as deployed

README.md

@@ -33,7 +33,7 @@ Create an encrypted Vault file at `group_vars/all/vault.yml` based on `group_var
 Example:
 
 ```bash
-ansible-vault create group_vars/all/vault.yml
+uv run ansible-vault create group_vars/all/vault.yml
 ```
 
 ## Usage
@@ -49,19 +49,30 @@ Update the inventory and variables first, especially:
 Run a syntax check:
 
 ```bash
-ansible-playbook --syntax-check site.yml
+uv run ansible-playbook --syntax-check site.yml
 ```
 
 Run the playbook:
 
 ```bash
-ansible-playbook site.yml --ask-vault-pass
+uv run ansible-playbook site.yml --ask-vault-pass
 ```
 
+## Result
+
+- `twirre.io`: Bun source checkout in `/srv/twirre/twirre.io`; runtime config in `/etc/twirre-io/app.env`; data in `/var/lib/twirre-io/app.sqlite3`, public files in `/var/lib/twirre-io/files`, and hidden files in `/var/lib/twirre-io/hfiles`; systemd unit `twirre_io.service`.
+- `twirre.me`: Bun source checkout in `/srv/twirre/twirre.me`; runtime config in `/etc/twirre-me/app.env`; data directory reserved at `/var/lib/twirre-me`; systemd unit `twirre_me.service`.
+- `Gitea`: Docker Compose stack in `/srv/gitea/compose.yaml`; persistent application data in `/srv/gitea/data`; systemd unit `gitea-compose.service`; public HTTP behind nginx at `git.twirre.io`, SSH on port `2222`.
+- `Mailserver`: Docker Compose stack in `/srv/mail/compose.yaml` with environment in `/srv/mail/mailserver.env`; mail data, state, logs, and docker-mailserver config under `/srv/mail/docker-data/dms/`; Let's Encrypt certificates mounted from `/etc/letsencrypt`; systemd unit `mailserver-compose.service`.
+- `lagrange.meulenbelt.nl`: static placeholder site rooted at `/srv/lagrange`.
+- `map.twirre.io`, `chat.twirre.io`, and `overleaf.twirre.io`: nginx reverse proxies only; no source code or data is stored on this host for these services.
+- Shared web infrastructure: nginx site configs in `/etc/nginx/sites-available/` with enabled symlinks in `/etc/nginx/sites-enabled/`; ACME webroot in `/var/www/letsencrypt`; certificates in `/etc/letsencrypt`.
+
 ## Notes
 
 - nginx falls back to snakeoil certificates until a matching ACME certificate already exists on disk.
-- If you enable `certbot_manage_certificates`, run the playbook a second time after the first successful issuance so nginx can switch to the live certificates automatically.
+- A run with `certbot_manage_certificates: true` requests certificates during that playbook run. If DNS and HTTP reachability are correct, issuance happens immediately.
+- `mailserver` starts only after its live Let's Encrypt certificate exists on disk, so the same run that issues `mail.twirre.io` can also bring up Docker Mailserver.
 - ACME issuance is disabled by default through `certbot_manage_certificates: false` so the first provisioning run can complete before DNS and public reachability are finalized.
 
 ## Manual post-provisioning steps