Initial Ansible automation for hobbs.farm infrastructure

Complete IaC covering:
- 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix,
  home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup
- Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla)
- Stack playbooks: core-infrastructure, monitoring, media, communication,
  automation, smarthome, security-hardening
- Maintenance playbooks: update-containers, backup, health-check
- Production Docker Compose templates with Traefik labels
- Security hardening (sysctl, auditd, UFW, fail2ban)
- Automated backups with retention policy

playbooks/maintenance/update-containers.yml

@@ -0,0 +1,47 @@
+---
+- name: Update Docker containers
+  hosts: docker_hosts
+  become: true
+  vars:
+    update_stack: all
+  tasks:
+    - name: Get list of compose directories
+      ansible.builtin.find:
+        paths: "{{ docker_compose_base }}"
+        file_type: directory
+        recurse: false
+      register: compose_dirs
+      tags: [update]
+
+    - name: Pull latest images for each stack
+      community.docker.docker_compose_v2_pull:
+        project_src: "{{ item.path }}"
+      loop: "{{ compose_dirs.files }}"
+      loop_control:
+        label: "{{ item.path | basename }}"
+      when: update_stack == 'all' or (item.path | basename) == update_stack
+      tags: [update]
+
+    - name: Recreate containers with new images
+      community.docker.docker_compose_v2:
+        project_src: "{{ item.path }}"
+        state: present
+        recreate: auto
+      loop: "{{ compose_dirs.files }}"
+      loop_control:
+        label: "{{ item.path | basename }}"
+      when: update_stack == 'all' or (item.path | basename) == update_stack
+      tags: [update]
+
+    - name: Prune unused Docker images
+      community.docker.docker_prune:
+        images: true
+        images_filters:
+          dangling: false
+      tags: [cleanup]
+
+    - name: Prune unused Docker volumes
+      community.docker.docker_prune:
+        volumes: true
+      tags: [cleanup]
+      when: prune_volumes | default(false) | bool