# platform-infra

Host baseline and platform services as code.

## `ansible/` — Phase 1 host baseline ✅

Idempotent Ubuntu 24.04 host config. See
[ansible/README.md](ansible/README.md) for how to run it.

Roles: `base` (packages, timezone, unattended-upgrades) → `zfs` (pool on a
dedicated disk + platform datasets) → `docker` (Engine + Compose, data-root on
ZFS, zfs storage driver) → `firewall` (nftables inbound + container SMTP egress
block) → `ssh_hardening` (key-first SSH, `sftponly` group).

## Planned (later phases)

- **Phase 2 base compose projects:** Traefik, shared MariaDB, Forgejo + registry,
  Prometheus/Grafana/Loki, Uptime-Kuma.
- **Phase 5 Ansible:** automysqlbackup, ZFS snapshot/`send` jobs.

See [../docs/07-repo-layout-gitops.md](../docs/07-repo-layout-gitops.md).