Initial commit: arr-stack homelab + local AI

Docker Compose media stack (gluetun, *arr, Jellyfin), Ternary-Bonsai AI
(Open WebUI, Forgejo, optional OpenHands), and Ansible bootstrap for the
SER5 Ubuntu host.

ansible/roles/firewall/tasks/main.yml

@@ -0,0 +1,71 @@
+---
+- name: Install UFW
+  ansible.builtin.apt:
+    name: ufw
+    state: present
+  tags: [firewall, ufw]
+
+- name: Set UFW default policies
+  community.general.ufw:
+    direction: "{{ item.direction }}"
+    policy: "{{ item.policy }}"
+  loop:
+    - { direction: incoming, policy: "{{ ufw_default_incoming }}" }
+    - { direction: outgoing, policy: "{{ ufw_default_outgoing }}" }
+  tags: [firewall, ufw]
+
+- name: Allow OpenSSH (rate-limited) from LAN
+  community.general.ufw:
+    rule: limit
+    port: "22"
+    proto: tcp
+    src: "{{ lan_subnet }}"
+    comment: "SSH from LAN"
+  tags: [firewall, ufw]
+
+- name: Allow OpenSSH from anywhere (optional)
+  community.general.ufw:
+    rule: limit
+    port: "22"
+    proto: tcp
+    comment: "SSH world"
+  when: ufw_allow_ssh_from_anywhere | bool
+  tags: [firewall, ufw]
+
+- name: Allow stack service ports from LAN
+  community.general.ufw:
+    rule: allow
+    port: "{{ item.port | string }}"
+    proto: tcp
+    src: "{{ lan_subnet }}"
+    comment: "{{ item.comment }}"
+  loop: "{{ ufw_lan_tcp_ports }}"
+  # SSH already handled above with limit; skip duplicate 22 if listed
+  when: item.port | int != 22
+  tags: [firewall, ufw]
+
+- name: Allow Docker published ports on loopback freely (implicit)
+  ansible.builtin.debug:
+    msg: "UFW will leave local/docker internal traffic alone; LAN rules cover published WebUIs."
+  tags: [firewall, ufw]
+
+# Docker + UFW: without this, published ports can bypass UFW on some setups.
+# Route forwarded packets through ufw-before-forward is complex; we rely on
+# binding services to LAN + ufw allow from lan_subnet. Documented in README.
+
+- name: Enable UFW
+  community.general.ufw:
+    state: enabled
+  when: ufw_enabled | bool
+  tags: [firewall, ufw]
+
+- name: Show UFW status
+  ansible.builtin.command: ufw status verbose
+  register: ufw_status
+  changed_when: false
+  tags: [firewall, ufw]
+
+- name: Print UFW status
+  ansible.builtin.debug:
+    msg: "{{ ufw_status.stdout_lines }}"
+  tags: [firewall, ufw]