Stage 1 base config/hardening toolset, applied and verified on pve1

Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).

Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.

Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.

README.md

@@ -1,30 +1,48 @@
 # Proxmox Configuration
 
-Config, planning docs, and scripts for rebuilding my Proxmox VE homelab on new
-hardware, with the end goal of a 3-node HA cluster.
+Base configuration and hardening toolset for Proxmox VE hosts, plus planning
+docs for eventually growing this into a 3-node HA/Ceph cluster. See
+`docs/00-overview.md` for the staging: **Stage 1** (base config/hardening,
+applies to any host — active) vs. **Stage 2** (multi-node HA/Ceph — future,
+deferred).
 
 ## Goals
 
-- Fresh install on new hardware (old box has a KVM/virtualization bug that
-  forced disabling hardware-accelerated virtualization — not expected to
-  recur on new hardware; verify VT-x/AMD-V + IOMMU in BIOS before assuming
-  otherwise).
-- Move off LVM-thin to ZFS for local (boot + pre-cluster) storage.
-- Build node 1 so its disk and network layout doesn't need rework when nodes
-  2 and 3 are added later.
-- End state: 3-node cluster, quorum via corosync, HA-managed VMs backed by
-  Ceph. No intermediate ZFS-replication HA step — Ceph goes live as soon as
-  node 2/3 join.
+- Stage 1: a reusable, idempotent base-hardening toolset (`scripts/`) that
+  can be run against any new Proxmox host — repo/updates, SSH, firewall, PVE
+  user/access hardening — verified with `scripts/audit.sh`.
+- Stage 2 (future): 3-node cluster, quorum via corosync, HA-managed VMs
+  backed by Ceph. Needs dedicated hardware node 1 (`pve1`, an ASUS PN53 mini
+  PC) doesn't have — see `docs/01-hardware-node1.md`.
 
 ## Repo layout
 
 - `docs/` — planning docs: hardware layout, storage migration, networking,
   security hardening. Read `docs/00-overview.md` first.
-- `scripts/` — scripts to apply configuration on a node (SSH hardening,
-  repo switch, etc.). Idempotent, safe to re-run.
+- `scripts/` — scripts to apply configuration on a node (SSH hardening, repo
+  switch, firewall, updates, etc). Idempotent, safe to re-run.
+  `scripts/bootstrap.sh` runs the full Stage 1 sequence end to end;
+  `scripts/audit.sh` verifies it (read-only). `scripts/lib/` holds shared
+  helpers (`common.sh`) sourced by the other scripts.
 - `config/` — reference config files/snippets to drop onto a node (firewall
   rules, sshd config, etc.).
 
+## Quick start (Stage 1, on a fresh node)
+
+```
+MGMT_CIDR=192.168.2.0/24 ./scripts/bootstrap.sh
+./scripts/create-admin-user.sh <username>
+# then enable 2FA for that user + root@pam via the web UI
+./scripts/audit.sh
+```
+
 ## Status
 
-Planning stage — node 1 not yet built.
+`pve1` built (ASUS PN53 mini PC, ZFS mirror boot+VM storage, single
+2.5GbE NIC) and already running production VMs/CTs. Stage 1 base
+hardening applied and verified (`scripts/audit.sh` all green): enterprise
+repos removed, SSH key-only + fail2ban, unattended security upgrades,
+PVE firewall (mgmt-only), subscription nag disabled, named admin user
+(`wayne@pve`) created. Remaining manual step: enable 2FA/TOTP for
+`wayne@pve` and `root@pam` via the web UI. Stage 2 (cluster/Ceph) not
+started — needs nodes 2/3 on hardware that can actually support it.