Replace run.sh with ansible-playbook

I've learned more about Ansible, and that the flags I set by using
`run.sh` are also settable with a `ansible.cfg` file! That's about the
same amount of overhead, but enables everything else to be more
standard. Neat!

README.md

@@ -9,23 +9,23 @@ We like to use Ansible playbooks to keep track of how we set up our servers,
 here's how we've structured them! (We don't use very fancy Ansible features, we
 just use them as idempotent command-line scripts!)
 
-- `setup-users.yml`: Sets up the user accounts for the system, with their SSH
-  keys for login.
+- `setup-machine.yml`: Sets up the hostname config and user accounts for the
+  system, with their SSH keys for login.
 - `setup-security.yml`: Sets up firewall rules and automatic system updates.
   (This is a standard playbook I use for all my servers!)
 - `setup-forgejo.yml`: Sets up the Forgejo server itself, as a `systemd`
   service running Forgejo's official Linux binary. This is mostly a 1:1 port
   of [Forgejo's "Installation from binary" guide][fj-install]!
 
-You can run them individually, or all at once, with `run.sh`:
+You can run them individually, or all at once, with `ansible-playbook`:
 
-    run.sh setup-all.yml
+    ansible-playbook setup-all.yml
 
 If you're interested in setting up your own Forgejo service, this could be
 useful as a starting point, there's not much custom here! Just a couple things
 to note:
 
-- `setup-users.yml` contains my own username and my own SSH public keys—you'll
+- `setup-machine.yml` contains my own username and my own SSH public keys—you'll
   want to replace those! (Public SSH keys aren't secret, don't worry, I'm fine!)
 - `files/app.ini` includes some custom config you'll need to replace, like our
   domain name. (We also opt to use Forgejo's built-in HTTPS support, via

ansible.cfg

@@ -0,0 +1,5 @@
+[defaults]
+inventory = inventory.cfg
+
+[privilege_escalation]
+become_ask_pass = True

files/forgejo.service

@@ -51,6 +51,9 @@ After=network.target
 ###
 
 [Service]
+# NOTE: I found that Let's Encrypt certificates only renew when the service
+# starts, so let's make sure we're restarting every so often.
+RuntimeMaxSec=7d
 # Uncomment the next line if you have repos with lots of files and get a HTTP 500 error because of that
 # LimitNOFILE=524288:524288
 RestartSec=2s

run.sh

@@ -1 +0,0 @@
-ansible-playbook -i inventory.cfg --ask-become-pass $1

setup-machine.yml

@@ -1,9 +1,13 @@
 ---
-- name: Set up user accounts
+- name: Set up host config & user accounts
   hosts: webserver
   become: yes
   become_user: root
   tasks:
+    - name: Set hostname to code.openneo.net
+      hostname:
+        name: code.openneo.net
+
     - name: Create user account for matchu
       user:
         name: matchu