- Smart TLS: skip certbot for IPs/.local/.lan, self-signed with SAN,
HSTS max-age=0 for self-signed certs, split LAN vs public messages
- Dynamic PHP: versionless meta-packages, runtime detection via php_ver fact
- Vaultwarden: fail-fast on armv7l (32-bit ARM not supported upstream)
- Module prompts: accept IPs for matrix/cloud/vault/media, hard error
on email with IP, all_in_one skips certbot email for LAN
- Matrix: skip matrix. prefix strip for IPs, warn about immutable server_name
- OS family guards: ansible_os_family == Debian on all apt tasks
- SSH key path: expanduser().resolve() on user-provided key paths
- Cloudflare Tunnel: post-deploy script (setup-tunnel.sh) using CF API
token — no browser auth needed, creates tunnel + credentials + DNS + systemd
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When deploying to existing servers as non-root, Ansible needs
become_password for sudo. Now prompts for it during credential
gathering and passes it via ansible_become_password in the
inventory (file chmod 0600). Blank input = NOPASSWD sudo assumed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
VPN/DNS/Vault → nanode/t3.micro, Matrix → g6-standard-2/t3.medium,
Cloud/Media/Email → g6-standard-1/t3.small, All-in-One → g6-standard-2/t3.medium.
Previously all services used the same provider-level default (often pulled
from c2itall vars), which meant a WireGuard VPN would default to g6-standard-2.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
n0mad1k