feat(ansible): move hosts to healthcheck_profiles list; decouple audit/restic

Inventory now declares the plural healthcheck_profiles list per host (hk2 runs
pdns, rustdesk, hk2aux) instead of a single healthcheck_profile, and carries
the rustdesk server vars (rustdesk_compose_dir/relay/image) plus the rustdesk
host group.

The restic role relied on the removed singular healthcheck_profile var; it now
uses its own restic_backup_profile (set per host to vaultwarden on us2 and pdns
on hk2), so the health-check rename no longer breaks it. audit.yml's summary
labels the host's profile list instead of the singular var.

ansible/inventory/hosts.yml

@@ -17,7 +17,7 @@ all:
           ansible_host_ipv4: 194.163.160.244
           service_role: mailcow
           compose_project_dir: /opt/mail
-          healthcheck_profile: mailcow
+          healthcheck_profiles: [mailcow]
           service_reconcile_services:
             all:
               compose_args: [--force-recreate]
@@ -26,7 +26,8 @@ all:
           ansible_host_ipv4: 193.9.44.165
           service_role: vaultwarden
           compose_project_dir: /opt/vaultwarden
-          healthcheck_profile: vaultwarden
+          healthcheck_profiles: [vaultwarden]
+          restic_backup_profile: vaultwarden
           service_reconcile_services:
             vaultwarden:
               compose_args: [--force-recreate]
@@ -36,7 +37,8 @@ all:
           ansible_host_ipv4: 154.36.174.161
           service_role: powerdns
           compose_project_dir: /opt/pdns
-          healthcheck_profile: pdns
+          healthcheck_profiles: [pdns, rustdesk, hk2aux]
+          restic_backup_profile: pdns
           service_reconcile_services:
             auth:
               compose_args: [--force-recreate]
@@ -45,12 +47,16 @@ all:
             backup:
               compose_args: [--no-deps, --force-recreate]
           service_reconcile_traefik_restart_targets: [poweradmin]
+          # RustDesk server (same host, separate compose project)
+          rustdesk_compose_dir: /opt/rustdesk
+          rustdesk_relay: hk2.chans.xyz:21117
+          rustdesk_image: rustdesk/rustdesk-server:1.1.14
         us4:
           ansible_host: us4.wsvc.info
           ansible_host_ipv4: 185.201.226.122
           service_role: wireguard
           compose_project_dir: /opt/wireguard
-          healthcheck_profile: wireguard
+          healthcheck_profiles: [wireguard]
           wireguard_image: >-
             lscr.io/linuxserver/wireguard@sha256:ac43e1226878d2611315172d6ea357a95cb326ee73124b91108118efc8666889
           service_reconcile_services:
@@ -61,7 +67,7 @@ all:
           ansible_host_ipv4: 192.168.66.36
           service_role: adguardhome
           compose_project_dir: /opt/adguardhome
-          healthcheck_profile: adguardhome
+          healthcheck_profiles: [adguardhome]
           service_reconcile_services:
             adguardhome:
               compose_args: [--no-deps, --force-recreate]
@@ -74,6 +80,9 @@ all:
     powerdns:
       hosts:
         hk2:
+    rustdesk:
+      hosts:
+        hk2:
     wireguard:
       hosts:
         us4:

ansible/playbooks/audit.yml

@@ -64,7 +64,7 @@
       ansible.builtin.debug:
         msg:
           host: "{{ inventory_hostname }}"
-          profile: "{{ healthcheck_profile }}"
+          profiles: "{{ healthcheck_profiles | default([]) | join(', ') }}"
           os: "{{ ansible_distribution }} {{ ansible_distribution_version }}"
           kernel: "{{ ansible_kernel }}"
           compose_rc: "{{ audit_compose_ps.rc }}"

ansible/roles/restic/defaults/main.yml

@@ -1,5 +1,8 @@
 ---
 restic_enabled: false
+# Approved Restic source profile (a key of restic_sources) for the host. Set
+# per-host in inventory; the role fails if it is not an approved source.
+restic_backup_profile: ""
 restic_binary: /usr/bin/restic
 restic_config_path: /etc/vps-restic/repository.env
 restic_state_dir: /var/lib/vps-restic

ansible/roles/restic/tasks/main.yml

@@ -10,8 +10,8 @@
 - name: Validate supported Restic source profile
   ansible.builtin.assert:
     that:
-      - healthcheck_profile in restic_sources
-    fail_msg: "No approved Restic source profile for {{ healthcheck_profile }}."
+      - restic_backup_profile in restic_sources
+    fail_msg: "No approved Restic source profile for {{ restic_backup_profile }}."
 
 - name: Verify Restic binary exists on target
   ansible.builtin.stat:

ansible/roles/restic/templates/backup.j2

@@ -3,4 +3,4 @@ set -euo pipefail
 # Repository and password credentials are host-local in {{ restic_config_path }}.
 # shellcheck source=/dev/null
 source '{{ restic_config_path }}'
-exec '{{ restic_binary }}' backup --tag '{{ healthcheck_profile }}' --tag "$(hostname -s)" {% for source in restic_sources[healthcheck_profile] %}{{ source | quote }} {% endfor %}
+exec '{{ restic_binary }}' backup --tag '{{ restic_backup_profile }}' --tag "$(hostname -s)" {% for source in restic_sources[restic_backup_profile] %}{{ source | quote }} {% endfor %}

ansible/roles/restic/templates/forget-prune.j2

@@ -2,4 +2,4 @@
 set -euo pipefail
 # shellcheck source=/dev/null
 source '{{ restic_config_path }}'
-exec '{{ restic_binary }}' forget --prune --keep-daily {{ restic_keep_daily }} --keep-weekly {{ restic_keep_weekly }} --keep-monthly {{ restic_keep_monthly }} --tag '{{ healthcheck_profile }}'
+exec '{{ restic_binary }}' forget --prune --keep-daily {{ restic_keep_daily }} --keep-weekly {{ restic_keep_weekly }} --keep-monthly {{ restic_keep_monthly }} --tag '{{ restic_backup_profile }}'

ansible/roles/restic/templates/vps-restic-backup.service.j2

@@ -1,5 +1,5 @@
 [Unit]
-Description=Restic backup for approved {{ healthcheck_profile }} sources
+Description=Restic backup for approved {{ restic_backup_profile }} sources
 After=network-online.target
 Wants=network-online.target