feat(freeipa): add domain-controller setup — Rocky Linux 9 + FreeIPA 4.13

Installs and documents the FreeIPA identity management server at
domain-controller.sweet.home (VMID 108, pve1). Provides Kerberos,
LDAP, and integrated DNS for the SWEET.HOME realm.

New section: freeipa/
- docs/install.md: full step-by-step reproduction procedure including
  Proxmox VM prep (Rocky Linux 9 GenericCloud, SeaBIOS, cloud-init),
  swap setup, static IP, /etc/hosts fix, ipa-server-install flags
- docs/pihole-dns.md: how to configure Pi-hole to forward sweet.home
  queries to the FreeIPA BIND instance
- scripts/install.sh: idempotent install script with pre-flight checks;
  reads passwords from env or interactive prompt (never commits them)
- scripts/configure-pihole-dns.sh: idempotent Pi-hole forwarder setup
- scripts/verify.sh: read-only health check (13 checks, 0 side effects)
- CLAUDE.md: host guardrails for domain-controller

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Jbvxx4xbHVcx1NkK3vtmK

freeipa/scripts/verify.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Read-only health check for the FreeIPA server.
+# Run locally on domain-controller or remotely:
+#   ssh wayne@domain-controller 'bash -s' < scripts/verify.sh
+#
+# Exit code 0 = all checks passed, non-zero = something is wrong.
+
+set -uo pipefail
+
+PASS=0
+FAIL=0
+
+check() {
+  local label="$1"
+  shift
+  if "$@" >/dev/null 2>&1; then
+    echo "  OK  $label"
+    (( PASS++ )) || true
+  else
+    echo "FAIL  $label"
+    (( FAIL++ )) || true
+  fi
+}
+
+echo "=== FreeIPA health check: $(hostname -f) ==="
+echo ""
+
+echo "--- Services ---"
+check "ipactl status"       sudo ipactl status
+check "dirsrv running"      systemctl is-active dirsrv.target
+check "krb5kdc running"     systemctl is-active krb5kdc
+check "named running"       systemctl is-active named
+check "httpd running"       systemctl is-active httpd
+check "pki-tomcatd running" systemctl is-active pki-tomcatd.target
+
+echo ""
+echo "--- DNS ---"
+check "A record: domain-controller.sweet.home"   dig +short domain-controller.sweet.home A @127.0.0.1
+check "SRV: _kerberos._udp.sweet.home"           dig +short _kerberos._udp.sweet.home SRV @127.0.0.1
+check "SRV: _ldap._tcp.sweet.home"               dig +short _ldap._tcp.sweet.home SRV @127.0.0.1
+check "TXT: _kerberos.sweet.home"                dig +short _kerberos.sweet.home TXT @127.0.0.1
+
+echo ""
+echo "--- LDAP ---"
+check "LDAP port 389 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/389"
+check "LDAPS port 636 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/636"
+
+echo ""
+echo "--- Kerberos ---"
+check "KDC port 88 open" bash -c "exec 3<>/dev/tcp/127.0.0.1/88"
+
+echo ""
+echo "--- HTTP ---"
+check "IPA HTTP redirect" curl -sk -o /dev/null -w "%{http_code}" http://localhost/ | grep -qE "^(301|302|200)"
+check "IPA HTTPS UI"      curl -sk -o /dev/null -w "%{http_code}" https://localhost/ipa/ui/ | grep -q "200"
+
+echo ""
+if [[ $FAIL -eq 0 ]]; then
+  echo "All $PASS checks passed."
+else
+  echo "$FAIL check(s) FAILED, $PASS passed."
+  exit 1
+fi