Fix critical discrepancies found during validation audit

- Fix cert resolver name (cloudflare -> letsencrypt)
- Fix volume paths (/mnt/nas -> /data)
- Add missing custom port mappings
- Add privileged/capability flags
- Add 8 new roles: portainer, n8n, nodered, influxdb, guacamole, watchtower, rtlamr2mqtt, telegraf
- Fix Traefik template (ports, ACME path, wildcard cert)
- Add extra volume mounts for media services

playbooks/site.yml

@@ -19,12 +19,16 @@
     - traefik
     - vaultwarden
     - adguard
+    - portainer
+    - watchtower
 
 - name: Deploy monitoring stack
   hosts: peggy
   tags: [monitoring]
   roles:
     - monitoring
+    - influxdb
+    - telegraf
 
 - name: Deploy media stack
   hosts: peggy
@@ -43,6 +47,7 @@
   tags: [smarthome]
   roles:
     - home_assistant
+    - rtlamr2mqtt
 
 - name: Deploy automation stack
   hosts: peggy
@@ -51,6 +56,14 @@
     - gitea
     - semaphore
     - openclaw
+    - n8n
+    - nodered
+
+- name: Deploy remote access
+  hosts: peggy
+  tags: [remote]
+  roles:
+    - guacamole
 
 - name: Deploy Frigate NVR
   hosts: bart