feat: add Hetzner-hosted todo application stack

Implement the server-rendered Go todo application with PostgreSQL persistence, Tailwind styling, health checks, and test coverage.

Provision production and staging infrastructure with OpenTofu, including private networking, static IPs, Object Storage backups, and load balancing.

Configure Rocky Linux hosts with Ansible, rootless Podman, PostgreSQL, WAL-G backup automation, staging restores, and generated inventory.

ansible/roles/wal_g/tasks/main.yml

@@ -0,0 +1,123 @@
+---
+- name: Validate WAL-G configuration
+  ansible.builtin.assert:
+    that:
+      - wal_g_s3_prefix is match('^s3://.+/prod/?$')
+      - wal_g_access_key | length > 0
+      - wal_g_secret_key | length > 0
+    fail_msg: WAL-G must use the production backup prefix and external credentials.
+  no_log: true
+
+- name: Create WAL-G temporary directory
+  ansible.builtin.file:
+    path: "/var/tmp/wal-g-install/{{ wal_g_version }}"
+    state: directory
+    mode: "0755"
+
+- name: Download WAL-G
+  ansible.builtin.unarchive:
+    src: "{{ wal_g_download_url }}"
+    dest: "/var/tmp/wal-g-install/{{ wal_g_version }}"
+    remote_src: true
+    creates: "/var/tmp/wal-g-install/{{ wal_g_version }}/wal-g-pg-ubuntu-20.04-amd64"
+
+- name: Install WAL-G executable
+  ansible.builtin.copy:
+    src: "/var/tmp/wal-g-install/{{ wal_g_version }}/wal-g-pg-ubuntu-20.04-amd64"
+    dest: /usr/local/bin/wal-g
+    remote_src: true
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Create WAL-G configuration directory
+  ansible.builtin.file:
+    path: /etc/wal-g
+    state: directory
+    owner: root
+    group: postgres
+    mode: "0750"
+
+- name: Install protected WAL-G environment
+  ansible.builtin.template:
+    src: wal-g.env.j2
+    dest: /etc/wal-g/wal-g.env
+    owner: postgres
+    group: postgres
+    mode: "0600"
+  no_log: true
+
+- name: Install PostgreSQL WAL-G wrapper
+  ansible.builtin.template:
+    src: wal-g-postgres.j2
+    dest: /usr/local/sbin/wal-g-postgres
+    owner: root
+    group: postgres
+    mode: "0750"
+
+- name: Install production backup service
+  ansible.builtin.template:
+    src: wal-g-backup.service.j2
+    dest: /etc/systemd/system/wal-g-backup.service
+    mode: "0644"
+  when: deployment_environment == 'prod'
+  notify: Restart WAL-G timer
+
+- name: Install production backup timer
+  ansible.builtin.template:
+    src: wal-g-backup.timer.j2
+    dest: /etc/systemd/system/wal-g-backup.timer
+    mode: "0644"
+  when: deployment_environment == 'prod'
+  notify: Restart WAL-G timer
+
+- name: Enable production backup timer
+  ansible.builtin.systemd_service:
+    name: wal-g-backup.timer
+    enabled: true
+    daemon_reload: true
+    state: started
+  when: deployment_environment == 'prod'
+
+- name: Install staging restore configuration
+  ansible.builtin.template:
+    src: db-sync.env.j2
+    dest: /etc/wal-g/db-sync.env
+    owner: root
+    group: root
+    mode: "0600"
+  when: deployment_environment == 'staging'
+  no_log: true
+
+- name: Install staging restore script
+  ansible.builtin.template:
+    src: db-sync.sh.j2
+    dest: /usr/local/sbin/db-sync
+    owner: root
+    group: root
+    mode: "0700"
+  when: deployment_environment == 'staging'
+
+- name: Install staging restore service
+  ansible.builtin.template:
+    src: db-sync.service.j2
+    dest: /etc/systemd/system/db-sync.service
+    mode: "0644"
+  when: deployment_environment == 'staging'
+  notify: Restart DB sync timer
+
+- name: Install staging restore timer
+  ansible.builtin.template:
+    src: db-sync.timer.j2
+    dest: /etc/systemd/system/db-sync.timer
+    mode: "0644"
+  when: deployment_environment == 'staging'
+  notify: Restart DB sync timer
+
+- name: Enable staging restore timer
+  ansible.builtin.systemd_service:
+    name: db-sync.timer
+    enabled: true
+    daemon_reload: true
+    state: started
+  when: deployment_environment == 'staging'