Add the compose_stack role, inventory and playbooks

One role that syncs a payload and brings the stack up, configured entirely
through stack_* variables, plus six playbooks that each demonstrate one part
of that contract. Every playbook runs standalone and is tagged with its
stack name, so site.yml --tags <stack> works.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ansible/inventory/group_vars/all.yml

@@ -0,0 +1,20 @@
+---
+ansible_user: deploy
+# Override per host in inventory/host_vars/<host>.yml if sshd moves off 22.
+ansible_port: 22
+
+# Path to the deploy private key, produced by scripts/load-ssh-key.sh. The key
+# itself is never stored in this repository — see docs/secrets.md.
+ansible_ssh_private_key_file: "{{ lookup('ansible.builtin.env', 'SSH_KEY_PATH') }}"
+
+# Where stacks live on the hosts. A stack deploys to {{ stack_root }}/<stack>
+# unless its playbook overrides stack_dest.
+stack_root: /srv/stacks
+
+# Image pull policy, overridden per run with `-e pull=always` to update a stack.
+# See "Deploy versus update" in the README.
+pull: policy
+
+# Repository root, so playbooks and the role can find payloads under server/
+# regardless of the directory ansible-playbook was invoked from.
+repo_root: "{{ (inventory_dir ~ '/../..') | realpath }}"

ansible/inventory/hosts.yml

@@ -0,0 +1,14 @@
+---
+# Two example hosts. Connection settings live in group_vars/all.yml, and key
+# material lives nowhere in this repository — see docs/secrets.md.
+#
+# The names here must match the directory names under server/: the compose_stack
+# role resolves a payload as server/{{ inventory_hostname }}/{{ stack_name }}.
+all:
+  hosts:
+    # Public entry point: the reverse proxy and its certificates.
+    edge:
+      ansible_host: edge.example.com
+    # Everything behind it.
+    app:
+      ansible_host: app.example.com