Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

scripts/check-secrets.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Run gitleaks against the full git history and staged changes.
+# Exits non-zero if any secrets are found.
+set -euo pipefail
+
+if ! command -v gitleaks &>/dev/null; then
+    echo "gitleaks not found. Install: https://github.com/gitleaks/gitleaks#installing" >&2
+    exit 1
+fi
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+echo "==> Scanning full git history..."
+gitleaks detect --config .gitleaks.toml --no-banner
+
+echo "==> Scanning staged changes..."
+gitleaks protect --staged --config .gitleaks.toml --no-banner
+
+echo "Secret scan passed."

scripts/docs-build.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Build infrastructure documentation.
+# Generates dynamic content then builds both internal and external MkDocs sites.
+#
+# Usage:
+#   ./scripts/docs-build.sh                  # generate + build both sites
+#   ./scripts/docs-build.sh --generate-only  # only regenerate dynamic content
+#   ./scripts/docs-build.sh --serve          # build + serve internal docs locally
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+GENERATE_ONLY=false
+SERVE=false
+for arg in "$@"; do
+    case "$arg" in
+        --generate-only) GENERATE_ONLY=true ;;
+        --serve)         SERVE=true ;;
+    esac
+done
+
+echo "==> Generating dynamic documentation..."
+
+# Service catalog from docker compose files
+if [ -d stacks/docker ]; then
+    python3 scripts/generate-service-catalog.py \
+        --stacks-dir stacks/ \
+        --output docs/generated/service-catalog.md 2>/dev/null || \
+        echo "  [skip] service catalog generator not yet implemented"
+fi
+
+# Host inventory from ansible
+python3 - <<'PYEOF' 2>/dev/null || echo "  [skip] inventory generator not yet implemented"
+import yaml, pathlib
+
+hosts_file = pathlib.Path("ansible/inventory/hosts.yml")
+out = pathlib.Path("docs/generated/host-inventory.md")
+out.parent.mkdir(parents=True, exist_ok=True)
+
+if hosts_file.exists():
+    data = yaml.safe_load(hosts_file.read_text())
+    lines = ["# Host Inventory\n", "Auto-generated from `ansible/inventory/hosts.yml`.\n\n"]
+    lines.append("| Host | Group | Role |\n|------|-------|------|\n")
+    def walk(node, parent=""):
+        if isinstance(node, dict):
+            for k, v in node.items():
+                if k == "hosts" and isinstance(v, dict):
+                    for host in v:
+                        lines.append(f"| `{host}` | `{parent}` | — |\n")
+                elif k not in ("vars", "children"):
+                    walk(v, k)
+                elif k == "children":
+                    walk(v, parent)
+    walk(data.get("all", {}))
+    out.write_text("".join(lines))
+    print(f"  Written {out}")
+PYEOF
+
+if [ "$GENERATE_ONLY" = true ]; then
+    echo "Dynamic content generated."
+    exit 0
+fi
+
+echo "==> Building internal documentation..."
+mkdocs build --config-file docs/mkdocs.yml --site-dir site/internal
+
+echo "==> Building external documentation..."
+mkdocs build --config-file docs/mkdocs-external.yml --site-dir site/external
+
+if [ "$SERVE" = true ]; then
+    echo "==> Serving internal docs at http://127.0.0.1:8000..."
+    mkdocs serve --config-file docs/mkdocs.yml
+fi
+
+echo "Documentation built successfully."

scripts/drift-detect.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Local drift detection runner.
+# Runs terraform plan (all workspaces) and ansible --check, then summarises.
+#
+# Usage:
+#   ./scripts/drift-detect.sh               # run everything
+#   ./scripts/drift-detect.sh --terraform   # terraform only
+#   ./scripts/drift-detect.sh --ansible     # ansible only
+#   ./scripts/drift-detect.sh --check-only  # alias for full run (no apply)
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+RUN_TF=true
+RUN_ANSIBLE=true
+
+for arg in "$@"; do
+    case "$arg" in
+        --terraform)    RUN_ANSIBLE=false ;;
+        --ansible)      RUN_TF=false ;;
+        --check-only)   ;;  # default, no-op
+        *) echo "Unknown flag: $arg" >&2; exit 1 ;;
+    esac
+done
+
+DRIFT_FOUND=0
+
+# ── Terraform ──────────────────────────────────────────────────────────────────
+
+if [ "$RUN_TF" = true ]; then
+    echo ""
+    echo "━━━ Terraform drift detection ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+    for workspace in terraform/proxmox terraform/dns terraform/pihole; do
+        if [ ! -f "${workspace}/providers.tf" ] && [ ! -f "${workspace}/provider.tf" ]; then
+            echo "[SKIP] ${workspace} — no providers.tf found"
+            continue
+        fi
+
+        echo ""
+        echo "--- ${workspace} ---"
+        (
+            cd "$workspace"
+            if [ ! -d .terraform ]; then
+                terraform init -input=false -no-color >/dev/null 2>&1
+            fi
+            set +e
+            terraform plan -detailed-exitcode -input=false -no-color
+            EXIT=$?
+            set -e
+            if [ "$EXIT" -eq 2 ]; then
+                echo "DRIFT: ${workspace} has pending changes"
+                DRIFT_FOUND=1
+            elif [ "$EXIT" -ne 0 ]; then
+                echo "ERROR in ${workspace} — plan failed (exit ${EXIT})"
+                DRIFT_FOUND=1
+            fi
+        )
+    done
+fi
+
+# ── Ansible ────────────────────────────────────────────────────────────────────
+
+if [ "$RUN_ANSIBLE" = true ]; then
+    echo ""
+    echo "━━━ Ansible drift detection (--check --diff) ━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    (
+        cd ansible
+        ansible-playbook playbooks/site.yml --check --diff 2>&1 | tee /tmp/ansible-drift.log
+        if grep -q 'changed=' /tmp/ansible-drift.log; then
+            echo "DRIFT: Ansible found pending changes"
+            DRIFT_FOUND=1
+        fi
+    )
+fi
+
+# ── Summary ────────────────────────────────────────────────────────────────────
+
+echo ""
+echo "━━━ Summary ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+if [ "$DRIFT_FOUND" -eq 0 ]; then
+    echo "No drift detected. All infrastructure matches declared state."
+else
+    echo "Drift detected — review the plan output above."
+fi
+
+exit "$DRIFT_FOUND"

scripts/install-hooks.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Install git pre-commit hook that runs gitleaks before every commit.
+# Idempotent — safe to re-run.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+HOOK="${REPO_ROOT}/.git/hooks/pre-commit"
+
+cat > "$HOOK" <<'EOF'
+#!/usr/bin/env bash
+set -e
+if ! command -v gitleaks &>/dev/null; then
+    echo "gitleaks not found — skipping pre-commit secret scan"
+    echo "Install: https://github.com/gitleaks/gitleaks#installing"
+    exit 0
+fi
+exec gitleaks protect --staged --config .gitleaks.toml --no-banner
+EOF
+
+chmod +x "$HOOK"
+echo "Pre-commit hook installed at ${HOOK}"