refactor: consolidate all roles into ansible/roles/ and update ansible.cfg

- Move all roles from playbooks/roles/ to roles/
- Update roles_path in ansible.cfg
- Add cast user to common role
- Create standalone podman role
- Add semaphore role with Podman + Quadlet support

ansible/roles/common/defaults/main.yml

@@ -0,0 +1,35 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/common/defaults/main.yml
+# ------------------------------------------------------------------------------
+
+common_timezone: America/Chicago
+
+common_ntp_server: "sundial.local.mk-labs.cloud"
+
+common_packages:
+  - acl
+  - curl
+  - wget
+  - vim
+  - htop
+  - git
+  - jq
+  - unzip
+  - ca-certificates
+  - gnupg
+  - lsb-release
+  - net-tools
+  - dnsutils
+  - lvm2
+
+# ------------------------------------------------------------------------------
+# LVM root volume expansion
+# Override common_root_pv/vg/lv per host if the template uses different names.
+# Ubuntu 24.04 cloud templates use ubuntu-vg/ubuntu-lv by default.
+# ------------------------------------------------------------------------------
+
+common_expand_root_lvm: true
+common_root_pv: /dev/sda3       # Ubuntu cloud-init partition layout
+common_root_vg: ubuntu-vg
+common_root_lv: ubuntu-lv

ansible/roles/common/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/common/handlers/main.yml
+# ------------------------------------------------------------------------------
+
+- name: restart chrony
+  systemd:
+    name: chrony
+    state: restarted

ansible/roles/common/main.yml

@@ -0,0 +1,22 @@
+---
+# ------------------------------------------------------------------------------
+# FILE: roles/common/defaults/main.yml
+# ------------------------------------------------------------------------------
+
+common_timezone: America/Chicago
+
+common_ntp_server: sundial.local.mk-labs.cloud
+
+common_packages:
+  - curl
+  - wget
+  - vim
+  - htop
+  - git
+  - jq
+  - unzip
+  - ca-certificates
+  - gnupg
+  - lsb-release
+  - net-tools
+  - dnsutils

ansible/roles/common/tasks/main.yml

@@ -0,0 +1,21 @@
+- name: Create cast group
+  ansible.builtin.group:
+    name: cast
+    state: present
+    system: true
+
+- name: Create cast user
+  ansible.builtin.user:
+    name: cast
+    group: cast
+    shell: /bin/bash
+    create_home: true
+    state: present
+
+- name: Ensure cast user has passwordless sudo
+  ansible.builtin.lineinfile:
+    path: /etc/sudoers.d/cast
+    line: "cast ALL=(ALL) NOPASSWD:ALL"
+    create: yes
+    mode: '0440'
+    validate: 'visudo -cf %s'

ansible/roles/common/tasks/step_ca_client.yml

@@ -0,0 +1,136 @@
+# ------------------------------------------------------------------------------
+# FILE: roles/common/tasks/step_ca_client.yml
+# DESCRIPTION: Enroll host as a step-ca SSH client. Installs the step CLI,
+#              bootstraps trust with the CA, configures sshd to accept
+#              CA-signed user certificates, signs a host certificate, and
+#              sets up automated renewal via systemd timer.
+# ------------------------------------------------------------------------------
+
+- name: Install step CLI
+  apt:
+    deb: "https://dl.smallstep.com/cli/docs-ca-install/latest/step-cli_amd64.deb"
+    state: present
+
+- name: Bootstrap step-ca trust
+  command: >
+    step ca bootstrap
+    --ca-url {{ step_ca_url }}
+    --fingerprint {{ step_ca_fingerprint }}
+    --install
+  args:
+    creates: /root/.step/certs/root_ca.crt
+
+- name: Get SSH user CA public key
+  command: step ssh config --roots
+  register: ssh_user_ca_key
+  changed_when: false
+
+- name: Write SSH user CA public key
+  copy:
+    content: "{{ ssh_user_ca_key.stdout }}"
+    dest: /etc/ssh/ssh_user_key.pub
+    mode: '0644'
+  notify: restart sshd
+
+- name: Configure sshd to trust CA-signed user certificates
+  lineinfile:
+    path: /etc/ssh/sshd_config
+    line: "TrustedUserCAKeys /etc/ssh/ssh_user_key.pub"
+    regexp: "^#?TrustedUserCAKeys"
+    state: present
+  notify: restart sshd
+
+# --- Host certificate signing ---
+
+- name: Write provisioner password to temp file on controller
+  copy:
+    content: "{{ stepca_ca_password }}"
+    dest: /tmp/step_provisioner_pw
+    mode: '0600'
+  delegate_to: localhost
+  run_once: true
+  no_log: true
+
+- name: Generate one-time host token
+  command: >
+    step ca token {{ inventory_hostname }}.local.mk-labs.cloud
+    --ssh --host
+    --provisioner {{ step_ca_provisioner_name }}
+    --password-file /tmp/step_provisioner_pw
+  delegate_to: localhost
+  register: host_token
+  changed_when: false
+
+- name: Sign host certificate
+  command: >
+    step ssh certificate {{ inventory_hostname }}.local.mk-labs.cloud
+    /etc/ssh/ssh_host_ecdsa_key.pub
+    --host --sign
+    --token {{ host_token.stdout }}
+    --no-password --insecure
+  args:
+    creates: /etc/ssh/ssh_host_ecdsa_key-cert.pub
+  notify: restart sshd
+
+- name: Configure sshd to present host certificate
+  blockinfile:
+    path: /etc/ssh/sshd_config
+    marker: "# {mark} STEP-CA HOST CERTIFICATE"
+    block: |
+      HostCertificate /etc/ssh/ssh_host_ecdsa_key-cert.pub
+      HostKey /etc/ssh/ssh_host_ecdsa_key
+  notify: restart sshd
+
+- name: Clean up provisioner password from controller
+  file:
+    path: /tmp/step_provisioner_pw
+    state: absent
+  delegate_to: localhost
+  run_once: true
+  no_log: true
+
+# --- Automated renewal via systemd ---
+
+- name: Create host cert renewal script
+  copy:
+    content: |
+      #!/bin/bash
+      step ssh renew --force /etc/ssh/ssh_host_ecdsa_key-cert.pub /etc/ssh/ssh_host_ecdsa_key
+      systemctl restart sshd
+    dest: /usr/local/bin/step-renew-host-cert.sh
+    mode: '0755'
+
+- name: Create systemd timer for host cert renewal
+  copy:
+    content: |
+      [Unit]
+      Description=Renew step-ca SSH host certificate
+
+      [Timer]
+      OnCalendar=weekly
+      Persistent=true
+      RandomizedDelaySec=3600
+
+      [Install]
+      WantedBy=timers.target
+    dest: /etc/systemd/system/step-renew-host-cert.timer
+    mode: '0644'
+
+- name: Create systemd service for host cert renewal
+  copy:
+    content: |
+      [Unit]
+      Description=Renew step-ca SSH host certificate
+
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/local/bin/step-renew-host-cert.sh
+    dest: /etc/systemd/system/step-renew-host-cert.service
+    mode: '0644'
+
+- name: Enable and start renewal timer
+  systemd:
+    name: step-renew-host-cert.timer
+    state: started
+    enabled: yes
+    daemon_reload: yes

ansible/roles/common/templates/chrony.conf.j2

@@ -0,0 +1,5 @@
+# Managed by Ansible — do not edit manually
+server {{ common_ntp_server }} iburst
+driftfile /var/lib/chrony/chrony.drift
+makestep 1.0 3
+rtcsync