Move host-level configuration to triangle-infrastructure

[ssavutu]

Splits server configuration out of this repo and into
DrexelTriangle/triangle-infrastructure
(private), where it is applied with Ansible instead of copied over SCP.

Draft: do not merge until Delta is adopted

Merging this is safe for deploys — the workflow step that read the removed
files is removed in the same commit, so Deploy Delta will not break.

What it does mean is that Delta's observability stack stops being updated by
anything. It keeps running on restart: unless-stopped, but a config change
would no longer reach it. Order:

1. Run playbooks/observability.yml --check --diff against Delta, then for real.
2. Confirm the stack is healthy and both nginx endpoints still answer.
3. Merge this.

Steps 1–2 have not been done. Everything else here has no live coupling —
nothing reads deploy/mariadb/, deploy/maxscale/, deploy/proxmox/ or
deploy/nginx/triangle-cms.conf at deploy time.

The boundary

Infrastructure is what gets applied to a machine and survives a
docker compose down. Application is what is built and shipped per release.
This repo keeps compose.cms.yml, the blue/green deploy and rollback scripts,
common.sh, all three Dockerfiles, the container-internal
frontend/nginx.conf, the active-upstream seed file, the env templates and
every workflow.

There is a third category with no owner: runtime state.
/etc/nginx/triangle-cms/active-upstreams.conf is written by deploy.sh and
read back to determine the live slot, so its correct contents are unknowable
from any git tree. Ansible manages the directory and never the file; the role
has a guard task that fails the run if that file ever appears in it.

Moved

From	To
deploy/mariadb/	roles/mariadb_{primary,replica}/
deploy/maxscale/	roles/maxscale/
deploy/proxmox/	roles/proxmox_ip_watch/
deploy/nginx/triangle-cms.conf	roles/delta_cms_host/files/
deploy/nginx/triangle-{loki,prometheus}.conf	roles/observability/files/nginx/
deploy/compose.observability.yml	roles/observability/files/
deploy/scripts/deploy-observability.sh	roles/observability/files/scripts/
observability/ except prometheus.dev.yml	roles/observability/files/observability/
observability/grafana/dashboards/	grafana/dashboards/
scripts/pull-dashboards.sh	grafana/

Two changes that are not just file moves

The dev stack loses Loki, Promtail and Grafana. loki-config.yml and
promtail-config.yml were mounted by both the repo-root docker-compose.yml
and Delta's compose.observability.yml. Keeping a copy here would have meant
two sources of truth for the production log pipeline with nothing to catch
drift. Dev keeps Prometheus; docker compose logs covers the rest.

deploy-observability.sh is now self-contained. It used to
source deploy/scripts/common.sh for nginx_test and nginx_reload — the only
two functions it took. Those are duplicated into the infra repo as
lib-nginx.sh, minus common.sh's DEPLOY_TEST_MODE hooks, which stay here
with the test harness that uses them.

Verification

• deploy/scripts/deploy_scripts_test.sh passes.
  test_host_nginx_health_uses_default_type moved to the infra repo's
  tests/site-contracts.sh with the file it asserts on — leaving it here would
  have tested whichever stale copy was on the runner.
• go build ./... clean; docker compose config valid.
• Every role in the new repo was dry-run against its real host.
  delta_cms_host, both mariadb roles and maxscale all report
  changed=0. That gate is what proves the roles describe the servers as they
  actually are rather than as the repo assumed.

Known follow-up

.gitignore still says "see deploy/mariadb/README.md" for the .webhook
entry. Left alone deliberately — there is an unrelated uncommitted change in
that file on this working tree.

🤖 Generated with Claude Code