Initial commit: arr-stack homelab + local AI

Docker Compose media stack (gluetun, *arr, Jellyfin), Ternary-Bonsai AI
(Open WebUI, Forgejo, optional OpenHands), and Ansible bootstrap for the
SER5 Ubuntu host.

ansible/roles/common/tasks/main.yml

@@ -0,0 +1,179 @@
+---
+- name: Set system timezone
+  community.general.timezone:
+    name: "{{ timezone }}"
+  tags: [common, timezone]
+
+- name: Wait for any existing unattended-upgrade / dpkg lock
+  ansible.builtin.shell: |
+    while fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
+       || fuser /var/lib/apt/lists/lock >/dev/null 2>&1; do
+      sleep 5
+    done
+  changed_when: false
+  tags: [common, apt]
+
+- name: Update apt cache
+  ansible.builtin.apt:
+    update_cache: true
+    cache_valid_time: 3600
+  tags: [common, apt]
+
+- name: Upgrade all packages
+  ansible.builtin.apt:
+    upgrade: dist
+    autoremove: true
+    autoclean: true
+  tags: [common, apt, upgrade]
+
+- name: Install essential packages (curl wget nano build-essential net-tools)
+  ansible.builtin.apt:
+    name: "{{ essential_packages }}"
+    state: present
+  tags: [common, packages, essentials]
+
+- name: Install common packages
+  ansible.builtin.apt:
+    name: "{{ common_packages }}"
+    state: present
+  tags: [common, packages]
+
+# ---------------------------------------------------------------------------
+# Microsoft Edit — terminal-based editor (https://github.com/microsoft/edit)
+# ---------------------------------------------------------------------------
+- name: Resolve Microsoft Edit archive name for this arch
+  ansible.builtin.set_fact:
+    ms_edit_arch_triple: >-
+      {{
+        'x86_64-linux-gnu' if ansible_architecture in ['x86_64', 'amd64']
+        else (
+          'aarch64-linux-gnu' if ansible_architecture in ['aarch64', 'arm64']
+          else 'UNSUPPORTED'
+        )
+      }}
+  when: ms_edit_install | bool
+  tags: [common, packages, edit]
+
+- name: Fail if Microsoft Edit has no binary for this architecture
+  ansible.builtin.fail:
+    msg: "No Microsoft Edit release for architecture {{ ansible_architecture }}"
+  when:
+    - ms_edit_install | bool
+    - ms_edit_arch_triple == 'UNSUPPORTED'
+  tags: [common, packages, edit]
+
+- name: Check whether Microsoft Edit is already installed at the desired version
+  ansible.builtin.command: /usr/local/bin/edit --version
+  register: ms_edit_installed
+  changed_when: false
+  failed_when: false
+  when: ms_edit_install | bool
+  tags: [common, packages, edit]
+
+- name: Download Microsoft Edit release tarball
+  ansible.builtin.get_url:
+    url: >-
+      https://github.com/microsoft/edit/releases/download/v{{ ms_edit_version }}/edit-{{ ms_edit_version }}-{{ ms_edit_arch_triple | trim }}.tar.gz
+    dest: "/tmp/edit-{{ ms_edit_version }}.tar.gz"
+    mode: "0644"
+  when:
+    - ms_edit_install | bool
+    - ms_edit_installed.rc is not defined or ms_edit_installed.rc != 0
+      or (ms_edit_version not in (ms_edit_installed.stdout | default('')))
+  tags: [common, packages, edit]
+
+- name: Install Microsoft Edit binary to /usr/local/bin/edit
+  ansible.builtin.unarchive:
+    src: "/tmp/edit-{{ ms_edit_version }}.tar.gz"
+    dest: /usr/local/bin
+    remote_src: true
+    mode: "0755"
+    owner: root
+    group: root
+  when:
+    - ms_edit_install | bool
+    - ms_edit_installed.rc is not defined or ms_edit_installed.rc != 0
+      or (ms_edit_version not in (ms_edit_installed.stdout | default('')))
+  tags: [common, packages, edit]
+
+- name: Verify Microsoft Edit is on PATH
+  ansible.builtin.command: /usr/local/bin/edit --version
+  register: ms_edit_verify
+  changed_when: false
+  failed_when: ms_edit_verify.rc != 0
+  when: ms_edit_install | bool
+  tags: [common, packages, edit]
+
+- name: Show Microsoft Edit version
+  ansible.builtin.debug:
+    msg: "{{ ms_edit_verify.stdout | default(ms_edit_installed.stdout) | default('edit installed') }}"
+  when: ms_edit_install | bool
+  tags: [common, packages, edit]
+
+- name: Enable unattended-upgrades
+  ansible.builtin.debconf:
+    name: unattended-upgrades
+    question: unattended-upgrades/enable_auto_updates
+    value: "true"
+    vtype: boolean
+  tags: [common, unattended]
+
+- name: Configure unattended-upgrades (security only)
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    mode: "0644"
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+      APT::Periodic::AutocleanInterval "7";
+  tags: [common, unattended]
+
+- name: Prefer security updates in unattended-upgrades
+  ansible.builtin.lineinfile:
+    path: /etc/apt/apt.conf.d/50unattended-upgrades
+    regexp: '{{ item.regexp }}'
+    line: '{{ item.line }}'
+    state: present
+  loop:
+    - regexp: '^\s*//\s*"\$\{distro_id\}:\$\{distro_codename\}-security";'
+      line: '        "${distro_id}:${distro_codename}-security";'
+    - regexp: 'Unattended-Upgrade::Remove-Unused-Dependencies'
+      line: 'Unattended-Upgrade::Remove-Unused-Dependencies "true";'
+  failed_when: false
+  tags: [common, unattended]
+
+- name: Enable and start fail2ban
+  ansible.builtin.service:
+    name: fail2ban
+    state: started
+    enabled: true
+  tags: [common, fail2ban]
+
+- name: Fail2ban SSH jail (sshd)
+  ansible.builtin.copy:
+    dest: /etc/fail2ban/jail.d/sshd.local
+    mode: "0644"
+    content: |
+      [sshd]
+      enabled = true
+      port = ssh
+      filter = sshd
+      maxretry = 5
+      bantime = 1h
+      findtime = 10m
+  notify: Restart fail2ban
+  tags: [common, fail2ban]
+
+- name: Ensure plocate database is built
+  ansible.builtin.command: updatedb
+  changed_when: false
+  failed_when: false
+  tags: [common]
+
+- name: Detect sensors (lm-sensors)
+  ansible.builtin.command: sensors-detect --auto
+  args:
+    creates: /etc/sensors3.conf
+  failed_when: false
+  changed_when: false
+  tags: [common]