Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

terraform/proxmox/server-nixos.tf

@@ -0,0 +1,88 @@
+# __generated__ by Terraform
+# Please review these resources and move them into your main configuration files.
+
+# __generated__ by Terraform
+resource "proxmox_virtual_environment_vm" "server-nixos" {
+  name          = "server-nixos"
+  node_name     = "pve"
+  scsi_hardware = "virtio-scsi-single"
+  vm_id         = 104
+  agent {
+    enabled = true
+    timeout = "15m"
+    trim    = false
+  }
+  cpu {
+    cores   = 4
+    numa    = false
+    sockets = 1
+    type    = "x86-64-v2-AES"
+    units   = 1024
+  }
+  disk {
+    aio               = "io_uring"
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi0"
+    iothread          = false
+    path_in_datastore = "vm-104-disk-0"
+    replicate         = true
+    size              = 32
+    ssd               = false
+  }
+  disk {
+    aio               = "io_uring"
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi1"
+    iothread          = false
+    path_in_datastore = "vm-104-disk-1"
+    replicate         = true
+    size              = 200
+    ssd               = false
+  }
+  disk {
+    aio               = "io_uring"
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi2"
+    iothread          = false
+    path_in_datastore = "vm-104-disk-2"
+    replicate         = true
+    size              = 200
+    ssd               = false
+  }
+  memory {
+    dedicated      = 4096
+    floating       = 2048
+    keep_hugepages = false
+    shared         = 0
+  }
+  network_device {
+    bridge       = "vmbr0"
+    disconnected = false
+    enabled      = true
+    firewall     = true
+  }
+  operating_system {
+    type = "l26"
+  }
+  lifecycle {
+    ignore_changes = [
+      vga,
+      keyboard_layout,
+      tablet_device,
+      agent,
+    ]
+  }
+
+}