feat: update deployment configuration and encrypted env loader

- Update Ansible playbooks and roles for application deployment
- Add new Gitea/Traefik troubleshooting playbooks
- Update Docker Compose configurations (base, local, staging, production)
- Enhance EncryptedEnvLoader with improved error handling
- Add deployment scripts (autossh setup, migration, secret testing)
- Update CI/CD workflows and documentation
- Add Semaphore stack configuration

deployment/ansible/playbooks/regenerate-wireguard-client.yml

@@ -10,6 +10,7 @@
     wireguard_config_file: "{{ wireguard_config_path }}/{{ wireguard_interface }}.conf"
     wireguard_client_configs_path: "/etc/wireguard/clients"
     wireguard_local_client_configs_dir: "{{ playbook_dir }}/../wireguard-clients"
+    wireguard_dns_servers: []
 
   tasks:
     - name: Validate client name
@@ -80,18 +81,19 @@
 
     - name: Extract server IP from config
       set_fact:
-        server_vpn_ip: "{{ (wireguard_server_config_read.content | b64decode | regex_search('Address = ([0-9.]+)')) | default(['10.8.0.1']) | first }}"
+        server_vpn_ip: "{{ (wireguard_server_config_read.content | b64decode | regex_search('Address = ([0-9.]+)', '\\\\1')) | first | default('10.8.0.1') }}"
       failed_when: false
 
-    - name: Set default DNS servers
-      set_fact:
-        wireguard_dns_servers: "{{ [server_vpn_ip] }}"
-
     - name: Extract WireGuard server IP octets
       set_fact:
-        wireguard_server_ip_octets: "{{ server_vpn_ip.split('.') }}"
+        wireguard_server_ip_octets: "{{ (server_vpn_ip | default('')).split('.') }}"
       when: client_ip == ""
 
+    - name: Fail if server VPN IP is invalid
+      fail:
+        msg: "Server VPN IP '{{ server_vpn_ip }}' ist ungültig – bitte wg0.conf prüfen."
+      when: client_ip == "" and (wireguard_server_ip_octets | length) < 4
+
     - name: Gather existing client addresses
       set_fact:
         existing_client_ips: "{{ (wireguard_server_config_read.content | b64decode | regex_findall('AllowedIPs = ([0-9A-Za-z.]+)/32', '\\\\1')) }}"
@@ -109,7 +111,7 @@
           wireguard_server_ip_octets[2],
           next_octet_candidate
         ] | join('.') }}"
-      when: client_ip == ""
+      when: client_ip == "" and (wireguard_server_ip_octets | length) >= 4
 
     - name: Generate NEW client private key
       command: "wg genkey"