Initial commit — OpenClaw VM infrastructure

- ansible/: VM provisioning playbooks and roles
  - provision-vm.yml: create KVM VM from Ubuntu cloud image
  - install.yml: install OpenClaw on guest (upstream)
  - customize.yml: swappiness, virtiofs fstab, linger
  - roles/vm/: libvirt domain XML, cloud-init templates
  - inventory.yml + host_vars/zap.yml: zap instance config
- backup-openclaw-vm.sh: daily rsync + MinIO upload
- restore-openclaw-vm.sh: full redeploy from scratch
- README.md: full operational documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,53 @@
+# ── Secrets & credentials ──────────────────────────────────────────────────
+.env
+*.env
+*.key
+*.pass
+*.token
+*.pem
+*.p12
+
+# LiteLLM tokens (API keys, access tokens)
+litellm-copilot-tokens/
+
+# Kubeconfig (cluster credentials)
+swarm-kubeconfig.yaml
+ansible/host_vars/*/kubeconfig*
+
+# ── OpenClaw runtime data ──────────────────────────────────────────────────
+# Secrets and credentials — never commit
+openclaw/secrets.json
+openclaw/credentials/
+openclaw/identity/
+openclaw/devices/
+openclaw/telegram/
+openclaw/delivery-queue/
+openclaw/exec-approvals.json
+
+# Large ephemeral data — not useful in git
+openclaw/workspace/
+openclaw/workspace-*/
+openclaw/memory/
+openclaw/agents/
+openclaw/logs/
+openclaw/extensions-quarantine/
+openclaw/sandboxes/
+openclaw/sandbox/
+openclaw/canvas/
+openclaw/media/
+openclaw/completions/
+openclaw/cron/
+openclaw/hooks/
+openclaw/subagents/
+openclaw/data/
+openclaw/extensions/
+openclaw/update-check.json
+
+# Keep only the main config file for reference
+# (secrets are excluded above; openclaw.json itself has no keys)
+
+# ── OS / editor noise ─────────────────────────────────────────────────────
+.DS_Store
+*.swp
+*.swo
+*~