Add Nextcloud cloud storage role with split Redis caching strategy

## New Features

- **Nextcloud Role**: Complete cloud storage deployment using Podman Quadlet
  - FPM variant with Caddy reverse proxy and FastCGI
  - PostgreSQL database via Unix socket
  - Valkey/Redis for app-level caching and file locking
  - Automatic HTTPS with Let's Encrypt via Caddy
  - Dual-root pattern: Caddy serves static assets, FPM handles PHP

- **Split Caching Strategy**: Redis caching WITHOUT Redis sessions
  - Custom redis.config.php template for app-level caching only
  - File-based PHP sessions for stability (avoids session lock issues)
  - Prevents cascading failures from session lock contention
  - Documented in role README with detailed rationale

## Infrastructure Updates

- **Socket Permissions**: Update PostgreSQL and Valkey to mode 777
  - Required for containers that switch users (root → www-data)
  - Nextcloud container loses supplementary groups on user switch
  - Security maintained via password authentication (scram-sha-256, requirepass)
  - Documented socket permission architecture in docs/

- **PostgreSQL**: Export client group GID as fact for dependent roles
- **Valkey**: Export client group GID as fact, update socket fix service

## Documentation

- New: docs/socket-permissions-architecture.md
  - Explains 777 vs 770 socket permission trade-offs
  - Documents why group-based access doesn't work for user-switching containers
  - Provides TCP alternative for stricter security requirements

- Updated: All role READMEs with socket permission notes
- New: Nextcloud README with comprehensive deployment, troubleshooting, and Redis architecture documentation

## Configuration

- host_vars: Add Nextcloud vault variables and configuration
- site.yml: Include Nextcloud role in main playbook

## Technical Details

**Why disable Redis sessions?**

The official Nextcloud container enables Redis session handling via REDIS_HOST env var,
which causes severe performance issues:

1. Session lock contention under high concurrency (browser parallel asset requests)
2. Infinite lock retries (default lock_retries=-1) blocking FPM workers
3. Timeout orphaning: reverse proxy kills connection, worker keeps lock
4. Worker pool exhaustion: all 5 default workers blocked on same session lock
5. Cascading failure: new requests queue, more timeouts, more orphaned locks

Solution: Use file-based sessions (reliable, fast for single-server) while keeping
Redis for distributed cache and transactional file locking via custom config file.

This provides optimal performance without the complexity of Redis session debugging.

Tested: Fresh deployment on arch-vps (69.62.119.31)
Domain: https://cloud.jnss.me/

roles/nextcloud/tasks/cache.yml

@@ -0,0 +1,17 @@
+---
+# Nextcloud Valkey Cache Setup
+# Valkey configuration is done via environment variables in the container
+# This file exists for consistency and future cache-specific tasks
+
+- name: Verify Valkey socket accessibility
+  stat:
+    path: "{{ valkey_unix_socket_path }}"
+  register: valkey_socket_stat
+  failed_when: not valkey_socket_stat.stat.exists
+
+- name: Display cache configuration
+  debug:
+    msg: |
+      Nextcloud will use Valkey database {{ nextcloud_valkey_db }}
+      Socket: {{ valkey_unix_socket_path }}
+      Access via valkey-clients group

roles/nextcloud/tasks/database.yml

@@ -0,0 +1,34 @@
+---
+# Nextcloud Database Setup - PostgreSQL via Unix Socket
+
+- name: Create Nextcloud PostgreSQL user
+  postgresql_user:
+    name: "{{ nextcloud_db_user }}"
+    password: "{{ nextcloud_db_password }}"
+    encrypted: true
+    login_unix_socket: "{{ postgresql_unix_socket_directories }}"
+    login_user: postgres
+  become: true
+  become_user: postgres
+
+- name: Create Nextcloud database
+  postgresql_db:
+    name: "{{ nextcloud_db_name }}"
+    owner: "{{ nextcloud_db_user }}"
+    encoding: UTF8
+    template: template0
+    login_unix_socket: "{{ postgresql_unix_socket_directories }}"
+    login_user: postgres
+  become: true
+  become_user: postgres
+
+- name: Grant Nextcloud database privileges
+  postgresql_privs:
+    db: "{{ nextcloud_db_name }}"
+    privs: ALL
+    type: database
+    role: "{{ nextcloud_db_user }}"
+    login_unix_socket: "{{ postgresql_unix_socket_directories }}"
+    login_user: postgres
+  become: true
+  become_user: postgres

roles/nextcloud/tasks/main.yml

@@ -0,0 +1,150 @@
+---
+# Nextcloud Cloud Storage Role - Main Tasks
+# Self-contained deployment with FPM, PostgreSQL, and Valkey via Unix sockets
+
+- name: Validate infrastructure facts are available
+  assert:
+    that:
+      - postgresql_client_group_gid is defined
+      - valkey_client_group_gid is defined
+    fail_msg: |
+      Required infrastructure facts are not available.
+      Ensure PostgreSQL and Valkey roles have run and exported client group GIDs.
+  tags: [validation]
+
+- name: Setup nextcloud user and container namespaces
+  include_tasks: user.yml
+  tags: [user, setup]
+
+- name: Setup database access and permissions
+  include_tasks: database.yml
+  tags: [database, setup]
+
+- name: Setup cache access and permissions
+  include_tasks: cache.yml
+  tags: [cache, setup]
+
+- name: Pull nextcloud container image
+  containers.podman.podman_image:
+    name: "{{ nextcloud_image }}:{{ nextcloud_version }}"
+    state: present
+  tags: [containers, image-pull]
+
+- name: Create nextcloud application directories (container manages ownership)
+  file:
+    path: "{{ item }}"
+    state: directory
+    # Note: No owner/group/mode specified - let container entrypoint manage ownership
+    # The official Nextcloud container expects to chown these to www-data (UID:33)
+  loop:
+    - "{{ nextcloud_html_dir }}"
+    - "{{ nextcloud_data_dir }}"
+    - "{{ nextcloud_config_dir }}"
+    - "{{ nextcloud_custom_apps_dir }}"
+  tags: [setup, directories]
+
+- name: Deploy environment configuration
+  template:
+    src: nextcloud.env.j2
+    dest: "{{ nextcloud_home }}/.env"
+    mode: '0600'
+    backup: true
+  notify: restart nextcloud
+  tags: [config]
+
+- name: Deploy custom Redis caching configuration
+  template:
+    src: redis.config.php.j2
+    dest: "{{ nextcloud_config_dir }}/redis.config.php"
+    mode: '0640'
+  notify: restart nextcloud
+  tags: [config, redis]
+
+- name: Deploy Redis session lock override configuration
+  template:
+    src: redis-session-override.ini.j2
+    dest: "{{ nextcloud_home }}/redis-session-override.ini"
+    mode: '0644'
+  notify: restart nextcloud
+  tags: [config, redis]
+
+- name: Create Quadlet systemd directory (system scope)
+  file:
+    path: /etc/containers/systemd
+    state: directory
+    mode: '0755'
+
+- name: Deploy Quadlet container file (system scope)
+  template:
+    src: nextcloud.container
+    dest: /etc/containers/systemd/nextcloud.container
+    mode: '0644'
+  notify:
+    - reload systemd
+    - restart nextcloud
+  tags: [containers, deployment]
+
+- name: Deploy Caddy configuration
+  template:
+    src: nextcloud.caddy.j2
+    dest: "{{ caddy_sites_enabled_dir }}/nextcloud.caddy"
+    owner: root
+    group: "{{ caddy_user }}"
+    mode: '0644'
+    backup: true
+  notify: reload caddy
+  tags: [caddy, reverse-proxy]
+
+- name: Ensure system dependencies are running
+  systemd:
+    name: "{{ item }}"
+    state: started
+  loop:
+    - postgresql
+    - valkey
+
+- name: Wait for PostgreSQL socket to be ready
+  wait_for:
+    path: "{{ postgresql_unix_socket_directories }}/.s.PGSQL.{{ postgresql_port }}"
+    timeout: 30
+
+- name: Wait for Valkey socket to be ready
+  wait_for:
+    path: "{{ valkey_unix_socket_path }}"
+    timeout: 30
+
+- name: Enable and start Nextcloud service (system scope)
+  systemd:
+    name: nextcloud
+    enabled: "{{ nextcloud_service_enabled }}"
+    state: "{{ nextcloud_service_state }}"
+    daemon_reload: true
+  tags: [containers, service]
+
+- name: Wait for Nextcloud FPM to be ready
+  wait_for:
+    host: 127.0.0.1
+    port: "{{ nextcloud_fpm_port }}"
+    timeout: 60
+  retries: 5
+  delay: 10
+  tags: [verification]
+
+- name: Display Nextcloud deployment status
+  debug:
+    msg: |
+      ✅ Nextcloud Cloud Storage deployed successfully!
+      
+      🌐 Domain: {{ nextcloud_domain }}
+      🗄️ Database: {{ nextcloud_db_name }} (Unix socket)
+      🗄️ Cache: Valkey DB {{ nextcloud_valkey_db }} (Unix socket)
+      🐳 Container: FPM via Podman Quadlet
+      🔒 Admin: {{ nextcloud_admin_user }}
+      
+      🚀 Ready for file storage and collaboration!
+      
+      📋 Next Steps:
+      - Access https://{{ nextcloud_domain }} to complete setup
+      - Install desired Nextcloud apps
+      - Configure user accounts
+  tags: [verification]

roles/nextcloud/tasks/user.yml

@@ -0,0 +1,54 @@
+---
+# Nextcloud User Management - Service-Specific User Setup
+
+- name: Check if nextcloud group exists
+  getent:
+    database: group
+    key: "{{ nextcloud_group }}"
+  register: nextcloud_group_check
+  failed_when: false
+
+- name: Create nextcloud group if not exists
+  group:
+    name: "{{ nextcloud_group }}"
+    system: true
+  when: nextcloud_group_check.ansible_facts.getent_group is not defined
+
+- name: Check if nextcloud user exists
+  getent:
+    database: passwd
+    key: "{{ nextcloud_user }}"
+  register: nextcloud_user_check
+  failed_when: false
+
+- name: Create or update nextcloud user
+  user:
+    name: "{{ nextcloud_user }}"
+    group: "{{ nextcloud_group }}"
+    groups: "{{ [postgresql_client_group, valkey_client_group] }}"
+    system: true
+    shell: /usr/bin/nologin
+    home: "{{ nextcloud_home }}"
+    create_home: true
+    comment: "Nextcloud cloud storage service"
+    append: true
+
+- name: Create nextcloud home directory
+  file:
+    path: "{{ nextcloud_home }}"
+    state: directory
+    owner: "{{ nextcloud_user }}"
+    group: "{{ nextcloud_group }}"
+    mode: '0755'
+
+- name: Get nextcloud user UID and GID for container configuration
+  shell: |
+    echo "uid=$(id -u {{ nextcloud_user }})"
+    echo "gid=$(id -g {{ nextcloud_user }})"
+  register: nextcloud_user_info
+  changed_when: false
+
+- name: Set nextcloud UID/GID facts for container templates
+  set_fact:
+    nextcloud_uid: "{{ nextcloud_user_info.stdout_lines[0] | regex_replace('uid=', '') }}"
+    nextcloud_gid: "{{ nextcloud_user_info.stdout_lines[1] | regex_replace('gid=', '') }}"