feat(ansible): move hosts to healthcheck_profiles list; decouple audit/restic

Inventory now declares the plural healthcheck_profiles list per host (hk2 runs
pdns, rustdesk, hk2aux) instead of a single healthcheck_profile, and carries
the rustdesk server vars (rustdesk_compose_dir/relay/image) plus the rustdesk
host group.

The restic role relied on the removed singular healthcheck_profile var; it now
uses its own restic_backup_profile (set per host to vaultwarden on us2 and pdns
on hk2), so the health-check rename no longer breaks it. audit.yml's summary
labels the host's profile list instead of the singular var.

ansible/roles/restic/defaults/main.yml

@@ -1,5 +1,8 @@
 ---
 restic_enabled: false
+# Approved Restic source profile (a key of restic_sources) for the host. Set
+# per-host in inventory; the role fails if it is not an approved source.
+restic_backup_profile: ""
 restic_binary: /usr/bin/restic
 restic_config_path: /etc/vps-restic/repository.env
 restic_state_dir: /var/lib/vps-restic

ansible/roles/restic/tasks/main.yml

@@ -10,8 +10,8 @@
 - name: Validate supported Restic source profile
   ansible.builtin.assert:
     that:
-      - healthcheck_profile in restic_sources
-    fail_msg: "No approved Restic source profile for {{ healthcheck_profile }}."
+      - restic_backup_profile in restic_sources
+    fail_msg: "No approved Restic source profile for {{ restic_backup_profile }}."
 
 - name: Verify Restic binary exists on target
   ansible.builtin.stat:

ansible/roles/restic/templates/backup.j2

@@ -3,4 +3,4 @@ set -euo pipefail
 # Repository and password credentials are host-local in {{ restic_config_path }}.
 # shellcheck source=/dev/null
 source '{{ restic_config_path }}'
-exec '{{ restic_binary }}' backup --tag '{{ healthcheck_profile }}' --tag "$(hostname -s)" {% for source in restic_sources[healthcheck_profile] %}{{ source | quote }} {% endfor %}
+exec '{{ restic_binary }}' backup --tag '{{ restic_backup_profile }}' --tag "$(hostname -s)" {% for source in restic_sources[restic_backup_profile] %}{{ source | quote }} {% endfor %}

ansible/roles/restic/templates/forget-prune.j2

@@ -2,4 +2,4 @@
 set -euo pipefail
 # shellcheck source=/dev/null
 source '{{ restic_config_path }}'
-exec '{{ restic_binary }}' forget --prune --keep-daily {{ restic_keep_daily }} --keep-weekly {{ restic_keep_weekly }} --keep-monthly {{ restic_keep_monthly }} --tag '{{ healthcheck_profile }}'
+exec '{{ restic_binary }}' forget --prune --keep-daily {{ restic_keep_daily }} --keep-weekly {{ restic_keep_weekly }} --keep-monthly {{ restic_keep_monthly }} --tag '{{ restic_backup_profile }}'

ansible/roles/restic/templates/vps-restic-backup.service.j2

@@ -1,5 +1,5 @@
 [Unit]
-Description=Restic backup for approved {{ healthcheck_profile }} sources
+Description=Restic backup for approved {{ restic_backup_profile }} sources
 After=network-online.target
 Wants=network-online.target