Manage routine operations through Ansible

AGENTS.md

@@ -10,7 +10,11 @@ Also readable as `agent.md` (symlink → this file).
 2. Open the matching [`hosts/<name>.md`](hosts/) for SSH, roles, paths, and quirks.
 3. For common tasks, follow a runbook under [`runbooks/`](runbooks/).
 4. Prefer read-only checks first; change only after confirming current state.
-5. Default access: `ssh -4 windy@<host>` (pubkey). Prefer **IPv4** from this WSL client (AAAA often exists but IPv6 route does not).
+5. For routine checks and approved service reconciliation, run the matching
+   Ansible playbook from `ansible/`; see [routine Ansible operations](runbooks/ansible-operations.md).
+6. Default SSH access (`ssh -4 windy@<host>`) is for focused diagnostics,
+   imperative upstream procedures, and incident work. Prefer **IPv4** from this
+   WSL client (AAAA often exists but IPv6 route does not).
 
 ## Active hosts (quick map)
 
@@ -59,6 +63,7 @@ Also readable as `agent.md` (symlink → this file).
 | PowerDNS upstream refs | [docs/pdns-upstream.md](docs/pdns-upstream.md) |
 | Matrix health | [runbooks/matrix-health.md](runbooks/matrix-health.md) |
 | Matrix upstream refs | [docs/matrix-upstream.md](docs/matrix-upstream.md) |
+| Routine Ansible operations | [runbooks/ansible-operations.md](runbooks/ansible-operations.md) |
 
 ```bash
 ./scripts/check-mx2.sh
@@ -71,6 +76,8 @@ Also readable as `agent.md` (symlink → this file).
 - Never commit secrets: passwords, API keys, private keys, `.env`, `mailcow.conf` DB passwords, Vaultwarden `ADMIN_TOKEN` / `.smtp-credentials`.
 - Secrets live **only on the servers** (e.g. `/opt/vaultwarden/.env`). Do not copy them from Obsidian into this repo.
 - Ask before destructive actions: `docker compose down -v`, DB drops, DNS changes, force-push, disk wipes.
+- Ansible reconciliation is intentionally allowlisted and requires an explicit
+  confirmation variable; it is not a general remote-command facility.
 - Do not modify local `~/.ssh/config` or git config unless explicitly asked.
 
 ## SSH access safety — mandatory change procedure