refactor: move ioc logic from ansible to the gitea runner

The ioc install/start/restart logic moves out of the ansible playbooks and
the 'agebd ioc ...' cli into scripts run by the gitea runner:

- ioc-install.sh / ioc-restart.sh run on the runner itself
- ioc-start.sh triggers the shellbox commands over ssh
- ioc-for-services.sh runs an action for one or all services

They read the deployed ioc files from /sls instead of cloning the repo on
the target host, so a service has to be deployed before its ioc can be
installed. The deploy script therefore also takes over the environment
suffix renaming of the subs/parameters files that ansible used to do, and
the workflow steps are ordered deploy -> install.

The commented-out ioc placeholders in the add-new-service workflow are
filled in, and a manually triggered 'Ioc' workflow replaces the removed
cli commands.

With this, nothing uses ansible anymore, so the ansible dir, the cli ioc
commands and the ansible dependencies are removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJTevZiSsHepW2xnJGQY49

docs/developer/ansible.md

@@ -1,36 +0,0 @@
-# Ansible
-
-## Running a playbook manually
-
-Set vars on command line:
-
-```
-ansible-playbook ansible/playbooks/add-new-service.yml \
-            -i ansible/hosts.yml \
-            --extra-vars="repo_root=${{ github.workspace }} agebd_env=dev service_name_lower=<service dir name>" \
-            -v
-```
-
-### Install an IOC
-```
-ansible-playbook ansible/playbooks/ioc-install.yml \
-            -i ansible/hosts.yml \
-            --extra-vars="agebd_env=dev branch_name=feature/add-service-playground service_name_lower=playground ioc_port=50003" \
-            -v
-```
-
-### Start an IOC
-```
-ansible-playbook ansible/playbooks/ioc-start.yml \
-            -i ansible/hosts.yml \
-            --extra-vars="service_name_lower=playground ioc_port=50003" \
-            -v
-```
-
-### Restart an IOC
-```
-ansible-playbook ansible/playbooks/ioc-restart.yml \
-            -i ansible/hosts.yml \
-            --extra-vars="agebd_env=dev branch_name=feature/add-service-playground service_name_lower=playground" \
-            -v
-```

docs/developer/cicd_runner.md

@@ -3,9 +3,11 @@
 ## Hosts
 
 - `sls-vserv-bd-01(-dev)`
-    - Runs shellbox commands (and `ioc install ...`?)
+    - Runs the shellbox commands, which the runner triggers over `ssh`
+      (see `.gitea/scripts/ioc-start.sh`)
 - `sls-vserv-bd-hla01(-dev)`
-    - Runs everything else
+    - Runs the runner itself, and therefore everything else: the deployments
+      to `/sls/bd/hla/<env>/` and the `ioc ...` commands
 
 ## Setup
 

docs/developer/ioc/ioc.md

@@ -1,6 +1,8 @@
 # IOC
 
-The following instructions explain the basics of starting and managing IOCs on the IOC host. 
+The following instructions explain the basics of starting and managing IOCs on the IOC host.
+They describe the manual steps. In practice the CI/CD runner does this for you, see
+[Automation](#automation) below. 
 
 - TODO: some iocs not associated to a service, where to put? 
 - TODO: need to dev/prod template them too
@@ -92,3 +94,20 @@ sudo shellbox start 50045       # start ioc
 sudo shellbox log 50045 -f      # log file (tail)
 exit                            # exit ssh
 ```
+
+
+## Automation
+
+Installing, starting and restarting IOCs is done by the gitea runner, not by hand:
+
+- `.gitea/scripts/ioc-install.sh <service-name> <dev|prod>`
+- `.gitea/scripts/ioc-start.sh <service-name> <dev|prod>` (shellbox, over `ssh`)
+- `.gitea/scripts/ioc-restart.sh <service-name> <dev|prod>`
+
+The scripts operate on the deployed IOC files in
+`/sls/bd/hla/<env>/services/<service-name>/current/ioc`, so a service has to be deployed
+before its IOC can be installed.
+
+They run automatically when a new service is added (`.gitea/workflows/add-new-service.yml`),
+and can be triggered manually for any service (or `all` services) through the `Ioc` workflow
+(`.gitea/workflows/ioc.yml`) in the gitea Actions tab.