (after platform_rocky)
 platform_fedora & role_personal_workstation -> profile_personal_workstation
 platform_fedora & desktop_gnome -> profile_desktop_gnome
@@ -414,7 +456,6 @@ ansible-lint ansible/roles/<role>
 yamllint ansible/path/to/file.yml
 podman-compose -f /opt/docker/server/docker-compose.yml config
 ansible-playbook ansible/site.yml --limit atlas --tags storage,sharing,containers --check --diff
-ansible-playbook ansible/site.yml --limit prometheus --tags rclone,navidrome --check --diff
 ```

 ## Tags
@@ -430,6 +471,7 @@ ansible-playbook ansible/site.yml --list-tags
 | `always` | Common pre-tasks, including optional vault loading. |
 | `ai_agents` | AI coding-agent install, configuration deployment, and managed-binary removal. |
 | `atlas` | Atlas NAS account, storage, sharing, and container configuration. |
+| `backend_phase1` | Rootless Atlas Navidrome and Syncthing Quadlets. |
 | `containers` | Rootful Atlas Quadlets. |
 | `dotfiles` | User configuration across all profiles. |
 | `dotfiles:common` | Shared dotfiles. |
@@ -440,15 +482,14 @@ ansible-playbook ansible/site.yml --list-tags
 | `emacs` | Shared Emacs setup and authoring dependencies. |
 | `gnome` | Fedora/GNOME desktop configuration. |
 | `immich` | Atlas Immich account and Quadlets. |
-| `navidrome` | Prometheus rclone mount and rootless Navidrome Quadlet. |
 | `npm` | Global npm packages. |
 | `packages` | Package installation and updates. |
 | `podman` | Podman Compose and rootless Quadlet integration. |
-| `rclone` | Prometheus Atlas music mount. |
 | `services` | runit and systemd services. |
 | `sharing` | Atlas NFSv4 and SMB3 configuration. |
 | `storage` | Atlas child ZFS datasets. |
 | `tmux` | tmux configuration and plugins. |
+| `wireguard` | Prometheus/Atlas WireGuard overlay. |
 | `wsl` | WSL bootstrap and configuration. |

 ## Bootstrapping a new machine
--- a/ansible/inventory/group_vars/server.yml
+++ b/ansible/inventory/group_vars/server.yml
@@ -6,29 +6,6 @@ effective_username: "{{ server_username }}"
 effective_user_group: "{{ server_user_group }}"
 effective_user_home: "{{ server_user_home }}"
 server_container_stack_dir: /opt/docker/server
-server_atlas_music_enabled: false
-server_atlas_sftp_remote_name: atlas
-server_atlas_sftp_host: CHANGEME_ATLAS_WIREGUARD_IP
-server_atlas_sftp_port: 22
-server_atlas_sftp_username: admin
-server_atlas_sftp_remote_path: /pool/media/music
-server_atlas_sftp_private_key: "{{ vault_prometheus_atlas_sftp_private_key | default('') }}"
-server_atlas_sftp_private_key_file: /etc/rclone/atlas_ed25519
-server_atlas_sftp_known_host: ""
-server_atlas_sftp_known_hosts_file: /etc/rclone/known_hosts
-server_atlas_wireguard_unit: ""
-server_rclone_config_dir: /etc/rclone
-server_rclone_config_file: /etc/rclone/rclone.conf
-server_rclone_music_service: rclone-music.service
-server_rclone_music_mountpoint: /mnt/music_atlas
-server_rclone_music_cache_dir: /var/cache/rclone-music
-server_navidrome_data_dir: /opt/navidrome/data
-server_navidrome_quadlet_dir: "{{ server_user_home }}/.config/containers/systemd"
-server_navidrome_env_dir: "{{ server_user_home }}/.config/navidrome"
-server_navidrome_env_file: "{{ server_navidrome_env_dir }}/navidrome.env"
-server_navidrome_image: docker.io/deluan/navidrome:latest
-server_navidrome_port: 4533
-server_navidrome_db_password: "{{ vault_navidrome_db_password | default('') }}"
 ai_agents: {}
 vim_plugins_enabled: false

@@ -85,10 +62,6 @@ server_directories:
    owner: root
    group: root
    mode: "0755"
-  - path: "{{ server_navidrome_data_dir }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0755"
  - path: /opt/npm/data
    owner: root
    group: root
@@ -97,10 +70,6 @@ server_directories:
    owner: root
    group: root
    mode: "0755"
-  - path: /opt/postgres/data
-    owner: root
-    group: root
-    mode: "0755"
  - path: /opt/gitea/data
    owner: root
    group: root
--- a/ansible/inventory/host_vars/atlas.yml
+++ b/ansible/inventory/host_vars/atlas.yml
@@ -1,5 +1,5 @@
 ---
-# Keep Atlas management gates disabled until the NAS and required Vault inputs are ready.
+# Atlas declares its intended steady state; set a feature flag false only for a deliberate suspension.
 hostname: atlas
 ansible_host: 192.168.178.55
 ansible_user: "{{ atlas_connection_username }}"
@@ -17,22 +17,45 @@ atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}

 atlas_lan_subnet: 192.168.178.0/24
 atlas_aegis_ip: 192.168.178.54
-atlas_manage_firewall: false
+atlas_manage_firewall: true
 atlas_firewalld_zone: public
 atlas_zfs_pool: zpool
+# Populate only for the first pool bootstrap with four real persistent disk paths.
+# Example: /dev/disk/by-id/ata-Seagate_IronWolf_...
+atlas_zpool_disks: []
+atlas_create_pool: false
 atlas_zfs_dataset_work: work
 atlas_zfs_dataset_archive: archive
+atlas_zfs_dataset_app_data: archive/app_data
+atlas_zfs_dataset_navidrome: archive/app_data/navidrome
+atlas_zfs_dataset_syncthing: archive/app_data/syncthing
+atlas_zfs_dataset_media: media
 atlas_zfs_dataset_music: media/music
-atlas_zfs_dataset_syncthing: syncthing
 atlas_zfs_dataset_backup_prometheus: backup_prometheus
-atlas_zfs_dataset_icloud_photos: media/icloud_photos
+atlas_zfs_dataset_photobook: media/photobook
+atlas_zfs_dataset_backups: backups
 atlas_zfs_dataset_service_backups: backups/services
 atlas_mount_root: /zpool
-atlas_manage_storage: false
+atlas_manage_storage: true
+atlas_manage_sharing: true
 atlas_manage_media_stack: false

+wireguard_overlay_enabled: true
+wireguard_address: 10.0.0.2/24
+wireguard_peers:
+  - name: prometheus
+    host: prometheus
+    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
+    allowed_ips:
+      - 10.0.0.0/24
+    persistent_keepalive: 25
+
+backend_phase1_enabled: true
+backend_phase1_start_services: false
+backend_phase1_wireguard_address: 10.0.0.2
+
 rocky_manage_openzfs_repo: true
-rocky_manage_syncthing_binary: true
+rocky_manage_syncthing_binary: false
 rocky_manage_podman: true
 rocky_podman_packages:
  - podman
@@ -47,7 +70,7 @@ host_packages:
  - zfs

 atlas_nfs_exports:
-  - path: "{{ atlas_icloud_photos_mountpoint }}"
+  - path: "{{ atlas_photobook_mountpoint }}"
    client: "{{ atlas_aegis_ip }}"
    options:
      - rw
--- a/ansible/inventory/host_vars/prometheus.yml
+++ b/ansible/inventory/host_vars/prometheus.yml
@@ -7,19 +7,21 @@ ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519

 server_username: rocky
 server_duckdns_domain: fscotto
-server_atlas_music_enabled: false
-server_atlas_sftp_host: CHANGEME_ATLAS_WIREGUARD_IP
-server_atlas_sftp_username: admin
-server_atlas_sftp_known_host: CHANGEME_ATLAS_SSH_HOST_KEY
-server_atlas_wireguard_unit: wg-quick@wg0.service
-server_atlas_sftp_private_key: "{{ vault_prometheus_atlas_sftp_private_key | default('') }}"
+
+wireguard_overlay_enabled: true
+wireguard_address: 10.0.0.1/24
+wireguard_listen_port: 51820
+wireguard_enable_ipv4_forwarding: true
+wireguard_peers:
+  - name: atlas
+    host: atlas
+    allowed_ips:
+      - 10.0.0.2/32

 host_packages:
  - cockpit
  - cockpit-navigator
  - cockpit-podman
-  - fuse3
-  - rclone

 host_enabled_services:
  - cockpit.socket
--- a/ansible/inventory/hosts.yml
+++ b/ansible/inventory/hosts.yml
@@ -95,3 +95,12 @@ all:
    rocky_server:
      hosts:
        prometheus:
+
+    wireguard_overlay:
+      hosts:
+        prometheus:
+        atlas:
+
+    role_backend_phase1:
+      hosts:
+        atlas:
--- a/ansible/roles/profile_atlas/defaults/main.yml
+++ b/ansible/roles/profile_atlas/defaults/main.yml
@@ -1,5 +1,9 @@
 ---
 atlas_manage_storage: false
+atlas_manage_sharing: false
+# Destructive first-boot action; normally false once the pool exists.
+atlas_create_pool: false
+atlas_zpool_disks: []
 atlas_admin_username: CHANGEME_ATLAS_ADMIN
 atlas_admin_group: "{{ atlas_admin_username }}"
 atlas_admin_home: "/home/{{ atlas_admin_username }}"
@@ -23,23 +27,29 @@ atlas_firewalld_zone: public
 atlas_zfs_pool: CHANGEME_ZFS_POOL
 atlas_zfs_dataset_work: work
 atlas_zfs_dataset_archive: archive
+atlas_zfs_dataset_app_data: archive/app_data
+atlas_zfs_dataset_navidrome: archive/app_data/navidrome
+atlas_zfs_dataset_syncthing: archive/app_data/syncthing
+atlas_zfs_dataset_media: media
 atlas_zfs_dataset_music: media/music
-atlas_zfs_dataset_syncthing: syncthing
 atlas_zfs_dataset_backup_prometheus: backup_prometheus
-atlas_zfs_dataset_icloud_photos: media/icloud_photos
+atlas_zfs_dataset_photobook: media/photobook
+atlas_zfs_dataset_backups: backups
 atlas_zfs_dataset_service_backups: backups/services
 atlas_zfs_service_backups_refreservation: 500G
 atlas_mount_root: /CHANGEME_ATLAS_MOUNT_ROOT

 atlas_archive_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_archive }}"
+atlas_app_data_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
+atlas_navidrome_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
+atlas_syncthing_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
+atlas_media_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_media }}"
 atlas_music_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
 atlas_work_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_work }}"
-atlas_syncthing_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
 atlas_backup_prometheus_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_backup_prometheus }}"
-atlas_icloud_photos_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_icloud_photos }}"
+atlas_photobook_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_photobook }}"
+atlas_backups_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_backups }}"
 atlas_service_backups_mountpoint: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_service_backups }}"
-atlas_syncthing_config_dir: "{{ atlas_admin_home }}/.local/state/syncthing"
-atlas_syncthing_default_dir: "{{ atlas_syncthing_mountpoint }}/Sync"

 atlas_45drives_repo_url: https://repo.45drives.com/repofiles/rocky/45drives-enterprise.repo
 atlas_45drives_repo_file: /etc/yum.repos.d/45drives-enterprise.repo
@@ -51,7 +61,7 @@ atlas_45drives_packages:
  - cockpit-scheduler

 atlas_nfs_exports:
-  - path: "{{ atlas_icloud_photos_mountpoint }}"
+  - path: "{{ atlas_photobook_mountpoint }}"
    client: "{{ atlas_aegis_ip }}"
    options:
      - rw
--- a/ansible/roles/profile_atlas/handlers/main.yml
+++ b/ansible/roles/profile_atlas/handlers/main.yml
@@ -28,11 +28,6 @@
    name: smb
    state: restarted

- name: Restart Atlas Syncthing service
-  ansible.builtin.systemd:
-    name: atlas-syncthing
-    state: restarted
-
 - name: Restart Atlas media Quadlets
  ansible.builtin.systemd:
    name: "{{ item }}"
--- a/ansible/roles/profile_atlas/tasks/main.yml
+++ b/ansible/roles/profile_atlas/tasks/main.yml
@@ -5,6 +5,9 @@
 - name: Import Atlas 45Drives tasks
  ansible.builtin.import_tasks: cockpit.yml

+- name: Import Atlas pool bootstrap tasks
+  ansible.builtin.import_tasks: pool.yml
+
 - name: Import Atlas storage tasks
  ansible.builtin.import_tasks: storage.yml

@@ -13,6 +16,3 @@

 - name: Import Atlas media-container tasks
  ansible.builtin.import_tasks: containers.yml
-
- name: Import Atlas Syncthing tasks
-  ansible.builtin.import_tasks: syncthing.yml
--- a/ansible/roles/profile_atlas/tasks/pool.yml
+++ b/ansible/roles/profile_atlas/tasks/pool.yml
@@ -0,0 +1,56 @@
+---
+- name: Bootstrap Atlas ZFS pool
+  tags: [atlas, storage, pool]
+  when: atlas_create_pool | bool
+  block:
+    - name: Validate Atlas pool bootstrap inputs
+      ansible.builtin.assert:
+        that:
+          - atlas_zpool_disks | length == 4
+          - atlas_zpool_disks | unique | length == 4
+          - atlas_zpool_disks | select('match', '^/dev/disk/by-id/') | list | length == 4
+        fail_msg: >-
+          Set exactly four distinct persistent /dev/disk/by-id paths in
+          atlas_zpool_disks before creating the RAIDZ2 pool.
+
+    - name: Inspect declared Atlas pool disks
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop: "{{ atlas_zpool_disks }}"
+      loop_control:
+        label: "{{ item }}"
+      register: atlas_zpool_disk_stats
+
+    - name: Require every declared Atlas pool disk
+      ansible.builtin.assert:
+        that:
+          - item.stat.exists
+          - item.stat.isblk | default(false)
+        fail_msg: "Declared Atlas pool disk is unavailable or is not a block device: {{ item.item }}"
+      loop: "{{ atlas_zpool_disk_stats.results }}"
+      loop_control:
+        label: "{{ item.item }}"
+
+    - name: Check whether the Atlas ZFS pool already exists
+      ansible.builtin.command:
+        argv:
+          - zpool
+          - list
+          - -H
+          - -o
+          - name
+          - "{{ atlas_zfs_pool }}"
+      register: atlas_zpool_bootstrap_check
+      changed_when: false
+      failed_when: atlas_zpool_bootstrap_check.rc not in [0, 1]
+
+    - name: Create the Atlas RAIDZ2 pool when absent
+      community.general.zpool:
+        name: "{{ atlas_zfs_pool }}"
+        state: present
+        mountpoint: "{{ atlas_mount_root }}"
+        force: false
+        vdevs:
+          - type: raidz2
+            disks: "{{ atlas_zpool_disks }}"
+      when: atlas_zpool_bootstrap_check.rc == 1
--- a/ansible/roles/profile_atlas/tasks/sharing.yml
+++ b/ansible/roles/profile_atlas/tasks/sharing.yml
@@ -8,7 +8,7 @@
    group: root
    mode: "0644"
  notify: Reload NFS exports
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Enable Atlas file-sharing services
  tags: [atlas, sharing, services]
@@ -21,7 +21,7 @@
    - smb.service
  loop_control:
    label: "{{ item }}"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Configure Atlas NFSv4-only service
  tags: [atlas, sharing]
@@ -32,7 +32,7 @@
    group: root
    mode: "0644"
  notify: Restart NFS server
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Mask Atlas NFSv3 RPC services
  tags: [atlas, sharing, services]
@@ -47,7 +47,7 @@
    - rpcbind.socket
  loop_control:
    label: "{{ item }}"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Ensure Atlas NFS mount daemon drop-in directory exists
  tags: [atlas, sharing, services]
@@ -57,7 +57,7 @@
    owner: root
    group: root
    mode: "0755"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Disable Atlas NFSv3 mount daemon listeners
  tags: [atlas, sharing, services]
@@ -68,7 +68,7 @@
    group: root
    mode: "0644"
  notify: Restart NFS mount daemon
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Enable SELinux access for Atlas file sharing
  tags: [atlas, sharing, services]
@@ -80,7 +80,7 @@
  loop_control:
    label: "{{ item }}"
  when:
-    - atlas_manage_storage | bool
+    - atlas_manage_sharing | bool
    - (ansible_facts['selinux'] | default({})).get('status', 'disabled') == 'enabled'

 - name: Render Atlas Samba configuration
@@ -93,7 +93,7 @@
    mode: "0644"
    validate: "testparm --suppress-prompt %s"
  notify: Restart Samba service
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Require Vault-backed Atlas Samba accounts
  tags: [atlas, sharing]
@@ -109,7 +109,7 @@
      - atlas_samba_accounts | selectattr('password', 'equalto', '') | list | length == 0
    fail_msg: Define every authorized Samba account and its Vault-backed password.
  no_log: true
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Ensure Atlas Samba private state directory exists
  tags: [atlas, sharing]
@@ -119,7 +119,7 @@
    owner: root
    group: root
    mode: "0700"
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Manage Vault-backed Atlas Samba credentials
  tags: [atlas, sharing]
@@ -129,7 +129,7 @@
    loop_var: atlas_samba_account
    label: "{{ atlas_samba_account.username }}"
  no_log: true
-  when: atlas_manage_storage | bool
+  when: atlas_manage_sharing | bool

 - name: Require completed Atlas firewall placeholders
  tags: [atlas, sharing, services]
--- a/ansible/roles/profile_atlas/tasks/storage.yml
+++ b/ansible/roles/profile_atlas/tasks/storage.yml
@@ -16,13 +16,20 @@
        properties:
          compression: zstd
          mountpoint: "{{ atlas_archive_mountpoint }}"
-      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
-        mountpoint: "{{ atlas_music_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
+        mountpoint: "{{ atlas_app_data_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
-          compression: lz4
-          mountpoint: "{{ atlas_music_mountpoint }}"
+          compression: zstd
+          mountpoint: "{{ atlas_app_data_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
+        mountpoint: "{{ atlas_navidrome_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: zstd
+          mountpoint: "{{ atlas_navidrome_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
        mountpoint: "{{ atlas_syncthing_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
@@ -30,19 +37,40 @@
        properties:
          compression: lz4
          mountpoint: "{{ atlas_syncthing_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_media }}"
+        mountpoint: "{{ atlas_media_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_media_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
+        mountpoint: "{{ atlas_music_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_music_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_backup_prometheus }}"
        mountpoint: "{{ atlas_backup_prometheus_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
        group: "{{ atlas_admin_group }}"
        properties:
          mountpoint: "{{ atlas_backup_prometheus_mountpoint }}"
-      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_icloud_photos }}"
-        mountpoint: "{{ atlas_icloud_photos_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_photobook }}"
+        mountpoint: "{{ atlas_photobook_mountpoint }}"
        owner: "{{ atlas_immich_username }}"
        group: "{{ atlas_immich_group }}"
        properties:
          compression: lz4
-          mountpoint: "{{ atlas_icloud_photos_mountpoint }}"
+          mountpoint: "{{ atlas_photobook_mountpoint }}"
+      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_backups }}"
+        mountpoint: "{{ atlas_backups_mountpoint }}"
+        owner: "{{ atlas_admin_username }}"
+        group: "{{ atlas_admin_group }}"
+        properties:
+          compression: lz4
+          mountpoint: "{{ atlas_backups_mountpoint }}"
      - name: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_service_backups }}"
        mountpoint: "{{ atlas_service_backups_mountpoint }}"
        owner: "{{ atlas_admin_username }}"
--- a/ansible/roles/profile_atlas/tasks/syncthing.yml
+++ b/ansible/roles/profile_atlas/tasks/syncthing.yml
@@ -1,40 +0,0 @@
---
- name: Create Atlas Syncthing configuration directory
-  tags: [atlas, syncthing]
-  ansible.builtin.file:
-    path: "{{ atlas_syncthing_config_dir }}"
-    state: directory
-    owner: "{{ atlas_admin_username }}"
-    group: "{{ atlas_admin_group }}"
-    mode: "0700"
-  when: atlas_manage_storage | bool
-
- name: Create Atlas Syncthing default data directory
-  tags: [atlas, syncthing]
-  ansible.builtin.file:
-    path: "{{ atlas_syncthing_default_dir }}"
-    state: directory
-    owner: "{{ atlas_admin_username }}"
-    group: "{{ atlas_admin_group }}"
-    mode: "0770"
-  when: atlas_manage_storage | bool
-
- name: Render Atlas Syncthing systemd service
-  tags: [atlas, syncthing]
-  ansible.builtin.template:
-    src: atlas-syncthing.service.j2
-    dest: /etc/systemd/system/atlas-syncthing.service
-    owner: root
-    group: root
-    mode: "0644"
-  notify: Restart Atlas Syncthing service
-  when: atlas_manage_storage | bool
-
- name: Enable Atlas Syncthing service
-  tags: [atlas, syncthing]
-  ansible.builtin.systemd:
-    name: atlas-syncthing
-    enabled: true
-    state: started
-    daemon_reload: true
-  when: atlas_manage_storage | bool
--- a/ansible/roles/profile_atlas/templates/atlas-immich-server.container.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-immich-server.container.j2
@@ -16,7 +16,7 @@ Network=atlas-media.network
 NetworkAlias=atlas-immich-server
 EnvironmentFile=/etc/immich/immich.env
 Volume={{ atlas_immich_upload_dir }}:/data:Z
-Volume={{ atlas_icloud_photos_mountpoint }}:/external/icloud_photos:ro,Z
+Volume={{ atlas_photobook_mountpoint }}:/external/photobook:ro,Z
 Volume=/etc/localtime:/etc/localtime:ro
 NoNewPrivileges=true
 DropCapability=NET_RAW
--- a/ansible/roles/profile_atlas/templates/atlas-syncthing.service.j2
+++ b/ansible/roles/profile_atlas/templates/atlas-syncthing.service.j2
@@ -1,16 +0,0 @@
-[Unit]
-Description=Atlas Syncthing service
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-User={{ atlas_admin_username }}
-Group={{ atlas_admin_group }}
-WorkingDirectory={{ atlas_syncthing_mountpoint }}
-Environment=HOME={{ atlas_syncthing_mountpoint }}
-ExecStart=/usr/local/bin/syncthing serve --no-browser --no-restart --no-upgrade --home={{ atlas_syncthing_config_dir }}
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
--- a/ansible/roles/profile_backend_phase1/defaults/main.yml
+++ b/ansible/roles/profile_backend_phase1/defaults/main.yml
@@ -0,0 +1,28 @@
+---
+backend_phase1_enabled: false
+backend_phase1_start_services: false
+backend_phase1_username: "{{ atlas_admin_username }}"
+backend_phase1_user_group: "{{ atlas_admin_group }}"
+backend_phase1_user_home: "{{ atlas_admin_home }}"
+backend_phase1_quadlet_dir: "{{ backend_phase1_user_home }}/.config/containers/systemd"
+backend_phase1_wireguard_interface: wg0
+backend_phase1_wireguard_address: CHANGEME_ATLAS_WIREGUARD_ADDRESS
+backend_phase1_wireguard_firewalld_zone: wireguard
+backend_phase1_music_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_music }}"
+backend_phase1_app_data_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_app_data }}"
+backend_phase1_navidrome_data_dir: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_navidrome }}"
+backend_phase1_syncthing_root: "{{ atlas_mount_root }}/{{ atlas_zfs_dataset_syncthing }}"
+backend_phase1_music_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_music }}"
+backend_phase1_app_data_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_app_data }}"
+backend_phase1_navidrome_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_navidrome }}"
+backend_phase1_syncthing_dataset: "{{ atlas_zfs_pool }}/{{ atlas_zfs_dataset_syncthing }}"
+backend_phase1_navidrome_image: docker.io/deluan/navidrome:0.63.2
+backend_phase1_syncthing_image: docker.io/syncthing/syncthing:2.1.3
+backend_phase1_navidrome_port: 4533
+backend_phase1_syncthing_gui_port: 8384
+backend_phase1_syncthing_transfer_port: 22000
+backend_phase1_syncthing_discovery_port: 21027
+backend_phase1_timezone: Europe/Rome
+backend_phase1_services:
+  - atlas-navidrome.service
+  - atlas-syncthing.service
--- a/ansible/roles/profile_backend_phase1/handlers/main.yml
+++ b/ansible/roles/profile_backend_phase1/handlers/main.yml
@@ -0,0 +1,32 @@
+---
+- name: Restart Atlas Navidrome Quadlet
+  tags: [backend_phase1, navidrome, podman, services]
+  become_user: "{{ backend_phase1_username }}"
+  ansible.builtin.systemd:
+    name: atlas-navidrome.service
+    scope: user
+    state: restarted
+    daemon_reload: true
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+  when:
+    - backend_phase1_enabled | bool
+    - backend_phase1_start_services | bool
+    - not ansible_check_mode
+
+- name: Restart Atlas Syncthing Quadlet
+  tags: [backend_phase1, syncthing, podman, services]
+  become_user: "{{ backend_phase1_username }}"
+  ansible.builtin.systemd:
+    name: atlas-syncthing.service
+    scope: user
+    state: restarted
+    daemon_reload: true
+  environment:
+    XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+    DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+  when:
+    - backend_phase1_enabled | bool
+    - backend_phase1_start_services | bool
+    - not ansible_check_mode
--- a/ansible/roles/profile_backend_phase1/tasks/main.yml
+++ b/ansible/roles/profile_backend_phase1/tasks/main.yml
@@ -0,0 +1,163 @@
+---
+- name: Configure Atlas phase-one backend services
+  tags: [backend_phase1, podman]
+  when: backend_phase1_enabled | bool
+  block:
+    - name: Validate phase-one backend inputs
+      ansible.builtin.assert:
+        that:
+          - not (atlas_manage_media_stack | bool)
+          - backend_phase1_wireguard_interface in ansible_facts.interfaces
+          - backend_phase1_wireguard_address != 'CHANGEME_ATLAS_WIREGUARD_ADDRESS'
+          - backend_phase1_music_dir.startswith('/')
+          - backend_phase1_app_data_root.startswith('/')
+          - backend_phase1_navidrome_data_dir.startswith(backend_phase1_app_data_root + '/')
+          - backend_phase1_syncthing_root.startswith(backend_phase1_app_data_root + '/')
+        fail_msg: >-
+          Disable the rootful media-stack gate and provide the active
+          WireGuard interface/address and absolute ZFS-backed paths before
+          enabling phase one. This role does not manage Prometheus or migrate
+          Navidrome application data.
+
+    - name: Read the rootless service account
+      ansible.builtin.getent:
+        database: passwd
+        key: "{{ backend_phase1_username }}"
+
+    - name: Record rootless service account IDs
+      ansible.builtin.set_fact:
+        backend_phase1_uid: "{{ ansible_facts['getent_passwd'][backend_phase1_username][1] }}"
+        backend_phase1_gid: "{{ ansible_facts['getent_passwd'][backend_phase1_username][2] }}"
+
+    - name: Read system service state before starting rootless Syncthing
+      ansible.builtin.service_facts:
+
+    - name: Refuse to overlap a system-level Atlas Syncthing service
+      ansible.builtin.assert:
+        that:
+          - >-
+            ansible_facts.services['atlas-syncthing.service'] is not defined
+            or ansible_facts.services['atlas-syncthing.service'].state != 'running'
+        fail_msg: >-
+          Remove or stop the system-level atlas-syncthing.service before
+          enabling the rootless Syncthing Quadlet.
+
+    - name: Inspect required ZFS datasets
+      community.general.zfs_facts:
+        name: "{{ item.dataset }}"
+        properties: name,mounted,mountpoint
+      loop:
+        - dataset: "{{ backend_phase1_music_dataset }}"
+          mountpoint: "{{ backend_phase1_music_dir }}"
+        - dataset: "{{ backend_phase1_app_data_dataset }}"
+          mountpoint: "{{ backend_phase1_app_data_root }}"
+        - dataset: "{{ backend_phase1_navidrome_dataset }}"
+          mountpoint: "{{ backend_phase1_navidrome_data_dir }}"
+        - dataset: "{{ backend_phase1_syncthing_dataset }}"
+          mountpoint: "{{ backend_phase1_syncthing_root }}"
+      loop_control:
+        label: "{{ item.dataset }}"
+      register: backend_phase1_zfs_facts
+
+    - name: Require mounted datasets at the declared paths
+      ansible.builtin.assert:
+        that:
+          - item.ansible_facts.ansible_zfs_datasets | length == 1
+          - item.ansible_facts.ansible_zfs_datasets[0].mounted == 'yes'
+          - item.ansible_facts.ansible_zfs_datasets[0].mountpoint == item.item.mountpoint
+        fail_msg: >-
+          {{ item.item.dataset }} must already be mounted at
+          {{ item.item.mountpoint }}. The phase-one role never creates or
+          imports the pool.
+      loop: "{{ backend_phase1_zfs_facts.results }}"
+      loop_control:
+        label: "{{ item.item.dataset }}"
+
+    - name: Enable lingering for the rootless service account
+      ansible.builtin.command:
+        argv:
+          - loginctl
+          - enable-linger
+          - "{{ backend_phase1_username }}"
+        creates: "/var/lib/systemd/linger/{{ backend_phase1_username }}"
+
+    - name: Start the rootless user systemd manager
+      ansible.builtin.systemd:
+        name: "user@{{ backend_phase1_uid }}.service"
+        state: started
+      when: not ansible_check_mode
+
+    - name: Create rootless Quadlet and application directories
+      ansible.builtin.file:
+        path: "{{ item.path }}"
+        state: directory
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "{{ item.mode }}"
+      loop:
+        - path: "{{ backend_phase1_quadlet_dir }}"
+          mode: "0700"
+        - path: "{{ backend_phase1_navidrome_data_dir }}"
+          mode: "0750"
+        - path: "{{ backend_phase1_syncthing_root }}"
+          mode: "0750"
+      loop_control:
+        label: "{{ item.path }}"
+
+    - name: Render the rootless Navidrome Quadlet
+      ansible.builtin.template:
+        src: atlas-navidrome.container.j2
+        dest: "{{ backend_phase1_quadlet_dir }}/atlas-navidrome.container"
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "0644"
+      notify: Restart Atlas Navidrome Quadlet
+
+    - name: Render the rootless Syncthing Quadlet
+      ansible.builtin.template:
+        src: atlas-syncthing.container.j2
+        dest: "{{ backend_phase1_quadlet_dir }}/atlas-syncthing.container"
+        owner: "{{ backend_phase1_username }}"
+        group: "{{ backend_phase1_user_group }}"
+        mode: "0644"
+      notify: Restart Atlas Syncthing Quadlet
+
+    - name: Reload the rootless user systemd manager
+      become_user: "{{ backend_phase1_username }}"
+      ansible.builtin.systemd:
+        scope: user
+        daemon_reload: true
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+      when: not ansible_check_mode
+
+    - name: Permit phase-one services only through the WireGuard zone
+      ansible.posix.firewalld:
+        port: "{{ item }}"
+        zone: "{{ backend_phase1_wireguard_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+      loop:
+        - "{{ backend_phase1_navidrome_port }}/tcp"
+        - "{{ backend_phase1_syncthing_gui_port }}/tcp"
+        - "{{ backend_phase1_syncthing_transfer_port }}/tcp"
+        - "{{ backend_phase1_syncthing_transfer_port }}/udp"
+        - "{{ backend_phase1_syncthing_discovery_port }}/udp"
+
+    - name: Start rootless phase-one Quadlets
+      become_user: "{{ backend_phase1_username }}"
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        scope: user
+        state: started
+        enabled: true
+        daemon_reload: true
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ backend_phase1_uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ backend_phase1_uid }}/bus"
+      loop: "{{ backend_phase1_services }}"
+      when:
+        - backend_phase1_start_services | bool
+        - not ansible_check_mode
--- a/ansible/roles/profile_backend_phase1/templates/atlas-navidrome.container.j2
+++ b/ansible/roles/profile_backend_phase1/templates/atlas-navidrome.container.j2
@@ -0,0 +1,28 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas rootless Navidrome backend
+
+[Container]
+ContainerName=atlas-navidrome
+Image={{ backend_phase1_navidrome_image }}
+UserNS=keep-id
+User={{ backend_phase1_uid }}
+Group={{ backend_phase1_gid }}
+PublishPort={{ backend_phase1_wireguard_address }}:{{ backend_phase1_navidrome_port }}:4533
+Environment=ND_LOGLEVEL=info
+Environment=ND_SCANSCHEDULE=1h
+Environment=ND_SESSIONTIMEOUT=24h
+Environment=ND_ENABLETRANSCODING=true
+Environment=TZ={{ backend_phase1_timezone }}
+Volume={{ backend_phase1_navidrome_data_dir }}:/data:Z
+Volume={{ backend_phase1_music_dir }}:/music:ro,z
+NoNewPrivileges=true
+DropCapability=all
+
+[Service]
+Restart=always
+RestartSec=10
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target
--- a/ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2
+++ b/ansible/roles/profile_backend_phase1/templates/atlas-syncthing.container.j2
@@ -0,0 +1,27 @@
+# Managed by Ansible. Do not edit manually.
+[Unit]
+Description=Atlas rootless Syncthing backend
+
+[Container]
+ContainerName=atlas-syncthing
+Image={{ backend_phase1_syncthing_image }}
+HostName=atlas-syncthing
+Network=host
+UserNS=keep-id
+User={{ backend_phase1_uid }}
+Group={{ backend_phase1_gid }}
+Environment=HOME=/var/syncthing
+Environment=STHOMEDIR=/var/syncthing/config
+Environment=STGUIADDRESS={{ backend_phase1_wireguard_address }}:{{ backend_phase1_syncthing_gui_port }}
+Environment=TZ={{ backend_phase1_timezone }}
+Volume={{ backend_phase1_syncthing_root }}:/var/syncthing:Z
+NoNewPrivileges=true
+DropCapability=all
+
+[Service]
+Restart=always
+RestartSec=10
+TimeoutStartSec=900
+
+[Install]
+WantedBy=default.target
--- a/ansible/roles/profile_server/handlers/main.yml
+++ b/ansible/roles/profile_server/handlers/main.yml
@@ -9,29 +9,3 @@
  tags: [services]
  ansible.builtin.systemd:
    daemon_reload: true
-
- name: Restart rclone music mount
-  tags: [services, rclone, navidrome]
-  ansible.builtin.systemd:
-    name: "{{ server_rclone_music_service }}"
-    state: restarted
-    daemon_reload: true
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode
-
- name: Restart rootless Navidrome
-  tags: [services, podman, rclone, navidrome]
-  become_user: "{{ server_username }}"
-  ansible.builtin.systemd:
-    name: navidrome.service
-    scope: user
-    state: restarted
-    daemon_reload: true
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}"
-    DBUS_SESSION_BUS_ADDRESS: >-
-      unix:path=/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}/bus
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode
--- a/ansible/roles/profile_server/tasks/main.yml
+++ b/ansible/roles/profile_server/tasks/main.yml
@@ -8,17 +8,6 @@
    fail_msg: >-
      server_firewall_backend must be firewalld for the Rocky server profile.

- name: Require server database secret variables
-  tags: [dotfiles, dotfiles:server, services, navidrome]
-  ansible.builtin.assert:
-    that:
-      - server_navidrome_db_password | length > 0
-      - (vault_postgres_root_password | default('')) | length > 0
-    fail_msg: >-
-      Define vault_navidrome_db_password and vault_postgres_root_password in Vault
-      before rendering the Navidrome database configuration.
-  no_log: true
-
 - name: Configure DuckDNS updater
  tags: [dotfiles, dotfiles:server, duckdns]
  ansible.builtin.import_tasks: duckdns.yml
@@ -72,12 +61,6 @@
  tags: [services, podman]
  ansible.builtin.include_tasks: podman-compose.yml

- name: Configure Atlas music mount
-  ansible.builtin.import_tasks: rclone-music.yml
-
- name: Configure rootless Navidrome
-  ansible.builtin.import_tasks: navidrome.yml
-
 - name: Disable SSH root login on server
  tags: [services]
  ansible.builtin.lineinfile:
--- a/ansible/roles/profile_server/tasks/navidrome.yml
+++ b/ansible/roles/profile_server/tasks/navidrome.yml
@@ -1,114 +0,0 @@
---
- name: Read server account details for rootless Navidrome
-  tags: [services, podman, rclone, navidrome]
-  ansible.builtin.getent:
-    database: passwd
-    key: "{{ server_username }}"
-  when: server_atlas_music_enabled | bool
-
- name: Check for a running legacy rootful Navidrome container
-  tags: [services, podman, navidrome]
-  ansible.builtin.command:
-    argv:
-      - podman
-      - container
-      - inspect
-      - --format
-      - "{{ '{{.State.Running}}' }}"
-      - navidrome
-  register: server_legacy_navidrome_container
-  changed_when: false
-  failed_when: false
-  check_mode: false
-  when: server_atlas_music_enabled | bool
-
- name: Refuse concurrent legacy and rootless Navidrome
-  tags: [services, podman, navidrome]
-  ansible.builtin.assert:
-    that:
-      - >-
-        server_legacy_navidrome_container.rc != 0
-        or server_legacy_navidrome_container.stdout | trim != 'true'
-    fail_msg: >-
-      Stop the legacy rootful Navidrome container before enabling the rootless Quadlet.
-      The playbook does not remove the old container or its data automatically.
-  when: server_atlas_music_enabled | bool
-
- name: Enable lingering for rootless Navidrome
-  tags: [services, podman, navidrome]
-  ansible.builtin.command:
-    argv:
-      - loginctl
-      - enable-linger
-      - "{{ server_username }}"
-    creates: "/var/lib/systemd/linger/{{ server_username }}"
-  when: server_atlas_music_enabled | bool
-
- name: Start server user systemd manager
-  tags: [services, podman, navidrome]
-  ansible.builtin.systemd:
-    name: "user@{{ ansible_facts['getent_passwd'][server_username][1] }}.service"
-    state: started
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode
-
- name: Create rootless Navidrome Quadlet directory
-  tags: [services, podman, navidrome]
-  ansible.builtin.file:
-    path: "{{ server_navidrome_quadlet_dir }}"
-    state: directory
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0700"
-  when: server_atlas_music_enabled | bool
-
- name: Create private rootless Navidrome configuration directory
-  tags: [services, podman, navidrome]
-  ansible.builtin.file:
-    path: "{{ server_navidrome_env_dir }}"
-    state: directory
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0700"
-  when: server_atlas_music_enabled | bool
-
- name: Render Vault-backed rootless Navidrome environment
-  tags: [services, podman, navidrome]
-  ansible.builtin.template:
-    src: navidrome.env.j2
-    dest: "{{ server_navidrome_env_file }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0600"
-  no_log: true
-  diff: false
-  notify: Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
- name: Render rootless Navidrome Quadlet
-  tags: [services, podman, navidrome]
-  ansible.builtin.template:
-    src: navidrome.container.j2
-    dest: "{{ server_navidrome_quadlet_dir }}/navidrome.container"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0644"
-  notify: Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
- name: Start rootless Navidrome Quadlet
-  tags: [services, podman, navidrome]
-  become_user: "{{ server_username }}"
-  ansible.builtin.systemd:
-    name: navidrome.service
-    scope: user
-    state: started
-    daemon_reload: true
-  environment:
-    XDG_RUNTIME_DIR: "/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}"
-    DBUS_SESSION_BUS_ADDRESS: >-
-      unix:path=/run/user/{{ ansible_facts['getent_passwd'][server_username][1] }}/bus
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode
--- a/ansible/roles/profile_server/tasks/rclone-music.yml
+++ b/ansible/roles/profile_server/tasks/rclone-music.yml
@@ -1,105 +0,0 @@
---
- name: Require completed Atlas SFTP mount configuration
-  tags: [services, rclone, navidrome]
-  ansible.builtin.assert:
-    that:
-      - server_atlas_sftp_host != 'CHANGEME_ATLAS_WIREGUARD_IP'
-      - server_atlas_sftp_known_host != 'CHANGEME_ATLAS_SSH_HOST_KEY'
-      - server_atlas_sftp_known_host | length > 0
-      - server_atlas_sftp_private_key | length > 0
-      - server_atlas_sftp_remote_path == '/pool/media/music'
-    fail_msg: >-
-      Define the Atlas WireGuard address, pinned SSH host key and Vault-backed
-      SFTP private key before enabling the music mount.
-  no_log: true
-  when: server_atlas_music_enabled | bool
-
- name: Create private rclone configuration directory
-  tags: [services, rclone, navidrome]
-  ansible.builtin.file:
-    path: "{{ server_rclone_config_dir }}"
-    state: directory
-    owner: root
-    group: "{{ server_user_group }}"
-    mode: "0750"
-  when: server_atlas_music_enabled | bool
-
- name: Install Vault-backed Atlas SFTP private key
-  tags: [services, rclone, navidrome]
-  ansible.builtin.copy:
-    content: "{{ server_atlas_sftp_private_key | trim }}\n"
-    dest: "{{ server_atlas_sftp_private_key_file }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0600"
-  no_log: true
-  diff: false
-  notify:
-    - Restart rclone music mount
-    - Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
- name: Install pinned Atlas SSH host key
-  tags: [services, rclone, navidrome]
-  ansible.builtin.copy:
-    content: "{{ server_atlas_sftp_known_host | trim }}\n"
-    dest: "{{ server_atlas_sftp_known_hosts_file }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0640"
-  notify:
-    - Restart rclone music mount
-    - Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
- name: Render Atlas SFTP rclone configuration
-  tags: [services, rclone, navidrome]
-  ansible.builtin.template:
-    src: rclone.conf.j2
-    dest: "{{ server_rclone_config_file }}"
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0600"
-  notify:
-    - Restart rclone music mount
-    - Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
- name: Create rclone music directories
-  tags: [services, rclone, navidrome]
-  ansible.builtin.file:
-    path: "{{ item }}"
-    state: directory
-    owner: "{{ server_username }}"
-    group: "{{ server_user_group }}"
-    mode: "0750"
-  loop:
-    - "{{ server_rclone_music_mountpoint }}"
-    - "{{ server_rclone_music_cache_dir }}"
-  loop_control:
-    label: "{{ item }}"
-  when: server_atlas_music_enabled | bool
-
- name: Render rclone music system service
-  tags: [services, rclone, navidrome]
-  ansible.builtin.template:
-    src: rclone-music.service.j2
-    dest: "/etc/systemd/system/{{ server_rclone_music_service }}"
-    owner: root
-    group: root
-    mode: "0644"
-  notify:
-    - Restart rclone music mount
-    - Restart rootless Navidrome
-  when: server_atlas_music_enabled | bool
-
- name: Enable and start rclone music mount
-  tags: [services, rclone, navidrome]
-  ansible.builtin.systemd:
-    name: "{{ server_rclone_music_service }}"
-    enabled: true
-    state: started
-    daemon_reload: true
-  when:
-    - server_atlas_music_enabled | bool
-    - not ansible_check_mode
--- a/ansible/roles/profile_server/templates/navidrome.container.j2
+++ b/ansible/roles/profile_server/templates/navidrome.container.j2
@@ -1,21 +0,0 @@
-# Managed by Ansible. Do not edit manually.
-[Unit]
-Description=Rootless Navidrome music server
-
-[Container]
-ContainerName=navidrome
-Image={{ server_navidrome_image }}
-Network=host
-EnvironmentFile={{ server_navidrome_env_file }}
-Volume={{ server_navidrome_data_dir }}:/data
-Volume={{ server_rclone_music_mountpoint }}:/music:ro
-SecurityLabelDisable=true
-
-[Service]
-ExecStartPre=/usr/bin/mountpoint -q {{ server_rclone_music_mountpoint }}
-Restart=always
-RestartSec=10s
-TimeoutStartSec=900
-
-[Install]
-WantedBy=default.target
--- a/ansible/roles/profile_server/templates/navidrome.env.j2
+++ b/ansible/roles/profile_server/templates/navidrome.env.j2
@@ -1,7 +0,0 @@
-# Managed by Ansible. Contains a Vault secret; do not edit or copy.
-ND_DATABASE_URL={{ ('postgres://navidrome:' ~ server_navidrome_db_password ~ '@127.0.0.1:5432/navidrome_db?sslmode=disable') | to_json }}
-ND_PORT={{ server_navidrome_port }}
-ND_SCANSCHEDULE="1h"
-ND_SESSIONTIMEOUT="24h"
-ND_ENABLETRANSCODING="true"
-ND_LOGLEVEL="info"
--- a/ansible/roles/profile_server/templates/rclone-music.service.j2
+++ b/ansible/roles/profile_server/templates/rclone-music.service.j2
@@ -1,29 +0,0 @@
-[Unit]
-Description=Read-only Atlas music mount via rclone SFTP
-Wants=network-online.target
-After=network-online.target
-{% if server_atlas_wireguard_unit | length > 0 %}
-Wants={{ server_atlas_wireguard_unit }}
-After={{ server_atlas_wireguard_unit }}
-{% endif %}
-
-[Service]
-Type=notify
-User={{ server_username }}
-Group={{ server_user_group }}
-ExecStart=/usr/bin/rclone mount \
-  {{ server_atlas_sftp_remote_name }}:{{ server_atlas_sftp_remote_path }} \
-  {{ server_rclone_music_mountpoint }} \
-  --config {{ server_rclone_config_file }} \
-  --cache-dir {{ server_rclone_music_cache_dir }} \
-  --read-only \
-  --vfs-cache-mode full \
-  --vfs-cache-max-size 15G \
-  --vfs-read-chunk-size 5M \
-  --dir-cache-time 24h
-ExecStop=-/usr/bin/fusermount3 -uz {{ server_rclone_music_mountpoint }}
-Restart=on-failure
-RestartSec=10s
-
-[Install]
-WantedBy=multi-user.target
--- a/ansible/roles/profile_server/templates/rclone.conf.j2
+++ b/ansible/roles/profile_server/templates/rclone.conf.j2
@@ -1,9 +0,0 @@
-# Managed by Ansible. Authentication uses the separately deployed Vault-backed key.
-[{{ server_atlas_sftp_remote_name }}]
-type = sftp
-host = {{ server_atlas_sftp_host }}
-user = {{ server_atlas_sftp_username }}
-port = {{ server_atlas_sftp_port }}
-key_file = {{ server_atlas_sftp_private_key_file }}
-known_hosts_file = {{ server_atlas_sftp_known_hosts_file }}
-shell_type = unix
--- a/ansible/roles/wireguard_overlay/defaults/main.yml
+++ b/ansible/roles/wireguard_overlay/defaults/main.yml
@@ -0,0 +1,15 @@
+---
+wireguard_overlay_enabled: false
+wireguard_interface: wg0
+wireguard_config_dir: /etc/wireguard
+wireguard_private_key_path: "{{ wireguard_config_dir }}/{{ wireguard_interface }}.key"
+wireguard_config_path: "{{ wireguard_config_dir }}/{{ wireguard_interface }}.conf"
+wireguard_address: CHANGEME_WIREGUARD_ADDRESS
+wireguard_listen_port: 0
+wireguard_mtu: 1420
+wireguard_firewalld_zone: wireguard
+wireguard_public_firewalld_zone: public
+wireguard_enable_ipv4_forwarding: false
+wireguard_peers: []
+wireguard_packages:
+  - wireguard-tools
--- a/ansible/roles/wireguard_overlay/handlers/main.yml
+++ b/ansible/roles/wireguard_overlay/handlers/main.yml
@@ -0,0 +1,10 @@
+---
+- name: Restart WireGuard interface
+  tags: [wireguard, services]
+  ansible.builtin.systemd:
+    name: "wg-quick@{{ wireguard_interface }}.service"
+    state: restarted
+    daemon_reload: true
+  when:
+    - wireguard_overlay_enabled | bool
+    - not ansible_check_mode
--- a/ansible/roles/wireguard_overlay/tasks/main.yml
+++ b/ansible/roles/wireguard_overlay/tasks/main.yml
@@ -0,0 +1,158 @@
+---
+- name: Configure WireGuard overlay
+  tags: [wireguard, services]
+  when: wireguard_overlay_enabled | bool
+  block:
+    - name: Validate WireGuard host configuration
+      ansible.builtin.assert:
+        that:
+          - wireguard_address != 'CHANGEME_WIREGUARD_ADDRESS'
+          - wireguard_address is match('^[0-9]{1,3}(\.[0-9]{1,3}){3}/[0-9]{1,2}$')
+          - wireguard_peers | length > 0
+          - wireguard_peers | map(attribute='host') | difference(ansible_play_hosts_all) | length == 0
+        fail_msg: >-
+          Configure this host's WireGuard address and peers, and run the first
+          key bootstrap against every peer in the same play.
+
+    - name: Install WireGuard userspace tools
+      ansible.builtin.dnf:
+        name: "{{ wireguard_packages }}"
+        state: present
+
+    - name: Create private WireGuard configuration directory
+      ansible.builtin.file:
+        path: "{{ wireguard_config_dir }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0700"
+
+    - name: Check for an existing WireGuard private key
+      ansible.builtin.stat:
+        path: "{{ wireguard_private_key_path }}"
+      register: wireguard_private_key_stat
+
+    - name: Generate a missing WireGuard private key
+      ansible.builtin.command:
+        argv:
+          - wg
+          - genkey
+      register: wireguard_generated_private_key
+      changed_when: true
+      no_log: true
+      when:
+        - not wireguard_private_key_stat.stat.exists
+        - not ansible_check_mode
+
+    - name: Persist the generated WireGuard private key
+      ansible.builtin.copy:
+        content: "{{ wireguard_generated_private_key.stdout }}\n"
+        dest: "{{ wireguard_private_key_path }}"
+        owner: root
+        group: root
+        mode: "0600"
+      no_log: true
+      when:
+        - not wireguard_private_key_stat.stat.exists
+        - not ansible_check_mode
+
+    - name: Require a private key during check mode
+      ansible.builtin.assert:
+        that:
+          - wireguard_private_key_stat.stat.exists
+        fail_msg: >-
+          The initial WireGuard key generation cannot be simulated safely in
+          check mode. Run the gated WireGuard play once without --check.
+      when: ansible_check_mode
+
+    - name: Read the persisted WireGuard private key
+      ansible.builtin.slurp:
+        src: "{{ wireguard_private_key_path }}"
+      register: wireguard_private_key_material
+      no_log: true
+
+    - name: Derive this host's WireGuard public key
+      ansible.builtin.command:
+        argv:
+          - wg
+          - pubkey
+        stdin: "{{ wireguard_private_key_material.content | b64decode | trim }}"
+      register: wireguard_derived_public_key
+      changed_when: false
+      no_log: true
+
+    - name: Publish this host's WireGuard public key
+      ansible.builtin.set_fact:
+        wireguard_public_key: "{{ wireguard_derived_public_key.stdout }}"
+
+    - name: Require every peer's generated public key
+      ansible.builtin.assert:
+        that:
+          - hostvars[item.host].wireguard_public_key is defined
+          - hostvars[item.host].wireguard_public_key | length > 0
+        fail_msg: >-
+          The public key for {{ item.host }} is unavailable. The first
+          WireGuard run must include every overlay host.
+      loop: "{{ wireguard_peers }}"
+      loop_control:
+        label: "{{ item.name }}"
+
+    - name: Render the private WireGuard interface configuration
+      ansible.builtin.template:
+        src: wg.conf.j2
+        dest: "{{ wireguard_config_path }}"
+        owner: root
+        group: root
+        mode: "0600"
+      diff: false
+      no_log: true
+      notify: Restart WireGuard interface
+
+    - name: Enable IPv4 forwarding for the ingress host
+      ansible.posix.sysctl:
+        name: net.ipv4.ip_forward
+        value: "1"
+        state: present
+        sysctl_set: true
+        reload: true
+      when: wireguard_enable_ipv4_forwarding | bool
+
+    - name: Create the WireGuard firewalld zone
+      ansible.posix.firewalld:
+        zone: "{{ wireguard_firewalld_zone }}"
+        state: present
+        permanent: true
+      register: wireguard_firewalld_zone_result
+
+    - name: Reload firewalld after creating the WireGuard zone
+      ansible.builtin.systemd:
+        name: firewalld.service
+        state: reloaded
+      when:
+        - wireguard_firewalld_zone_result is changed
+        - not ansible_check_mode
+
+    - name: Assign the WireGuard interface to its firewalld zone
+      ansible.posix.firewalld:
+        interface: "{{ wireguard_interface }}"
+        zone: "{{ wireguard_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+
+    - name: Permit this host's public WireGuard listener
+      ansible.posix.firewalld:
+        port: "{{ wireguard_listen_port }}/udp"
+        zone: "{{ wireguard_public_firewalld_zone }}"
+        state: enabled
+        permanent: true
+        immediate: true
+      when: wireguard_listen_port | int > 0
+
+    - name: Enable the WireGuard interface
+      ansible.builtin.systemd:
+        name: "wg-quick@{{ wireguard_interface }}.service"
+        enabled: true
+        state: started
+        daemon_reload: true
+      when: not ansible_check_mode
--- a/ansible/roles/wireguard_overlay/templates/wg.conf.j2
+++ b/ansible/roles/wireguard_overlay/templates/wg.conf.j2
@@ -0,0 +1,25 @@
+# Managed by Ansible. Do not edit manually.
+[Interface]
+Address = {{ wireguard_address }}
+PrivateKey = {{ wireguard_private_key_material.content | b64decode | trim }}
+MTU = {{ wireguard_mtu }}
+SaveConfig = false
+{% if wireguard_listen_port | int > 0 %}
+ListenPort = {{ wireguard_listen_port }}
+{% endif %}
+
+{% for peer in wireguard_peers %}
+[Peer]
+# {{ peer.name }}
+PublicKey = {{ hostvars[peer.host].wireguard_public_key }}
+AllowedIPs = {{ peer.allowed_ips | join(', ') }}
+{% if peer.endpoint is defined %}
+Endpoint = {{ peer.endpoint }}
+{% endif %}
+{% if peer.persistent_keepalive | default(0) | int > 0 %}
+PersistentKeepalive = {{ peer.persistent_keepalive }}
+{% endif %}
+{% if not loop.last %}
+
+{% endif %}
+{% endfor %}
--- a/ansible/site.yml
+++ b/ansible/site.yml
@@ -73,6 +73,13 @@
    - packages_rocky
    - services_systemd

+- name: Configure WireGuard overlay
+  hosts: wireguard_overlay
+  become: true
+
+  roles:
+    - wireguard_overlay
+
 - name: Configure Aegis Fedora IoT profile
  hosts: role_aegis
  become: true
@@ -87,6 +94,13 @@
  roles:
    - profile_atlas

+- name: Configure Atlas phase-one backend services
+  hosts: role_backend_phase1
+  become: true
+
+  roles:
+    - profile_backend_phase1
+
 - name: Configure Rocky Linux server
  hosts: rocky_server
  become: true
--- a/ansible/templates/server/docker-compose.yml.j2
+++ b/ansible/templates/server/docker-compose.yml.j2
@@ -38,22 +38,6 @@ services:
  #   networks:
  #     - web

-  navidromedb:
-    image: docker.io/library/postgres:13
-    container_name: navidromedb
-    restart: unless-stopped
-    mem_limit: 2048m
-    environment:
-      POSTGRES_DB: "navidrome_db"
-      POSTGRES_USER: "navidrome"
-      POSTGRES_PASSWORD: "{{ vault_postgres_root_password }}"
-    volumes:
-      - "/opt/postgres/data:/var/lib/postgresql/data{{ ':' ~ selinux_volume_option if selinux_volume_option else '' }}"
-    ports:
-      - "127.0.0.1:5432:5432"
-    networks:
-      - web
-
  gitea:
    image: docker.gitea.com/gitea:1.25.2
    container_name: gitea
--- a/scripts/migrate_prometheus_data.sh
+++ b/scripts/migrate_prometheus_data.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh

-# Copy the persistent Docker data from the retired Ubuntu server to the Rocky
+# Copy the persistent NPM and Gitea data from the retired Ubuntu server to the Rocky
 # replacement. Run this script on the Ubuntu source as root. It is a dry run
 # unless --execute and --quiesce-source are both supplied. Extended attributes
 # are deliberately not copied: Rocky must assign its own SELinux labels.
@@ -14,11 +14,8 @@ EXECUTE=false
 QUIESCE_SOURCE=false

 DATA_PATHS='
-/opt/navidrome/data
-/opt/music
 /opt/npm/data
 /opt/npm/letsencrypt
-/opt/postgres/data
 /opt/gitea/data
 '

@@ -26,8 +23,8 @@ usage() {
  cat <<'EOF'
 Usage: sudo ./scripts/migrate_prometheus_data.sh --destination USER@HOST [options]

-Copies persistent Navidrome, Nginx Proxy Manager, PostgreSQL and Gitea data to
-the Rocky server with rsync. The destination Docker containers must be stopped.
+Copies persistent Nginx Proxy Manager and Gitea data to the Rocky server with
+rsync. The destination Docker containers must be stopped.

 Options:
  --destination USER@HOST  Rocky SSH destination (required).
@@ -97,7 +94,7 @@ if [ -n "$IDENTITY_FILE" ]; then
 fi

 if [ "$EXECUTE" = true ] && [ "$QUIESCE_SOURCE" != true ]; then
-  fail '--execute requires --quiesce-source to keep PostgreSQL data consistent'
+  fail '--execute requires --quiesce-source to keep application data consistent'
 fi

 require_command rsync
--- a/secrets/vault.yml.example
+++ b/secrets/vault.yml.example
@@ -9,8 +9,6 @@ vault_icloud_mail_password: "REPLACE_ME"
 vault_git_work_email: "REPLACE_ME"
 vault_git_work_gpg: "REPLACE_ME"
 vault_openai_api_key: "REPLACE_ME"
-vault_navidrome_db_password: "REPLACE_ME"
-vault_postgres_root_password: "REPLACE_ME"
 vault_ikaros_authorized_ssh_keys:
  - "ssh-ed25519 REPLACE_ME"
 vault_atlas_authorized_ssh_keys:
@@ -18,5 +16,3 @@ vault_atlas_authorized_ssh_keys:
 vault_atlas_admin_password_hash: "REPLACE_WITH_A_SHADOW_COMPATIBLE_HASH"
 vault_atlas_samba_password: "REPLACE_ME"
 vault_atlas_immich_db_password: "REPLACE_ME"
-vault_prometheus_atlas_sftp_private_key: |
-  REPLACE_WITH_A_DEDICATED_ATLAS_SFTP_PRIVATE_KEY
Author	SHA1	Message	Date
Fabio Scotto di Santolo	db10d1296e	Enable Atlas NAS management and document bootstrap workflow	2026-09-12 18:53:21 +02:00
Fabio Scotto di Santolo	8c35ef63c9	Document Atlas backend phase one and WireGuard deployment	2026-09-12 17:19:20 +02:00