Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

terraform/dns/records.tf

@@ -0,0 +1,161 @@
+locals {
+  dynu_dns_records_catalog_base = {
+    auth = {
+      hostname    = "auth"
+      service     = "authelia"
+      source      = "core/authelia/docker-compose.yml"
+      purpose     = "Authentication portal"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    gitea = {
+      hostname    = "gitea"
+      service     = "gitea"
+      source      = "apps/gitea/docker-compose.yml"
+      purpose     = "Gitea service endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    gotify = {
+      hostname    = "gotify"
+      service     = "gotify"
+      source      = "monitoring/gotify/docker-compose.yml"
+      purpose     = "Gotify notifications"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    grafana = {
+      hostname    = "grafana"
+      service     = "grafana"
+      source      = "monitoring/grafana/docker-compose.yml"
+      purpose     = "Grafana monitoring UI"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    familytree = {
+      hostname    = "familytree"
+      service     = "gramps"
+      source      = "apps/gramps/docker-compose.yml"
+      purpose     = "Family tree application"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    influxdb = {
+      hostname    = "influxdb"
+      service     = "influxdb"
+      source      = "monitoring/influxdb/docker-compose.yml"
+      purpose     = "InfluxDB metrics endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    monitor_kuma = {
+      hostname    = "monitor-kuma"
+      service     = "uptime-kuma"
+      source      = "monitoring/uptime-kuma/docker-compose.yml"
+      purpose     = "Uptime Kuma monitoring UI"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    mtls_bridge = {
+      hostname    = "mtls-bridge"
+      service     = "mtls-bridge"
+      source      = "monitoring/mtls-bridge/docker-compose.yml"
+      purpose     = "mTLS bridge API"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    nextcloud = {
+      hostname    = "nextcloud"
+      service     = "nextcloud-webapp"
+      source      = "apps/nextcloud/docker-compose.yml"
+      purpose     = "Nextcloud service endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    node_red = {
+      hostname    = "node-red"
+      service     = "node-red"
+      source      = "monitoring/node-red/docker-compose.yml"
+      purpose     = "Node-RED automation UI/API"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    passbolt = {
+      hostname    = "passbolt"
+      service     = "passbolt-webapp"
+      source      = "apps/passbolt/docker-compose.yml"
+      purpose     = "Passbolt password management"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    portainer = {
+      hostname    = "portainer"
+      service     = "portainer"
+      source      = "monitoring/portainer/docker-compose.yml"
+      purpose     = "Portainer admin endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    prometheus = {
+      hostname    = "prometheus"
+      service     = "prometheus"
+      source      = "monitoring/prometheus/docker-compose.yml"
+      purpose     = "Prometheus metrics endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    searxng = {
+      hostname    = "searxng"
+      service     = "searxng"
+      source      = "apps/searxng/docker-compose.yml"
+      purpose     = "SearXNG search endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    traefik = {
+      hostname    = "traefik"
+      service     = "traefik"
+      source      = "core/traefik/docker-compose.yml"
+      purpose     = "Traefik dashboard/API endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+  }
+
+  dynu_dns_records_catalog = {
+    for key, record in local.dynu_dns_records_catalog_base :
+    key => merge(record, {
+      fqdn = format("%s.%s", record.hostname, local.dynu_domain)
+    })
+  }
+}