Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

scripts/drift-detect.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Local drift detection runner.
+# Runs terraform plan (all workspaces) and ansible --check, then summarises.
+#
+# Usage:
+#   ./scripts/drift-detect.sh               # run everything
+#   ./scripts/drift-detect.sh --terraform   # terraform only
+#   ./scripts/drift-detect.sh --ansible     # ansible only
+#   ./scripts/drift-detect.sh --check-only  # alias for full run (no apply)
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+RUN_TF=true
+RUN_ANSIBLE=true
+
+for arg in "$@"; do
+    case "$arg" in
+        --terraform)    RUN_ANSIBLE=false ;;
+        --ansible)      RUN_TF=false ;;
+        --check-only)   ;;  # default, no-op
+        *) echo "Unknown flag: $arg" >&2; exit 1 ;;
+    esac
+done
+
+DRIFT_FOUND=0
+
+# ── Terraform ──────────────────────────────────────────────────────────────────
+
+if [ "$RUN_TF" = true ]; then
+    echo ""
+    echo "━━━ Terraform drift detection ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+    for workspace in terraform/proxmox terraform/dns terraform/pihole; do
+        if [ ! -f "${workspace}/providers.tf" ] && [ ! -f "${workspace}/provider.tf" ]; then
+            echo "[SKIP] ${workspace} — no providers.tf found"
+            continue
+        fi
+
+        echo ""
+        echo "--- ${workspace} ---"
+        (
+            cd "$workspace"
+            if [ ! -d .terraform ]; then
+                terraform init -input=false -no-color >/dev/null 2>&1
+            fi
+            set +e
+            terraform plan -detailed-exitcode -input=false -no-color
+            EXIT=$?
+            set -e
+            if [ "$EXIT" -eq 2 ]; then
+                echo "DRIFT: ${workspace} has pending changes"
+                DRIFT_FOUND=1
+            elif [ "$EXIT" -ne 0 ]; then
+                echo "ERROR in ${workspace} — plan failed (exit ${EXIT})"
+                DRIFT_FOUND=1
+            fi
+        )
+    done
+fi
+
+# ── Ansible ────────────────────────────────────────────────────────────────────
+
+if [ "$RUN_ANSIBLE" = true ]; then
+    echo ""
+    echo "━━━ Ansible drift detection (--check --diff) ━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    (
+        cd ansible
+        ansible-playbook playbooks/site.yml --check --diff 2>&1 | tee /tmp/ansible-drift.log
+        if grep -q 'changed=' /tmp/ansible-drift.log; then
+            echo "DRIFT: Ansible found pending changes"
+            DRIFT_FOUND=1
+        fi
+    )
+fi
+
+# ── Summary ────────────────────────────────────────────────────────────────────
+
+echo ""
+echo "━━━ Summary ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+if [ "$DRIFT_FOUND" -eq 0 ]; then
+    echo "No drift detected. All infrastructure matches declared state."
+else
+    echo "Drift detected — review the plan output above."
+fi
+
+exit "$DRIFT_FOUND"