feat(freeipa): add domain-controller setup — Rocky Linux 9 + FreeIPA 4.13

Installs and documents the FreeIPA identity management server at
domain-controller.sweet.home (VMID 108, pve1). Provides Kerberos,
LDAP, and integrated DNS for the SWEET.HOME realm.

New section: freeipa/
- docs/install.md: full step-by-step reproduction procedure including
  Proxmox VM prep (Rocky Linux 9 GenericCloud, SeaBIOS, cloud-init),
  swap setup, static IP, /etc/hosts fix, ipa-server-install flags
- docs/pihole-dns.md: how to configure Pi-hole to forward sweet.home
  queries to the FreeIPA BIND instance
- scripts/install.sh: idempotent install script with pre-flight checks;
  reads passwords from env or interactive prompt (never commits them)
- scripts/configure-pihole-dns.sh: idempotent Pi-hole forwarder setup
- scripts/verify.sh: read-only health check (13 checks, 0 side effects)
- CLAUDE.md: host guardrails for domain-controller

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Jbvxx4xbHVcx1NkK3vtmK

freeipa/scripts/configure-pihole-dns.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Configure Pi-hole to forward sweet.home DNS queries to FreeIPA.
+#
+# Usage:
+#   bash configure-pihole-dns.sh <pihole-host>
+#   bash configure-pihole-dns.sh pihole.sweet.home
+#
+# Idempotent — safe to run multiple times.
+# Requires SSH access to the Pi-hole host as a user with sudo.
+
+set -euo pipefail
+
+PIHOLE_HOST="${1:-}"
+IPA_IP="192.168.2.138"
+IPA_DOMAIN="sweet.home"
+DNSMASQ_CONF="/etc/dnsmasq.d/10-ipa-${IPA_DOMAIN//./-}.conf"
+DIRECTIVE="server=/${IPA_DOMAIN}/${IPA_IP}"
+
+if [[ -z "$PIHOLE_HOST" ]]; then
+  echo "Usage: $0 <pihole-host>" >&2
+  exit 1
+fi
+
+echo "==> Configuring Pi-hole at $PIHOLE_HOST to forward $IPA_DOMAIN → $IPA_IP..."
+
+ssh "$PIHOLE_HOST" "
+  set -euo pipefail
+
+  if grep -qF '${DIRECTIVE}' '${DNSMASQ_CONF}' 2>/dev/null; then
+    echo '==> Forwarder already configured, skipping write.'
+  else
+    echo '${DIRECTIVE}' | sudo tee '${DNSMASQ_CONF}'
+    echo '==> Written to ${DNSMASQ_CONF}'
+  fi
+
+  echo '==> Restarting Pi-hole DNS...'
+  sudo pihole restartdns
+
+  echo '==> Verifying SRV record resolution via Pi-hole...'
+  sleep 2
+  dig +short _kerberos._udp.${IPA_DOMAIN} SRV @127.0.0.1 || true
+"
+
+echo "==> Done. Pi-hole now forwards ${IPA_DOMAIN} queries to ${IPA_IP}."
+echo "    Verify from a LAN client:"
+echo "      dig +short _kerberos._udp.${IPA_DOMAIN} SRV @${PIHOLE_HOST}"