Refactor inventory into OS groups and update playbooks accordingly

Group hosts by OS (ubuntu/rocky) in inventory, refactor playbooks to
use group-targeted plays instead of ansible_os_family conditionals,
add bot host, and add Docker volume backup playbook via rsync to storage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

playbooks/bootstrap_lxc.yml

@@ -1,11 +1,10 @@
-- name: Bootstrap new Linux servers
-  hosts: all
-  become: yes
+- name: Bootstrap - Install packages on Ubuntu
+  hosts: ubuntu
+  become: true
 
   tasks:
-
-    - name: Install packages on Debian/Ubuntu
-      apt:
+    - name: Install packages via apt
+      ansible.builtin.apt:
         name:
           - vim
           - htop
@@ -34,17 +33,20 @@
           - mtr
           - tar
         state: present
-        update_cache: yes
-      when: ansible_facts['os_family'] == "Debian"
+        update_cache: true
 
-    - name: Ensure EPEL repo is enabled (RHEL/CentOS/AlmaLinux)
-      yum:
+- name: Bootstrap - Install packages on Rocky Linux
+  hosts: rocky
+  become: true
+
+  tasks:
+    - name: Ensure EPEL repo is enabled
+      ansible.builtin.dnf:
         name: epel-release
         state: present
-      when: ansible_facts['os_family'] == "RedHat"
 
-    - name: Install packages on RHEL/CentOS/AlmaLinux
-      yum:
+    - name: Install packages via dnf
+      ansible.builtin.dnf:
         name:
           - tar
           - vim
@@ -65,7 +67,7 @@
           - tree
           - bash-completion
           - traceroute
-          - bind-utils        # provides dig, nslookup
+          - bind-utils
           - ca-certificates
           - python3
           - python3-pip
@@ -73,11 +75,15 @@
           - sysstat
           - screen
         state: present
-        update_cache: yes
-      when: ansible_facts['os_family'] == "RedHat"
+        update_cache: true
 
+- name: Bootstrap - Configure SSH access
+  hosts: all
+  become: true
+
+  tasks:
     - name: Ensure root's .ssh directory exists
-      file:
+      ansible.builtin.file:
         path: /root/.ssh
         state: directory
         owner: root
@@ -85,7 +91,7 @@
         mode: '0700'
 
     - name: Set authorized_keys for root
-      copy:
+      ansible.builtin.copy:
         dest: /root/.ssh/authorized_keys
         content: |
           ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINegitHaQG8i+s412h3wTWf/KvpeX1CEpYFva9MhHR+7 ansible-key
@@ -94,35 +100,43 @@
         mode: '0600'
 
     - name: Permit root login via public key
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^#?PermitRootLogin\s+'
         line: 'PermitRootLogin prohibit-password'
         state: present
-        backup: yes
+        backup: true
 
     - name: Ensure PubkeyAuthentication is enabled
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^#?PubkeyAuthentication\s+'
         line: 'PubkeyAuthentication yes'
         state: present
 
     - name: Ensure PasswordAuthentication is enabled
-      lineinfile:
+      ansible.builtin.lineinfile:
         path: /etc/ssh/sshd_config
         regexp: '^#?PasswordAuthentication\s+'
         line: 'PasswordAuthentication yes'
         state: present
 
-    - name: Restart SSH service (Debian)
-      service:
+- name: Bootstrap - Restart SSH on Ubuntu
+  hosts: ubuntu
+  become: true
+
+  tasks:
+    - name: Restart ssh service
+      ansible.builtin.service:
         name: ssh
         state: restarted
-      when: ansible_facts['os_family'] == "Debian"
 
-    - name: Restart SSH service (RHEL)
-      service:
+- name: Bootstrap - Restart SSH on Rocky Linux
+  hosts: rocky
+  become: true
+
+  tasks:
+    - name: Restart sshd service
+      ansible.builtin.service:
         name: sshd
         state: restarted
-      when: ansible_facts['os_family'] == "RedHat"