Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

ansible/roles/raspberrypi/tasks/main.yml

@@ -0,0 +1,74 @@
+---
+# raspberrypi/tasks/main.yml
+# Post-IPA-enrollment setup for the Raspberry Pi edge node.
+# Mirrors debian-configuration/raspberrypi/scripts/.
+
+# ── IPA sudo ──────────────────────────────────────────────────────────────────
+
+- name: Check IPA enrollment
+  ansible.builtin.stat:
+    path: /etc/ipa/default.conf
+  register: ipa_conf
+  tags: ipa
+
+- name: Write IPA admins sudoers file
+  ansible.builtin.copy:
+    content: "%admins ALL=(ALL) NOPASSWD:ALL\n"
+    dest: /etc/sudoers.d/ipa-admins
+    mode: "0440"
+    validate: "visudo -cf %s"
+  when:
+    - raspberrypi_setup_ipa_sudo
+    - ipa_conf.stat.exists
+  tags: ipa
+
+# ── Docker GID pinning ────────────────────────────────────────────────────────
+
+- name: Check docker group GID
+  ansible.builtin.command:
+    cmd: "getent group docker"
+  register: docker_group
+  changed_when: false
+  failed_when: false
+  when: raspberrypi_pin_docker_gid
+  tags: docker
+
+- name: Pin docker group GID to IPA docker-access GID
+  block:
+    - name: Stop docker service and socket
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        state: stopped
+      loop:
+        - docker.service
+        - docker.socket
+
+    - name: Remove stale docker socket
+      ansible.builtin.file:
+        path: /var/run/docker.sock
+        state: absent
+
+    - name: Reassign docker group GID (non-unique — SSSD already owns this GID)
+      ansible.builtin.command:
+        cmd: "groupmod --non-unique -g {{ docker_access_gid }} docker"
+      changed_when: true
+
+    - name: Start docker socket and service
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        state: started
+      loop:
+        - docker.socket
+        - docker.service
+
+    - name: Verify socket GID
+      ansible.builtin.command:
+        cmd: "stat -c '%g' /var/run/docker.sock"
+      register: socket_gid
+      changed_when: false
+      failed_when: socket_gid.stdout != docker_access_gid | string
+  when:
+    - raspberrypi_pin_docker_gid
+    - docker_group.rc == 0
+    - docker_group.stdout.split(':')[2] != docker_access_gid | string
+  tags: docker