restructure: move proxmox/ into subfolder, add pihole/ section

All existing content moved from repo root into proxmox/ to make room
for other Debian machine configs. Adds pihole/ with:

- config/pihole.toml — snapshot of current Pi-hole v6 config
- config/dnsmasq.d/99-ipxe-chainload.conf — custom PXE DHCP rules
  (EFI/BIOS iPXE chainload, fixed tag-specificity bug for UEFI boot)
- pull-config.sh <source-host> <dest-dir> — pull live config to disk
- apply-config.sh <source-dir> <dest-host> — push config to a Pi-hole

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s

proxmox/scripts/harden-ssh.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# Apply baseline SSH hardening to a Proxmox VE node: key-only root login
+# + fail2ban. Idempotent - safe to re-run. Run as root on the PVE host.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+if ! authorized_keys_present=$(find /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys -type f 2>/dev/null | head -n1); then
+    authorized_keys_present=""
+fi
+if [ -z "$authorized_keys_present" ]; then
+    echo "WARNING: no authorized_keys found for any user yet." >&2
+    echo "Add your SSH public key before disconnecting, or you'll lock yourself out." >&2
+fi
+
+mkdir -p /etc/ssh/sshd_config.d
+write_if_changed "/etc/ssh/sshd_config.d/99-hardening.conf" "PermitRootLogin prohibit-password
+PasswordAuthentication no"
+
+sshd -t
+systemctl reload sshd
+echo "sshd reloaded with key-only root login."
+
+if ! dpkg -s fail2ban >/dev/null 2>&1; then
+    apt-get update
+    apt-get install -y fail2ban
+fi
+
+mkdir -p /etc/fail2ban/jail.d
+write_if_changed "/etc/fail2ban/jail.d/sshd.local" "[sshd]
+enabled = true
+port = ssh
+backend = systemd
+maxretry = 5
+bantime = 1h
+findtime = 10m"
+
+systemctl enable --now fail2ban
+systemctl restart fail2ban
+echo "fail2ban enabled for sshd."