Phase 1 : socle & sécurité (WireGuard, Ansible, OpenTofu)

- Reconnaissance : le serveur héberge déjà 6 autres projets derrière un
  Caddy partagé (80/443) ; tripoli-edge sera un service interne (décision
  prise avec l'utilisateur), pas un second frontal.
- WireGuard : canal admin Mac <-> serveur (10.100.0.0/24, port 58212/udp
  après avoir découvert que 51820 était filtré par le pare-feu Hetzner
  Cloud, distinct de ufw).
- Ansible : rôle base (confirme fail2ban/unattended-upgrades/ufw déjà en
  place, sans toucher aux règles des autres projets) + rôle wireguard
  (clé privée générée sur la cible, jamais stockée dans ce dépôt).
- OpenTofu : serveur Hetzner référencé en data source lecture seule
  (jamais recréé/détruit - serveur partagé et déjà en prod) ; DNS
  tripoli.cloud géré via le provider OVH.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tofu/.terraform.lock.hcl

@@ -0,0 +1,70 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/hetznercloud/hcloud" {
+  version     = "1.69.0"
+  constraints = "~> 1.48"
+  hashes = [
+    "h1:/pWxd5Osefkg7cjjoocgUGsgV+ogMNR5Bj8NSUDLXUU=",
+    "h1:3LoUpRjqu3O/vSVTdHPQSMXvGSAA9g4O3emY8qhQPpw=",
+    "h1:3eLWWMWbF/q/UYAvhFbRfL6RwAs9cACPvi0N4W+vi14=",
+    "h1:H9WTbWGVkHW9oixJWfNOD9E6TdDVRwmVjFiHDqfe6hk=",
+    "h1:HGJANuVqrAGQiSN/m6DODhf05D7rSugUpriG2bPhBuM=",
+    "h1:MLxpeLlRL97wDLqL+WNpb7L9Vk+g8aUHLjXspFPR+tg=",
+    "h1:PWhmd5g+OPBPdwQoFkG+KFmppYSR6ujPof+zwCjfMPI=",
+    "h1:XuuF9gGyXrmeINI2/SdgfoaJntzP231hsM+MSbaQ5QM=",
+    "h1:e4gDEHjE7p660CTFwnkWS3ibVNV54nT7e1TliOJ0cqw=",
+    "h1:owcgdkfmWRbaGgiIl2HY5AFQdFENckbPcn91NJpr1r4=",
+    "h1:sRkgVfXIDHNIyGR/kOVjIa45/sxH2JzCHNzDQlKgdF4=",
+    "h1:xxSPOhL3DApttfBxP8GeH91tf1ywGw56NeNqpkD2P2k=",
+    "h1:z7i3QamSF7nU+9dj+5+g7JTRwtos+kAfkwQpZjbx+/Q=",
+    "zh:023c0580c46b48a1dce8aeb5832ec9896ce53ee019a2b296d854873f92aad7d9",
+    "zh:02fa14eebb1c48b52b9acb33fb987425513537b70a50dac5639aecfe62c4b66f",
+    "zh:0f534ee078e5f0f3c21e99cc020c3a9be565fceed4936d88b978f7b7d4b981fc",
+    "zh:42dcf6859d097179c30cbe346931be731548a51ef7c73d08cd4af69a044bd60f",
+    "zh:6d319ee6c9e64437634f3e682196dab24025ea91a7332b40972279e9c6e67f64",
+    "zh:71a1dc59a47ab1b4127696e8047b54bb4bc8f92b8994ecc13509eaeb7e13a729",
+    "zh:781310b68c74dede2e225096d7ada9a0b4b9252b6cafa4dc1ff064dd9ea4c817",
+    "zh:7c4e0411e6e10ca6bd49c8e699c7c61cd9750d32d46ee5472d01faa30fbd222f",
+    "zh:c4c70587a7632aea65d6b1bb0bbe8da2145a7acb6d16a7dd0e0dbbde6195c8ca",
+    "zh:caaab2e9bb7cf8bb478b143bc0156c40729d720d3e2c77cf021e515fbeca3a6a",
+    "zh:cbd1c2040111b595cfa5daa201166560b4988eb0227dd6be17e8ae72a5ff1df0",
+    "zh:eba595371b98a66c1bf64dfb9f9256e6dc365e990e7202c50b6977fb3d24f822",
+    "zh:fd477dca1d5b0bc7f41cce6b9f3e3250b58597cc178a70fa3136717343ffeede",
+  ]
+}
+
+provider "registry.opentofu.org/ovh/ovh" {
+  version     = "1.8.0"
+  constraints = "~> 1.1"
+  hashes = [
+    "h1:Cw+yHbVdi3SErNVKDfjkT7uJrkrz1iDoLKbtUYcD/vY=",
+    "h1:Emge4OtI8D3utNeWm9ZGp1dXJZGNM4XkfucpeECH/OM=",
+    "h1:EnUJhaLpRyNo9jyFbqNysVuB41aUHU2fPyDZviNyjQw=",
+    "h1:JiQ+u8Weik9cagC9zwQzgg50dSQCWIVSOcm6cBb/GLI=",
+    "h1:L70RPaCt9ynhgDA+ysLpg9XGUspDe/FV/i0bZwSDSQc=",
+    "h1:OY1R8TWQKdAa4/IlAFIhkz1mrjdCU4h7yjkdcaG3EVY=",
+    "h1:PxCb7XQsQSM+F7zL2uvQUU3c/GlHUX3achf8lZFE4GQ=",
+    "h1:SL4jA6hX+8gQmzogggo/T928Atu2uWxTSfwij5swnKg=",
+    "h1:UMNAYIM6tuCeexI0uNVvlY1BY38xELgDGR7mrl18gHk=",
+    "h1:gQAf5ZrxwGhPgEO8MYeExH05YNZaIwLGDPY7GUq89rs=",
+    "h1:giGZL9GqvPoLmwSSJei6xvM11NkPtRyYH4GvEH7PaRA=",
+    "h1:uforg5SSBOVHu0bHCVuKJhqv6TqI1q2oLiWid1WJDB0=",
+    "h1:yCfHzFrXA4RFEQUEpbfzWzeT0sa05yHz1U36I2EaYtQ=",
+    "h1:zq2m7JCCjXoIYoYJrSyD4Sn7D6bQErm05cbw28xRhdE=",
+    "zh:13de915a1de2f2d52daf3843be04b73b8c28102b4798b6519226ceba6de462a1",
+    "zh:229a6b42faaac23855d5b894a3d1116aa4bfe959870bf52820eba645dd84d240",
+    "zh:37c04f19df0462ae399d63da2a20efe16c8234302ef6ef7999f4ab9b17f82c84",
+    "zh:4145c35b7b06a3557c7d06694b4608356abb6c368b5ce94dea407b548c181213",
+    "zh:6848937828ec8f38fad2776abdfbcffc3cd353fbfb5885a2c1987775781e522b",
+    "zh:6d071a2ddcaddb318452b46782ae2f239acb1c83953248521858b59ff9651c98",
+    "zh:825ac2271e7f532d40e4633380fbe6ea7efca733b1e25ed01ed02e10bbb6e2bc",
+    "zh:9d24c56db0ced569615f84462d362a984d930cf21bbdbe69cf029cd89b9b179a",
+    "zh:a87773b85c2c732f8d03b65058cb595ec78a7fd5ad29ea61e69d4d3141675c40",
+    "zh:be454013f64a42f24cb1d7e14090dd03257fc387f0fff0e2992db77b47c125cf",
+    "zh:d4613672416be037a929e92d4c32e4d40eb5a7db4e2b67c689be6a00d91a7f46",
+    "zh:e435a038d9dc53bd3249c6f155311ea0bcbbba753e65236b2b5b630ae5917eb0",
+    "zh:ea0d3097edfbfd3e55140a04d570436fd62f2c18b7d4abbed3eb7d8a6781c875",
+    "zh:f88df12b81d7cbc320cf40dbca3cc45293cc74b8535362ed1a8360c487d744ee",
+  ]
+}