deploy via Gitea CI registry; provision GCP infra with Terraform

- Terraform: e2-micro VM (us-east1-b, free tier), static IP, SSH/web
  firewall rules, IAM bindings for Firestore + GCS; imports existing
  drb-calls bucket and c2-server Firestore database into state
- Gitea CI: build c2-core, discord-bot, frontend images and push to
  git.vpn.cusano.net registry; SSH deploy pulls pre-built images (no
  build on VM)
- Ansible: first-time setup only — git clone, env files from vault,
  Caddyfile, docker login + compose pull + up; no rsync or on-VM builds
- docker-compose: add image: ${REGISTRY}/name:latest alongside build:
  so local dev and CI registry both work
- gitignore: add Terraform state, lock, tfvars, ansible secrets

infra/ansible/roles/deploy/tasks/main.yml

@@ -1,21 +1,14 @@
 ---
-# Sync code, write secrets, bring the stack up.
+# First-time setup: clone repo, write secrets, pull pre-built images and start stack.
+# Images are built and pushed by Gitea CI — this role never builds on the VM.
 
-- name: Sync app code from local machine
-  synchronize:
-    src: "{{ local_repo_path }}"
-    dest: "{{ app_dir }}/"
-    delete: true
-    recursive: true
-    rsync_opts:
-      - "--exclude=.git"
-      - "--exclude=**/__pycache__"
-      - "--exclude=**/.env"
-      - "--exclude=**/gcp-key.json"
-      - "--exclude=**/node_modules"
-      - "--exclude=drb-c2-core/gcp-key.json"
-      - "--exclude=infra/"
-  become: false   # rsync runs as the SSH user, not root
+- name: Clone repo (skipped if already present)
+  git:
+    repo: "{{ repo_url }}"
+    dest: "{{ app_dir }}"
+    version: main
+    update: false
+  become: false
 
 - name: Set ownership of app directory
   file:
@@ -25,10 +18,7 @@
     group: "{{ ssh_user }}"
     recurse: true
 
-# No gcp-key.json needed — the VM authenticates to GCS/Firestore via ADC
-# (GCE metadata server). IAM roles are granted by Terraform.
-
-- name: Template top-level .env (docker-compose MQTT creds)
+- name: Template top-level .env (docker-compose MQTT creds + registry)
   template:
     src: root.env.j2
     dest: "{{ app_dir }}/.env"
@@ -69,18 +59,19 @@
     mode: "0644"
   notify: Reload Caddy
 
-- name: Bring the stack up (builds images if changed)
+- name: Log in to container registry
+  command: >
+    docker login {{ vault_registry_host }}
+    -u {{ vault_registry_user }}
+    -p {{ vault_registry_token }}
+  no_log: true
+
+- name: Pull pre-built images and start stack
   community.docker.docker_compose_v2:
     project_src: "{{ app_dir }}"
-    build: always
+    files:
+      - docker-compose.yml
+      - docker-compose.prod.yml
+    pull: always
+    build: never
     state: present
-    pull: never
-  become: true
-  environment:
-    DOCKER_BUILDKIT: "1"
-
-- name: Prune unused Docker images
-  community.docker.docker_prune:
-    images: true
-    images_filters:
-      dangling: true

infra/ansible/roles/deploy/templates/root.env.j2

@@ -1,7 +1,10 @@
-# Top-level docker-compose environment — MQTT credentials for the broker container.
+# Top-level docker-compose environment — MQTT credentials and registry prefix.
 # Managed by Ansible. Do not edit manually.
 
 MQTT_C2_USER={{ vault_mqtt_c2_user }}
 MQTT_C2_PASS={{ vault_mqtt_c2_pass }}
 MQTT_NODE_USER={{ vault_mqtt_node_user }}
 MQTT_NODE_PASS={{ vault_mqtt_node_pass }}
+
+# Container registry prefix — docker compose uses this for image: ${REGISTRY}/name:latest
+REGISTRY={{ vault_registry }}