refactor: drop shared-service meta dependencies from service roles

podman, postgres, valkey, and nginx are shared services deployed once
per host. Declaring them in meta/main.yml re-ran them on every service
deploy, adding significant time to targeted runs. Playbooks now list
shared services first (tagged 'infra') and every role entry carries a
group tag plus its own name, so '--tags <role>' deploys just that role.

Roles still fail fast when a shared service is missing (password
asserts, postgresql tasks). Prerequisites are documented in role
READMEs. CLAUDE.md updated to reflect the new convention.

CLAUDE.md

@@ -159,13 +159,17 @@ roles/myservice/
 ### 2. Meta Dependencies
 
 ```yaml
-dependencies:
+dependencies: []
-    - role: podman # If using containers
-    - role: postgres # If needs database
-    - role: redis # If needs cache
 ```
 
-**Important:** Only include dependencies that are **always** required. Optional dependencies (like nginx for reverse proxy) should be added explicitly in playbooks, not in `meta/main.yml`.
+**Do NOT declare shared services (podman, postgres, valkey, nginx) as meta dependencies.** They are deployed once via playbook role ordering and would otherwise re-run on every service deploy. Instead:
+
+- Playbooks list shared services before service roles, tagged `infra`
+- Every role entry in a playbook carries tags: a group tag (`system`, `net`, `infra`, `monitoring`, `services`) plus its own name
+- Targeted deploys use `--tags <role>`; fresh installs run the full playbook (or `--tags infra` first)
+- Service roles fail fast when a shared service is missing (password asserts, postgresql tasks)
+
+Document prerequisites in the role README instead of `meta/main.yml`.
 
 ### 3. Rootless Podman and User Systemd Services
 

roles/fdroid/meta/main.yml

@@ -1,3 +1,5 @@
 ---
-dependencies:
+# No meta dependencies: shared services (podman) are deployed once via
-  - role: podman
+# playbook role ordering (tagged 'infra'), not re-run on every deploy of
+# this role. See playbooks/*.yml.
+dependencies: []

roles/gitea/meta/main.yml

@@ -1,4 +1,5 @@
 ---
-dependencies:
+# No meta dependencies: shared services (podman, postgres) are deployed once via
-  - role: podman
+# playbook role ordering (tagged 'infra'), not re-run on every deploy of
-  - role: postgres
+# this role. See playbooks/*.yml.
+dependencies: []

roles/immich/README.md

@@ -2,6 +2,10 @@
 
 This Ansible role deploys [Immich](https://immich.app/) - a high performance self-hosted photo and video management solution - using Podman with k8s files.
 
+## Prerequisites
+
+The `podman`, `postgres`, `valkey`, and `nginx` roles must have been applied to the host first (they are shared services, intentionally not declared in `meta/main.yml` to keep immich deploys fast). Order them before `immich` in the playbook for fresh installs.
+
 ## Role Variables
 
 See `defaults/main.yml` for all available variables and their default values.

roles/immich/meta/main.yml

@@ -1,6 +1,7 @@
 ---
-dependencies:
+# No meta dependencies: podman, postgres, valkey, and nginx are shared
-  - role: podman
+# services deployed once via the playbook (see playbooks/andromeda.yml
-  - role: postgres
+# role ordering). Declaring them here would re-run them on every immich
-  - role: valkey
+# deploy. The role fails fast if they are missing (password asserts,
-  - role: nginx
+# postgresql_* tasks).
+dependencies: []

roles/metabase/meta/main.yml

@@ -1,4 +1,5 @@
 ---
-dependencies:
+# No meta dependencies: shared services (podman, postgres) are deployed once via
-  - role: podman
+# playbook role ordering (tagged 'infra'), not re-run on every deploy of
-  - role: postgres
+# this role. See playbooks/*.yml.
+dependencies: []

roles/ntfy/meta/main.yml

@@ -1,3 +1,5 @@
 ---
-dependencies:
+# No meta dependencies: shared services (podman) are deployed once via
-  - role: podman
+# playbook role ordering (tagged 'infra'), not re-run on every deploy of
+# this role. See playbooks/*.yml.
+dependencies: []

roles/static_web/meta/main.yml

@@ -1,3 +1,5 @@
 ---
-dependencies:
+# No meta dependencies: shared services (nginx) are deployed once via
-  - role: nginx
+# playbook role ordering (tagged 'infra'), not re-run on every deploy of
+# this role. See playbooks/*.yml.
+dependencies: []

roles/unifi/meta/main.yml

@@ -1,3 +1,5 @@
 ---
-dependencies:
+# No meta dependencies: shared services (podman) are deployed once via
-  - role: podman
+# playbook role ordering (tagged 'infra'), not re-run on every deploy of
+# this role. See playbooks/*.yml.
+dependencies: []

roles/uptime_kuma/meta/main.yml

@@ -1,3 +1,5 @@
 ---
-dependencies:
+# No meta dependencies: shared services (podman) are deployed once via
-  - role: podman
+# playbook role ordering (tagged 'infra'), not re-run on every deploy of
+# this role. See playbooks/*.yml.
+dependencies: []