Fix Docker failing to start on first deploy

The firewall role's "Reload systemd" handler shadowed the docker role's
handler of the same name, and its flush_handlers ran the pending Docker
restart right after base lowered fs.nr_open, without a daemon-reload.
Docker then started without its LimitNOFILE override and systemd could
not apply the default limit (status=205/LIMITS).

Reload systemd inline in the firewall role instead of through a
handler, so other roles' handlers keep running at the end of the play,
and reload before ensuring Docker is running so a host left in this
state recovers on the next deploy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/ansible/roles/docker/tasks/main.yml

@@ -41,11 +41,14 @@
     mode: "0644"
   notify: Restart docker
 
+# daemon_reload picks up the LimitNOFILE override below if it is already on
+# disk; without it Docker cannot start once base lowers fs.nr_open.
 - name: Ensure Docker is enabled and running
   ansible.builtin.systemd:
     name: docker
     enabled: true
     state: started
+    daemon_reload: true
 
 - name: Configure Docker systemd override for unlimited file descriptors
   ansible.builtin.file:

deploy/ansible/roles/firewall/handlers/main.yml

@@ -1,4 +0,0 @@
----
-- name: Reload systemd
-  ansible.builtin.systemd:
-    daemon_reload: true

deploy/ansible/roles/firewall/tasks/main.yml

@@ -39,16 +39,15 @@
   loop:
     - ufw-cloudflare-sync.service
     - ufw-cloudflare-sync.timer
-  notify: Reload systemd
-
-- name: Apply systemd unit changes before enabling the timer
-  ansible.builtin.meta: flush_handlers
 
+# Reload here rather than via a handler: flushing handlers mid-play would also
+# run other roles' pending handlers (e.g. restarting Docker) out of order.
 - name: Enable daily Cloudflare IP sync
   ansible.builtin.systemd:
     name: ufw-cloudflare-sync.timer
     enabled: true
     state: started
+    daemon_reload: true
 
 - name: Sync Cloudflare IP ranges now
   ansible.builtin.command: /usr/local/sbin/ufw-cloudflare-sync