refactor: reorganize fluent-bit and geoip out of containers

- Move fluent-bit to common role (systemd service, not a container)
- Move geoip to podman/tasks/data/ (data prep, not a container)
- Remove debyltech tag from geoip (not a debyltech service)
- Fix check_mode for fetch subuid task to enable dry-run mode

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

ansible/roles/podman/tasks/containers/base/fluent-bit.yml

@@ -1,64 +0,0 @@
----
-# Fluent Bit - Log forwarder from journald to Graylog GELF
-# Deployed as systemd service (not container) for direct journal access
-
-# Clean up old container deployment if it exists
-- name: stop and remove fluent-bit container if exists
-  become: true
-  become_user: "{{ podman_user }}"
-  containers.podman.podman_container:
-    name: fluent-bit
-    state: absent
-  ignore_errors: true
-
-- name: disable old fluent-bit container systemd service
-  become: true
-  become_user: "{{ podman_user }}"
-  ansible.builtin.systemd:
-    name: fluent-bit
-    enabled: false
-    state: stopped
-    scope: user
-  ignore_errors: true
-
-- name: install fluent-bit package
-  become: true
-  ansible.builtin.dnf:
-    name: fluent-bit
-    state: present
-
-- name: create fluent-bit state directory for tail db files
-  become: true
-  ansible.builtin.file:
-    path: /var/lib/fluent-bit
-    state: directory
-    owner: root
-    group: root
-    mode: '0755'
-
-- name: deploy fluent-bit parsers configuration
-  become: true
-  ansible.builtin.template:
-    src: fluent-bit/parsers.conf.j2
-    dest: /etc/fluent-bit/parsers.conf
-    owner: root
-    group: root
-    mode: '0644'
-  notify: restart fluent-bit
-
-- name: deploy fluent-bit configuration
-  become: true
-  ansible.builtin.template:
-    src: fluent-bit/fluent-bit.conf.j2
-    dest: /etc/fluent-bit/fluent-bit.conf
-    owner: root
-    group: root
-    mode: '0644'
-  notify: restart fluent-bit
-
-- name: enable and start fluent-bit service
-  become: true
-  ansible.builtin.systemd:
-    name: fluent-bit
-    enabled: true
-    state: started

ansible/roles/podman/tasks/main.yml

@@ -31,7 +31,7 @@
 
 - import_tasks: containers/home/hass.yml
   vars:
-    image: ghcr.io/home-assistant/home-assistant:2025.9
+    image: ghcr.io/home-assistant/home-assistant:2026.1
   tags: hass
 
 - import_tasks: containers/home/partkeepr.yml
@@ -86,15 +86,16 @@
     image: docker.io/louislam/uptime-kuma:2.0.2
   tags: home, uptime
 
-- import_tasks: containers/debyltech/geoip.yml
-  tags: debyltech, graylog, geoip
+- import_tasks: data/geoip.yml
+  tags: graylog, geoip
 
 - import_tasks: containers/debyltech/graylog.yml
+  vars:
+    mongo_image: docker.io/mongo:7.0
+    opensearch_image: docker.io/opensearchproject/opensearch:2
+    image: docker.io/graylog/graylog:7.0.1
   tags: debyltech, graylog
 
-- import_tasks: containers/base/fluent-bit.yml
-  tags: fluent-bit, graylog
-
 - import_tasks: containers/home/gregtime.yml
   vars:
     image: localhost/greg-time-bot:3.0.2

ansible/roles/podman/tasks/podman/podman.yml

@@ -112,6 +112,7 @@
 - name: fetch subuid of {{ podman_user }}
   become: true
   changed_when: false
+  check_mode: false
   ansible.builtin.shell: |
     set -o pipefail && cat /etc/subuid | awk -F':' '/{{ podman_user }}/{ print $2 }' | head -n 1
   register: podman_subuid