fix(ansible): Prevent Traefik and Gitea restart loops

- Set traefik_auto_restart: false in group_vars to prevent automatic restarts after config deployment
- Set traefik_ssl_restart: false to prevent automatic restarts during SSL certificate setup
- Set gitea_auto_restart: false to prevent automatic restarts when healthcheck fails
- Modify traefik/tasks/ssl.yml to only restart if explicitly requested or acme.json was created
- Modify traefik/tasks/config.yml to respect traefik_auto_restart flag
- Modify gitea/tasks/restart.yml to respect gitea_auto_restart flag
- Add verify-traefik-fix.yml playbook to monitor Traefik stability

This fixes the issue where Traefik was restarting every minute due to
automatic restart mechanisms triggered by config deployments and health checks.
The restart loops caused 504 Gateway Timeouts for Gitea and other services.

Fixes: Traefik restart loop causing service unavailability

deployment/ansible/roles/gitea/defaults/main.yml

@@ -1,4 +1,62 @@
 ---
+# Gitea Stack Configuration
 gitea_stack_path: "{{ stacks_base_path }}/gitea"
+gitea_container_name: "gitea"
+gitea_url: "https://{{ gitea_domain | default('git.michaelschiemer.de') }}"
+gitea_domain: "{{ gitea_domain | default('git.michaelschiemer.de') }}"
+
+# Wait Configuration
 gitea_wait_timeout: "{{ wait_timeout | default(60) }}"
 gitea_wait_interval: 5
+gitea_restart_wait_timeout: 30
+gitea_restart_retries: 30
+gitea_restart_delay: 2
+
+# Health Check Configuration
+gitea_health_check_timeout: 10
+gitea_check_health: true
+gitea_show_status: true
+gitea_show_logs: true
+gitea_logs_tail: 50
+
+# Auto-Restart Configuration
+# Set to false to prevent automatic restarts when healthcheck fails
+# This prevents restart loops when Gitea is temporarily unavailable
+gitea_auto_restart: true
+
+# Config Update Configuration
+gitea_app_ini_path: "{{ gitea_stack_path }}/app.ini"
+gitea_app_ini_container_path: "/data/gitea/conf/app.ini"
+gitea_app_ini_template: "../../templates/gitea-app.ini.j2"
+gitea_config_retries: 30
+gitea_config_delay: 2
+
+# Setup Configuration
+gitea_admin_username: "{{ vault_gitea_admin_username | default('admin') }}"
+gitea_admin_password: "{{ vault_gitea_admin_password | default('') }}"
+gitea_admin_email: "{{ vault_gitea_admin_email | default(acme_email) }}"
+gitea_force_update_app_ini: false
+gitea_setup_health_retries: 30
+gitea_setup_health_delay: 5
+gitea_setup_db_wait: 10
+
+# Runner Configuration
+gitea_runner_path: "{{ runner_path | default('/home/deploy/deployment/gitea-runner') }}"
+gitea_runner_container_name: "gitea-runner"
+gitea_instance_url: "https://git.michaelschiemer.de"
+gitea_runner_action: "fix"  # Options: fix, register
+gitea_runner_registration_token: ""
+gitea_runner_name: "dev-runner-01"
+gitea_runner_labels: "ubuntu-latest:docker://node:16-bullseye,ubuntu-22.04:docker://node:16-bullseye,php-ci:docker://php-ci:latest"
+gitea_runner_show_status: true
+gitea_runner_wait_seconds: 5
+
+# Repository Configuration
+gitea_repo_name: "michaelschiemer"
+gitea_repo_owner: "michael"
+gitea_repo_private: false
+gitea_repo_description: "Main application repository"
+gitea_repo_auto_init: false
+gitea_configure_git_remote: true
+gitea_git_repo_path: "/home/michael/dev/michaelschiemer"
+gitea_force_create_repo: false

deployment/ansible/roles/gitea/tasks/restart.yml

@@ -0,0 +1,123 @@
+---
+# Check and Restart Gitea if Unhealthy
+
+- name: Check if Gitea stack directory exists
+  ansible.builtin.stat:
+    path: "{{ gitea_stack_path }}"
+  register: gitea_stack_exists
+
+- name: Fail if Gitea stack directory does not exist
+  ansible.builtin.fail:
+    msg: "Gitea stack directory not found at {{ gitea_stack_path }}"
+  when: not gitea_stack_exists.stat.exists
+
+- name: Check Gitea container status
+  ansible.builtin.shell: |
+    cd {{ gitea_stack_path }}
+    docker compose ps {{ gitea_container_name }} --format json
+  register: gitea_container_status
+  changed_when: false
+  failed_when: false
+
+- name: Display Gitea container status
+  ansible.builtin.debug:
+    msg: |
+      ================================================================================
+      Gitea Container Status:
+      {{ gitea_container_status.stdout | default('Container not found or error') }}
+      ================================================================================
+  when: gitea_show_status | default(true) | bool
+
+- name: Check Gitea health endpoint
+  ansible.builtin.uri:
+    url: "{{ gitea_url }}/api/healthz"
+    method: GET
+    status_code: [200]
+    validate_certs: false
+    timeout: "{{ gitea_health_check_timeout | default(10) }}"
+  register: gitea_health
+  ignore_errors: yes
+  changed_when: false
+
+- name: Display Gitea health check result
+  ansible.builtin.debug:
+    msg: |
+      ================================
+      Gitea Health Check:
+      - Status Code: {{ gitea_health.status | default('UNREACHABLE') }}
+      - Response Time: {{ gitea_health.elapsed | default('N/A') }}s
+      - Status: {% if gitea_health.status | default(0) == 200 %}✅ HEALTHY{% else %}❌ UNHEALTHY or TIMEOUT{% endif %}
+      ================================
+  when: gitea_show_status | default(true) | bool
+
+- name: Get Gitea container logs
+  ansible.builtin.shell: |
+    cd {{ gitea_stack_path }}
+    docker compose logs --tail={{ gitea_logs_tail | default(50) }} {{ gitea_container_name }} 2>&1 || echo "LOGS_NOT_AVAILABLE"
+  register: gitea_logs
+  changed_when: false
+  failed_when: false
+
+- name: Display Gitea container logs
+  ansible.builtin.debug:
+    msg: |
+      ================================================================================
+      Gitea Container Logs (last {{ gitea_logs_tail | default(50) }} lines):
+      {{ gitea_logs.stdout | default('No logs available') }}
+      ================================================================================
+  when: gitea_show_logs | default(true) | bool
+
+- name: Check if Gitea container is running
+  ansible.builtin.set_fact:
+    gitea_is_running: "{{ 'State\":\"running' in (gitea_container_status.stdout | default('')) }}"
+
+- name: Check if Gitea is healthy
+  ansible.builtin.set_fact:
+    gitea_is_healthy: "{{ (gitea_health.status | default(0)) == 200 }}"
+
+- name: Restart Gitea container if unhealthy or not running
+  ansible.builtin.shell: |
+    cd {{ gitea_stack_path }}
+    docker compose restart {{ gitea_container_name }}
+  when: 
+    - (not gitea_is_healthy | bool or not gitea_is_running | bool)
+    - gitea_auto_restart | default(true) | bool
+  register: gitea_restart
+  changed_when: gitea_restart.rc == 0
+  notify: wait for gitea
+
+- name: Wait for Gitea to be ready after restart
+  ansible.builtin.uri:
+    url: "{{ gitea_url }}/api/healthz"
+    method: GET
+    status_code: [200]
+    validate_certs: false
+    timeout: "{{ gitea_health_check_timeout | default(10) }}"
+  register: gitea_health_after_restart
+  until: gitea_health_after_restart.status == 200
+  retries: "{{ gitea_restart_retries | default(30) }}"
+  delay: "{{ gitea_restart_delay | default(2) }}"
+  when: gitea_restart.changed | default(false)
+  ignore_errors: yes
+  changed_when: false
+
+- name: Display final status
+  ansible.builtin.debug:
+    msg: |
+      ========================================
+      ========================================
+      Gitea Status Summary
+      ========================================
+      Container Running: {% if gitea_is_running | bool %}✅ YES{% else %}❌ NO{% endif %}
+      Health Check: {% if gitea_health_after_restart.status | default(0) == 200 %}✅ HEALTHY{% elif gitea_is_healthy | bool %}✅ HEALTHY{% else %}❌ UNHEALTHY{% endif %}
+      Action Taken: {% if gitea_restart.changed | default(false) %}🔄 Container restarted{% else %}ℹ️ No restart needed{% endif %}
+      Final Status: {% if gitea_is_running | bool and (gitea_health_after_restart.status | default(0) == 200 or gitea_is_healthy | bool) %}✅ HEALTHY{% else %}❌ STILL UNHEALTHY{% endif %}
+      ========================================
+      {% if gitea_is_running | bool and (gitea_health_after_restart.status | default(0) == 200 or gitea_is_healthy | bool) %}
+      ✅ Gitea is now accessible and healthy!
+      {% else %}
+      ❌ Gitea is still not fully healthy. Manual intervention may be required.
+      {% endif %}
+      ========================================
+  when: gitea_show_status | default(true) | bool
+