Manage routine operations through Ansible

hosts/hk2.chans.xyz.md

@@ -110,12 +110,18 @@ See full shape in [docs/pdns-upstream.md](../docs/pdns-upstream.md). Live secret
 - [pdns-upstream docs](../docs/pdns-upstream.md)
 
 ```bash
-ssh -4 windy@hk2.chans.xyz
-cd /opt/pdns && docker compose ps -a
-docker compose logs -f auth poweradmin backup
-./scripts/manual-backup.sh
-# after pdns.conf / secrets.j2 / auth env changes:
-docker compose up -d --force-recreate auth
+cd ansible
+ansible-playbook playbooks/health-report.yml --limit powerdns
+# after reviewed auth config / secret-template / environment changes:
+ansible-playbook playbooks/compose-reconcile.yml --limit powerdns \
+  -e '{"service_reconcile_confirm": true, "service_reconcile_targets": ["auth"]}'
+```
+
+Direct SSH remains appropriate for streaming incident logs or running the
+on-server, intentionally imperative manual backup command:
+
+```bash
+ssh -4 windy@hk2.chans.xyz 'cd /opt/pdns && ./scripts/manual-backup.sh'
 ```
 
 ```bash

hosts/mx2.windy.me.md

@@ -29,7 +29,10 @@
 
 ## Ops notes
 
-- Manage with: `cd /opt/mail && docker compose …`
+- Use the Ansible health report for routine checks. Use the gated Ansible
+  Compose reconcile playbook for a reviewed full-stack recreate; retain direct
+  Compose access only for focused incident diagnosis and Mailcow's interactive
+  upstream updater.
 - `SKIP_CLAMD=y` may still leave `clamd` running after updates; recreate if you need it truly skipped
 - Host has ~8G RAM, no swap; watch memory under load
 - Unrelated stopped containers may exist (`zc-*` monitoring stack) — not part of mailcow

hosts/synapse.chans.xyz.md

@@ -90,11 +90,16 @@ Path: `/etc/matrix-bootstrap/` (root:root, 0700) — individual files per secret
 
 Inventory group: `matrix_production` (but NOT in `managed` which expects Docker Compose).
 
-Playbooks in `ansible/playbooks/matrix-*.yml`.
+Routine status: `cd ansible && ansible-playbook playbooks/health-report.yml --limit matrix`.
+Use `matrix-preflight.yml` before a Matrix/K3s change, and use the gated
+`matrix-stack.yml` to apply a reviewed ESS chart version. Playbooks are in
+`ansible/playbooks/matrix-*.yml`; direct SSH is reserved for focused K3s
+diagnosis and imperative recovery work.
 
 ## Known limitations
 
 - MatrixRTC / Element Call / LiveKit / Coturn not deployed (`mrtc.chans.xyz` reserved only)
-- SMTP email not yet configured (requires manual bootstrap + Helm upgrade)
+- SMTP email not yet configured (requires manual secret bootstrap followed by a
+  reviewed Ansible stack deployment)
 - No off-site Restic backup
 - Single-node K3s (no HA for control plane)

hosts/us2.wsvc.info.md

@@ -69,10 +69,11 @@ Effective `config.json`: domain `https://auth.wsvc.info`, SMTP 587/starttls to `
 - [vaultwarden-upstream docs](../docs/vaultwarden-upstream.md)
 
 ```bash
-ssh -4 windy@us2.wsvc.info
-cd /opt/vaultwarden && docker compose ps -a
-# after recreating vaultwarden, if auth 404s:
-docker restart traefik
+cd ansible
+ansible-playbook playbooks/health-report.yml --limit vaultwarden
+# after a reviewed Vaultwarden configuration change (and only if auth 404s):
+ansible-playbook playbooks/compose-reconcile.yml --limit vaultwarden \
+  -e '{"service_reconcile_confirm": true, "service_reconcile_targets": ["vaultwarden"], "service_reconcile_restart_traefik": true}'
 ```
 
 ## Other software on this host (stubs)