Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

terraform/docker/README.md

@@ -0,0 +1,43 @@
+# Terraform Docker Mirror Layer
+
+This directory tracks selected existing Docker containers in Terraform for inventory/documentation purposes.
+
+## Purpose
+
+- Mirror specific running containers as Terraform resources.
+- Reconcile imported state into maintainable code.
+- Produce structured outputs/reminders that support documentation workflows.
+
+## Boundary with Docker Compose
+
+Docker Compose + `services-up.sh` remain runtime composition authority.
+
+Terraform resources here are **not** the primary day-to-day deployment mechanism for app services.
+
+## Current contents
+
+- `main.tf` — import-first workflow notes and minimal scaffolding.
+- `searxng-webapp.tf` — generated/reconciled example container resource.
+- `outputs.tf` — documentation-oriented reminders/outputs.
+- `terraform.tfvars.example` — safe template for local values.
+
+## Import/reconciliation workflow
+
+1. Start with one existing container.
+2. Import with `import {}` block or `terraform import`.
+3. Inspect state / generated config.
+4. Reduce generated attributes to meaningful, stable arguments.
+5. Keep lifecycle `ignore_changes` narrow and justified.
+6. Iterate until plan is clean for the intended resource.
+
+## Guardrails
+
+- Do not attempt to mirror all containers in one pass.
+- Do not commit local state or real credentials.
+- Treat generated config as draft input that needs review.
+
+## Related docs
+
+- [../README.md](../README.md)
+- [../../../docs/source-of-truth.md](../../../docs/source-of-truth.md)
+- [../../../docs/terraform-workflows.md](../../../docs/terraform-workflows.md)