Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

.gitea/workflows/docs-build.yml

@@ -0,0 +1,61 @@
+name: Documentation Build
+
+on:
+  push:
+    paths:
+      - "docs/**"
+      - "stacks/**"
+      - "ansible/inventory/**"
+      - "mkdocs.yml"
+      - "scripts/docs-build.sh"
+  workflow_dispatch:
+
+jobs:
+  generate-and-build:
+    name: Generate + build docs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          pip install mkdocs mkdocs-material mkdocs-awesome-pages-plugin
+          pip install jinja2 pyyaml
+
+      - name: Generate dynamic content
+        run: ./scripts/docs-build.sh --generate-only
+
+      - name: Build internal docs
+        run: mkdocs build --config-file docs/mkdocs.yml --site-dir site/internal
+
+      - name: Build external docs
+        run: mkdocs build --config-file docs/mkdocs-external.yml --site-dir site/external
+
+      - name: Deploy internal docs
+        if: github.ref == 'refs/heads/main'
+        # Deploy to Gitea Pages or internal server — configure PAGES_URL in secrets
+        env:
+          PAGES_SSH_KEY: ${{ secrets.PAGES_SSH_KEY }}
+          PAGES_HOST: ${{ secrets.PAGES_HOST }}
+          PAGES_PATH: ${{ secrets.PAGES_PATH_INTERNAL }}
+        run: |
+          if [ -n "$PAGES_SSH_KEY" ]; then
+            install -m 600 /dev/null /tmp/pages_key
+            echo "$PAGES_SSH_KEY" > /tmp/pages_key
+            rsync -avz --delete -e "ssh -i /tmp/pages_key -o StrictHostKeyChecking=no" \
+              site/internal/ "${PAGES_HOST}:${PAGES_PATH}/"
+          else
+            echo "PAGES_SSH_KEY not configured — skipping deploy"
+          fi
+
+      - name: Upload docs artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs-site
+          path: site/
+          retention-days: 7

.gitea/workflows/drift-detect.yml

@@ -0,0 +1,130 @@
+name: Drift Detection
+
+on:
+  schedule:
+    # Daily at 06:00 AEST (20:00 UTC previous day)
+    - cron: "0 20 * * *"
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Which layer to check: all | terraform | ansible"
+        required: false
+        default: "all"
+
+env:
+  TF_IN_AUTOMATION: "true"
+
+jobs:
+  terraform-drift:
+    name: Terraform — detect drift
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.target == 'all' || github.event.inputs.target == 'terraform' || github.event_name == 'schedule' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.9"
+
+      - name: Terraform init + plan (proxmox)
+        id: tf_proxmox
+        env:
+          TF_VAR_proxmox_endpoint: ${{ secrets.PROXMOX_ENDPOINT }}
+          TF_VAR_proxmox_api_token_id: ${{ secrets.PROXMOX_API_TOKEN_ID }}
+          TF_VAR_proxmox_api_token_secret: ${{ secrets.PROXMOX_API_TOKEN_SECRET }}
+        run: |
+          cd terraform/proxmox
+          terraform init -input=false
+          set +e
+          terraform plan -detailed-exitcode -input=false -no-color -out=plan.out 2>&1 | tee plan.log
+          PLAN_EXIT=${PIPESTATUS[0]}
+          set -e
+          if [ "$PLAN_EXIT" -eq 2 ]; then
+            echo "drift=true" >> "$GITHUB_OUTPUT"
+            echo "### Proxmox drift detected" >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            cat plan.log >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+          elif [ "$PLAN_EXIT" -eq 0 ]; then
+            echo "drift=false" >> "$GITHUB_OUTPUT"
+            echo "Proxmox: no drift" >> "$GITHUB_STEP_SUMMARY"
+          else
+            exit $PLAN_EXIT
+          fi
+
+      - name: Terraform init + plan (dns)
+        id: tf_dns
+        env:
+          TF_VAR_dynu_api_key: ${{ secrets.DYNU_API_KEY }}
+        run: |
+          cd terraform/dns
+          terraform init -input=false
+          set +e
+          terraform plan -detailed-exitcode -input=false -no-color 2>&1 | tee plan.log
+          PLAN_EXIT=${PIPESTATUS[0]}
+          set -e
+          if [ "$PLAN_EXIT" -eq 2 ]; then
+            echo "drift=true" >> "$GITHUB_OUTPUT"
+            echo "### DNS drift detected" >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            cat plan.log >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Notify on drift
+        if: steps.tf_proxmox.outputs.drift == 'true' || steps.tf_dns.outputs.drift == 'true'
+        env:
+          GOTIFY_URL: ${{ secrets.GOTIFY_URL }}
+          GOTIFY_TOKEN: ${{ secrets.GOTIFY_TOKEN }}
+        run: |
+          curl -s -X POST "${GOTIFY_URL}/message" \
+            -H "X-Gotify-Key: ${GOTIFY_TOKEN}" \
+            -F "title=Infrastructure drift detected" \
+            -F "message=Terraform plan found changes. Check the CI run for details." \
+            -F "priority=7"
+
+  ansible-drift:
+    name: Ansible — check mode
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.target == 'all' || github.event.inputs.target == 'ansible' || github.event_name == 'schedule' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Ansible
+        run: pip install ansible
+
+      - name: Install collections
+        run: ansible-galaxy collection install -r ansible/collections/requirements.yml
+
+      - name: Write SSH key
+        env:
+          ANSIBLE_SSH_KEY: ${{ secrets.ANSIBLE_SSH_KEY }}
+        run: |
+          install -m 600 /dev/null /tmp/ansible_key
+          echo "$ANSIBLE_SSH_KEY" > /tmp/ansible_key
+
+      - name: Ansible check mode (site.yml)
+        env:
+          ANSIBLE_PRIVATE_KEY_FILE: /tmp/ansible_key
+          ANSIBLE_HOST_KEY_CHECKING: "False"
+        run: |
+          cd ansible
+          ansible-playbook playbooks/site.yml --check --diff \
+            -e "@inventory/group_vars/all.yml" \
+            2>&1 | tee check.log
+          # Summarise
+          echo "### Ansible check summary" >> "$GITHUB_STEP_SUMMARY"
+          grep -E '(changed|failed|ok)=' check.log | tail -20 >> "$GITHUB_STEP_SUMMARY" || true
+
+      - name: Notify on changes detected
+        if: failure()
+        env:
+          GOTIFY_URL: ${{ secrets.GOTIFY_URL }}
+          GOTIFY_TOKEN: ${{ secrets.GOTIFY_TOKEN }}
+        run: |
+          curl -s -X POST "${GOTIFY_URL}/message" \
+            -H "X-Gotify-Key: ${GOTIFY_TOKEN}" \
+            -F "title=Ansible drift detected" \
+            -F "message=ansible --check found pending changes. Check CI for details." \
+            -F "priority=7"

.gitea/workflows/secret-scan.yml

@@ -0,0 +1,22 @@
+name: Secret Scan
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # full history — gitleaks scans all commits
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+        with:
+          config-path: .gitleaks.toml