Initial Ansible automation for hobbs.farm infrastructure

Complete IaC covering:
- 14 roles: common, docker, traefik, vaultwarden, monitoring, media, matrix,
  home_assistant, frigate, adguard, gitea, semaphore, openclaw, security, backup
- Inventory for all hosts (Peggy, Bart, Yoda, NAS, Firewalla)
- Stack playbooks: core-infrastructure, monitoring, media, communication,
  automation, smarthome, security-hardening
- Maintenance playbooks: update-containers, backup, health-check
- Production Docker Compose templates with Traefik labels
- Security hardening (sysctl, auditd, UFW, fail2ban)
- Automated backups with retention policy

roles/security/templates/audit.rules.j2

@@ -0,0 +1,24 @@
+# Audit rules - Managed by Ansible
+# Monitor changes to authentication configuration
+-w /etc/pam.d/ -p wa -k auth_changes
+-w /etc/nsswitch.conf -p wa -k auth_changes
+-w /etc/ssh/sshd_config -p wa -k sshd_config
+
+# Monitor user/group changes
+-w /etc/passwd -p wa -k user_changes
+-w /etc/group -p wa -k group_changes
+-w /etc/shadow -p wa -k shadow_changes
+
+# Monitor sudo usage
+-w /etc/sudoers -p wa -k sudoers
+-w /etc/sudoers.d/ -p wa -k sudoers
+
+# Monitor Docker
+-w /usr/bin/docker -p rwxa -k docker
+-w /var/lib/docker -p wa -k docker
+-w /etc/docker -p wa -k docker
+-w /usr/lib/systemd/system/docker.service -p wa -k docker
+
+# Monitor cron
+-w /etc/crontab -p wa -k cron
+-w /etc/cron.d/ -p wa -k cron

roles/security/templates/sysctl.conf.j2

@@ -0,0 +1,24 @@
+# Network hardening - Managed by Ansible
+net.ipv4.conf.all.send_redirects = 0
+net.ipv4.conf.default.send_redirects = 0
+net.ipv4.conf.all.accept_redirects = 0
+net.ipv4.conf.default.accept_redirects = 0
+net.ipv4.conf.all.accept_source_route = 0
+net.ipv4.conf.default.accept_source_route = 0
+net.ipv4.conf.all.log_martians = 1
+net.ipv4.conf.default.log_martians = 1
+net.ipv4.icmp_echo_ignore_broadcasts = 1
+net.ipv4.icmp_ignore_bogus_error_responses = 1
+net.ipv4.conf.all.rp_filter = 1
+net.ipv4.conf.default.rp_filter = 1
+net.ipv4.tcp_syncookies = 1
+net.ipv6.conf.all.accept_redirects = 0
+net.ipv6.conf.default.accept_redirects = 0
+
+# Memory hardening
+kernel.randomize_va_space = 2
+fs.protected_hardlinks = 1
+fs.protected_symlinks = 1
+
+# Docker needs IP forwarding
+net.ipv4.ip_forward = 1