feat(iac): establish Ansible baseline for Nginx, SearXNG, Valkey, and Certbot

- Reverse-engineer live Debian 13 (trixie) VPS state at miguelpedro.xyz.br
- Add modular Ansible roles: common, certbot, valkey, searxng, and nginx
- Encrypt SearXNG secret_key using ansible-vault in group_vars/all/vault.yml
- Cleanly remove unused example.com Nginx stub symlink (sites-enabled/miguelpedro.xyz.br)
- Scaffold cgit + fcgiwrap role (cgit_enabled: false) for upcoming deployment
- Add DISCOVERY_REPORT.md, COMMAND_LOG.md, README.md, and AGENT_INSTRUCTIONS.md with Self-Updating Protocol

1 files changed, 132 insertions, 0 deletions

diff --git a/DISCOVERY_REPORT.md b/DISCOVERY_REPORT.md
new file mode 100644
index 0000000..ab45750
--- /dev/null
+++ b/DISCOVERY_REPORT.md
@@ -0,0 +1,132 @@
+# VPS Discovery Report
+
+**Target Host:** `root@miguelpedro.xyz.br` (`dd.vps-kinghost.net`)  
+**Discovery Date:** 2026-10-29  
+**OS / Kernel:** Debian GNU/Linux 13 (trixie) v13.7 | Kernel `6.12.63+deb13-amd64` x86_64  
+**Runtime Model:** Bare-metal / VM Systemd services (No Docker or Podman installed)
+
+---
+
+## 1. Architecture Overview
+
+```
+Internet (Ports 80/443)
+   │
+   ▼
+[ Nginx Reverse Proxy & Web Server ] (/etc/nginx)
+   ├── miguelpedro.xyz.br / www.miguelpedro.xyz.br ──► Static files (/var/www/html)
+   ├── _ (default_server :80) ───────────────────────► Static files + /searxng sub-path
+   └── searx.miguelpedro.xyz.br (HTTPS :443)
+          │
+          ▼ (Unix Socket: /usr/local/searxng/run/socket)
+       [ uWSGI Daemon ] (/etc/uwsgi/apps-enabled/searxng.ini)
+          │  Runs as user/group `searxng` (UID/GID 988)
+          │  Python venv: /usr/local/searxng/searx-pyenv
+          │  App source:  /usr/local/searxng/searxng-src
+          │  Settings:    /etc/searxng/settings.yml & limiter.toml
+          ▼ (TCP: 127.0.0.1:6379)
+       [ Valkey Server ] (/etc/valkey/valkey.conf)
+```
+
+---
+
+## 2. Web Server (Nginx)
+
+- **Service:** `nginx.service` (active, enabled)
+- **Main Config:** `/etc/nginx/nginx.conf` (standard Debian config with `server_tokens off;` enabled)
+- **Active Virtual Hosts (`/etc/nginx/sites-enabled/`):**
+  1. **`default` (`-> /etc/nginx/sites-available/default`)**:
+     - Port 80 `default_server` (`server_name _;`): serves `/var/www/html` and includes `/etc/nginx/default.d/*.conf`.
+     - Port 443 SSL (`server_name www.miguelpedro.xyz.br miguelpedro.xyz.br;`): serves `/var/www/html` using Let's Encrypt certificate `miguelpedro.xyz.br`.
+     - Port 80 redirect block for `miguelpedro.xyz.br` and `www.miguelpedro.xyz.br` (301 to HTTPS).
+     - *Note:* `/etc/nginx/sites-available/default.bak` also exists as a backup prior to SearXNG setup.
+  2. **`searxng.conf` (`-> /etc/nginx/sites-available/searxng.conf`)**:
+     - Port 443 SSL (`server_name searx.miguelpedro.xyz.br;`):
+       - Privacy logging: `access_log /dev/null;` and `error_log /dev/null;`
+       - Security headers: `X-Frame-Options "SAMEORIGIN"`, `X-Content-Type-Options "nosniff"`, `Referrer-Policy "no-referrer"`, `Strict-Transport-Security "max-age=31536000; includeSubDomains"`.
+       - Proxies `location /` via `uwsgi_pass unix:///usr/local/searxng/run/socket;` with `HTTP_HOST`, `HTTP_CONNECTION`, `HTTP_X_SCHEME`, `HTTP_X_REAL_IP`, and `HTTP_X_FORWARDED_FOR`.
+     - Port 80 redirect block for `searx.miguelpedro.xyz.br` (301 to HTTPS).
+  3. **`miguelpedro.xyz.br` (`-> /etc/nginx/sites-available/miguelpedro.xyz.br`)**:
+     - Port 80 stub with `server_name example.com www.example.com;` pointing to `/var/www/miguelpedro.xyz.br/html` (currently an empty directory, while the active `miguelpedro.xyz.br` site is served from `sites-available/default`).
+- **Default App Includes (`/etc/nginx/default.d/`):**
+  - `/etc/nginx/default.d/searxng.conf -> /etc/nginx/default.apps-available/searxng.conf` (created by SearXNG's official installation script, exposing `location /searxng` on the default server block).
+
+---
+
+## 3. SearXNG, uWSGI & Valkey
+
+SearXNG was installed using the official SearXNG installation script (`utils/searxng.sh`), running natively via `uwsgi` and backed by `valkey-server`.
+
+### System User & Environment
+- **User/Group:** `searxng` (`UID=988`, `GID=988`, home `/usr/local/searxng`, shell `/bin/bash`, member of `sudo` group).
+- **Profile:** `/usr/local/searxng/.profile` automatically activates `/usr/local/searxng/searx-pyenv/bin/activate`.
+- **Source Repository:** `/usr/local/searxng/searxng-src`
+  - Git remote: `https://github.com/searxng/searxng` (`master` branch, commit `b5ed73fcb6c6bda5d4e8b13d1472aa3917f784dc`).
+- **Virtualenv:** `/usr/local/searxng/searx-pyenv`
+
+### SearXNG Configuration (`/etc/searxng/`)
+- **`/etc/searxng/settings.yml`** (`0640`, `searxng:searxng`):
+  - `use_default_settings: true`
+  - `general`: `debug: false`, `instance_name: "SearXNG"`
+  - `search`: `safe_search: 0`, `autocomplete: "duckduckgo"`, `formats: [html, json]`
+  - `server`: `secret_key` (32-char hex), `limiter: true`, `image_proxy: true`, `base_url: https://searx.miguelpedro.xyz.br/`
+  - `valkey`: `url: valkey://localhost:6379/0`
+- **`/etc/searxng/limiter.toml`** (`0644`, `searxng:searxng`):
+  - Configures `[botdetection]` with `ipv4_prefix = 32`, `ipv6_prefix = 48`, `trusted_proxies = ['127.0.0.0/8', '::1']`, and `pass_searxng_org = true`.
+
+### Application Server (uWSGI)
+- **Service:** `uwsgi.service` (SysV/LSB service via `/etc/init.d/uwsgi`, configured by `/etc/default/uwsgi`).
+- **App Config:** `/etc/uwsgi/apps-enabled/searxng.ini -> /etc/uwsgi/apps-available/searxng.ini`
+  - Runs as `uid = searxng`, `gid = searxng`
+  - `chdir = /usr/local/searxng/searxng-src/searx`
+  - `env = SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml`
+  - `disable-logging = true`, `chmod-socket = 666`
+  - `plugin = python3,http`, `workers = %k`, `threads = 4`, `offload-threads = %k`
+  - `module = searx.webapp`
+  - `virtualenv = /usr/local/searxng/searx-pyenv`
+  - `pythonpath = /usr/local/searxng/searxng-src`
+  - `socket = /usr/local/searxng/run/socket`
+
+### Key-Value Store (Valkey)
+- **Service:** `valkey-server.service` (active, enabled; aliased as `valkey.service`).
+- **Config:** `/etc/valkey/valkey.conf` (bound to `127.0.0.1` and `-::1` on port `6379`, data dir `/var/lib/valkey`).
+
+---
+
+## 4. TLS/SSL & Firewall State
+
+### TLS / Certbot
+- **Packages:** `certbot`, `python3-certbot-nginx`
+- **Timer:** `certbot.timer` (active, runs twice daily) and `/etc/cron.d/certbot`.
+- **Certificates (`/etc/letsencrypt/live/`):**
+  1. `miguelpedro.xyz.br` (Domains: `miguelpedro.xyz.br`, `www.miguelpedro.xyz.br` | Key Type: ECDSA | Authenticator/Installer: `nginx`)
+  2. `searx.miguelpedro.xyz.br` (Domains: `searx.miguelpedro.xyz.br` | Key Type: ECDSA | Authenticator/Installer: `nginx`)
+- **Shared Nginx TLS Configs:** `/etc/letsencrypt/options-ssl-nginx.conf` and `/etc/letsencrypt/ssl-dhparams.pem`.
+
+### Firewall & Network
+- **Listening Public Ports:**
+  - `22/tcp` (IPv4 & IPv6) — OpenSSH (`sshd`)
+  - `80/tcp` (IPv4 & IPv6) — Nginx HTTP
+  - `443/tcp` (IPv4 & IPv6) — Nginx HTTPS
+- **Listening Loopback Ports:**
+  - `6379/tcp` (`127.0.0.1` & `::1`) — Valkey Server
+- **Firewall State:**
+  - `ufw` and `iptables` are **not installed**.
+  - `nftables` (`/usr/sbin/nft`) is installed, with default empty tables in `/etc/nftables.conf`, and `nftables.service` is currently **disabled/inactive (dead)** (`nft list ruleset` is empty).
+
+---
+
+## 5. Complete Critical State Map
+
+| Component | Critical Path on VPS | Purpose |
+| :--- | :--- | :--- |
+| **Nginx Core** | `/etc/nginx/nginx.conf` | Global Nginx settings (`server_tokens off`, TLS 1.2/1.3) |
+| **Nginx VHosts** | `/etc/nginx/sites-available/default`<br>`/etc/nginx/sites-available/searxng.conf`<br>`/etc/nginx/sites-available/miguelpedro.xyz.br` | Main domain vhost, SearXNG reverse proxy vhost, and stub config |
+| **Nginx App Snippet** | `/etc/nginx/default.apps-available/searxng.conf` | `/searxng` sub-path snippet symlinked in `/etc/nginx/default.d/` |
+| **Web Root** | `/var/www/html/`<br>`/var/www/miguelpedro.xyz.br/html/` | Static web roots |
+| **SearXNG Config** | `/etc/searxng/settings.yml`<br>`/etc/searxng/limiter.toml` | SearXNG instance settings, secret key, Valkey URL, and bot limiter |
+| **SearXNG App & Venv** | `/usr/local/searxng/searxng-src/`<br>`/usr/local/searxng/searx-pyenv/`<br>`/usr/local/searxng/run/socket` | SearXNG git clone, Python virtualenv, and uWSGI Unix socket |
+| **uWSGI Config** | `/etc/uwsgi/apps-available/searxng.ini`<br>`/etc/default/uwsgi` | uWSGI worker configuration for SearXNG |
+| **Valkey Config** | `/etc/valkey/valkey.conf`<br>`/var/lib/valkey/` | Local Redis-compatible store used by SearXNG limiter |
+| **TLS Certificates** | `/etc/letsencrypt/live/*`<br>`/etc/letsencrypt/renewal/*.conf`<br>`/etc/letsencrypt/options-ssl-nginx.conf` | Certbot ECDSA certificates and renewal definitions |
+| **Firewall** | `/etc/nftables.conf` | Nftables ruleset (currently inactive) |