feat(tailscale): add Ansible role and playbook for merlin + gandalf

Installs Tailscale on k3s agents via the Debian stable apt repo using
the modern signed-by keyring approach. Auth key stored in vault.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infrastructure/inventory/group_vars/all/prole_vault.yml

@@ -1,7 +1,11 @@
 $ANSIBLE_VAULT;1.1;AES256
-64373935366135353230383931313131666463323262663363623934346165653933323636386635
-6437306634623062323464646431323333306464316634620a306466353266663262396435613537
-37383737653930633932336633666430653462343634363838383439666163326638616264323562
-6138393633396631650a643864373833656232393164616138386638373932393363363731383033
-65366163323932633033376338646231656264363431636334656363336462616665346634613966
-3637646539373535353234653461613036353435626561396466
+33623138366633303132353563383738646164396538336165316530363262646134393036616635
+6662653962366435313563306164393937666335663930350a383261343263663336663065613963
+66393438336334326134303437646362653964396361333134326136626432636362373337353232
+3936646132656535350a343365643561356362363636636166623132366438326465633833663862
+33316135303164356262663934646434313534366335336536663631656133346139393038366162
+64326362623432646462343662363963353765356262646139616535303534633931633662643964
+36373263353666373161326330616637363634313434626633613864336230643631313436643039
+32363362323132643164333130666132303263386366393764323066353063653861663962646266
+32623162323638366666613032343566653465616439666364366130373830303539333832313034
+3563336539623938313361636633643531303564666537383065

infrastructure/inventory/group_vars/tailscale.yml

@@ -0,0 +1,2 @@
+---
+tailscale_authkey: "{{ vault_tailscale_authkey }}"

infrastructure/inventory/hosts.ini

@@ -45,6 +45,10 @@ raspberry.prole.org
 mariadb_primary
 mariadb_replica
 
+[tailscale]
+merlin.prole.org
+gandalf.prole.org
+
 [merlin_bootstrap]
 merlin ansible_host=10.0.0.36 ansible_user=ansible
 

infrastructure/playbooks/tailscale.yml

@@ -0,0 +1,6 @@
+---
+- name: Install and connect Tailscale
+  hosts: tailscale
+  become: true
+  roles:
+    - tailscale

infrastructure/roles/tailscale/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+tailscale_authkey: ""
+tailscale_up_args: "--accept-routes"

infrastructure/roles/tailscale/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart tailscaled
+  service:
+    name: tailscaled
+    state: restarted

infrastructure/roles/tailscale/tasks/main.yml

@@ -0,0 +1,37 @@
+---
+- name: Download Tailscale signing key
+  get_url:
+    url: "https://pkgs.tailscale.com/stable/debian/{{ ansible_distribution_release }}.gpg"
+    dest: /usr/share/keyrings/tailscale-archive-keyring.gpg
+    mode: "0644"
+
+- name: Add Tailscale apt repository
+  apt_repository:
+    repo: "deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/debian {{ ansible_distribution_release }} main"
+    state: present
+    filename: tailscale
+
+- name: Install tailscale
+  apt:
+    name: tailscale
+    state: present
+    update_cache: true
+
+- name: Enable and start tailscaled
+  service:
+    name: tailscaled
+    state: started
+    enabled: true
+
+- name: Check current Tailscale status
+  command: tailscale status --json
+  register: ts_status
+  changed_when: false
+  failed_when: false
+
+- name: Bring up Tailscale (skip if already authenticated)
+  command: "tailscale up --authkey {{ tailscale_authkey }} {{ tailscale_up_args }}"
+  when: >
+    ts_status.rc != 0 or
+    (ts_status.stdout | from_json).BackendState != 'Running'
+  no_log: true