From 4a84b5b2779a1489924785508e2f2f5ff3eb5c09 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Fri, 8 May 2026 12:02:35 -0500
Subject: [PATCH] ansible: drop dead caddy_ansible dep + commented-out
 ns/netbox/tailscale_home plays
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

caddy_ansible.caddy_ansible was only referenced by the (commented) netbox play,
so removing the disabled play also makes the role unused. ns play was already
superseded by the BIND9 play. Tailscale-on-home-hosts was never re-enabled
post-Talos-migration — drop the stub; restore from git history if needed.
---
 ansible/playbook.yml           | 83 ----------------------------------
 ansible/roles/requirements.yml |  1 -
 2 files changed, 84 deletions(-)

diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index e635aec..0231845 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -33,89 +33,6 @@
   roles:
     - resolvers
 
-# NS play disabled - replaced by BIND9 play below
-#- name: Apply ns config
-#  hosts: ns
-#  gather_facts: true
-#  become: true
-#  roles:
-#    - role: ns
-
-# NetBox plays disabled - no hosts in netbox group
-#- name: Apply netbox config
-#  hosts: netbox
-#  gather_facts: true
-#  become: true
-#  roles:
-#    - role: caddy_ansible.caddy_ansible
-#      caddy_systemd_network_dependency: true
-#      caddy_setcap: true
-#      caddy_systemd_capabilities_enabled: true
-#      caddy_systemd_capabilities: "CAP_NET_BIND_SERVICE"
-#      caddy_config: |
-#        {{ netbox.domain }} {
-#            bind {{ netbox.bind_address }}
-#            log {
-#              level error
-#            }
-#            route /static* {
-#              uri strip_prefix /static
-#              root * /opt/netbox/netbox/static
-#              file_server
-#            }
-#            @notStatic not path /static*
-#            encode gzip zstd
-#            reverse_proxy @notStatic http://localhost:{{ netbox.port }} {
-#                header_up Host {http.request.host}
-#                header_up X-Real-IP {http.request.remote.host}
-#                header_up X-Forwarded-For {http.request.remote.host}
-#                header_up X-Forwarded-Port {http.request.port}
-#                header_up X-Forwarded-Proto {http.request.scheme}
-#            }
-#        }
-#
-#- name: Apply firewall rules to netbox
-#  hosts: netbox
-#  become: true
-#  # remote_user: graham
-#  handlers:
-#    - import_tasks: playbook_handlers.yml
-#
-#  tasks:
-#    - name: Permit traffic in default zone for http service
-#      ansible.posix.firewalld:
-#        zone: public
-#        service: http
-#        permanent: true
-#        state: enabled
-#
-#    - name: Permit traffic in default zone for https service
-#      ansible.posix.firewalld:
-#        zone: public
-#        service: https
-#        permanent: true
-#        state: enabled
-#      notify:
-#        - Restart firewalld
-
-# Tailscale play disabled - no hosts in tailscale_home group
-#- name: Tailscale
-#  hosts: tailscale_home
-#  become: true
-#  gather_facts: true
-#  vars:
-#    inject_facts_as_vars: false
-#  roles:
-#    - role: artis3n.tailscale
-#      vars:
-#        # Pull Tailscale auth key from environment variable
-#        tailscale_authkey: "{{ lookup('ansible.builtin.env', 'TAILSCALE_KEY') }}"
-#        tailscale_args: "--ssh --advertise-exit-node"
-#  pre_tasks:
-#    - name: Debug - Check Tailscale key (will be partially redacted)
-#      debug:
-#        msg: "Key exists and starts with: {{ lookup('ansible.builtin.env', 'TAILSCALE_KEY')[0:10] }}..."
-
 - name: Install and configure Caddy
   hosts: caddy_servers
   become: true
diff --git a/ansible/roles/requirements.yml b/ansible/roles/requirements.yml
index f1f40a3..850f167 100644
--- a/ansible/roles/requirements.yml
+++ b/ansible/roles/requirements.yml
@@ -1,5 +1,4 @@
 - src: graylog2.graylog
-- src: caddy_ansible.caddy_ansible
 - src: bertvv.bind
 - src: https://github.com/artis3n/tailscale.git
   version: v5.0.1