chore: make group_vars into templates, gitignore instances

Rename all.yml, relay.yml, landing.yml to .yml.example.
Actual group_vars/*.yml files are now gitignored.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,5 +1,7 @@
 credentials/
 output/
 inventory/hosts.yml
+group_vars/*.yml
+!group_vars/*.yml.example
 *.retry
 .claude/settings.local.json

README.md

@@ -52,6 +52,10 @@ Make sure your SSH key is already configured for the specified user on both serv
 
 ### 2. Configure variables
 
+```bash
+for f in group_vars/*.yml.example; do cp "$f" "${f%.example}"; done
+```
+
 Edit `group_vars/landing.yml`:
 - `trojan_domain`: Your domain name
 - `certbot_email`: Email for Let's Encrypt notifications

openspec/changes/archive/2026-04-22-group-vars-template/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-04-22

openspec/changes/archive/2026-04-22-group-vars-template/design.md

@@ -0,0 +1,22 @@
+## Context
+
+Same pattern as `inventory/hosts.yml.example` — ship templates, gitignore instances.
+
+## Goals / Non-Goals
+
+**Goals:**
+- All three group_vars files become `.example` templates
+- Actual `.yml` files gitignored
+
+**Non-Goals:**
+- Changing variable names or defaults
+
+## Decisions
+
+### 1. Gitignore pattern: `group_vars/*.yml` with negation for `.example`
+
+Use `group_vars/*.yml` in `.gitignore` and `!group_vars/*.yml.example` to ensure only the actual config files are ignored while templates remain tracked.
+
+## Risks / Trade-offs
+
+- **[Forgotten copy step]** → Ansible will fail clearly if files are missing. README documents the step.

openspec/changes/archive/2026-04-22-group-vars-template/proposal.md

@@ -0,0 +1,25 @@
+## Why
+
+`group_vars/*.yml` files contain user-specific configuration (domain names, email, port/cipher preferences). Like the inventory, they should be `.example` templates in git with the actual files gitignored.
+
+## What Changes
+
+- Rename `group_vars/{all,relay,landing}.yml` to `.yml.example` via git mv
+- Add `group_vars/*.yml` (excluding `.example`) to `.gitignore`
+- Update README to document the copy step
+
+## Capabilities
+
+### New Capabilities
+
+(none)
+
+### Modified Capabilities
+
+(none — this is a file organization change, not a behavior change)
+
+## Impact
+
+- `group_vars/*.yml` gitignored
+- `group_vars/*.yml.example` committed as templates
+- README updated

openspec/changes/archive/2026-04-22-group-vars-template/specs/no-spec-changes.md

@@ -0,0 +1 @@
+No spec changes — this is a file organization change only.

openspec/changes/archive/2026-04-22-group-vars-template/tasks.md

@@ -0,0 +1,5 @@
+## 1. Group Vars Templates
+
+- [x] 1.1 git mv `group_vars/all.yml` → `group_vars/all.yml.example`, same for `relay.yml` and `landing.yml`
+- [x] 1.2 Add `group_vars/*.yml` and `!group_vars/*.yml.example` to `.gitignore`
+- [x] 1.3 Update README to add `cp group_vars/*.yml.example` step (replace `.example` suffix)