Initial Ansible automation for hobbs.farm infrastructure

Complete IaC covering:
- 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix,
  home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup
- Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla)
- Stack playbooks: core-infrastructure, monitoring, media, communication,
  automation, smarthome, security-hardening
- Maintenance playbooks: update-containers, backup, health-check
- Production Docker Compose templates with Traefik labels
- Security hardening (sysctl, auditd, UFW, fail2ban)
- Automated backups with retention policy

README.md

@@ -1,3 +1,80 @@
-# ansible-homelab
+# Ansible Homelab - hobbs.farm
 
-Ansible automation for hobbs.farm infrastructure
+Infrastructure-as-Code for the hobbs.farm homelab environment.
+
+## Architecture
+
+| Host | IP | Role | OS |
+|------|-----|------|-----|
+| Peggy | 192.168.86.45 | Primary Docker host (48+ containers) | Ubuntu 24.04 |
+| Bart | 192.168.86.181 | Frigate NVR | Ubuntu |
+| Yoda | 192.168.86.31 | BlueIris NVR | Windows |
+| NAS | 192.168.86.30 | 16TB storage (SMB/NFS) | Synology |
+| Firewalla | 192.168.86.1 | Gateway / Firewall | Firewalla |
+
+## Quick Start
+
+```bash
+# Install Galaxy requirements
+ansible-galaxy install -r requirements.yml
+
+# Test connectivity
+ansible all -m ping
+
+# Full deployment
+ansible-playbook playbooks/site.yml
+
+# Deploy specific stack
+ansible-playbook playbooks/core-infrastructure.yml
+ansible-playbook playbooks/monitoring.yml
+ansible-playbook playbooks/media.yml
+
+# Maintenance
+ansible-playbook playbooks/maintenance/health-check.yml
+ansible-playbook playbooks/maintenance/update-containers.yml
+ansible-playbook playbooks/maintenance/backup.yml
+```
+
+## Tags
+
+All playbooks support selective execution via tags:
+
+```bash
+ansible-playbook playbooks/site.yml --tags traefik
+ansible-playbook playbooks/site.yml --tags monitoring
+ansible-playbook playbooks/site.yml --tags media
+```
+
+Available tags: `common`, `docker`, `traefik`, `vaultwarden`, `monitoring`, `grafana`, `prometheus`, `alertmanager`, `media`, `jellyfin`, `sonarr`, `radarr`, `matrix`, `homeassistant`, `esphome`, `frigate`, `adguard`, `gitea`, `semaphore`, `openclaw`, `security`, `backup`
+
+## Vault
+
+Sensitive variables are referenced via `vault_` prefix and should be stored in an encrypted vault file:
+
+```bash
+ansible-vault create inventory/group_vars/vault.yml
+ansible-vault edit inventory/group_vars/vault.yml
+```
+
+Required vault variables:
+- `vault_acme_email` - Let's Encrypt email
+- `vault_cloudflare_api_token` - Cloudflare DNS API token
+- `vault_grafana_admin_password` - Grafana admin password
+- `vault_vaultwarden_admin_token` - Vaultwarden admin token
+- `vault_matrix_shared_secret` - Matrix Synapse registration secret
+- `vault_smtp_host` - SMTP relay host
+- `vault_slack_webhook` - Slack/Discord webhook for alerts
+- `vault_gitea_db_password` - Gitea PostgreSQL password
+- `vault_semaphore_db_password` - Semaphore DB password
+- `vault_nas_smb_password` - NAS SMB credentials
+
+## Directory Structure
+
+```
+├── ansible.cfg           # Ansible configuration
+├── requirements.yml      # Galaxy dependencies
+├── inventory/            # Hosts and variables
+├── playbooks/            # Orchestration playbooks
+│   └── maintenance/      # Maintenance tasks
+└── roles/                # Reusable roles
+```