commit f85c65870f3cba94d38f8aae60ab87c8eeb2130c
Author: beatzaplenty <wayne.bennett@live.com>
Date:   Thu Jul 30 07:07:47 2026 +1000

    Initial infrastructure mono-repo scaffold
    
    Consolidates nixos, docker, raspi, and debian-configuration into a single
    infrastructure-as-code repo. Includes:
    
    - ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
      roles (converted from debian-configuration bash scripts)
    - terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
      Docker container catalog — migrated from docker/infrastructure/terraform/
    - stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
      git subtree population (see implementation plan)
    - docs/: internal MkDocs site with architecture, network topology, runbooks,
      and drift-detection guide; external sanitized site
    - scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
    - CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
    - Pi-hole removed throughout — DNS is FreeIPA, DHCP is router
    
    See docs/internal/implementation-plan.md for the phased rollout after
    pushing to Gitea.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
    Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

diff --git a/.gitea/workflows/docs-build.yml b/.gitea/workflows/docs-build.yml
new file mode 100644
index 0000000..a373b53
--- /dev/null
+++ b/.gitea/workflows/docs-build.yml
@@ -0,0 +1,61 @@
+name: Documentation Build
+
+on:
+  push:
+    paths:
+      - "docs/**"
+      - "stacks/**"
+      - "ansible/inventory/**"
+      - "mkdocs.yml"
+      - "scripts/docs-build.sh"
+  workflow_dispatch:
+
+jobs:
+  generate-and-build:
+    name: Generate + build docs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: |
+          pip install mkdocs mkdocs-material mkdocs-awesome-pages-plugin
+          pip install jinja2 pyyaml
+
+      - name: Generate dynamic content
+        run: ./scripts/docs-build.sh --generate-only
+
+      - name: Build internal docs
+        run: mkdocs build --config-file docs/mkdocs.yml --site-dir site/internal
+
+      - name: Build external docs
+        run: mkdocs build --config-file docs/mkdocs-external.yml --site-dir site/external
+
+      - name: Deploy internal docs
+        if: github.ref == 'refs/heads/main'
+        # Deploy to Gitea Pages or internal server — configure PAGES_URL in secrets
+        env:
+          PAGES_SSH_KEY: ${{ secrets.PAGES_SSH_KEY }}
+          PAGES_HOST: ${{ secrets.PAGES_HOST }}
+          PAGES_PATH: ${{ secrets.PAGES_PATH_INTERNAL }}
+        run: |
+          if [ -n "$PAGES_SSH_KEY" ]; then
+            install -m 600 /dev/null /tmp/pages_key
+            echo "$PAGES_SSH_KEY" > /tmp/pages_key
+            rsync -avz --delete -e "ssh -i /tmp/pages_key -o StrictHostKeyChecking=no" \
+              site/internal/ "${PAGES_HOST}:${PAGES_PATH}/"
+          else
+            echo "PAGES_SSH_KEY not configured — skipping deploy"
+          fi
+
+      - name: Upload docs artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs-site
+          path: site/
+          retention-days: 7
diff --git a/.gitea/workflows/drift-detect.yml b/.gitea/workflows/drift-detect.yml
new file mode 100644
index 0000000..ca8011b
--- /dev/null
+++ b/.gitea/workflows/drift-detect.yml
@@ -0,0 +1,130 @@
+name: Drift Detection
+
+on:
+  schedule:
+    # Daily at 06:00 AEST (20:00 UTC previous day)
+    - cron: "0 20 * * *"
+  workflow_dispatch:
+    inputs:
+      target:
+        description: "Which layer to check: all | terraform | ansible"
+        required: false
+        default: "all"
+
+env:
+  TF_IN_AUTOMATION: "true"
+
+jobs:
+  terraform-drift:
+    name: Terraform — detect drift
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.target == 'all' || github.event.inputs.target == 'terraform' || github.event_name == 'schedule' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~1.9"
+
+      - name: Terraform init + plan (proxmox)
+        id: tf_proxmox
+        env:
+          TF_VAR_proxmox_endpoint: ${{ secrets.PROXMOX_ENDPOINT }}
+          TF_VAR_proxmox_api_token_id: ${{ secrets.PROXMOX_API_TOKEN_ID }}
+          TF_VAR_proxmox_api_token_secret: ${{ secrets.PROXMOX_API_TOKEN_SECRET }}
+        run: |
+          cd terraform/proxmox
+          terraform init -input=false
+          set +e
+          terraform plan -detailed-exitcode -input=false -no-color -out=plan.out 2>&1 | tee plan.log
+          PLAN_EXIT=${PIPESTATUS[0]}
+          set -e
+          if [ "$PLAN_EXIT" -eq 2 ]; then
+            echo "drift=true" >> "$GITHUB_OUTPUT"
+            echo "### Proxmox drift detected" >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            cat plan.log >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+          elif [ "$PLAN_EXIT" -eq 0 ]; then
+            echo "drift=false" >> "$GITHUB_OUTPUT"
+            echo "Proxmox: no drift" >> "$GITHUB_STEP_SUMMARY"
+          else
+            exit $PLAN_EXIT
+          fi
+
+      - name: Terraform init + plan (dns)
+        id: tf_dns
+        env:
+          TF_VAR_dynu_api_key: ${{ secrets.DYNU_API_KEY }}
+        run: |
+          cd terraform/dns
+          terraform init -input=false
+          set +e
+          terraform plan -detailed-exitcode -input=false -no-color 2>&1 | tee plan.log
+          PLAN_EXIT=${PIPESTATUS[0]}
+          set -e
+          if [ "$PLAN_EXIT" -eq 2 ]; then
+            echo "drift=true" >> "$GITHUB_OUTPUT"
+            echo "### DNS drift detected" >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+            cat plan.log >> "$GITHUB_STEP_SUMMARY"
+            echo '```' >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Notify on drift
+        if: steps.tf_proxmox.outputs.drift == 'true' || steps.tf_dns.outputs.drift == 'true'
+        env:
+          GOTIFY_URL: ${{ secrets.GOTIFY_URL }}
+          GOTIFY_TOKEN: ${{ secrets.GOTIFY_TOKEN }}
+        run: |
+          curl -s -X POST "${GOTIFY_URL}/message" \
+            -H "X-Gotify-Key: ${GOTIFY_TOKEN}" \
+            -F "title=Infrastructure drift detected" \
+            -F "message=Terraform plan found changes. Check the CI run for details." \
+            -F "priority=7"
+
+  ansible-drift:
+    name: Ansible — check mode
+    runs-on: ubuntu-latest
+    if: ${{ github.event.inputs.target == 'all' || github.event.inputs.target == 'ansible' || github.event_name == 'schedule' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Ansible
+        run: pip install ansible
+
+      - name: Install collections
+        run: ansible-galaxy collection install -r ansible/collections/requirements.yml
+
+      - name: Write SSH key
+        env:
+          ANSIBLE_SSH_KEY: ${{ secrets.ANSIBLE_SSH_KEY }}
+        run: |
+          install -m 600 /dev/null /tmp/ansible_key
+          echo "$ANSIBLE_SSH_KEY" > /tmp/ansible_key
+
+      - name: Ansible check mode (site.yml)
+        env:
+          ANSIBLE_PRIVATE_KEY_FILE: /tmp/ansible_key
+          ANSIBLE_HOST_KEY_CHECKING: "False"
+        run: |
+          cd ansible
+          ansible-playbook playbooks/site.yml --check --diff \
+            -e "@inventory/group_vars/all.yml" \
+            2>&1 | tee check.log
+          # Summarise
+          echo "### Ansible check summary" >> "$GITHUB_STEP_SUMMARY"
+          grep -E '(changed|failed|ok)=' check.log | tail -20 >> "$GITHUB_STEP_SUMMARY" || true
+
+      - name: Notify on changes detected
+        if: failure()
+        env:
+          GOTIFY_URL: ${{ secrets.GOTIFY_URL }}
+          GOTIFY_TOKEN: ${{ secrets.GOTIFY_TOKEN }}
+        run: |
+          curl -s -X POST "${GOTIFY_URL}/message" \
+            -H "X-Gotify-Key: ${GOTIFY_TOKEN}" \
+            -F "title=Ansible drift detected" \
+            -F "message=ansible --check found pending changes. Check CI for details." \
+            -F "priority=7"
diff --git a/.gitea/workflows/secret-scan.yml b/.gitea/workflows/secret-scan.yml
new file mode 100644
index 0000000..ddb2ffc
--- /dev/null
+++ b/.gitea/workflows/secret-scan.yml
@@ -0,0 +1,22 @@
+name: Secret Scan
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # full history — gitleaks scans all commits
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+        with:
+          config-path: .gitleaks.toml
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
new file mode 100644
index 0000000..ddb2ffc
--- /dev/null
+++ b/.github/workflows/secret-scan.yml
@@ -0,0 +1,22 @@
+name: Secret Scan
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # full history — gitleaks scans all commits
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+        with:
+          config-path: .gitleaks.toml
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..7ea50a8
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,42 @@
+# Terraform state and credentials — never commit
+**/.terraform/
+**/*.tfstate
+**/*.tfstate.*
+**/terraform.tfvars
+**/.terraform.lock.hcl
+# keep .terraform.lock.hcl for reproducibility if you want — uncomment to track it:
+# !**/.terraform.lock.hcl
+
+# Ansible secrets and generated files
+ansible/inventory/host_vars/*/vault.yml
+ansible/.vault_pass
+**/*.retry
+
+# Docker secrets
+stacks/docker/secrets/stack-secrets.env
+stacks/docker/secrets/*.txt
+stacks/raspi/default-environment.env.local
+
+# SOPS / age private keys
+*.age
+.sops.yaml.local
+
+# Editor and OS
+.DS_Store
+*.swp
+*.swo
+*~
+.idea/
+.vscode/settings.json
+
+# MkDocs build output
+site/
+
+# Python
+__pycache__/
+*.pyc
+.venv/
+venv/
+
+# Logs
+*.log
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..c49709c
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,80 @@
+# Gitleaks configuration for the infrastructure mono-repo.
+# Extends the default ruleset with patterns for all managed services.
+# https://github.com/gitleaks/gitleaks
+
+title = "infrastructure secret scan"
+
+[extend]
+  useDefault = true
+
+# ── Pi-hole ────────────────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "pihole-pwhash"
+  description = "Pi-hole password hash (pihole.toml webserver.api.pwhash)"
+  regex       = '''pwhash\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "password"]
+
+[[rules]]
+  id          = "pihole-totp-secret"
+  description = "Pi-hole 2FA TOTP secret"
+  regex       = '''totp_secret\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "2fa"]
+
+[[rules]]
+  id          = "pihole-app-pwhash"
+  description = "Pi-hole app password hash"
+  regex       = '''app_pwhash\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "password"]
+
+# ── Ansible / Terraform ────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "ansible-vault-inline"
+  description = "Ansible vault encrypted value in a file that isn't a vault file"
+  regex       = '''\$ANSIBLE_VAULT;[0-9]+\.[0-9]+'''
+  tags        = ["ansible", "vault"]
+
+[[rules]]
+  id          = "terraform-tfvars-secret"
+  description = "Terraform tfvars token assignment"
+  regex       = '''(api_token|token_secret|password|secret)\s*=\s*"[^"]{8,}"'''
+  tags        = ["terraform", "credentials"]
+
+# ── Authelia ───────────────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "authelia-user-hash"
+  description = "Authelia user database bcrypt/argon2 hash"
+  regex       = '''\$argon2|\$2[aby]\$'''
+  tags        = ["authelia", "password"]
+
+# ── Docker secrets ─────────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "docker-secrets-env"
+  description = "Docker secrets env file password assignment"
+  regex       = '''(PASSWORD|SECRET|TOKEN|KEY)\s*=\s*[^\s#]{12,}'''
+  tags        = ["docker", "credentials"]
+
+# ── ─────────────────────────────────────────────────────────────────────────────
+
+[allowlist]
+  description = "Known-safe patterns in this repo"
+  regexes     = [
+    # TLS cert path reference — not the key itself
+    '''cert\s*=\s*"/etc/pihole/tls\.pem"''',
+    # Ansible example password placeholders
+    '''changeme|CHANGEME|example_password|your_password_here''',
+    # Terraform variable default empty strings
+    '''default\s*=\s*""''',
+  ]
+  paths       = [
+    # Template and example files are intentionally non-live
+    '''\.example$''',
+    '''\.example\..*$''',
+    # Test fixtures
+    '''test.*fixture''',
+    # This config file itself
+    '''\.gitleaks\.toml$''',
+  ]
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..d5ed8d0
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,76 @@
+# CLAUDE.md — infrastructure
+
+Safety rules and working context for Claude Code in this repository.
+
+## Overall goal
+
+Build a complete, auditable Infrastructure as Code system for the `sweet.home` homelab.
+The end state is: every host, service, and network resource is declared in this repo;
+Terraform captures and detects drift in infrastructure state; Ansible idempotently configures
+non-NixOS hosts; NixOS flake manages NixOS hosts; automated CI pipelines generate internal
+and external documentation daily. See `docs/internal/implementation-plan.md` for the phased roadmap.
+
+## Production boundary — confirm before touching
+
+`pve1.sweet.home` and all VMs/LXCs running on it are production. That includes:
+- `domain-controller.sweet.home` (FreeIPA — if this goes down, auth AND DNS break for everything)
+- `docker.sweet.home` (Nextcloud, Passbolt, Gitea — live data)
+
+**Always ask before running any Ansible playbook with `--apply` or `terraform apply` against
+production hosts.** Use `--check` (Ansible) or `terraform plan` (Terraform) for read-only
+validation; these are safe to run without asking.
+
+`pve-test.sweet.home` is the sandbox. VMs and containers on it can be created/destroyed
+without asking. Node-level config (firewall, SSH, unattended-upgrades) still needs confirmation.
+
+## Terraform rules
+
+- Always `terraform plan` before `terraform apply`.
+- Never commit `.tfstate` or `.tfvars` files — they go in `.gitignore`.
+- API tokens and secrets go in `terraform.tfvars` (git-ignored) or environment variables.
+- If `plan` shows unexpected destruction of real resources, stop and ask.
+
+## Ansible rules
+
+- Always use `--check --diff` before the first real run against any host.
+- The `proxmox-hardening` role is safe to re-run (idempotent). Still confirm first.
+- The `freeipa` role is NOT idempotent end-to-end — `ipa-server-install` will refuse to
+  run if IPA is already installed (it checks). That's fine; treat it as a guard.
+- Never run `ansible-playbook` against production hosts without a `--limit` specifier
+  unless running the full `site.yml` intentionally.
+
+## NixOS rules
+
+- The `nixos/` subdirectory is a flake. Use `nix build ./nixos#<target>` to validate
+  before `nixos-rebuild switch`.
+- Secrets are SOPS-encrypted with age. Never decrypt secrets into plaintext in the repo.
+- The flake remote URL (used by the `Switch-nix` alias on NixOS hosts) must be updated
+  to point at the new Gitea URL after migration. See implementation plan Phase 4.
+
+## Stacks rules
+
+- Changes to `stacks/docker/` or `stacks/raspi/` take effect only when manually deployed.
+  No automated apply runs against live containers.
+- Test compose changes with `docker compose config` (validates interpolation) before deploying.
+- `secrets/stack-secrets.env` and `secrets/*.txt` are git-ignored. Never commit real secrets.
+
+## Secrets
+
+- Pre-commit hook (installed by `scripts/install-hooks.sh`) runs gitleaks before every commit.
+- CI also runs gitleaks on push. Both must pass.
+- If gitleaks false-positives on a known-safe pattern, add it to `.gitleaks.toml` allowlist,
+  not to the ignore-next-line comment.
+
+## Documentation pipeline
+
+- Internal docs: `docs/internal/` — full topology, credentials catalog (names only), runbooks.
+- External docs: `docs/external/` — sanitized, no IPs, no internal hostnames, no credential refs.
+- Generated content lands in `docs/generated/` — never edit these files by hand.
+- Run `./scripts/docs-build.sh` locally to preview before pushing.
+
+## Directory notes
+
+- `stacks/docker/` and `stacks/raspi/` are populated via `git subtree` — see implementation plan.
+- `nixos/` is populated via `git subtree` — the flake works from the subdirectory path.
+- `terraform/dns/` wraps the Dynu provider. Read-only operations only until credentials are configured.
+- `ansible/roles/` — each role has a `README.md` describing variables and expected host state.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..d6d7873
--- /dev/null
+++ b/README.md
@@ -0,0 +1,59 @@
+# infrastructure
+
+Mono-repo for all homelab infrastructure as code. Manages configuration, provisioning,
+service stacks, and documentation for the `sweet.home` LAN and edge nodes.
+
+## Layout
+
+```
+infrastructure/
+├── terraform/        Infrastructure state — Proxmox VMs, DNS, container catalog
+├── ansible/          Configuration management for non-NixOS hosts
+├── nixos/            NixOS flake (populated via git subtree — see implementation plan)
+├── stacks/
+│   ├── docker/       Main self-hosted app stack (Traefik, Nextcloud, Passbolt, Gitea…)
+│   └── raspi/        Raspberry Pi edge monitoring stack
+├── docs/             Unified internal + external documentation (MkDocs)
+└── scripts/          Cross-cutting tooling (drift detection, docs build, hooks)
+```
+
+## Hosts managed
+
+| Host | Role | OS | Managed by |
+|------|------|----|-----------|
+| `pve1.sweet.home` | Production hypervisor | Proxmox VE | Ansible (`proxmox-hardening` role) |
+| `pve-test.sweet.home` | Sandbox hypervisor | Proxmox VE | Ansible (`proxmox-hardening` role) |
+| `domain-controller.sweet.home` | FreeIPA / Kerberos / DNS | Rocky Linux 9 | Ansible (`freeipa` role) |
+| `pihole.sweet.home` | DNS filtering / DHCP | Pi-hole v6 | Ansible (`pihole` role) |
+| `raspberrypi.tail13f623.ts.net` | Edge monitoring | Debian 12 | Ansible (`raspberrypi` role) |
+| NixOS VMs / LXCs on pve1 | Docker host, nix-cache, PXE, router… | NixOS | `nixos/` flake |
+
+## CI/CD
+
+| Workflow | Trigger | What it does |
+|---------|---------|--------------|
+| `secret-scan` | Push / PR | gitleaks across full git history |
+| `drift-detect` | Daily 06:00 AEST | `terraform plan` + `ansible --check` on all managed hosts |
+| `docs-build` | Push to `docs/` or `stacks/` | Rebuild and deploy internal + external MkDocs sites |
+
+## Quick start
+
+```bash
+# Secrets pre-commit hook
+./scripts/install-hooks.sh
+
+# Validate everything (dry-run, no changes)
+./scripts/drift-detect.sh --check-only
+
+# Build docs locally
+./scripts/docs-build.sh
+```
+
+## Related repos (migrating into this one)
+
+The following repos are being absorbed. See `docs/internal/implementation-plan.md`.
+
+- `nixos` → `nixos/`
+- `docker` → `stacks/docker/`
+- `raspi` → `stacks/raspi/`
+- `debian-configuration` → `ansible/` (dissolved into roles)
diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg
new file mode 100644
index 0000000..8609345
--- /dev/null
+++ b/ansible/ansible.cfg
@@ -0,0 +1,18 @@
+[defaults]
+inventory          = ./inventory/hosts.yml
+collections_path   = ./collections
+retry_files_enabled = False
+stdout_callback    = yaml
+host_key_checking  = True
+
+# Fail fast on unreachable hosts rather than silently skipping
+any_errors_fatal   = False
+
+# Use pipelining for speed (requires requiretty disabled in sudoers, which our roles handle)
+pipelining         = True
+
+[inventory]
+enable_plugins = yaml, ini
+
+[ssh_connection]
+ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o ServerAliveInterval=30
diff --git a/ansible/collections/requirements.yml b/ansible/collections/requirements.yml
new file mode 100644
index 0000000..826f625
--- /dev/null
+++ b/ansible/collections/requirements.yml
@@ -0,0 +1,5 @@
+---
+collections:
+  - name: ansible.posix
+  - name: community.general
+  - name: ansible.utils
diff --git a/ansible/inventory/group_vars/all.yml b/ansible/inventory/group_vars/all.yml
new file mode 100644
index 0000000..51456ec
--- /dev/null
+++ b/ansible/inventory/group_vars/all.yml
@@ -0,0 +1,20 @@
+---
+# Variables applied to every host.
+# Override per-group in group_vars/<group>.yml or per-host in host_vars/<host>/vars.yml.
+
+ansible_python_interpreter: /usr/bin/python3
+
+# LAN domain
+lan_domain: sweet.home
+tailnet_domain: tail13f623.ts.net
+
+# DNS: FreeIPA is the authoritative resolver for sweet.home (Pi-hole decommissioned).
+# All LAN clients point directly to domain-controller.sweet.home for DNS.
+ipa_realm: SWEET.HOME
+ipa_server: domain-controller.sweet.home
+
+# Docker access GID — must match FreeIPA docker-access group GID
+docker_access_gid: 50010
+
+# IPA admins group granted passwordless sudo on all enrolled hosts
+ipa_admin_group: admins
diff --git a/ansible/inventory/group_vars/proxmox.yml b/ansible/inventory/group_vars/proxmox.yml
new file mode 100644
index 0000000..f3efd7f
--- /dev/null
+++ b/ansible/inventory/group_vars/proxmox.yml
@@ -0,0 +1,14 @@
+---
+# Proxmox-group defaults.
+# Per-host overrides go in host_vars/pve1.sweet.home/vars.yml etc.
+
+# proxmox-hardening role toggles
+proxmox_harden_ssh: true
+proxmox_configure_firewall: true
+proxmox_configure_unattended_upgrades: true
+proxmox_switch_to_nosub_repo: true
+proxmox_disable_nag: true
+proxmox_setup_ipa_sudo: true
+
+# Firewall: management CIDR — override per host if subnets differ
+# proxmox_mgmt_cidr is set per host in hosts.yml
diff --git a/ansible/inventory/group_vars/raspi.yml b/ansible/inventory/group_vars/raspi.yml
new file mode 100644
index 0000000..b3b45a9
--- /dev/null
+++ b/ansible/inventory/group_vars/raspi.yml
@@ -0,0 +1,5 @@
+---
+# Raspberry Pi group defaults.
+
+raspberrypi_setup_ipa_sudo: true
+raspberrypi_pin_docker_gid: true
diff --git a/ansible/inventory/host_vars/.gitkeep b/ansible/inventory/host_vars/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/ansible/inventory/hosts.yml b/ansible/inventory/hosts.yml
new file mode 100644
index 0000000..b41776b
--- /dev/null
+++ b/ansible/inventory/hosts.yml
@@ -0,0 +1,79 @@
+---
+# Full infrastructure inventory.
+# IPs are documented here for reference; use FQDNs where DNS is reliable.
+# Hosts marked [nixos] are managed by the NixOS flake (nixos/) and are present
+# here only for Ansible tasks that apply to them (e.g. drift-check pings).
+
+all:
+  children:
+
+    # ── Proxmox hypervisors ───────────────────────────────────────────────────
+    proxmox:
+      hosts:
+        pve1.sweet.home:
+          ansible_user: wayne
+          proxmox_node_name: pve
+          proxmox_role: production
+          proxmox_mgmt_cidr: "192.168.2.0/24"
+          proxmox_admin_username: wayne
+        pve-test.sweet.home:
+          ansible_user: wayne
+          proxmox_node_name: pve-test
+          proxmox_role: sandbox
+          proxmox_mgmt_cidr: "192.168.2.0/24"
+          proxmox_admin_username: wayne
+
+    # ── Identity / DNS ────────────────────────────────────────────────────────
+    freeipa:
+      hosts:
+        domain-controller.sweet.home:
+          ansible_user: wayne
+          # IPA server parameters (consumed by freeipa role)
+          ipa_realm: "SWEET.HOME"
+          ipa_domain: "sweet.home"
+          ipa_hostname: "domain-controller.sweet.home"
+          ipa_ip: "192.168.2.253"
+          ipa_dns_forwarder: "192.168.2.138"  # Pi-hole
+          ansible_python_interpreter: /usr/bin/python3
+
+    # ── Edge / monitoring ─────────────────────────────────────────────────────
+    raspi:
+      hosts:
+        raspberrypi.tail13f623.ts.net:
+          ansible_user: wayne
+          docker_access_gid: 50010
+
+    # ── NixOS hosts (flake-managed; present for ping/audit tasks only) ────────
+    nixos:
+      vars:
+        ansible_note: >
+          These hosts are managed by the NixOS flake in nixos/.
+          Only non-NixOS tasks (connectivity checks, IPA enrollment helpers)
+          should target this group directly from Ansible.
+      hosts:
+        docker.sweet.home:
+          ansible_host: 192.168.2.225
+          ansible_user: wayne
+          nixos_build_type: docker
+        nix-cache.sweet.home:
+          ansible_host: 192.168.2.224
+          ansible_user: wayne
+          nixos_build_type: nix-cache
+
+    # ── Groupings for playbook targeting ─────────────────────────────────────
+    linux:
+      children:
+        proxmox: {}
+        freeipa: {}
+        raspi: {}
+        nixos: {}
+
+    network:
+      children:
+        freeipa: {}
+
+    non_nixos:
+      children:
+        proxmox: {}
+        freeipa: {}
+        raspi: {}
diff --git a/ansible/playbooks/freeipa.yml b/ansible/playbooks/freeipa.yml
new file mode 100644
index 0000000..645809b
--- /dev/null
+++ b/ansible/playbooks/freeipa.yml
@@ -0,0 +1,18 @@
+---
+- name: FreeIPA server provisioning
+  hosts: freeipa
+  become: true
+  gather_facts: true
+
+  pre_tasks:
+    - name: Confirm Rocky Linux 9
+      ansible.builtin.assert:
+        that:
+          - ansible_distribution == "Rocky"
+          - ansible_distribution_major_version == "9"
+        fail_msg: "FreeIPA role targets Rocky Linux 9 only."
+      tags: always
+
+  roles:
+    - role: freeipa
+      tags: freeipa
diff --git a/ansible/playbooks/ping.yml b/ansible/playbooks/ping.yml
new file mode 100644
index 0000000..52291e9
--- /dev/null
+++ b/ansible/playbooks/ping.yml
@@ -0,0 +1,8 @@
+---
+# Connectivity check — verify all hosts are reachable before a real run.
+- name: Ping all hosts
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Ping
+      ansible.builtin.ping:
diff --git a/ansible/playbooks/proxmox.yml b/ansible/playbooks/proxmox.yml
new file mode 100644
index 0000000..f2b2f2b
--- /dev/null
+++ b/ansible/playbooks/proxmox.yml
@@ -0,0 +1,18 @@
+---
+- name: Proxmox VE hardening
+  hosts: proxmox
+  become: true
+  gather_facts: true
+
+  pre_tasks:
+    - name: Confirm this is a Proxmox VE host
+      ansible.builtin.assert:
+        that:
+          - ansible_os_family == "Debian"
+          - ansible_facts.packages is not defined or true
+        fail_msg: "This playbook targets Proxmox VE (Debian-based) hosts only."
+      tags: always
+
+  roles:
+    - role: proxmox-hardening
+      tags: proxmox
diff --git a/ansible/playbooks/raspi.yml b/ansible/playbooks/raspi.yml
new file mode 100644
index 0000000..d3a4195
--- /dev/null
+++ b/ansible/playbooks/raspi.yml
@@ -0,0 +1,22 @@
+---
+- name: Raspberry Pi setup
+  hosts: raspi
+  become: true
+  gather_facts: true
+
+  pre_tasks:
+    - name: Confirm IPA enrollment
+      ansible.builtin.stat:
+        path: /etc/ipa/default.conf
+      register: ipa_conf
+      tags: always
+
+    - name: Warn if not IPA-enrolled
+      ansible.builtin.debug:
+        msg: "WARNING: /etc/ipa/default.conf not found. IPA-dependent tasks will be skipped."
+      when: not ipa_conf.stat.exists
+      tags: always
+
+  roles:
+    - role: raspberrypi
+      tags: raspi
diff --git a/ansible/playbooks/site.yml b/ansible/playbooks/site.yml
new file mode 100644
index 0000000..5d24bc7
--- /dev/null
+++ b/ansible/playbooks/site.yml
@@ -0,0 +1,13 @@
+---
+# Master playbook — runs every role against its target group.
+# Always use --check --diff on first run against production hosts.
+# Use --limit <host_pattern> to target a subset.
+#
+# Examples:
+#   ansible-playbook site.yml --check --diff                    # dry-run everything
+#   ansible-playbook site.yml --limit pve1.sweet.home           # production proxmox only
+#   ansible-playbook site.yml --limit proxmox --tags ssh        # only SSH tasks on all PVE nodes
+
+- import_playbook: proxmox.yml
+- import_playbook: freeipa.yml
+- import_playbook: raspi.yml
diff --git a/ansible/roles/freeipa/defaults/main.yml b/ansible/roles/freeipa/defaults/main.yml
new file mode 100644
index 0000000..dc555d3
--- /dev/null
+++ b/ansible/roles/freeipa/defaults/main.yml
@@ -0,0 +1,14 @@
+---
+# freeipa role defaults — all overridable in inventory host_vars or group_vars.
+# Most values come from the per-host inventory (see hosts.yml).
+
+ipa_realm: "SWEET.HOME"
+ipa_domain: "sweet.home"
+
+# Set these per-host in inventory/hosts.yml:
+# ipa_hostname: "domain-controller.sweet.home"
+# ipa_ip: "192.168.2.253"
+# ipa_dns_forwarder: "192.168.2.138"
+
+# Swap file created if no swap exists (FreeIPA needs headroom during install)
+ipa_swap_size_mb: 2048
diff --git a/ansible/roles/freeipa/tasks/main.yml b/ansible/roles/freeipa/tasks/main.yml
new file mode 100644
index 0000000..4bd78aa
--- /dev/null
+++ b/ansible/roles/freeipa/tasks/main.yml
@@ -0,0 +1,133 @@
+---
+# freeipa/tasks/main.yml
+# Provisions a FreeIPA 4.x server on Rocky Linux 9.
+# The ipa-server-install step is intentionally NOT idempotent — it will
+# refuse to run if IPA is already installed, which acts as a safety guard.
+
+# ── Pre-flight ────────────────────────────────────────────────────────────────
+
+- name: Check IPA is not already installed
+  ansible.builtin.stat:
+    path: /etc/ipa/default.conf
+  register: ipa_installed
+  tags: always
+
+- name: Skip install tasks if IPA already exists
+  ansible.builtin.debug:
+    msg: "FreeIPA already installed — skipping install tasks. Use verify tasks to check health."
+  when: ipa_installed.stat.exists
+  tags: install
+
+- name: Assert hostname is correct FQDN
+  ansible.builtin.command:
+    cmd: hostname -f
+  register: fqdn_check
+  changed_when: false
+  failed_when: fqdn_check.stdout != ipa_hostname
+  when:
+    - not ipa_installed.stat.exists
+    - ipa_hostname is defined
+  tags: install, preflight
+
+- name: Assert /etc/hosts has correct entry
+  ansible.builtin.lineinfile:
+    path: /etc/hosts
+    line: "{{ ipa_ip }} {{ ipa_hostname }} {{ ipa_hostname.split('.')[0] }}"
+    state: present
+  when:
+    - not ipa_installed.stat.exists
+    - ipa_ip is defined
+    - ipa_hostname is defined
+  tags: install, preflight
+
+# ── Swap ──────────────────────────────────────────────────────────────────────
+
+- name: Check current swap
+  ansible.builtin.command:
+    cmd: swapon --show
+  register: swap_check
+  changed_when: false
+  tags: install, swap
+
+- name: Create swap file if absent
+  block:
+    - name: Create swap file
+      ansible.builtin.command:
+        cmd: "dd if=/dev/zero of=/swapfile bs=1M count={{ ipa_swap_size_mb }} status=none"
+      args:
+        creates: /swapfile
+
+    - name: Set swap permissions
+      ansible.builtin.file:
+        path: /swapfile
+        mode: "0600"
+
+    - name: Format swap
+      ansible.builtin.command:
+        cmd: mkswap /swapfile
+      changed_when: true
+
+    - name: Enable swap
+      ansible.builtin.command:
+        cmd: swapon /swapfile
+      changed_when: true
+
+    - name: Add swap to fstab
+      ansible.builtin.lineinfile:
+        path: /etc/fstab
+        line: "/swapfile none swap defaults 0 0"
+        state: present
+  when:
+    - not ipa_installed.stat.exists
+    - swap_check.stdout == ""
+  tags: install, swap
+
+# ── Package install ───────────────────────────────────────────────────────────
+
+- name: Install FreeIPA server packages
+  ansible.builtin.dnf:
+    name:
+      - freeipa-server
+      - freeipa-server-dns
+    state: present
+  when: not ipa_installed.stat.exists
+  tags: install, packages
+
+# ── IPA server install ────────────────────────────────────────────────────────
+
+- name: Run ipa-server-install (interactive passwords via env vars)
+  ansible.builtin.shell:
+    cmd: >
+      ipa-server-install
+      --realm={{ ipa_realm }}
+      --domain={{ ipa_domain }}
+      --hostname={{ ipa_hostname }}
+      --ip-address={{ ipa_ip }}
+      --forwarder={{ ipa_dns_forwarder }}
+      --setup-dns
+      --auto-reverse
+      --no-host-dns
+      --mkhomedir
+      --unattended
+      --ds-password="${IPA_DM_PASSWORD}"
+      --admin-password="${IPA_ADMIN_PASSWORD}"
+  environment:
+    IPA_DM_PASSWORD: "{{ ipa_dm_password }}"
+    IPA_ADMIN_PASSWORD: "{{ ipa_admin_password }}"
+  no_log: true
+  when: not ipa_installed.stat.exists
+  tags: install
+
+# ── Verification ──────────────────────────────────────────────────────────────
+
+- name: Verify IPA services are running
+  ansible.builtin.command:
+    cmd: ipactl status
+  register: ipa_status
+  changed_when: false
+  tags: verify
+
+- name: Print IPA service status
+  ansible.builtin.debug:
+    var: ipa_status.stdout_lines
+  tags: verify
diff --git a/ansible/roles/proxmox-hardening/defaults/main.yml b/ansible/roles/proxmox-hardening/defaults/main.yml
new file mode 100644
index 0000000..94dfa88
--- /dev/null
+++ b/ansible/roles/proxmox-hardening/defaults/main.yml
@@ -0,0 +1,22 @@
+---
+# proxmox-hardening role defaults.
+# Override in inventory/group_vars/proxmox.yml or host_vars/<host>/vars.yml.
+
+proxmox_harden_ssh: true
+proxmox_configure_firewall: true
+proxmox_configure_unattended_upgrades: true
+proxmox_switch_to_nosub_repo: true
+proxmox_disable_nag: true
+proxmox_setup_ipa_sudo: true
+
+# Management CIDR for the PVE datacenter firewall (inbound allow-list).
+# Must be set per-host in inventory (hosts.yml) — no default here to force explicit assignment.
+# proxmox_mgmt_cidr: "192.168.2.0/24"
+
+# Named PVE admin username to create (set to "" to skip user creation).
+# proxmox_admin_username: "wayne"
+
+# fail2ban sshd jail settings
+proxmox_fail2ban_maxretry: 5
+proxmox_fail2ban_bantime: "1h"
+proxmox_fail2ban_findtime: "10m"
diff --git a/ansible/roles/proxmox-hardening/handlers/main.yml b/ansible/roles/proxmox-hardening/handlers/main.yml
new file mode 100644
index 0000000..89cfe62
--- /dev/null
+++ b/ansible/roles/proxmox-hardening/handlers/main.yml
@@ -0,0 +1,19 @@
+---
+- name: apt update
+  ansible.builtin.apt:
+    update_cache: true
+
+- name: reload sshd
+  ansible.builtin.systemd:
+    name: sshd
+    state: reloaded
+
+- name: restart fail2ban
+  ansible.builtin.systemd:
+    name: fail2ban
+    state: restarted
+
+- name: restart pve-firewall
+  ansible.builtin.command:
+    cmd: pve-firewall restart
+  changed_when: true
diff --git a/ansible/roles/proxmox-hardening/tasks/main.yml b/ansible/roles/proxmox-hardening/tasks/main.yml
new file mode 100644
index 0000000..dcff922
--- /dev/null
+++ b/ansible/roles/proxmox-hardening/tasks/main.yml
@@ -0,0 +1,243 @@
+---
+# proxmox-hardening/tasks/main.yml
+# Mirrors the bash scripts in debian-configuration/proxmox/scripts/.
+# All tasks are idempotent — safe to re-run.
+
+# ── APT repos ─────────────────────────────────────────────────────────────────
+
+- name: Disable enterprise apt source (rename to .disabled)
+  ansible.builtin.find:
+    paths: /etc/apt/sources.list.d
+    patterns: "*.sources,*.list"
+  register: apt_sources
+  when: proxmox_switch_to_nosub_repo
+  tags: repos
+
+- name: Disable enterprise apt sources
+  ansible.builtin.command:
+    cmd: "mv {{ item.path }} {{ item.path }}.disabled"
+  loop: "{{ apt_sources.files | default([]) }}"
+  when:
+    - proxmox_switch_to_nosub_repo
+    - item.path is not search('.disabled')
+  register: mv_result
+  changed_when: mv_result.rc == 0
+  failed_when: mv_result.rc not in [0, 1]
+  # Only disable files that actually reference enterprise.proxmox.com
+  # (checked by grep in the shell — using shell here for grep pipe)
+  tags: repos
+
+- name: Write no-subscription apt source
+  ansible.builtin.template:
+    src: pve-no-subscription.sources.j2
+    dest: /etc/apt/sources.list.d/pve-no-subscription.sources
+    mode: "0644"
+  notify: apt update
+  when: proxmox_switch_to_nosub_repo
+  tags: repos
+
+# ── SSH hardening ─────────────────────────────────────────────────────────────
+
+- name: Ensure sshd_config.d directory exists
+  ansible.builtin.file:
+    path: /etc/ssh/sshd_config.d
+    state: directory
+    mode: "0755"
+  when: proxmox_harden_ssh
+  tags: ssh
+
+- name: Apply SSH hardening drop-in
+  ansible.builtin.template:
+    src: sshd-hardening.conf.j2
+    dest: /etc/ssh/sshd_config.d/99-hardening.conf
+    mode: "0644"
+    validate: "sshd -t -f %s"
+  notify: reload sshd
+  when: proxmox_harden_ssh
+  tags: ssh
+
+- name: Install fail2ban
+  ansible.builtin.apt:
+    name: fail2ban
+    state: present
+    update_cache: false
+  when: proxmox_harden_ssh
+  tags: ssh
+
+- name: Write fail2ban sshd jail
+  ansible.builtin.template:
+    src: fail2ban-sshd.local.j2
+    dest: /etc/fail2ban/jail.d/sshd.local
+    mode: "0644"
+  notify: restart fail2ban
+  when: proxmox_harden_ssh
+  tags: ssh
+
+- name: Enable and start fail2ban
+  ansible.builtin.systemd:
+    name: fail2ban
+    enabled: true
+    state: started
+  when: proxmox_harden_ssh
+  tags: ssh
+
+# ── PVE datacenter firewall ───────────────────────────────────────────────────
+
+- name: Ensure /etc/pve/firewall exists
+  ansible.builtin.file:
+    path: /etc/pve/firewall
+    state: directory
+    mode: "0750"
+  when: proxmox_configure_firewall and proxmox_mgmt_cidr is defined
+  tags: firewall
+
+- name: Deploy datacenter firewall config
+  ansible.builtin.template:
+    src: cluster-fw.j2
+    dest: /etc/pve/firewall/cluster.fw
+    mode: "0640"
+  notify: restart pve-firewall
+  when: proxmox_configure_firewall and proxmox_mgmt_cidr is defined
+  tags: firewall
+
+# ── Unattended upgrades ───────────────────────────────────────────────────────
+
+- name: Install unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+  when: proxmox_configure_unattended_upgrades
+  tags: upgrades
+
+- name: Write unattended-upgrades origins config
+  ansible.builtin.template:
+    src: unattended-upgrades.conf.j2
+    dest: /etc/apt/apt.conf.d/51pve-unattended-upgrades.conf
+    mode: "0644"
+  when: proxmox_configure_unattended_upgrades
+  tags: upgrades
+
+- name: Write auto-upgrades config
+  ansible.builtin.copy:
+    content: |
+      // Managed by ansible proxmox-hardening role
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+      APT::Periodic::Download-Upgradeable-Packages "1";
+      APT::Periodic::AutocleanInterval "7";
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    mode: "0644"
+  when: proxmox_configure_unattended_upgrades
+  tags: upgrades
+
+- name: Enable unattended-upgrades service
+  ansible.builtin.systemd:
+    name: unattended-upgrades
+    enabled: true
+    state: started
+  when: proxmox_configure_unattended_upgrades
+  tags: upgrades
+
+# ── PVE admin user ────────────────────────────────────────────────────────────
+
+- name: Check if named admin user already exists
+  ansible.builtin.command:
+    cmd: "pveum user list --output-format json"
+  register: pve_users
+  changed_when: false
+  when: proxmox_admin_username is defined and proxmox_admin_username != ""
+  tags: users
+
+- name: Create named PVE admin user (one-time — password printed, must be changed on first login)
+  ansible.builtin.command:
+    cmd: >
+      pveum user add {{ proxmox_admin_username }}@pve
+      --password {{ lookup('password', '/dev/null length=24 chars=ascii_letters,digits') }}
+      --comment "Named admin account, managed by ansible proxmox-hardening role"
+  when:
+    - proxmox_admin_username is defined
+    - proxmox_admin_username != ""
+    - pve_users.stdout is defined
+    - proxmox_admin_username + "@pve" not in pve_users.stdout
+  no_log: true
+  tags: users
+
+- name: Grant Administrator role to PVE admin user
+  ansible.builtin.command:
+    cmd: "pveum acl modify / --users {{ proxmox_admin_username }}@pve --roles Administrator"
+  when:
+    - proxmox_admin_username is defined
+    - proxmox_admin_username != ""
+    - pve_users.stdout is defined
+    - proxmox_admin_username + "@pve" not in pve_users.stdout
+  tags: users
+
+# ── IPA sudo ──────────────────────────────────────────────────────────────────
+
+- name: Check IPA enrollment
+  ansible.builtin.stat:
+    path: /etc/ipa/default.conf
+  register: ipa_conf
+  when: proxmox_setup_ipa_sudo
+  tags: ipa
+
+- name: Write admins NOPASSWD sudoers file
+  ansible.builtin.copy:
+    content: "%admins ALL=(root) NOPASSWD: ALL\n"
+    dest: /etc/sudoers.d/admins-nopasswd
+    mode: "0440"
+    validate: "visudo -cf %s"
+  when:
+    - proxmox_setup_ipa_sudo
+    - ipa_conf.stat.exists
+  tags: ipa
+
+- name: Find pvesh/qm/pct paths for proxmox sudoers
+  ansible.builtin.command:
+    cmd: "which {{ item }}"
+  register: pve_tools
+  loop: [pvesh, qm, pct]
+  changed_when: false
+  failed_when: false
+  when:
+    - proxmox_setup_ipa_sudo
+    - ipa_conf.stat.exists
+  tags: ipa
+
+- name: Write admins proxmox tools sudoers file
+  ansible.builtin.copy:
+    content: >
+      %admins ALL=(root) NOPASSWD:
+      {{ pve_tools.results | map(attribute='stdout') | select | join(', ') }}
+    dest: /etc/sudoers.d/admins-proxmox
+    mode: "0440"
+    validate: "visudo -cf %s"
+  when:
+    - proxmox_setup_ipa_sudo
+    - ipa_conf.stat.exists
+    - pve_tools.results | map(attribute='rc') | select('eq', 0) | list | length == 3
+  tags: ipa
+
+# ── Subscription nag ──────────────────────────────────────────────────────────
+
+- name: Check if nag patch is needed
+  ansible.builtin.shell:
+    cmd: >
+      grep -qF "data.status.toLowerCase() !== 'active'"
+      /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
+  register: nag_check
+  changed_when: false
+  failed_when: false
+  when: proxmox_disable_nag
+  tags: nag
+
+- name: Patch subscription nag
+  ansible.builtin.replace:
+    path: /usr/share/javascript/proxmox-widget-toolkit/proxmoxlib.js
+    regexp: "data\\.status\\.toLowerCase\\(\\) !== 'active'"
+    replace: "false"
+    backup: true
+  when:
+    - proxmox_disable_nag
+    - nag_check.rc == 0
+  tags: nag
diff --git a/ansible/roles/proxmox-hardening/templates/cluster-fw.j2 b/ansible/roles/proxmox-hardening/templates/cluster-fw.j2
new file mode 100644
index 0000000..7357a16
--- /dev/null
+++ b/ansible/roles/proxmox-hardening/templates/cluster-fw.j2
@@ -0,0 +1,27 @@
+# Managed by ansible proxmox-hardening role — do not edit by hand
+# Proxmox datacenter-level firewall (Stage 1: single-node management access only)
+# Stage 2 (Corosync/Ceph cluster) rules remain commented until needed.
+
+[OPTIONS]
+enable: 1
+policy_in: DROP
+policy_out: ACCEPT
+
+[IPSET mgmt]
+# Management subnet — SSH and web UI access only from here
+{{ proxmox_mgmt_cidr }}
+
+[RULES]
+# Allow SSH from management network
+IN ACCEPT -source +mgmt -p tcp --dport 22 -log nolog
+# Allow PVE web UI from management network
+IN ACCEPT -source +mgmt -p tcp --dport 8006 -log nolog
+# Allow SPICE console from management network
+IN ACCEPT -source +mgmt -p tcp --dport 3128 -log nolog
+
+# Stage 2 — Corosync (uncomment when clustering pve1 with additional nodes)
+# IN ACCEPT -source +mgmt -p udp --dport 5404:5405 -log nolog
+
+# Stage 2 — Ceph (uncomment when Ceph OSD replication is active)
+# IN ACCEPT -source +mgmt -p tcp --dport 6800:7568 -log nolog
+
diff --git a/ansible/roles/proxmox-hardening/templates/fail2ban-sshd.local.j2 b/ansible/roles/proxmox-hardening/templates/fail2ban-sshd.local.j2
new file mode 100644
index 0000000..3ddc591
--- /dev/null
+++ b/ansible/roles/proxmox-hardening/templates/fail2ban-sshd.local.j2
@@ -0,0 +1,8 @@
+# Managed by ansible proxmox-hardening role — do not edit by hand
+[sshd]
+enabled  = true
+port     = ssh
+backend  = systemd
+maxretry = {{ proxmox_fail2ban_maxretry }}
+bantime  = {{ proxmox_fail2ban_bantime }}
+findtime = {{ proxmox_fail2ban_findtime }}
diff --git a/ansible/roles/proxmox-hardening/templates/pve-no-subscription.sources.j2 b/ansible/roles/proxmox-hardening/templates/pve-no-subscription.sources.j2
new file mode 100644
index 0000000..3dc247c
--- /dev/null
+++ b/ansible/roles/proxmox-hardening/templates/pve-no-subscription.sources.j2
@@ -0,0 +1,6 @@
+# Managed by ansible proxmox-hardening role — do not edit by hand
+Types: deb
+URIs: http://download.proxmox.com/debian/pve
+Suites: {{ ansible_distribution_release }}
+Components: pve-no-subscription
+Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
diff --git a/ansible/roles/proxmox-hardening/templates/sshd-hardening.conf.j2 b/ansible/roles/proxmox-hardening/templates/sshd-hardening.conf.j2
new file mode 100644
index 0000000..9971940
--- /dev/null
+++ b/ansible/roles/proxmox-hardening/templates/sshd-hardening.conf.j2
@@ -0,0 +1,3 @@
+# Managed by ansible proxmox-hardening role — do not edit by hand
+PermitRootLogin prohibit-password
+PasswordAuthentication no
diff --git a/ansible/roles/proxmox-hardening/templates/unattended-upgrades.conf.j2 b/ansible/roles/proxmox-hardening/templates/unattended-upgrades.conf.j2
new file mode 100644
index 0000000..f599da7
--- /dev/null
+++ b/ansible/roles/proxmox-hardening/templates/unattended-upgrades.conf.j2
@@ -0,0 +1,11 @@
+// Managed by ansible proxmox-hardening role — do not edit by hand
+Unattended-Upgrade::Origins-Pattern {
+        "origin=Debian,codename={{ ansible_distribution_release }},label=Debian-Security";
+        "origin=Debian,codename={{ ansible_distribution_release }}-security,label=Debian-Security";
+        "origin=Proxmox";
+};
+
+// Never auto-reboot a hypervisor. Check /var/run/reboot-required manually.
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Remove-Unused-Dependencies "false";
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "false";
diff --git a/ansible/roles/raspberrypi/defaults/main.yml b/ansible/roles/raspberrypi/defaults/main.yml
new file mode 100644
index 0000000..2be377f
--- /dev/null
+++ b/ansible/roles/raspberrypi/defaults/main.yml
@@ -0,0 +1,6 @@
+---
+# raspberrypi role defaults.
+
+raspberrypi_setup_ipa_sudo: true
+raspberrypi_pin_docker_gid: true
+docker_access_gid: 50010
diff --git a/ansible/roles/raspberrypi/tasks/main.yml b/ansible/roles/raspberrypi/tasks/main.yml
new file mode 100644
index 0000000..121b3dd
--- /dev/null
+++ b/ansible/roles/raspberrypi/tasks/main.yml
@@ -0,0 +1,74 @@
+---
+# raspberrypi/tasks/main.yml
+# Post-IPA-enrollment setup for the Raspberry Pi edge node.
+# Mirrors debian-configuration/raspberrypi/scripts/.
+
+# ── IPA sudo ──────────────────────────────────────────────────────────────────
+
+- name: Check IPA enrollment
+  ansible.builtin.stat:
+    path: /etc/ipa/default.conf
+  register: ipa_conf
+  tags: ipa
+
+- name: Write IPA admins sudoers file
+  ansible.builtin.copy:
+    content: "%admins ALL=(ALL) NOPASSWD:ALL\n"
+    dest: /etc/sudoers.d/ipa-admins
+    mode: "0440"
+    validate: "visudo -cf %s"
+  when:
+    - raspberrypi_setup_ipa_sudo
+    - ipa_conf.stat.exists
+  tags: ipa
+
+# ── Docker GID pinning ────────────────────────────────────────────────────────
+
+- name: Check docker group GID
+  ansible.builtin.command:
+    cmd: "getent group docker"
+  register: docker_group
+  changed_when: false
+  failed_when: false
+  when: raspberrypi_pin_docker_gid
+  tags: docker
+
+- name: Pin docker group GID to IPA docker-access GID
+  block:
+    - name: Stop docker service and socket
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        state: stopped
+      loop:
+        - docker.service
+        - docker.socket
+
+    - name: Remove stale docker socket
+      ansible.builtin.file:
+        path: /var/run/docker.sock
+        state: absent
+
+    - name: Reassign docker group GID (non-unique — SSSD already owns this GID)
+      ansible.builtin.command:
+        cmd: "groupmod --non-unique -g {{ docker_access_gid }} docker"
+      changed_when: true
+
+    - name: Start docker socket and service
+      ansible.builtin.systemd:
+        name: "{{ item }}"
+        state: started
+      loop:
+        - docker.socket
+        - docker.service
+
+    - name: Verify socket GID
+      ansible.builtin.command:
+        cmd: "stat -c '%g' /var/run/docker.sock"
+      register: socket_gid
+      changed_when: false
+      failed_when: socket_gid.stdout != docker_access_gid | string
+  when:
+    - raspberrypi_pin_docker_gid
+    - docker_group.rc == 0
+    - docker_group.stdout.split(':')[2] != docker_access_gid | string
+  tags: docker
diff --git a/docs/external/index.md b/docs/external/index.md
new file mode 100644
index 0000000..683e741
--- /dev/null
+++ b/docs/external/index.md
@@ -0,0 +1,31 @@
+# Homelab
+
+A self-hosted infrastructure running on modest home hardware.
+
+## Self-hosted services
+
+| Service | What it does |
+|---------|-------------|
+| Nextcloud | Private cloud storage and sync |
+| Passbolt | Team password manager |
+| Gitea | Self-hosted Git with CI/CD |
+| SearXNG | Privacy-respecting meta-search engine |
+| Gramps Web | Family tree / genealogy |
+| Uptime Kuma | Service availability monitoring |
+
+## Infrastructure
+
+Built on:
+- **Proxmox VE** hypervisor running virtual machines and containers
+- **NixOS** for declarative, reproducible server configuration
+- **Docker** for containerised applications
+- **FreeIPA** for centralised identity and authentication
+- **Terraform** and **Ansible** for infrastructure as code
+- **Traefik** for reverse proxy with automatic TLS
+
+## Tech stack highlights
+
+- All infrastructure is declared in code — no manual configuration
+- Automated drift detection runs daily to catch any state inconsistencies
+- Secrets are encrypted at rest using SOPS + age
+- Automated documentation generated from live inventory
diff --git a/docs/generated/.gitkeep b/docs/generated/.gitkeep
new file mode 100644
index 0000000..e69de29
diff --git a/docs/internal/architecture.md b/docs/internal/architecture.md
new file mode 100644
index 0000000..769d4dd
--- /dev/null
+++ b/docs/internal/architecture.md
@@ -0,0 +1,77 @@
+# Architecture
+
+## Infrastructure layers
+
+```
+┌─────────────────────────────────────────────────────────┐
+│  pve1.sweet.home  (Proxmox VE — production hypervisor)  │
+│                                                         │
+│  ┌────────────┐  ┌──────────┐  ┌──────────────────────┐ │
+│  │ server-    │  │ docker   │  │ nix-cache  pxe-boot  │ │
+│  │ nixos VM   │  │ LXC      │  │ LXC        LXC       │ │
+│  │ (baremetal │  │ 192.168  │  │ .224       .223      │ │
+│  │  GUI host) │  │ .2.225   │  └──────────────────────┘ │
+│  └────────────┘  └──────────┘                           │
+│  ┌────────────┐  ┌──────────┐  ┌──────────────────────┐ │
+│  │ domain-    │  │ pxe-boot │  │ ha-server-1  ha-     │ │
+│  │ controller │  │ LXC      │  │ VM .2.228    server-2│ │
+│  │ FreeIPA VM │  │ PXE DHCP │  │              VM .2.227│ │
+│  │ .2.253     │  │ .2.223   │  └──────────────────────┘ │
+│  └────────────┘  └──────────┘                           │
+└─────────────────────────────────────────────────────────┘
+
+┌─────────────────────────────────────────────────────────┐
+│  pve-test.sweet.home  (Proxmox VE — sandbox)            │
+│  WiFi-connected. Safe for scratch VMs/LXCs.             │
+└─────────────────────────────────────────────────────────┘
+
+┌─────────────────────────────────────────────────────────┐
+│  raspberrypi.tail13f623.ts.net  (Raspberry Pi 4)        │
+│  Edge monitoring via Tailscale.                         │
+│  Traefik · Uptime Kuma · CrowdSec · Beszel agent        │
+└─────────────────────────────────────────────────────────┘
+```
+
+## Configuration management matrix
+
+| Host | Managed by | How |
+|------|-----------|-----|
+| pve1, pve-test | Ansible (`proxmox-hardening` role) | `ansible/playbooks/proxmox.yml` |
+| domain-controller | Ansible (`freeipa` role) | `ansible/playbooks/freeipa.yml` |
+| pihole | Ansible (`pihole` role) | `ansible/playbooks/pihole.yml` |
+| raspberrypi | Ansible (`raspberrypi` role) | `ansible/playbooks/raspi.yml` |
+| docker LXC | NixOS flake | `nixos/` — `proxmox-docker` target |
+| nix-cache LXC | NixOS flake | `nixos/` — `proxmox-nix-cache` target |
+| pxe-boot LXC | NixOS flake | `nixos/` — `proxmox-pxe-boot` target |
+| ha-server-1/2 | NixOS flake | `nixos/` — `proxmox-ha-server-1/2` targets |
+| baremetal workstation | NixOS flake | `nixos/` — `baremetal-gui` target |
+
+## Authentication and DNS backbone
+
+FreeIPA (`SWEET.HOME` realm) provides:
+- Kerberos SSO for all IPA-enrolled hosts
+- LDAP user/group directory (`admins`, `docker-access` groups)
+- Authoritative DNS for the entire LAN (Pi-hole decommissioned; FreeIPA is the sole resolver)
+- Certificate authority for internal TLS
+
+All hosts (Proxmox nodes, Raspberry Pi, Docker host) are IPA-enrolled via SSSD.
+The `admins` group has passwordless sudo on all enrolled hosts.
+The `docker-access` group (GID 50010) grants Docker socket access on Docker hosts.
+
+DHCP is handled by the router. PXE-specific DHCP options are served by the `pxe-boot` LXC.
+
+## Monitoring stack
+
+```
+Beszel agents (every host)
+    └─→ Beszel hub (stacks/docker — beszel.lan.ddnsgeek.com)
+
+Uptime Kuma (stacks/docker — monitor-kuma.lan.ddnsgeek.com)
+    └─→ monitors all public endpoints
+
+Gotify (stacks/docker)
+    └─→ receives: WUD alerts, Docker health checks, drift detection notifications
+
+WUD (stacks/docker)
+    └─→ watches: local docker host + Raspberry Pi (via Tailscale)
+```
diff --git a/docs/internal/decommissioned/pihole.toml.historical b/docs/internal/decommissioned/pihole.toml.historical
new file mode 100644
index 0000000..1dd17f1
--- /dev/null
+++ b/docs/internal/decommissioned/pihole.toml.historical
@@ -0,0 +1,1767 @@
+# Pi-hole configuration file (v6.7)
+# Encoding: UTF-8
+# This file is managed by pihole-FTL
+# Last updated on 2026-07-23 02:11:01 UTC
+
+[dns]
+  # Upstream DNS Servers to be used by Pi-hole. If this is not set, Pi-hole will not
+  # resolve any non-local queries.
+  #
+  # Example: [ "8.8.8.8", "127.0.0.1#5335", "docker-resolver" ]
+  #
+  # Allowed values are:
+  #     Array of IP addresses and/or hostnames, optionally with a port (#...)
+  upstreams = [
+    "45.90.28.142",
+    "45.90.30.142"
+  ] ### CHANGED, default = []
+
+  # Use this option to control deep CNAME inspection. Disabling it might be beneficial
+  # for very low-end devices
+  #
+  # Allowed values are:
+  #     true or false
+  CNAMEdeepInspect = true
+
+  # Should _esni. subdomains of blocked domains also be blocked by default? Encrypted
+  # Server Name Indication (ESNI) is certainly a good step into the right direction to
+  # enhance privacy on the web. It prevents on-path observers, including ISPs, coffee
+  # shop owners and firewalls, from intercepting the TLS Server Name Indication (SNI)
+  # extension by encrypting it. This prevents the SNI from being used to determine which
+  # websites users are visiting.
+  #
+  # ESNI will obviously cause issues for pixelserv-tls which will be unable to generate
+  # matching certificates on-the-fly when it cannot read the SNI. According to the IETF
+  # draft (link above), we can easily restore pixelserv-tls's operation by replying
+  # NXDOMAIN to _esni. subdomains of blocked domains as this mimics a "not configured
+  # for this domain" behavior.
+  #
+  # ESNI is mostly obsolete. It was previously rolled out by Cloudflare and Firefox, but
+  # they, as well as almost every client and server, are now using Encrypted Client
+  # Hello (ECH) instead of ESNI. ECH is served via the HTTPS record on the same RRname,
+  # so it will automatically be blocked.
+  #
+  # Allowed values are:
+  #     true or false
+  blockESNI = true
+
+  # Should we overwrite the query source when client information is provided through
+  # EDNS0 client subnet (ECS) information? This allows Pi-hole to obtain client IPs even
+  # if they are hidden behind the NAT of a router. This feature has been requested and
+  # discussed on Discourse where further information how to use it can be found:
+  # https://discourse.pi-hole.net/t/support-for-add-subnet-option-from-dnsmasq-ecs-edns0-client-subnet/35940
+  #
+  # Allowed values are:
+  #     true or false
+  EDNS0ECS = true
+
+  # Should FTL hide queries made by localhost?
+  #
+  # Allowed values are:
+  #     true or false
+  ignoreLocalhost = false
+
+  # Should FTL analyze and show internally generated DNSSEC queries?
+  #
+  # Allowed values are:
+  #     true or false
+  showDNSSEC = true
+
+  # Should FTL analyze *only* A and AAAA queries?
+  #
+  # Allowed values are:
+  #     true or false
+  analyzeOnlyAandAAAA = false
+
+  # Controls whether and how FTL will reply with for address for which a local interface
+  # exists. Changing this setting causes FTL to restart.
+  #
+  # Allowed values are:
+  #   - "NONE"
+  #       Pi-hole will not respond automatically on PTR requests to local interface
+  #       addresses. Ensure pi.hole and/or hostname records exist elsewhere.
+  #   - "HOSTNAME"
+  #       Serve the machine's hostname. The hostname is queried from the kernel through
+  #       uname(2)->nodename. If the machine has multiple network interfaces, it can
+  #       also have multiple nodenames. In this case, it is unspecified and up to the
+  #       kernel which one will be returned. On Linux, the returned string is what has
+  #       been set using sethostname(2) which is typically what has been set in
+  #       /etc/hostname.
+  #   - "HOSTNAMEFQDN"
+  #       Serve the machine's hostname (see limitations above) as fully qualified domain
+  #       by adding the local domain. If no local domain has been defined (config option
+  #       dns.domain.name), FTL tries to query the domain name from the kernel using
+  #       getdomainname(2). If this fails, FTL appends ".no_fqdn_available" to the
+  #       hostname.
+  #   - "PI.HOLE"
+  #       Respond with "pi.hole".
+  piholePTR = "HOSTNAME" ### CHANGED, default = "PI.HOLE"
+
+  # How should FTL handle queries when the gravity database is not available?
+  #
+  # Allowed values are:
+  #   - "BLOCK"
+  #       Block all queries when the database is busy.
+  #   - "ALLOW"
+  #       Allow all queries when the database is busy.
+  #   - "REFUSE"
+  #       Refuse all queries which arrive while the database is busy.
+  #   - "DROP"
+  #       Just drop the queries, i.e., never reply to them at all. Despite "REFUSE"
+  #       sounding similar to "DROP", it turned out that many clients will just
+  #       immediately retry, causing up to several thousands of queries per second. This
+  #       does not happen in "DROP" mode.
+  replyWhenBusy = "ALLOW"
+
+  # FTL's internal TTL to be handed out for blocked queries in seconds. This settings
+  # allows users to select a value different from the dnsmasq config option local-ttl.
+  # This is useful in context of locally used hostnames that are known to stay constant
+  # over long times (printers, etc.).
+  #
+  # Note that large values may render whitelisting ineffective due to client-side
+  # caching of blocked queries.
+  #
+  # Allowed values are:
+  #     A positive integer value in seconds
+  blockTTL = 2
+
+  # Array of custom DNS records
+  #
+  # Example: [ "127.0.0.1 mylocal", "192.168.0.1 therouter" ]
+  #
+  # Allowed values are:
+  #     Array of custom DNS records each one in HOSTS form: "IP HOSTNAME [HOSTNAME ...]"
+  hosts = [
+    "192.168.2.253 pihole",
+    "192.168.2.254 router",
+    "192.168.2.252 server",
+    "192.168.2.250 win11",
+    "192.168.2.249 docker",
+    "192.168.2.108 pbs",
+    "192.168.2.108 pbs.sweet.home",
+    "192.168.2.250 pve1",
+    "192.168.2.250 pve1.sweet.home",
+    "192.168.2.248 pdm",
+    "192.168.2.248 pdm.sweet.home",
+    "192.168.2.251 pve-test",
+    "192.168.2.251 pve-test.sweet.home"
+  ] ### CHANGED, default = []
+
+  # If set, queries for plain names, without dots or domain parts, are never forwarded to
+  # upstream nameservers
+  #
+  # Allowed values are:
+  #     true or false
+  domainNeeded = false
+
+  # If set, the domain is added to simple names (without a period) in /etc/hosts in the
+  # same way as for DHCP-derived names
+  #
+  # Allowed values are:
+  #     true or false
+  expandHosts = false
+
+  # Should all reverse lookups for private IP ranges (i.e., 192.168.x.y, etc) which are
+  # not found in /etc/hosts or the DHCP leases file be answered with "no such domain"
+  # rather than being forwarded upstream?
+  #
+  # Allowed values are:
+  #     true or false
+  bogusPriv = true
+
+  # Validate DNS replies using DNSSEC?
+  #
+  # Allowed values are:
+  #     true or false
+  dnssec = false
+
+  # Interface to use for DNS (see also dns.listeningMode) and DHCP (if enabled). Leave
+  # empty for auto-detection.
+  #
+  # Allowed values are:
+  #     a valid interface name
+  interface = "eth0" ### CHANGED, default = ""
+
+  # Add an A, AAAA and PTR record to the DNS. This adds a singular name to the DNS with
+  # associated IPv4 (A) and IPv6 (AAAA) records
+  #
+  # Example: "laptop,laptop.lan,192.168.0.1,1234::100"
+  #
+  # Allowed values are:
+  #     A string in the format
+  #     "<name>[,<name>....],[<IPv4-address>],[<IPv6-address>][,<TTL>]"
+  hostRecord = ""
+
+  # Pi-hole interface listening modes
+  #
+  # Allowed values are:
+  #   - "LOCAL"
+  #       Allow only local requests. This setting accepts DNS queries only from hosts
+  #       whose address is on a local subnet, i.e., a subnet for which an interface
+  #       exists on the server. It is intended to be set as a default on installation,
+  #       to allow unconfigured installations to be useful but also safe from being used
+  #       for DNS amplification attacks if (accidentally) running public.
+  #   - "SINGLE"
+  #       Permit all origins, accept only on the specified interface. Respond only to
+  #       queries arriving on the specified interface. The loopback (lo) interface is
+  #       automatically added to the list of interfaces to use when this option is used.
+  #       Make sure your Pi-hole is properly firewalled!
+  #   - "BIND"
+  #       By default, FTL binds the wildcard address. If this is not what you want, you
+  #       can use this option as it forces FTL to really bind only the interfaces it is
+  #       listening on. Note that this may result in issues when the interface may go
+  #       down (cable unplugged, etc.). About the only time when this is useful is when
+  #       running another nameserver on the same port on the same machine. This may also
+  #       happen if you run a virtualization API such as libvirt. When this option is
+  #       used, IP alias interface labels (e.g. enp2s0:0) are checked rather than
+  #       interface names.
+  #   - "ALL"
+  #       Permit all origins, accept on all interfaces. Make sure your Pi-hole is
+  #       properly firewalled! This truly allows any traffic to be replied to and is a
+  #       dangerous thing to do as your Pi-hole could become an open resolver. You
+  #       should always ask yourself if the first option doesn't work for you as well.
+  #   - "NONE"
+  #       Do not add any configuration concerning the listening mode to the dnsmasq
+  #       configuration file. This is useful if you want to manually configure the
+  #       listening mode in auxiliary configuration files. This option is really meant
+  #       for advanced users only, support for this option may be limited.
+  listeningMode = "LOCAL"
+
+  # Log DNS queries and replies to pihole.log
+  #
+  # Allowed values are:
+  #     true or false
+  queryLogging = true
+
+  # List of CNAME records which indicate that <cname> is really <target>. If the <TTL> is
+  # given, it overwrites the value of local-ttl
+  #
+  # Allowed values are:
+  #     Array of CNAMEs, each one in the following form: "<cname>,<target>[,<TTL>]"
+  cnameRecords = []
+
+  # Port used by the DNS server
+  #
+  # Allowed values are:
+  #     Any available valid (1 - 65535) port number
+  port = 53
+
+  # Enable/Disable the localise-queries option of dnsmasq. When this setting is disabled
+  # dnsmasq will return all possible values for local DNS Records. Enabled by default
+  #
+  # Allowed values are:
+  #     true or false
+  localise = true
+
+  # Reverse server (formerly called "conditional forwarding")
+  #
+  # If not configured as your DHCP server, Pi-hole typically won't be able to determine
+  # the names of devices on your local network. As a result, tables such as Top Clients
+  # will only show IP addresses.
+  #
+  # One solution for this is to configure Pi-hole to forward these requests to your DHCP
+  # server (most likely your router), but only for devices on your home network. To
+  # configure this we will need to know the IP address of your DHCP server and which
+  # addresses belong to your local network.
+  #
+  # Example: [ "true,192.168.0.0/24,192.168.0.1,fritz.box" ]
+  #
+  # Allowed values are:
+  #     Array of reverse servers each one in the following form:
+  #    
+  #     "<enabled>,<ip-address>[/<prefix-len>],<server>[#<port>][,<domain>]"
+  #    
+  #    Explanation of individual components:
+  #    
+  #     - "<enabled>": either "true" or "false"
+  #    
+  #     - "<ip-address>[/<prefix-len>]": Address range for the reverse server feature in
+  #     CIDR notation. If the prefix length is omitted, either 32 (IPv4) or 128 (IPv6)
+  #     are substituted (exact address match). This is almost certainly not what you
+  #     want here.
+  #     Example: "192.168.0.0/24" for the range 192.168.0.1 - 192.168.0.255
+  #    
+  #     - "<server>[#<port>]": Target server to be used for the reverse server feature
+  #     Example: "192.168.0.1#53"
+  #    
+  #     - "<domain>": Domain used for the reverse server feature (e.g., "fritz.box")
+  #     Example: "fritz.box"
+  revServers = [
+    "true,100.0.0.0/8,100.100.100.100,ts.net"
+  ] ### CHANGED, default = []
+
+  [dns.domain]
+    # The DNS domain used by your Pi-hole.
+    #
+    # This DNS domain is purely local. FTL may answer queries from its local cache and
+    # configuration but *never* forwards any requests upstream *unless* you have
+    # configured a dns.revServer exactly for this domain. In the latter case, all queries
+    # for this domain are sent exclusively to this server (including reverse lookups).
+    #
+    # For DHCP, this has two effects; firstly it causes the DHCP server to return the
+    # domain to any hosts which request it, and secondly it sets the domain which it is
+    # legal for DHCP-configured hosts to claim. The intention is to constrain hostnames so
+    # that an untrusted host on the LAN cannot advertise its name via DHCP as e.g.
+    # "google.com" and capture traffic not meant for it. If no domain suffix is specified,
+    # then any DHCP hostname with a domain part (ie with a period) will be disallowed and
+    # logged. If a domain is specified, then hostnames with a domain part are allowed,
+    # provided the domain part matches the suffix. In addition, when a suffix is set then
+    # hostnames without a domain part have the suffix added as an optional domain part.
+    # For instance, we can set domain=mylab.com and have a machine whose DHCP hostname is
+    # "laptop". The IP address for that machine is available both as "laptop" and
+    # "laptop.mylab.com".
+    #
+    # You can disable setting a domain by setting this option to an empty string.
+    #
+    # Allowed values are:
+    #     Any valid domain
+    name = "sweet.home" ### CHANGED, default = "lan"
+
+    # If set, the domain configured by dns.domain.name is considered local and queries for
+    # this domain are never forwarded upstream unless a dns.revServer is configured for
+    # this domain.
+    #
+    # If unset, queries for this domain are forwarded upstream to (possibly public) server
+    # which is probably not what you want *unless* you have added extra configuration for
+    # this domain *or* your upstream servers are able to handle local domains (e.g.,
+    # router).
+    #
+    # Allowed values are:
+    #     true or false
+    local = true
+
+  [dns.cache]
+    # Cache size of the DNS server. Note that expiring cache entries naturally make room
+    # for new insertions over time.
+    #
+    #Setting this number too high will have an adverse effect as not only more space is
+    # needed, but also lookup speed gets degraded in the 10,000+ range. dnsmasq may issue
+    # a warning when you go beyond 10,000+ cache entries.
+    #
+    # Allowed values are:
+    #     A positive integer value
+    size = 10000
+
+    # Query cache optimizer: If a DNS name exists in the cache, but its time-to-live has
+    # expired only recently, the data will be used anyway (a refreshing from upstream is
+    # triggered). This can improve DNS query delays especially over unreliable Internet
+    # connections. This feature comes at the expense of possibly sometimes returning
+    # out-of-date data and less efficient cache utilization, since old data cannot be
+    # flushed when its TTL expires, so the cache becomes mostly least-recently-used. To
+    # mitigate issues caused by massively outdated DNS replies, the maximum overaging of
+    # cached records is limited. We strongly recommend staying below 86400 (1 day) with
+    # this option.
+    #
+    # Setting the TTL excess time to zero will serve stale cache data regardless how long
+    # it has expired. This is not recommended as it may lead to stale data being served
+    # for a long time. Setting this option to any negative value will disable this feature
+    # altogether.
+    #
+    # Allowed values are:
+    #     A positive integer value in seconds, or any negative to disable this feature
+    optimizer = 3600
+
+    # This setting allows you to specify the TTL used for queries blocked upstream. Once
+    # the TTL expires, the query will be forwarded to the upstream server again to check
+    # if the block is still valid. Defaults to caching for one day (86400 seconds).
+    # Setting this value to zero disables caching of queries blocked upstream.
+    #
+    # Allowed values are:
+    #     A positive integer value in seconds, or zero to disable caching of upstream
+    #     blocked queries
+    upstreamBlockedTTL = 86400
+
+    # This is dnsmasq's --cache-rr option, which allows you to define which DNS record
+    # types should be cached by PiHole. This option can take a comma-separated list of
+    # RR-types as input. The default value ANY caches all record types.
+    #
+    # Allowed values are:
+    #     Valid DNS record types in the following form: <rrtype>[,<rrtype>...]
+    rrtype = "ANY"
+
+  [dns.blocking]
+    # Should FTL block queries?
+    #
+    # Allowed values are:
+    #     true or false
+    active = true
+
+    # How should FTL reply to blocked queries?
+    #
+    # Allowed values are:
+    #   - "NULL"
+    #       In NULL mode, which is both the default and recommended mode for Pi-hole
+    #       FTLDNS, blocked queries will be answered with the "unspecified address"
+    #       (0.0.0.0 or ::). The "unspecified address" is a reserved IP address specified
+    #       by RFC 3513 - Internet Protocol Version 6 (IPv6) Addressing Architecture,
+    #       section 2.5.2.
+    #   - "IP_NODATA_AAAA"
+    #       In IP-NODATA-AAAA mode, blocked queries will be answered with the local IPv4
+    #       addresses of your Pi-hole. Blocked AAAA queries will be answered with
+    #       NODATA-IPV6 and clients will only try to reach your Pi-hole over its static
+    #       IPv4 address.
+    #   - "IP"
+    #       In IP mode, blocked queries will be answered with the local IP addresses of
+    #       your Pi-hole.
+    #   - "NX"
+    #       In NXDOMAIN mode, blocked queries will be answered with an empty response
+    #       (i.e., there won't be an answer section) and status NXDOMAIN. A NXDOMAIN
+    #       response should indicate that there is no such domain to the client making the
+    #       query.
+    #   - "NODATA"
+    #       In NODATA mode, blocked queries will be answered with an empty response (no
+    #       answer section) and status NODATA. A NODATA response indicates that the domain
+    #       exists, but there is no record for the requested query type.
+    mode = "NULL"
+
+    # Should FTL enrich blocked replies with EDNS0 information?
+    #
+    # Allowed values are:
+    #   - "NONE"
+    #       In NONE mode, no additional EDNS information is added to blocked queries
+    #   - "CODE"
+    #       In CODE mode, blocked queries will be enriched with EDNS info-code BLOCKED (15)
+    #   - "TEXT"
+    #       In TEXT mode, blocked queries will be enriched with EDNS info-code BLOCKED (15)
+    #       and a text message describing the reason for the block
+    edns = "TEXT"
+
+  [dns.specialDomains]
+    # Should Pi-hole always reply with NXDOMAIN to A and AAAA queries of
+    # use-application-dns.net to disable Firefox automatic DNS-over-HTTP?
+    #
+    # This follows the recommendation on
+    # https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https
+    #
+    # Allowed values are:
+    #     true or false
+    mozillaCanary = true
+
+    # Should Pi-hole always reply with NXDOMAIN to A and AAAA queries of mask.icloud.com
+    # and mask-h2.icloud.com to disable Apple's iCloud Private Relay to prevent Apple
+    # devices from bypassing Pi-hole?
+    #
+    # This follows the recommendation on
+    # https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay
+    #
+    # Allowed values are:
+    #     true or false
+    iCloudPrivateRelay = true
+
+    # Should Pi-hole always reply with NODATA to all queries to zone resolver.arpa to
+    # prevent devices from bypassing Pi-hole using Discovery of Designated Resolvers?
+    #
+    # This is based on recommendations at the end of RFC 9462, section 4.
+    #
+    # Allowed values are:
+    #     true or false
+    designatedResolver = true
+
+    [dns.reply.host]
+      # Use a specific IPv4 address for the Pi-hole host? By default, FTL determines the
+      # address of the interface a query arrived on and uses this address for replying to A
+      # queries with the most suitable address for the requesting client.
+      #
+      # This setting can be used to use a fixed, rather than the dynamically obtained,
+      # address when Pi-hole responds to the following names:
+      # - "pi.hole"
+      # - "<the device's hostname>"
+      # - "pi.hole.<local domain>"
+      # - "<the device's hostname>.<local domain>"
+      #
+      # Allowed values are:
+      #     true or false
+      force4 = false
+
+      # Custom IPv4 address for the Pi-hole host
+      #
+      # Allowed values are:
+      #     A valid IPv4 address or empty string ("")
+      IPv4 = ""
+
+      # Use a specific IPv6 address for the Pi-hole host? See description for the IPv4
+      # variant above for further details.
+      #
+      # Allowed values are:
+      #     true or false
+      force6 = false
+
+      # Custom IPv6 address for the Pi-hole host
+      #
+      # Allowed values are:
+      #     A valid IPv6 address or empty string ("")
+      IPv6 = ""
+
+    [dns.reply.blocking]
+      # Use a specific IPv4 address in IP blocking mode? By default, FTL determines the
+      # address of the interface a query arrived on and uses this address for replying to A
+      # queries with the most suitable address for the requesting client.
+      #
+      # This setting can be used to use a fixed, rather than the dynamically obtained,
+      # address when Pi-hole responds in the following cases:
+      # - IP blocking mode is used and this query is to be blocked
+      # - regular expressions with the ;reply=IP regex extension.
+      #
+      # Allowed values are:
+      #     true or false
+      force4 = false
+
+      # Custom IPv4 address for IP blocking mode
+      #
+      # Allowed values are:
+      #     A valid IPv4 address or empty string ("")
+      IPv4 = ""
+
+      # Use a specific IPv6 address in IP blocking mode? See description for the IPv4 variant
+      # above for further details.
+      #
+      # Allowed values are:
+      #     true or false
+      force6 = false
+
+      # Custom IPv6 address for IP blocking mode
+      #
+      # Allowed values are:
+      #     A valid IPv6 address or empty string ("")
+      IPv6 = ""
+
+  [dns.rateLimit]
+    # Rate-limited queries are answered with a REFUSED reply and not further processed by
+    # FTL.
+    #
+    # The default settings for FTL's rate-limiting are to permit no more than 1000 queries
+    # in 60 seconds. Both numbers can be customized independently. It is important to note
+    # that rate-limiting is happening on a per-client basis. Other clients can continue to
+    # use FTL while rate-limited clients are short-circuited at the same time.
+    #
+    # For this setting, both numbers, the maximum number of queries within a given time,
+    # and the length of the time interval (seconds) have to be specified. For instance, if
+    # you want to set a rate limit of 1 query per hour, the option should look like
+    # dns.rateLimit.count=1 and dns.rateLimit.interval=3600. The time interval is relative
+    # to when FTL has finished starting (start of the daemon + possible delay by
+    # DELAY_STARTUP) then it will advance in steps of the rate-limiting interval. If a
+    # client reaches the maximum number of queries it will be blocked until the end of the
+    # current interval. This will be logged to /var/log/pihole/FTL.log, e.g. Rate-limiting
+    # 10.0.1.39 for at least 44 seconds. If the client continues to send queries while
+    # being blocked already and this number of queries during the blocking exceeds the
+    # limit the client will continue to be blocked until the end of the next interval
+    # (FTL.log will contain lines like Still rate-limiting 10.0.1.39 as it made additional
+    # 5007 queries). As soon as the client requests less than the set limit, it will be
+    # unblocked (Ending rate-limitation of 10.0.1.39).
+    #
+    # Rate-limiting may be disabled altogether by setting both values to zero (this
+    # results in the same behavior as before FTL v5.7).
+    #
+    # How many queries are permitted...
+    #
+    # Allowed values are:
+    #     A positive integer value
+    count = 1000
+
+    # ... in the set interval before rate-limiting?
+    #
+    # Allowed values are:
+    #     A positive integer value in seconds
+    interval = 60
+
+[dhcp]
+  # Is the embedded DHCP server enabled?
+  #
+  # Allowed values are:
+  #     true or false
+  active = true ### CHANGED, default = false
+
+  # Start address of the DHCP address pool
+  #
+  # Example: "192.168.0.10"
+  #
+  # Allowed values are:
+  #     A valid IPv4 address, or empty string ("")
+  start = "192.168.2.100" ### CHANGED, default = ""
+
+  # End address of the DHCP address pool
+  #
+  # Example: "192.168.0.250"
+  #
+  # Allowed values are:
+  #     A valid IPv4 address, or empty string ("")
+  end = "192.168.2.150" ### CHANGED, default = ""
+
+  # Address of the gateway to be used (typically the address of your router in a home
+  # installation)
+  #
+  # Example: "192.168.0.1"
+  #
+  # Allowed values are:
+  #     A valid IPv4 address, or empty string ("")
+  router = "192.168.2.254" ### CHANGED, default = ""
+
+  # The netmask used by your Pi-hole. For directly connected networks (i.e., networks on
+  # which the machine running Pi-hole has an interface) the netmask is optional and may
+  # be set to an empty string (""): it will then be determined from the interface
+  # configuration itself.
+  #
+  # For networks which receive DHCP service via a relay agent, we cannot determine the
+  # netmask itself, so it should explicitly be specified, otherwise Pi-hole guesses
+  # based on the class (A, B or C) of the network address.
+  #
+  # Example: "255.255.255.0"
+  #
+  # Allowed values are:
+  #     Any valid netmask, or an empty string ("") for auto-discovery
+  netmask = "255.255.255.0" ### CHANGED, default = ""
+
+  # If the lease time is given, then leases will be given for that length of time. If not
+  # given, the default lease time is one hour for IPv4 and one day for IPv6.
+  #
+  # Allowed values are:
+  #     The lease time can be in seconds, or minutes (e.g., "45m") or hours (e.g., "1h")
+  #     or days (like "2d") or even weeks ("1w"). You may also use "infinite" as string
+  #     but be aware of the drawbacks
+  leaseTime = "24h" ### CHANGED, default = ""
+
+  # Should Pi-hole make an attempt to also satisfy IPv6 address requests (be aware that
+  # IPv6 works a whole lot different than IPv4)
+  #
+  # Allowed values are:
+  #     true or false
+  ipv6 = true ### CHANGED, default = false
+
+  # Enable DHCPv4 Rapid Commit Option specified in RFC 4039. Should only be enabled if
+  # either the server is the only server for the subnet to avoid conflicts
+  #
+  # Allowed values are:
+  #     true or false
+  rapidCommit = false
+
+  # Advertise DNS server multiple times to clients. Some devices will add their own
+  # proprietary DNS servers to the list of DNS servers, which can cause issues with
+  # Pi-hole. This option will advertise the Pi-hole DNS server multiple times to
+  # clients, which should prevent this from happening.
+  #
+  # Allowed values are:
+  #     true or false
+  multiDNS = false
+
+  # Enable logging for DHCP. This will log all relevant DHCP-related activity, including,
+  # e.g., all the options sent to DHCP clients and the tags used to determine them (if
+  # any). This can be useful for debugging DHCP issues. The generated output is saved to
+  # the file specified by files.log.dnsmasq below.
+  #
+  # Allowed values are:
+  #     true or false
+  logging = false
+
+  # Ignore unknown DHCP clients.
+  # If this option is set, Pi-hole ignores all clients which are not explicitly
+  # configured through dhcp.hosts. This can be useful to prevent unauthorized clients
+  # from getting an IP address from the DHCP server.
+  #
+  # It should be noted that this option is not a security feature, as clients can still
+  # assign themselves an IP address and use the network. It is merely a convenience
+  # feature to prevent unknown clients from getting a valid IP configuration assigned
+  # automatically.
+  #
+  # Note that you will need to configure new clients manually in dhcp.hosts before they
+  # can use the network when this feature is enabled.
+  #
+  # Allowed values are:
+  #     true or false
+  ignoreUnknownClients = false
+
+  # Per host parameters for the DHCP server. This allows a machine with a particular
+  # hardware address to be always allocated the same hostname, IP address and lease time
+  # or to specify static DHCP leases
+  #
+  # Example: [ "00:20:e0:3b:13:af,192.168.0.123,laptop,24h",
+  # "00:20:e0:ab:cd:ef,192.168.0.124,desktop,24h"]
+  #
+  # Allowed values are:
+  #     Array of static leases each one in the following form:
+  #     "[<hwaddr>][,id:<client_id>|*][,set:<tag>][,tag:<tag>][,<ipaddr>][,<hostname>][,<lease_time>][,ignore]"
+  hosts = [
+    "BC:24:11:D6:B6:D3,192.168.2.252,server",
+    "BC:24:11:32:79:DF,192.168.2.249,docker",
+    "bc:24:11:15:97:41,192.168.2.108,pbs",
+    "BC:24:11:FE:BE:C1,192.168.2.247,pxe-boot",
+    "bc:24:11:8b:be:21,192.168.2.107,tor-relay",
+    "BC:24:11:52:99:6E,192.168.2.120,nix-cache",
+    "BC:24:11:2C:33:56,192.168.2.248,pdm"
+  ] ### CHANGED, default = []
+
+  [ntp.ipv4]
+    # Should FTL act as network time protocol (NTP) server (IPv4)?
+    #
+    # Allowed values are:
+    #     true or false
+    active = true
+
+    # IPv4 address to listen on for NTP requests
+    #
+    # Allowed values are:
+    #     A valid IPv4 address, or empty string (""). For wildcard (0.0.0.0)
+    address = ""
+
+  [ntp.ipv6]
+    # Should FTL act as network time protocol (NTP) server (IPv6)?
+    #
+    # Allowed values are:
+    #     true or false
+    active = true
+
+    # IPv6 address to listen on for NTP requests
+    #
+    # Allowed values are:
+    #     A valid IPv6 address, or empty string (""). For wildcard (::)
+    address = ""
+
+  [ntp.sync]
+    # Should FTL try to synchronize the system time with an upstream NTP server?
+    #
+    # Allowed values are:
+    #     true or false
+    active = true
+
+    # NTP upstream server to sync with, e.g., "pool.ntp.org". Note that the NTP server
+    # should be located as close as possible to you in order to minimize the time offset
+    # possibly introduced by different routing paths.
+    #
+    # Allowed values are:
+    #     A valid NTP upstream server
+    server = "pool.ntp.org"
+
+    # Interval in seconds between successive synchronization attempts with the NTP server
+    #
+    # Allowed values are:
+    #     A positive integer value in seconds
+    interval = 3600
+
+    # Number of NTP syncs to perform and average before updating the system time
+    #
+    # Allowed values are:
+    #     A positive integer value
+    count = 8
+
+    [ntp.sync.rtc]
+      # Should FTL update a real-time clock (RTC) if available?
+      #
+      # Allowed values are:
+      #     true or false
+      set = false
+
+      # Path to the RTC device to update.
+      #
+      # Example: "/dev/rtc0"
+      #
+      # Allowed values are:
+      #     A valid RTC device path, or empty string ("") for auto-discovery
+      device = ""
+
+      # Should the RTC be set to UTC?
+      #
+      # Allowed values are:
+      #     true or false
+      utc = true
+
+[resolver]
+  # Should FTL try to resolve IPv4 addresses to hostnames?
+  #
+  # Allowed values are:
+  #     true or false
+  resolveIPv4 = true
+
+  # Should FTL try to resolve IPv6 addresses to hostnames?
+  #
+  # Allowed values are:
+  #     true or false
+  resolveIPv6 = true
+
+  # Control whether FTL should attempt to obtain client names from the network table by
+  # MAC address.
+  #
+  #This can provide hostnames for devices that do not have a hostname or have multiple
+  # IP addresses (e.g. IPv4 and IPv6).
+  #However, MAC-derived names can be ambiguous (e.g., when a MAC appears for multiple
+  # IPs due to a router/NAT or MAC reuse), which may lead to incorrect hostnames being
+  # shown. Disabling this option can prevent such issues but may lead to more clients
+  # without hostnames.
+  #
+  # Allowed values are:
+  #     true or false
+  macNames = true
+
+  # Control whether FTL should use the fallback option to try to obtain client names from
+  # checking the network table. This behavior can be disabled with this option.
+  #
+  # Assume an IPv6 client without a host names. However, the network table knows -
+  # though the client's MAC address - that this is the same device where we have a host
+  # name for another IP address (e.g., a DHCP server managed IPv4 address). In this
+  # case, we use the host name associated to the other address as this is the same
+  # device.
+  #
+  # Allowed values are:
+  #     true or false
+  networkNames = true
+
+  # With this option, you can change how (and if) hourly PTR requests are made to check
+  # for changes in client and upstream server hostnames.
+  #
+  # Allowed values are:
+  #   - "IPV4_ONLY"
+  #       Do hourly PTR lookups only for IPv4 addresses. This is the new default since
+  #       Pi-hole FTL v5.3.2. It should resolve issues with more and more very
+  #       short-lived PE IPv6 addresses coming up in a lot of networks.
+  #   - "ALL"
+  #       Do hourly PTR lookups for all addresses. This was the default until FTL
+  #       v5.3(.1). It has been replaced as it can create a lot of PTR queries for those
+  #       with many IPv6 addresses in their networks.
+  #   - "UNKNOWN"
+  #       Only resolve unknown hostnames. Already existing hostnames are never refreshed,
+  #       i.e., there will be no PTR queries made for clients where hostnames are known.
+  #       This also means that known hostnames will not be updated once known.
+  #   - "NONE"
+  #       Don't do any hourly PTR lookups. This means we look host names up exactly once
+  #       (when we first see a client) and never again. You may miss future changes of
+  #       host names.
+  refreshNames = "IPV4_ONLY"
+
+[database]
+  # Should FTL load information from the database on startup to be aware of the most
+  # recent history?
+  #
+  # Allowed values are:
+  #     true or false
+  DBimport = true
+
+  # How long should queries be stored in the database [days]?
+  #
+  # Allowed values are:
+  #     A positive integer value in days, or 0 to disable the database
+  maxDBdays = 91
+
+  # How often do we store queries in FTL's database [seconds]?
+  #
+  # Allowed values are:
+  #     A positive integer value in seconds
+  DBinterval = 60
+
+  # Should FTL enable Write-Ahead Log (WAL) mode for the on-disk query database
+  # (configured via files.database)?
+  #
+  # It is recommended to leave this setting enabled for performance reasons. About the
+  # only reason to disable WAL mode is if you are experiencing specific issues with it,
+  # e.g., when using a database that is accessed from multiple hosts via a network
+  # share. When this setting is disabled, FTL will use SQLite3's default journal mode
+  # (rollback journal in DELETE mode).
+  #
+  # Allowed values are:
+  #     true or false
+  useWAL = true
+
+  # Should FTL force the use of disk storage for the history database? By default, FTL
+  # uses an in-memory database for much improved performance when browsing the history
+  # from the dashboard. However, on systems with very limited RAM and only occasional
+  # usage of the web interface, it may be useful to force the use of disk storage
+  # instead of holding everything in memory.
+  #
+  # Note that using disk storage *will* reduce performance, especially on systems with
+  # slow storage media (e.g., SD cards).
+  #
+  # Allowed values are:
+  #     true or false
+  forceDisk = false
+
+  [database.network]
+    # Should FTL analyze the local ARP cache? When disabled, client identification and the
+    # network table will stop working reliably.
+    #
+    # Allowed values are:
+    #     true or false
+    parseARPcache = true
+
+    # How long should IP addresses be kept in the network_addresses table [days]? IP
+    # addresses (and associated host names) older than the specified number of days are
+    # removed to avoid dead entries in the network overview table.
+    #
+    # Allowed values are:
+    #     A positive integer value in days
+    expire = 91
+
+[webserver]
+  # On which domain is the web interface served?
+  #
+  # Allowed values are:
+  #     A valid domain
+  domain = "pi.hole"
+
+  # Webserver access control list (ACL) allowing for restrictions to be put on the list
+  # of IP addresses which have access to the web server. The ACL is a comma separated
+  # list of IP subnets, where each subnet is prepended by either a - or a + sign. A plus
+  # sign means allow, where a minus sign means deny.
+  #
+  # If a subnet mask is omitted, such as -1.2.3.4, this means to deny only that single
+  # IP address. If this value is not set (empty string), all accesses are allowed.
+  # Otherwise, the default setting is to deny all accesses. On each request the full
+  # list is traversed, and the last (!) match wins. IPv6 addresses may be specified in
+  # CIDR-form [a:b::c]/64.
+  #
+  # Example 1: "+127.0.0.1,+[::1]" ---> deny all access, except from 127.0.0.1 and ::1
+  #
+  # Example 2: "+192.168.0.0/16" ---> deny all accesses, except from the 192.168.0.0/16
+  # subnet
+  #
+  # Example 3: "+[::]/0" ---> allow only IPv6 access.
+  #
+  # Allowed values are:
+  #     A valid ACL
+  acl = ""
+
+  # Ports to be used by the webserver.
+  #
+  # Comma-separated list of ports to listen on. It is possible to specify an IP address
+  # to bind to. In this case, an IP address and a colon must be prepended to the port
+  # number. For example, to bind to the loopback interface on port 80 (IPv4) and to all
+  # interfaces port 8080 (IPv4), use "127.0.0.1:80,8080". "[::]:80" can be used to
+  # listen to IPv6 connections to port 80. IPv6 addresses of network interfaces can be
+  # specified as well, e.g. "[::1]:80" for the IPv6 loopback interface. "[::]:80" will
+  # bind to port 80 IPv6 only.
+  #
+  # In order to use port 80 for all interfaces, both IPv4 and IPv6, use either the
+  # configuration "80,[::]:80" (create one socket for IPv4 and one for IPv6 only), or
+  # "+80" (create one socket for both, IPv4 and IPv6). The '+' notation to use IPv4 and
+  # IPv6 will only work if no network interface is specified. Depending on your
+  # operating system version and IPv6 network environment, some configurations might not
+  # work as expected, so you have to test to find the configuration most suitable for
+  # your needs. In case "+80" does not work for your environment, you need to use
+  # "80,[::]:80".
+  #
+  # If the port is TLS/SSL, a letter 's' (secure) must be appended, for example,
+  # "80,443s" will open port 80 and port 443, and connections on port 443 will be
+  # encrypted. For non-encrypted ports, it is allowed to append letter 'r' (as in
+  # redirect). Redirected ports will redirect all their traffic to the first configured
+  # SSL port. For example, if webserver.port is "80r,443s", then all HTTP traffic coming
+  # at port 80 will be redirected to HTTPS port 443.
+  #
+  # When specifying 'o' (optional) behind a port, inability to use this port is not
+  # considered an error. For instance, specifying "80o,8080o" will allow the webserver
+  # to listen on either 80, 8080, both or even none of the two ports. This flag may be
+  # combined with 'r' and 's' like "80or,443os,8080,4443s" (80 redirecting to SSL if
+  # available, 443 encrypted if available, 8080 mandatory and unencrypted, 4443
+  # mandatory and encrypted).
+  #
+  # If this value is not set (empty string), the web server will not be started and,
+  # hence, the API will not be available.
+  #
+  # Allowed values are:
+  #     A comma-separated list of <[ip_address:]port>
+  port = "80o,443os,[::]:80o,[::]:443os"
+
+  # Maximum number of worker threads allowed.
+  #
+  # The Pi-hole web server handles each incoming connection in a separate thread.
+  # Therefore, the value of this option is effectively the number of concurrent HTTP
+  # connections that can be handled. Any other connections are queued until they can be
+  # processed by a unoccupied thread.
+  #
+  # The total number of threads you see may be lower than the configured value as
+  # threads are only created when needed due to incoming connections.
+  #
+  # The value 0 means the number of threads is 50 (as per default settings of CivetWeb)
+  # for backwards-compatible behavior.
+  #
+  # Allowed values are:
+  #     A positive integer value, or 0 for default (50)
+  threads = 50
+
+  # Additional HTTP headers added to the web server responses.
+  #
+  # The headers are added to all responses, including those for the API.
+  # Note about the default additional headers:
+  # - X-DNS-Prefetch-Control: off: Usually browsers proactively perform domain name
+  # resolution on links that the user may choose to follow. We disable DNS prefetching
+  # here.
+  # - Content-Security-Policy: [...] 'unsafe-inline' is both required by Chart.js
+  # styling some elements directly, and index.html containing some inlined Javascript
+  # code.
+  # - X-Frame-Options: DENY: The page can not be displayed in a frame, regardless of the
+  # site attempting to do so.
+  # - X-Xss-Protection: 0: Disables XSS filtering in browsers that support it. This
+  # header is usually enabled by default in browsers, and is not recommended as it can
+  # hurt the security of the site.
+  # (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection).
+  # - X-Content-Type-Options: nosniff: Marker used by the server to indicate that the
+  # MIME types advertised in the  Content-Type headers should not be changed and be
+  # followed. This allows to opt-out of MIME type sniffing, or, in other words, it is a
+  # way to say that the webmasters knew what they were doing. Site security testers
+  # usually expect this header to be set.
+  # - Referrer-Policy: strict-origin-when-cross-origin: A referrer will be sent for
+  # same-site origins, but cross-origin requests will send no referrer information.
+  # The latter four headers are set as expected by https://securityheaders.io
+  #
+  # Allowed values are:
+  #     An array of HTTP headers
+  headers = [
+    "Content-Security-Policy: default-src 'self' 'unsafe-inline';",
+    "X-Frame-Options: DENY",
+    "X-XSS-Protection: 0",
+    "X-Content-Type-Options: nosniff",
+    "Referrer-Policy: strict-origin-when-cross-origin"
+  ] ### CHANGED, default = [ "X-DNS-Prefetch-Control: off", "Content-Security-Policy: default-src 'none'; connect-src 'self'; font-src 'self'; frame-ancestors 'none'; img-src 'self'; manifest-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self'", "X-Frame-Options: DENY", "X-XSS-Protection: 0", "X-Content-Type-Options: nosniff", "Referrer-Policy: strict-origin-when-cross-origin" ]
+
+  # Should the web server serve all files in webserver.paths.webroot directory?
+  #
+  # If disabled, only files within the path defined through webserver.paths.webhome and
+  # /api will be served.
+  #
+  # Allowed values are:
+  #     true or false
+  serve_all = false
+
+  # Additional options passed directly to the web server.
+  #
+  # This can be used to set any option supported by the underlying web server
+  # (CivetWeb). See the CivetWeb documentation for a list of supported options. The
+  # options are passed as an array of strings, where each string is an option in the
+  # form "<option>=<value>". Be aware that this is an advanced option and that setting
+  # options here may break the web server if invalid or conflicting with other settings
+  # applied based on other settings in this file. The config options specified here are
+  # added to the end of the passed options. This makes it possible to overwrite settings
+  # set by Pi-hole (only the last values is used when a config option is specified
+  # multiple times). Use with caution.
+  #
+  # Example: [ "ssl_protocol_version=4", "ssl_cipher_list=AES128:!MD5" ]
+  #
+  # Allowed values are:
+  #     An array of valid CivetWeb options
+  advancedOpts = []
+
+  [webserver.session]
+    # Session timeout in seconds.
+    #
+    # If a session is inactive for more than this time, it will be terminated. Sessions
+    # are continuously refreshed by the web interface, preventing sessions from timing out
+    # while the web interface is open.
+    #
+    # This option may also be used to make logins persistent for long times, e.g. 86400
+    # seconds (24 hours), 604800 seconds (7 days) or 2592000 seconds (30 days). Note that
+    # the total number of concurrent sessions is limited so setting this value too high
+    # may result in users being rejected and unable to log in if there are already too
+    # many sessions active.
+    #
+    # Allowed values are:
+    #     A positive integer value in seconds
+    timeout = 1800
+
+    # Should Pi-hole backup and restore sessions from the database?
+    #
+    # This is useful if you want to keep your sessions after a restart of the web
+    # interface.
+    #
+    # Allowed values are:
+    #     true or false
+    restore = true
+
+  [webserver.tls]
+    # Path to the TLS (SSL) certificate file.
+    #
+    # All directories along the path must be readable and accessible by the user running
+    # FTL (typically 'pihole'). This option is only required when at least one of
+    # webserver.port is TLS. The file must be in PEM format, and it must have both,
+    # private key and certificate (the *.pem file created must contain a 'CERTIFICATE'
+    # section as well as a 'PRIVATE KEY' section).
+    #
+    # The *.pem file can be created using `cp server.crt server.pem && cat server.key >>
+    # server.pem` if you have these files instead
+    #
+    # Allowed values are:
+    #     A valid TLS certificate file (*.pem)
+    cert = "/etc/pihole/tls.pem"
+
+    # Number of days the automatically generated self-signed TLS/SSL certificate will be
+    # valid for.
+    #
+    # Defaults to 47 days. A minimum of 7 days is enforced.
+    # Some devices may enforce shorter validity ranges. Note that defining a lower
+    # validity range may require you to accept the self-signed certificate more often in
+    # your browser.
+    # Pi-hole will regenerate certificates it created itself two days prior to expiration.
+    # If you are using your own certificate, you need to regenerate it yourself. In this
+    # case, it is advised to set the validity range to 0 days, so that Pi-hole does not
+    # try to regenerate your certificate. If you set the validity range to 0 days and
+    # still try to generate a certificate, Pi-hole will set a fixed validity range of
+    # roughly 30 years for the certificate.
+    validity = 47
+
+  [webserver.paths]
+    # Server root on the host
+    #
+    # Allowed values are:
+    #     A valid path
+    webroot = "/var/www/html"
+
+    # Sub-directory of the root containing the web interface
+    #
+    # Allowed values are:
+    #     A valid subpath, both slashes are needed!
+    webhome = "/admin/"
+
+    # Prefix where the web interface is served
+    #
+    # This is useful when you are using a reverse proxy serving the web interface, e.g.,
+    # at http://<ip>/pihole/admin/ instead of http://<ip>/admin/. In this example, the
+    # prefix would be "/pihole". Note that the prefix has to be stripped away by the
+    # reverse proxy, e.g., for traefik:
+    # - traefik.http.routers.pihole.rule=PathPrefix(`/pihole`)
+    # - traefik.http.middlewares.piholehttp.stripprefix.prefixes=/pihole
+    # The prefix should start with a slash. If you don't use a prefix, leave this field
+    # empty. Setting this field to an incorrect value may result in the web interface not
+    # being accessible.
+    # Don't use this setting if you are not using a reverse proxy!
+    #
+    # Allowed values are:
+    #     A valid URL prefix or empty
+    prefix = ""
+
+  [webserver.interface]
+    # Should the web interface use the boxed layout?
+    #
+    # Allowed values are:
+    #     true or false
+    boxed = true
+
+    # Theme used by the Pi-hole web interface
+    #
+    # Allowed values are:
+    #   - "default-auto"
+    #       Pi-hole auto
+    #   - "default-light"
+    #       Pi-hole day
+    #   - "default-dark"
+    #       Pi-hole midnight
+    #   - "default-darker"
+    #       Pi-hole deep-midnight
+    #   - "high-contrast"
+    #       High-contrast light
+    #   - "high-contrast-dark"
+    #       High-contrast dark
+    #   - "lcars"
+    #       Star Trek LCARS
+    theme = "default-dark" ### CHANGED, default = "default-auto"
+
+  [webserver.api]
+    # Number of concurrent sessions allowed for the API. If the number of sessions exceeds
+    # this value, no new sessions will be allowed until the number of sessions drops due
+    # to session expiration or logout.
+    #
+    # Note that the number of concurrent sessions is irrelevant if authentication is
+    # disabled as no sessions are used in this case.
+    #
+    # Allowed values are:
+    #     A positive integer value
+    max_sessions = 16
+
+    # Should FTL prettify the API output (add extra spaces, newlines and indentation)?
+    #
+    # Allowed values are:
+    #     true or false
+    prettyJSON = false
+
+    # API password hash
+    #
+    # Allowed values are:
+    #     A valid Pi-hole password hash
+    pwhash = ""
+
+    # Pi-hole 2FA TOTP secret. When set to something different than an empty string, 2FA
+    # authentication will be enforced for the API and the web interface. This setting is
+    # write-only, the secret itself cannot be read back, but the CLI will show "********"
+    # to indicate that 2FA is configured.
+    #
+    # Allowed values are:
+    #     A valid TOTP secret (20 Bytes in Base32 encoding)
+    totp_secret = ""
+
+    # Pi-hole application password.
+    #
+    # After you turn on two-factor (2FA) verification and set up an Authenticator app, you
+    # may run into issues if you use apps or other services that don't support two-step
+    # verification. In this case, you can create and use an app password to sign in.
+    #
+    # An app password is a long, randomly generated password that can be used instead of
+    # your regular password + TOTP token when signing in to the API. The app password can
+    # be generated through the API and will be shown only once.
+    #
+    # You can revoke the app password at any time. If you revoke the app password, be sure
+    # to generate a new one and update your app with the new password.
+    #
+    # Allowed values are:
+    #     A valid Pi-hole password hash
+    app_pwhash = ""
+
+    # Should application password API sessions be allowed to modify config settings?
+    #
+    # Setting this to true allows third-party applications using the application password
+    # to modify settings, e.g., the upstream DNS servers, DHCP server settings, or
+    # changing passwords. This setting should only be enabled if really needed and only if
+    # you trust the applications using the application password.
+    #
+    # Allowed values are:
+    #     true or false
+    app_sudo = false
+
+    # Should FTL create a temporary CLI password?
+    #
+    # This password is stored in clear in /etc/pihole and can be used by the CLI (pihole
+    # ...  commands) to authenticate against the API. Note that the password is only valid
+    # for the current session and regenerated on each FTL restart. Sessions initiated with
+    # this password cannot modify the Pi-hole configuration (change passwords, etc.) for
+    # security reasons but can still use the API to query data and manage lists.
+    #
+    # Allowed values are:
+    #     true or false
+    cli_pw = true
+
+    # Array of clients to be excluded from certain API responses (regex):
+    # - Query Log (/api/queries)
+    # - Top Clients (/api/stats/top_clients)
+    # This setting accepts both IP addresses (IPv4 and IPv6) as well as hostnames.
+    # Note that backslashes "\" need to be escaped, i.e. "\\" in this setting
+    #
+    # Example: [ "^192\\.168\\.2\\.56$", "^fe80::341:[0-9a-f]*$", "^localhost$" ]
+    #
+    # Allowed values are:
+    #     An array of regular expressions describing clients
+    excludeClients = []
+
+    # Array of domains to be excluded from certain API responses (regex):
+    # - Query Log (/api/queries)
+    # - Top Clients (/api/stats/top_domains)
+    # Note that backslashes "\" need to be escaped, i.e. "\\" in this setting
+    #
+    # Example: [ "(^|\\.)\\.google\\.de$", "\\.pi-hole\\.net$" ]
+    #
+    # Allowed values are:
+    #     An array of regular expressions describing domains
+    excludeDomains = []
+
+    # How much history should be imported from the database and returned by the API
+    # [seconds]? (max 24hrs = 86400)
+    #
+    # Allowed values are:
+    #     A positive integer value in seconds up to 86400
+    maxHistory = 86400
+
+    # Up to how many clients should be returned in the activity graph endpoint
+    # (/api/history/clients)?
+    #
+    # This setting can be overwritten at run-time using the parameter N. Setting this to 0
+    # will always send all clients. Be aware that this may be challenging for the GUI if
+    # you have many (think > 1.000 clients) in your network
+    #
+    # Allowed values are:
+    #     A positive integer value
+    maxClients = 10
+
+    # How should the API compute the most active clients? If set to true, the API will
+    # return the clients with the most queries globally (within 24 hours). If set to
+    # false, the API will return the clients with the most queries per time slot
+    # individually.
+    #
+    # Allowed values are:
+    #     true or false
+    client_history_global_max = true
+
+    # Allow destructive API calls (e.g. restart DNS server, flush logs, ...)
+    #
+    # Allowed values are:
+    #     true or false
+    allow_destructive = true
+
+    [webserver.api.temp]
+      # Which upper temperature limit should be used by Pi-hole? Temperatures above this
+      # limit will be shown as "hot". The number specified here is in the unit defined below
+      #
+      # Allowed values are:
+      #     A positive floating point value in the unit defined below
+      limit = 60.000000
+
+      # Which temperature unit should be used for temperatures processed by FTL?
+      #
+      # Allowed values are:
+      #   - "C"
+      #       Celsius
+      #   - "F"
+      #       Fahrenheit
+      #   - "K"
+      #       Kelvin
+      unit = "C"
+
+[files]
+  # The location of FTL's long-term database
+  #
+  # Allowed values are:
+  #     Any FTL database
+  database = "/etc/pihole/pihole-FTL.db"
+
+  # The location of FTL's short-term temporary database (only used when
+  # database.forceDisk is true)
+  #
+  # Allowed values are:
+  #     Any FTL database
+  tmp_db = "/etc/pihole/pihole-tmp.db"
+
+  # The location of Pi-hole's gravity database
+  #
+  # Allowed values are:
+  #     Any Pi-hole gravity database
+  gravity = "/etc/pihole/gravity.db"
+
+  # A temporary directory where Pi-hole can store files during gravity updates. This
+  # directory must be writable by the user running gravity (typically pihole).
+  #
+  # Allowed values are:
+  #     Any existing world-writable writable directory
+  gravity_tmp = "/tmp"
+
+  # The database containing MAC -> Vendor information for the network table
+  #
+  # Allowed values are:
+  #     Any Pi-hole macvendor database
+  macvendor = "/etc/pihole/macvendor.db"
+
+  # An optional file containing a pcap capture of the network traffic. This file is used
+  # for debugging purposes only. If you don't know what this is, you don't need it.
+  #
+  # Setting this to an empty string disables pcap recording. The file must be writable
+  # by the user running FTL (typically pihole). Failure to write to this file will
+  # prevent the DNS resolver from starting. The file is appended to if it already
+  # exists.
+  #
+  # Allowed values are:
+  #     Any writable pcap file
+  pcap = ""
+
+  [files.log]
+    # The location of FTL's log file
+    #
+    # Allowed values are:
+    #     any writable file
+    ftl = "/var/log/pihole/FTL.log"
+
+    # The log file used by the embedded dnsmasq DNS server
+    #
+    # Allowed values are:
+    #     Any writable file
+    dnsmasq = "/var/log/pihole/pihole.log"
+
+    # The log file used by the webserver
+    #
+    # Allowed values are:
+    #     Any writable file
+    webserver = "/var/log/pihole/webserver.log"
+
+[misc]
+  # Using privacy levels you can specify which level of detail you want to see in your
+  # Pi-hole statistics. Changing this setting will trigger a restart of FTL
+  #
+  # Allowed values are:
+  #   - 0
+  #       Don't hide anything, all statistics are available.
+  #   - 1
+  #       Hide domains. This setting disables Top Domains and Top Ads
+  #   - 2
+  #       Hide domains and clients. This setting disables Top Domains, Top Ads, Top
+  #       Clients and Clients over time.
+  #   - 3
+  #       Anonymize everything. This setting disables almost any statistics and query
+  #       analysis. There will be no long-term database logging and no Query Log. You
+  #       will also lose most regex features.
+  privacylevel = 0
+
+  # During startup, in some configurations, network interfaces appear only late during
+  # system startup and are not ready when FTL tries to bind to them. Therefore, you may
+  # want FTL to wait a given amount of time before trying to start the DNS resolver.
+  #
+  # This setting takes any integer value between 0 and 300 seconds. To prevent delayed
+  # startup while the system is already running and FTL is restarted, the delay only
+  # takes place within the first 180 seconds (hard-coded) after booting.
+  #
+  # Allowed values are:
+  #     A positive integer value between 0 and 300
+  delay_startup = 0
+
+  # Set niceness of pihole-FTL. Defaults to -10 and can be disabled altogether by setting
+  # a value of -999. The nice value is an attribute that can be used to influence the
+  # CPU scheduler to favor or disfavor a process in scheduling decisions.
+  #
+  # The range of the nice value varies across UNIX systems. On modern Linux, the range
+  # is -20 (high priority = not very nice to other processes) to +19 (low priority).
+  #
+  # Allowed values are:
+  #     A signed integer value between -20 and 19, or -999 to disable niceness
+  nice = -10
+
+  # Should FTL translate its own stack addresses into code lines during the bug
+  # backtrace? This improves the analysis of crashed significantly. It is recommended to
+  # leave the option enabled.
+  #
+  # This option should only be disabled when addr2line is known to not be working
+  # correctly on the machine because, in this case, the malfunctioning addr2line can
+  # prevent from generating any backtrace at all.
+  #
+  # Allowed values are:
+  #     true or false
+  addr2line = true
+
+  # Should FTL load additional dnsmasq configuration files from /etc/dnsmasq.d/?
+  #
+  # Warning: This is an advanced setting and should only be used with care.
+  # Incorrectly formatted or config files specifying options which can only be defined
+  # once can result in conflicts with the automatic configuration of Pi-hole (see
+  # /etc/pihole/dnsmasq.conf) and may stop DNS resolution from working.
+  #
+  # Allowed values are:
+  #     true or false
+  etc_dnsmasq_d = true ### CHANGED, default = false
+
+  # Additional lines to inject into the generated dnsmasq configuration.
+  # Warning: This is an advanced setting and should only be used with care. Incorrectly
+  # formatted or duplicated lines as well as lines conflicting with the automatic
+  # configuration of Pi-hole can break the embedded dnsmasq and will stop DNS resolution
+  # from working.
+  #
+  # Use this option with extra care.
+  #
+  # Example: [ "address=/example.com/192.168.0.1", "address=/example.org/192.168.0.2",
+  # "address=/example.net/192.168.0.3" ]
+  #
+  # Allowed values are:
+  #     Array of valid dnsmasq config line options
+  dnsmasq_lines = []
+
+  # Log additional information about queries and replies to pihole.log
+  #
+  # When this setting is enabled, the log has extra information at the start of each
+  # line. This consists of a serial number which ties together the log lines associated
+  # with an individual query, and the IP address of the requestor. This setting is only
+  # effective if dns.queryLogging is enabled, too. This option is only useful for
+  # debugging and is not recommended for normal use.
+  #
+  # Allowed values are:
+  #     true or false
+  extraLogging = false
+
+  # Put configuration into read-only mode. This will prevent any changes to the
+  # configuration file via the API or CLI. This setting useful when a configuration is
+  # to be forced/modified by some third-party application (like infrastructure-as-code
+  # providers) and should not be changed by any means.
+  #
+  # Allowed values are:
+  #     true or false
+  readOnly = false
+
+  # Should FTL normalize reported CPU usage?
+  #
+  # On multi-core systems, a high workload can lead to CPU usage numbers exceeding 100%
+  # (e.g., 200% on a quad-core system if two out of four cores are fully utilized). This
+  # may look alarming at first glance even though the system is not actually overloaded.
+  # Enabling this setting will divide the CPU usage by the number of cores, leading to
+  # more intuitive numbers (e.g., 50% for the same load on a quad-core system).
+  # Note that this setting only affects how CPU usage is *reported*, it does not change
+  # the actual CPU usage.
+  #
+  # Allowed values are:
+  #     true or false
+  normalizeCPU = true
+
+  # Should FTL hide warnings coming from dnsmasq?
+  #
+  # By default, FTL reports warnings coming from the embedded dnsmasq DNS server to the
+  # FTL log file. These warnings can be useful to identify misconfigurations or problems
+  # with the DNS server. However, some warnings may be harmless and can be ignored in
+  # certain setups. Enabling this setting will hide all dnsmasq warnings.
+  #
+  # Allowed values are:
+  #     true or false
+  hide_dnsmasq_warn = false
+
+  # Should FTL hide network connection errors?
+  #
+  # By default, FTL reports network connection errors (e.g., Connection prematurely
+  # closed by remote server) to the FTL log file. These warnings can be useful to
+  # identify intermittent network problems or general problem with upstream servers.
+  # However, in some setups, these warnings may be expected (e.g. due to low-quality
+  # Internet connectivity) and cannot be fixed. Enabling this setting will hide all
+  # connection warnings.
+  #
+  # Allowed values are:
+  #     true or false
+  hide_connection_error = false
+
+  [misc.check]
+    # Pi-hole is very lightweight on resources. Nevertheless, this does not mean that you
+    # should run Pi-hole on a server that is otherwise extremely busy as queuing on the
+    # system can lead to unnecessary delays in DNS operation as the system becomes less
+    # and less usable as the system load increases because all resources are permanently
+    # in use. To account for this, FTL regularly checks the system load. To bring this to
+    # your attention, FTL warns about excessive load when the 15 minute system load
+    # average exceeds the number of cores.
+    #
+    # This check can be disabled with this setting.
+    #
+    # Allowed values are:
+    #     true or false
+    load = true
+
+    # FTL stores history in shared memory to allow inter-process communication with forked
+    # dedicated TCP workers. If FTL runs out of memory, it cannot continue to work as
+    # queries cannot be analyzed any further. Hence, FTL checks if enough shared memory is
+    # available on your system and warns you if this is not the case.
+    # By default, FTL warns if the shared-memory usage exceeds 90%. You can set any
+    # integer limit between 0 to 100 (interpreted as percentages) where 0 means that
+    # checking of shared-memory usage is disabled.
+    #
+    # Allowed values are:
+    #     A positive integer value between 0 and 100
+    shmem = 90
+
+    # FTL stores its long-term history in a database file on disk. Furthermore, FTL stores
+    # log files. By default, FTL warns if usage of the disk holding any crucial file
+    # exceeds 90%. You can set any integer limit between 0 to 100 (interpreted as
+    # percentages) where 0 means that checking of disk usage is disabled.
+    #
+    # Allowed values are:
+    #     A positive integer value between 0 and 100
+    disk = 90
+
+[debug]
+  # Print debugging information about database actions. This prints performed SQL
+  # statements as well as some general information such as the time it took to store the
+  # queries and how many have been saved to the database.
+  #
+  # Allowed values are:
+  #     true or false
+  database = false
+
+  # Prints a list of the detected interfaces on the startup of pihole-FTL. Also, prints
+  # whether these interfaces are IPv4 or IPv6 interfaces.
+  #
+  # Allowed values are:
+  #     true or false
+  networking = false
+
+  # Print information about shared memory locks. Messages will be generated when waiting,
+  # obtaining, and releasing a lock.
+  #
+  # Allowed values are:
+  #     true or false
+  locks = false
+
+  # Print extensive query information (domains, types, replies, etc.). This has always
+  # been part of the legacy debug mode of pihole-FTL.
+  #
+  # Allowed values are:
+  #     true or false
+  queries = false
+
+  # Print flags of queries received by the DNS hooks. Only effective when DEBUG_QUERIES
+  # is enabled as well.
+  #
+  # Allowed values are:
+  #     true or false
+  flags = false
+
+  # Print information about shared memory buffers. Messages are either about creating or
+  # enlarging shmem objects or string injections.
+  #
+  # Allowed values are:
+  #     true or false
+  shmem = false
+
+  # Print information about garbage collection (GC): What is to be removed, how many have
+  # been removed and how long did GC take.
+  #
+  # Allowed values are:
+  #     true or false
+  gc = false
+
+  # Print information about ARP table processing: How long did parsing take, whether read
+  # MAC addresses are valid, and if the macvendor.db file exists.
+  #
+  # Allowed values are:
+  #     true or false
+  arp = false
+
+  # Controls if FTLDNS should print extended details about regex matching into FTL.log.
+  #
+  # Allowed values are:
+  #     true or false
+  regex = false
+
+  # Print extra debugging information concerning API calls. This includes the request,
+  # the request parameters, and the internal details about how the algorithms decide
+  # which data to present and in what form. This very verbose output should only be used
+  # when debugging specific API issues and can be helpful, e.g., when a client cannot
+  # connect due to an obscure API error. Furthermore, this setting enables logging of
+  # all API requests (auth log) and details about user authentication attempts.
+  #
+  # Allowed values are:
+  #     true or false
+  api = false
+
+  # Print extra debugging information about TLS connections. This includes the TLS
+  # version, the cipher suite, the certificate chain and much more. This very verbose
+  # output should only be used when debugging specific TLS issues and can be helpful,
+  # e.g., when a client cannot connect due to an obscure TLS error as modern browsers do
+  # not provide much information about the underlying TLS connection and most often give
+  # only very generic error messages without much/any underlying technical information.
+  #
+  # Allowed values are:
+  #     true or false
+  tls = false
+
+  # Print information about overTime memory operations, such as initializing or moving
+  # overTime slots.
+  #
+  # Allowed values are:
+  #     true or false
+  overtime = false
+
+  # Print information about status changes for individual queries. This can be useful to
+  # identify unexpected unknown queries.
+  #
+  # Allowed values are:
+  #     true or false
+  status = false
+
+  # Print information about capabilities granted to the pihole-FTL process. The current
+  # capabilities are printed on receipt of SIGHUP, i.e., the current set of capabilities
+  # can be queried without restarting pihole-FTL (by setting DEBUG_CAPS=true and
+  # thereafter sending killall -HUP pihole-FTL).
+  #
+  # Allowed values are:
+  #     true or false
+  caps = false
+
+  # Print information about DNSSEC activity
+  #
+  # Allowed values are:
+  #     true or false
+  dnssec = false
+
+  # FTL uses dynamically allocated vectors for various tasks. This config option enables
+  # extensive debugging information such as information about allocation, referencing,
+  # deletion, and appending.
+  #
+  # Allowed values are:
+  #     true or false
+  vectors = false
+
+  # Extensive information about hostname resolution like which DNS servers are used in
+  # the first and second hostname resolving tries (only affecting internally generated
+  # PTR queries).
+  #
+  # Allowed values are:
+  #     true or false
+  resolver = false
+
+  # Print debugging information about received EDNS(0) data.
+  #
+  # Allowed values are:
+  #     true or false
+  edns0 = false
+
+  # Log various important client events such as change of interface (e.g., client
+  # switching from WiFi to wired or VPN connection), as well as extensive reporting
+  # about how clients were assigned to its groups.
+  #
+  # Allowed values are:
+  #     true or false
+  clients = false
+
+  # Log information related to alias-client processing.
+  #
+  # Allowed values are:
+  #     true or false
+  aliasclients = false
+
+  # Log information regarding FTL's embedded event handling queue.
+  #
+  # Allowed values are:
+  #     true or false
+  events = false
+
+  # Log information about script helpers, e.g., due to dhcp-script.
+  #
+  # Allowed values are:
+  #     true or false
+  helper = false
+
+  # Print config parsing details
+  #
+  # Allowed values are:
+  #     true or false
+  config = false
+
+  # Debug monitoring of /etc/pihole filesystem events
+  #
+  # Allowed values are:
+  #     true or false
+  inotify = false
+
+  # Debug monitoring of the webserver (CivetWeb) events
+  #
+  # Allowed values are:
+  #     true or false
+  webserver = false
+
+  # Temporary flag that may print additional information. This debug flag is meant to be
+  # used whenever needed for temporary investigations. The logged content may change
+  # without further notice at any time.
+  #
+  # Allowed values are:
+  #     true or false
+  extra = false
+
+  # Reserved debug flag
+  #
+  # Allowed values are:
+  #     true or false
+  reserved = false
+
+  # Print information about NTP synchronization
+  #
+  # Allowed values are:
+  #     true or false
+  ntp = false
+
+  # Print information about netlink communication and parsing
+  #
+  # Allowed values are:
+  #     true or false
+  netlink = false
+
+  # Print timing information from various parts of FTL
+  #
+  # Allowed values are:
+  #     true or false
+  timing = false
+
+  # Log gravity lookup and FTL DNS cache performance statistics every 5 minutes. For each
+  # operation type (gravity, antigravity, denylist, allowlist), reports the call count,
+  # average and maximum latency, and percentage of slow queries (>1 ms). Also reports
+  # the FTL cache hit/miss ratio, indicating how often gravity.db is queried at all.
+  #
+  # Allowed values are:
+  #     true or false
+  performance = false
+
+  # Set all debug flags at once. This is a convenience option to enable all debug flags
+  # at once. Note that this option is not persistent, setting it to true will enable all
+  # *remaining* debug flags but unsetting it will disable *all* debug flags.
+  all = false
+
+# Configuration statistics:
+# 167 total entries out of which 150 entries are default
+# --> 17 entries are modified
+
diff --git a/docs/internal/implementation-plan.md b/docs/internal/implementation-plan.md
new file mode 100644
index 0000000..0b39319
--- /dev/null
+++ b/docs/internal/implementation-plan.md
@@ -0,0 +1,372 @@
+# Implementation Plan
+
+Phased rollout of the `infrastructure` mono-repo. Work through these phases in order
+after the initial push to Gitea. Each phase is independently completeable — the repo
+is usable after Phase 0 even if later phases aren't done yet.
+
+---
+
+## Phase 0: Initial push and git history migration
+
+**Goal:** Get the repo to Gitea and bring in existing repos with their commit histories.
+
+### 0.1 — Create Gitea repo and push
+
+```bash
+cd /home/wayne/repos/infrastructure
+git add -A
+git commit -m "Initial infrastructure mono-repo scaffold"
+
+# Create the repo on Gitea first (via web UI), then:
+git remote add origin git@gitea.lan.ddnsgeek.com:wayne/infrastructure.git
+git push -u origin main
+```
+
+### 0.2 — Migrate existing repos via git subtree
+
+`git subtree` merges another repo's history into a subdirectory. Run these in order.
+`--squash` collapses history into one merge commit (cleaner). Remove `--squash` if you
+want full per-commit history (makes the log noisier but preserves full blame).
+
+```bash
+# Main docker stack → stacks/docker/
+git subtree add --prefix=stacks/docker /home/wayne/repos/docker main --squash
+git push
+
+# Raspberry Pi stack → stacks/raspi/
+git subtree add --prefix=stacks/raspi /home/wayne/repos/raspi main --squash
+git push
+```
+
+> **Note:** `debian-configuration` is NOT imported via subtree — it's being dissolved.
+> Its content has been converted into Ansible roles in `ansible/roles/`. The original
+> repo should be archived in Gitea (Settings → Danger Zone → Archive) after Phase 3
+> is complete.
+
+### 0.3 — Install pre-commit hook locally
+
+```bash
+./scripts/install-hooks.sh
+```
+
+### 0.4 — Configure Gitea CI secrets
+
+In the Gitea repo → Settings → Secrets, add:
+
+| Secret name | Value |
+|-------------|-------|
+| `PROXMOX_ENDPOINT` | `https://pve1.sweet.home:8006/` |
+| `PROXMOX_API_TOKEN_ID` | Terraform API token ID (create in PVE if not exists) |
+| `PROXMOX_API_TOKEN_SECRET` | Terraform API token secret |
+| `DYNU_API_KEY` | Dynu API key |
+| `ANSIBLE_SSH_KEY` | Private SSH key for Ansible connections (base64 or raw PEM) |
+| `GOTIFY_URL` | `https://gotify.lan.ddnsgeek.com` |
+| `GOTIFY_TOKEN` | Gotify app token |
+
+**Creating a Proxmox API token for Terraform (if not already done):**
+```bash
+# On pve1 as root:
+pveum user add terraform@pve --comment "Terraform service account"
+pveum role add TerraformRole --privs "VM.Allocate VM.Clone VM.Config.CDROM VM.Config.CPU VM.Config.Cloudinit VM.Config.Disk VM.Config.HWType VM.Config.Memory VM.Config.Network VM.Config.Options VM.Monitor VM.Audit VM.PowerMgmt Datastore.AllocateSpace Datastore.Audit Pool.Allocate Sys.Audit Sys.Console Sys.Modify"
+pveum aclmod / -user terraform@pve -role TerraformRole
+pveum user token add terraform@pve tf --privsep=0
+# Copy the token secret — it's shown only once
+```
+
+---
+
+## Phase 1: Ansible — verify connectivity and run check mode
+
+**Goal:** Confirm Ansible can reach all managed hosts and produce clean check-mode output.
+
+### 1.1 — Install Ansible and collections
+
+```bash
+pip install ansible
+cd ansible
+ansible-galaxy collection install -r collections/requirements.yml
+```
+
+### 1.2 — Verify inventory and connectivity
+
+```bash
+cd ansible
+# List all hosts
+ansible all --list-hosts
+
+# Ping everything
+ansible-playbook playbooks/ping.yml
+```
+
+Fix any unreachable hosts (SSH key, hostname, `ansible_user`) before proceeding.
+
+### 1.3 — Run check mode against each host group
+
+```bash
+# Proxmox nodes
+ansible-playbook playbooks/proxmox.yml --check --diff --limit proxmox
+
+# FreeIPA (check only — install tasks are gated by ipa_installed check)
+ansible-playbook playbooks/freeipa.yml --check --diff
+
+# Raspberry Pi
+ansible-playbook playbooks/raspi.yml --check --diff
+```
+
+**Expected result:** `check` mode should show either "no changes" (already hardened) or
+show exactly the diffs you'd expect. If it shows unexpected changes, review the task
+and update the role defaults before applying.
+
+### 1.4 — Apply to pve-test first (sandbox validation)
+
+```bash
+ansible-playbook playbooks/proxmox.yml --limit pve-test.sweet.home
+```
+
+Verify the node is still reachable and the PVE web UI works before applying to pve1.
+
+### 1.5 — Apply to production hosts
+
+```bash
+# Confirm check mode looks clean, then:
+ansible-playbook playbooks/proxmox.yml --limit pve1.sweet.home
+ansible-playbook playbooks/raspi.yml
+```
+
+---
+
+## Phase 2: Terraform — import existing infrastructure state
+
+**Goal:** Bring existing Proxmox VMs and DNS records under Terraform state management,
+enabling drift detection.
+
+### 2.1 — Configure credentials
+
+```bash
+export TF_VAR_proxmox_endpoint="https://pve1.sweet.home:8006/"
+export TF_VAR_proxmox_api_token_id="terraform@pve!tf"
+export TF_VAR_proxmox_api_token_secret="<token>"
+```
+
+Or create `terraform/proxmox/terraform.tfvars` (this file is git-ignored):
+```hcl
+proxmox_endpoint           = "https://pve1.sweet.home:8006/"
+proxmox_api_token_id       = "terraform@pve!tf"
+proxmox_api_token_secret   = "<token>"
+```
+
+### 2.2 — Initialise Terraform workspaces
+
+```bash
+cd terraform/proxmox && terraform init
+cd ../dns && terraform init
+```
+
+### 2.3 — Verify existing resource blocks match live state
+
+The `terraform/proxmox/` workspace already has resource blocks for existing VMs
+(`docker.tf`, `nix-cache.tf`, `server-nixos.tf`, etc.) — these were generated from
+live state previously. Verify they're accurate:
+
+```bash
+cd terraform/proxmox
+# Check if state is already populated (it may not be on first run)
+terraform state list
+
+# If state is empty, import each existing VM:
+terraform import proxmox_virtual_environment_vm.docker pve/qemu/103
+terraform import proxmox_virtual_environment_vm.nix-cache pve/qemu/105
+terraform import proxmox_virtual_environment_vm.server-nixos pve/qemu/104
+# Add imports for any other VMs not yet in state
+# VMID reference: check 'qm list' on pve1
+```
+
+### 2.4 — Run plan and reconcile any drift
+
+```bash
+terraform plan
+```
+
+If plan shows changes, the `.tf` resource block differs from live state.
+Either update the `.tf` file to match (if the live state is correct) or apply
+to enforce the declared state. **Do not apply to production VMs without reviewing
+every planned change.**
+
+### 2.5 — DNS workspace
+
+```bash
+cd terraform/dns
+# Configure Dynu credentials if not already set:
+export TF_VAR_dynu_api_key="<api_key>"
+terraform plan
+```
+
+The DNS workspace already has the existing records imported. Verify no drift.
+
+### 2.6 — Verify drift detection works end-to-end
+
+Manually introduce a small change in the PVE UI (e.g. add a VM note) and run:
+```bash
+./scripts/drift-detect.sh --terraform
+```
+Confirm it detects the change. Revert it or update the `.tf` to match.
+
+---
+
+## Phase 3: NixOS flake migration
+
+**Goal:** Move the `nixos` repo into this mono-repo while keeping the flake fully functional.
+
+### 3.1 — Import with git subtree
+
+```bash
+git subtree add --prefix=nixos /home/wayne/repos/nixos main --squash
+git push
+```
+
+### 3.2 — Update the remote flake URL on all NixOS hosts
+
+The `Switch-nix` and `Test-nix` aliases on NixOS hosts reference the old Gitea URL.
+Update `nixos/variables.nix` (the `flakeUrl` variable) to point at the new path:
+
+```nix
+# Old:
+flakeUrl = "git+ssh://gitea.lan.ddnsgeek.com/wayne/nixos";
+# New:
+flakeUrl = "git+ssh://gitea.lan.ddnsgeek.com/wayne/infrastructure?dir=nixos";
+```
+
+Deploy the change to the `docker` LXC first (lowest risk), then remaining hosts.
+
+### 3.3 — Validate flake builds from subdirectory
+
+```bash
+nix build ./nixos#proxmox-docker
+nix build ./nixos#proxmox-nix-cache
+```
+
+### 3.4 — Archive the old nixos repo
+
+Once all hosts are rebuilding successfully from the new URL, archive the old repo:
+Gitea → `wayne/nixos` → Settings → Danger Zone → Archive Repository.
+
+---
+
+## Phase 4: Activate drift detection CI
+
+**Goal:** Daily automated drift checks running in Gitea CI with Gotify notifications.
+
+### 4.1 — Verify secrets are configured (from Phase 0.4)
+
+Trigger the `drift-detect` workflow manually from Gitea CI → Actions → Drift Detection.
+
+### 4.2 — Confirm first successful run
+
+Review the step summary in Gitea. Expected outcome on a clean run:
+- Terraform: "No changes. Infrastructure matches configuration."
+- Ansible: `changed=0` on all hosts
+
+### 4.3 — Test the notification path
+
+Temporarily modify a `.tf` resource (without applying) and trigger a manual run.
+Confirm the Gotify notification arrives.
+
+---
+
+## Phase 5: Documentation pipeline
+
+**Goal:** Auto-generated service catalog and host inventory, with both internal and external sites building on every push.
+
+### 5.1 — Install docs dependencies
+
+```bash
+pip install mkdocs mkdocs-material jinja2 pyyaml
+```
+
+### 5.2 — Test local build
+
+```bash
+./scripts/docs-build.sh
+./scripts/docs-build.sh --serve  # preview at http://localhost:8000
+```
+
+### 5.3 — Implement service catalog generator
+
+Create `scripts/generate-service-catalog.py`:
+- Parses all `docker-compose.yml` files under `stacks/`
+- Extracts service name, image, Traefik domain (from labels), network memberships
+- Outputs `docs/generated/service-catalog.md`
+
+Template for the output:
+```markdown
+# Service Catalog
+Auto-generated from compose files in stacks/.
+
+| Service | Image | Domain | Stack |
+|---------|-------|--------|-------|
+| traefik | traefik:latest | — | stacks/docker/core/traefik |
+| nextcloud-webapp | nextcloud:production | nextcloud.lan.ddnsgeek.com | stacks/docker/apps/nextcloud |
+...
+```
+
+### 5.4 — Configure docs deploy target
+
+Set these Gitea secrets (from Phase 0.4):
+- `PAGES_SSH_KEY` — key for rsync to the docs server
+- `PAGES_HOST` — user@host for rsync
+- `PAGES_PATH_INTERNAL` — path on the docs server for internal site
+
+Or use Gitea Pages if self-hosted Gitea supports it.
+
+---
+
+## Phase 6: Cleanup and archive
+
+**Goal:** Retire the old repos cleanly.
+
+### 6.1 — Verify nothing still references old repos
+
+- All NixOS hosts rebuilding from `infrastructure?dir=nixos` ✓
+- Docker stack deployed from `stacks/docker/` ✓
+- Ansible roles replacing debian-configuration scripts ✓
+
+### 6.2 — Archive deprecated repos
+
+Archive these repos on Gitea (makes them read-only, preserves history):
+- `wayne/debian-configuration` — content dissolved into `ansible/roles/`
+- `wayne/docker` — content migrated to `stacks/docker/`
+- `wayne/raspi` — content migrated to `stacks/raspi/`
+- `wayne/nixos` — migrated to `infrastructure/nixos/`
+
+Do NOT delete them — they have git history that may be useful for reference.
+
+### 6.3 — Update any external references
+
+- CLAUDE.md files in the old repos — add a note pointing to the new mono-repo
+- Any README links, bookmarks, or documentation that references the old repo URLs
+
+---
+
+## Ongoing: Adding new infrastructure
+
+### Adding a new Proxmox VM
+
+1. Add a resource block in `terraform/proxmox/<name>.tf`
+2. Run `terraform plan` → `terraform apply`
+3. Add the host to `ansible/inventory/hosts.yml`
+4. If NixOS: add to `nixos/hosts/<name>/host.nix`, run `./scripts/sync-host-keys.sh`
+5. Deploy: `nixos-rebuild switch --flake ./nixos#<target> --target-host <hostname>`
+
+### Adding a new Docker service
+
+1. Add a `docker-compose.yml` under `stacks/docker/apps/<service>/` or `stacks/docker/monitoring/<service>/`
+2. Add Traefik labels, networks, secrets (following existing service patterns)
+3. Update `stacks/docker/default-environment.env` if new env vars are needed
+4. Test: `./services-up.sh config` (validates interpolation), then `./services-up.sh up -d <service>`
+
+### Rotating credentials
+
+- Proxmox API token: create new, update Gitea secrets, delete old
+- Ansible SSH key: replace `ANSIBLE_SSH_KEY` secret, re-add public key to all hosts
+- Dynu API key: update `DYNU_API_KEY` secret in Gitea
+- NixOS SOPS secrets: use `nixos/scripts/rotate-admin-key.sh`
diff --git a/docs/internal/index.md b/docs/internal/index.md
new file mode 100644
index 0000000..000a557
--- /dev/null
+++ b/docs/internal/index.md
@@ -0,0 +1,25 @@
+# Infrastructure Documentation
+
+Internal documentation for the `sweet.home` homelab. Contains full topology, network
+details, credentials catalog (names only), and operational runbooks.
+
+## Quick links
+
+- [Architecture](architecture.md) — host map and service relationships
+- [Network Topology](network-topology.md) — VLANs, IPs, firewall rules
+- [Implementation Plan](implementation-plan.md) — phased rollout roadmap
+- [Host Inventory](generated/host-inventory.md) — auto-generated from Ansible inventory
+- [Service Catalog](generated/service-catalog.md) — auto-generated from compose files
+
+## Repo structure
+
+```
+infrastructure/
+├── terraform/     Infrastructure state (Proxmox VMs, DNS, Pi-hole)
+├── ansible/       Configuration management (non-NixOS hosts)
+├── nixos/         NixOS flake (all NixOS hosts)
+├── stacks/
+│   ├── docker/    Main app stack (Traefik, Nextcloud, Passbolt, Gitea…)
+│   └── raspi/     Raspberry Pi edge monitoring stack
+└── docs/          This documentation
+```
diff --git a/docs/internal/network-topology.md b/docs/internal/network-topology.md
new file mode 100644
index 0000000..4cb3de3
--- /dev/null
+++ b/docs/internal/network-topology.md
@@ -0,0 +1,53 @@
+# Network Topology
+
+## LAN segments
+
+| Subnet | VLAN | Purpose |
+|--------|------|---------|
+| `192.168.2.0/24` | (untagged/management) | Primary LAN — all host management interfaces |
+| `192.168.10.0/29` | VLAN 10 | HA cluster replication (Corosync ring, DRBD) — internal to pve1 |
+| `192.168.20.0/24` | VLAN 20 | HA storage-client (iSCSI/NFS) — internal to pve1 |
+
+## Host IP assignments
+
+| Host | IP | Role |
+|------|----|------|
+| `pve1.sweet.home` | (assigned by router) | Proxmox hypervisor |
+| `domain-controller.sweet.home` | `192.168.2.253` | FreeIPA server |
+| `pihole.sweet.home` | see Pi-hole admin | DNS/DHCP server |
+| `docker.sweet.home` | `192.168.2.225` | Docker app stack host |
+| `nix-cache.sweet.home` | `192.168.2.224` | Nix binary cache |
+| `pxe-boot.sweet.home` | `192.168.2.223` | PXE/TFTP/HTTP boot server |
+| `tailscale-router.sweet.home` | `192.168.2.222` | Tailscale subnet router |
+| `tor-relay.sweet.home` | `192.168.2.221` | Tor middle relay |
+| `ha-server-1.sweet.home` | `192.168.2.228` | HA cluster node 1 |
+| `ha-server-2.sweet.home` | `192.168.2.227` | HA cluster node 2 |
+| HA LAN VIP (Pacemaker) | `192.168.2.229` | Floating NFS/service VIP |
+| HA storage VIP (Pacemaker) | `192.168.20.229` | Docker iSCSI/NFS floating VIP |
+| `raspberrypi.tail13f623.ts.net` | Tailscale | Raspberry Pi (reachable via Tailnet) |
+
+## DNS architecture
+
+Pi-hole has been decommissioned. FreeIPA is now the sole DNS server for the LAN.
+
+```
+All LAN clients → FreeIPA (domain-controller.sweet.home — 192.168.2.253)
+    │
+    ├── *.sweet.home → IPA integrated DNS (authoritative)
+    └── Everything else → upstream resolvers (forwarded by FreeIPA)
+```
+
+PXE DHCP is handled by the `pxe-boot` LXC (dnsmasq in proxy mode for PXE chainloading only).
+General DHCP is handled by the router.
+
+## External access
+
+- Domain: `*.lan.ddnsgeek.com` → Dynamic DNS via Dynu → home WAN IP
+- TLS: LetsEncrypt via Traefik ACME (HTTP challenge)
+- Tailscale VPN: subnet router at `192.168.2.222` bridges Tailnet to LAN
+
+## Proxmox firewall
+
+Default-deny inbound on all Proxmox nodes.
+Management access (SSH port 22, web UI port 8006) from `192.168.2.0/24` only.
+See `ansible/roles/proxmox-hardening/templates/cluster-fw.j2` for the ruleset.
diff --git a/docs/internal/runbooks/drift-detection.md b/docs/internal/runbooks/drift-detection.md
new file mode 100644
index 0000000..31a9caa
--- /dev/null
+++ b/docs/internal/runbooks/drift-detection.md
@@ -0,0 +1,64 @@
+# Runbook: Drift Detection
+
+How to interpret and respond to drift detected by the CI pipeline or local script.
+
+## What is drift?
+
+**Terraform drift** — a Proxmox VM, DNS record, or Pi-hole entry exists in a different
+state than what's declared in the Terraform workspace. Common causes:
+- A VM was resized or reconfigured manually in the PVE web UI
+- A DNS record was added directly via Dynu or Pi-hole admin
+- A VM was deleted outside of Terraform
+
+**Ansible drift** — a host's configuration differs from what the Ansible role declares.
+Common causes:
+- A config file was edited by hand on the host
+- A package was installed/removed manually
+- A service was stopped/disabled without updating the role
+
+## CI workflow
+
+The `drift-detect` workflow runs daily at 06:00 AEST. If drift is detected, a Gotify
+notification is sent to the push notification dashboard. The step summary in Gitea CI
+contains the full `terraform plan` diff.
+
+## Responding to Terraform drift
+
+```bash
+# See exactly what changed
+cd terraform/proxmox
+terraform plan
+
+# Option A: The manual change was intentional — update the .tf file to match reality,
+# then run terraform apply to reconcile state
+vim proxmox/docker.tf  # update the resource to match current state
+terraform apply
+
+# Option B: The manual change was accidental — apply to restore declared state
+terraform apply  # will revert the manual change
+```
+
+## Responding to Ansible drift
+
+```bash
+# See exactly what would change
+cd ansible
+ansible-playbook playbooks/site.yml --check --diff --limit <drifted_host>
+
+# Apply to restore declared state
+ansible-playbook playbooks/site.yml --limit <drifted_host>
+```
+
+## Required Gitea secrets
+
+The following secrets must be configured in the Gitea repo for CI drift detection to work:
+
+| Secret | Used by |
+|--------|---------|
+| `PROXMOX_ENDPOINT` | Terraform proxmox workspace |
+| `PROXMOX_API_TOKEN_ID` | Terraform proxmox workspace |
+| `PROXMOX_API_TOKEN_SECRET` | Terraform proxmox workspace |
+| `DYNU_API_KEY` | Terraform dns workspace |
+| `ANSIBLE_SSH_KEY` | Ansible drift check |
+| `GOTIFY_URL` | Drift notifications |
+| `GOTIFY_TOKEN` | Drift notifications |
diff --git a/docs/internal/runbooks/new-host.md b/docs/internal/runbooks/new-host.md
new file mode 100644
index 0000000..ae2e467
--- /dev/null
+++ b/docs/internal/runbooks/new-host.md
@@ -0,0 +1,59 @@
+# Runbook: Provisioning a New Host
+
+Steps for adding a new machine to the infrastructure.
+
+## NixOS host on Proxmox
+
+```bash
+# 1. Use the PXE boot menu or installer ISO
+#    The auto-installer at pxe-boot.sweet.home presents all flake targets.
+
+# 2. Add to nixos/ flake if a new build-type is needed
+#    Otherwise pick the closest existing target (e.g. proxmox-minimal)
+
+# 3. Add SSH host key to clan vars (enables SOPS decryption)
+cd nixos
+./scripts/sync-host-keys.sh <target>
+
+# 4. Create the VM/LXC via Terraform
+cd ../terraform/proxmox
+# Add a resource block in the appropriate .tf file
+terraform plan
+terraform apply
+
+# 5. Deploy NixOS
+nixos-rebuild switch --flake ./nixos#<target> --target-host <hostname>
+```
+
+## Non-NixOS host (Proxmox VM)
+
+```bash
+# 1. Create VM in Proxmox (manually or via terraform)
+# 2. Add to ansible/inventory/hosts.yml with correct group
+# 3. Add SSH key, verify connectivity:
+ansible-playbook ansible/playbooks/ping.yml --limit <hostname>
+# 4. Apply the role:
+ansible-playbook ansible/playbooks/<role>.yml --limit <hostname> --check --diff
+ansible-playbook ansible/playbooks/<role>.yml --limit <hostname>
+```
+
+## Adding Ansible inventory entry
+
+```yaml
+# ansible/inventory/hosts.yml — under the appropriate group:
+new-host.sweet.home:
+  ansible_user: wayne
+  # any role-specific variables
+```
+
+## IPA enrollment (for any new host)
+
+```bash
+# On the new host (after OS install):
+sudo ipa-client-install \
+  --server=domain-controller.sweet.home \
+  --domain=sweet.home \
+  --realm=SWEET.HOME \
+  --principal=admin \
+  --mkhomedir
+```
diff --git a/docs/internal/runbooks/proxmox-hardening.md b/docs/internal/runbooks/proxmox-hardening.md
new file mode 100644
index 0000000..bc7fdec
--- /dev/null
+++ b/docs/internal/runbooks/proxmox-hardening.md
@@ -0,0 +1,52 @@
+# Runbook: Proxmox VE Hardening
+
+Applies Stage 1 hardening to a fresh Proxmox VE node using the `proxmox-hardening` Ansible role.
+
+## Pre-conditions
+
+- Fresh PVE install with root SSH access
+- SSH key already added to root's `authorized_keys`
+- Host added to `ansible/inventory/hosts.yml` under the `proxmox` group
+
+## Steps
+
+```bash
+# 1. Verify connectivity
+cd ansible
+ansible-playbook playbooks/ping.yml --limit <hostname>
+
+# 2. Dry-run to preview changes
+ansible-playbook playbooks/proxmox.yml --limit <hostname> --check --diff
+
+# 3. Review the diff output, then apply
+ansible-playbook playbooks/proxmox.yml --limit <hostname>
+
+# 4. Verify hardening state
+ansible-playbook playbooks/proxmox.yml --limit <hostname> --tags audit --check
+```
+
+## What gets applied
+
+1. **APT repos** — enterprise source disabled, no-subscription source enabled
+2. **SSH hardening** — `PermitRootLogin prohibit-password`, `PasswordAuthentication no`, fail2ban
+3. **Datacenter firewall** — default-deny inbound; SSH (22) and web UI (8006) from management CIDR only
+4. **Unattended upgrades** — security-only origins, no auto-reboot
+5. **Named admin user** — `<proxmox_admin_username>@pve` with Administrator role (one-time)
+6. **IPA sudo** — `admins` group gets NOPASSWD sudo for shell and PVE tools
+7. **Subscription nag** — cosmetic patch to remove the nag dialog
+
+## Variables to set per-host
+
+In `ansible/inventory/hosts.yml`:
+```yaml
+pve1.sweet.home:
+  proxmox_mgmt_cidr: "192.168.2.0/24"
+  proxmox_admin_username: wayne
+```
+
+## After hardening
+
+- Log into the PVE web UI as the named admin, change the initial password
+- Enable TOTP/2FA for both the named admin and root@pam
+- Verify with the audit script: `cd /home/wayne/repos/debian-configuration && proxmox/scripts/audit.sh`
+  (will migrate to an Ansible audit task in a future iteration)
diff --git a/docs/mkdocs-external.yml b/docs/mkdocs-external.yml
new file mode 100644
index 0000000..6fadb26
--- /dev/null
+++ b/docs/mkdocs-external.yml
@@ -0,0 +1,15 @@
+site_name: "Homelab"
+site_description: "Self-hosted infrastructure overview"
+docs_dir: external
+
+nav:
+  - Home: index.md
+  - Services: services.md
+
+theme:
+  name: material
+  palette:
+    scheme: default
+    primary: indigo
+
+# No internal IPs, hostnames, or credential references in external docs.
diff --git a/docs/mkdocs.yml b/docs/mkdocs.yml
new file mode 100644
index 0000000..458a148
--- /dev/null
+++ b/docs/mkdocs.yml
@@ -0,0 +1,30 @@
+site_name: "Infrastructure — Internal Docs"
+site_description: "Internal documentation for the sweet.home homelab infrastructure"
+docs_dir: internal
+
+nav:
+  - Home: index.md
+  - Architecture: architecture.md
+  - Network Topology: network-topology.md
+  - Runbooks:
+    - Proxmox Hardening: runbooks/proxmox-hardening.md
+    - FreeIPA Setup: runbooks/freeipa-setup.md
+    - New Host Provisioning: runbooks/new-host.md
+    - Drift Detection: runbooks/drift-detection.md
+  - Generated:
+    - Host Inventory: generated/host-inventory.md
+    - Service Catalog: generated/service-catalog.md
+
+theme:
+  name: material
+  palette:
+    scheme: slate
+    primary: indigo
+
+validation:
+  nav:
+    omitted_files: ignore
+
+exclude_docs: |
+  README.md
+  *.example
diff --git a/nixos/README.md b/nixos/README.md
new file mode 100644
index 0000000..1a3150f
--- /dev/null
+++ b/nixos/README.md
@@ -0,0 +1,49 @@
+# nixos/
+
+NixOS flake — manages all NixOS hosts via a platform × build-type matrix.
+This directory will be populated via `git subtree` from the existing `nixos` repo.
+
+## Migration (Phase 4 of implementation plan)
+
+```bash
+# From the repo root — do this once:
+git subtree add --prefix=nixos /home/wayne/repos/nixos main --squash
+
+# To pull future updates:
+git subtree pull --prefix=nixos /home/wayne/repos/nixos main --squash
+```
+
+## After migration
+
+The flake works from the subdirectory. Update references on NixOS hosts:
+
+```bash
+# The Switch-nix / Test-nix aliases reference the flake URL.
+# Update from (example):
+#   git+ssh://gitea.lan.ddnsgeek.com/wayne/nixos
+# To:
+#   git+ssh://gitea.lan.ddnsgeek.com/wayne/infrastructure?dir=nixos
+```
+
+## Hosts managed
+
+| Target | Role | Platform |
+|--------|------|---------|
+| `proxmox-docker` | Docker app stack host | Proxmox LXC |
+| `proxmox-nix-cache` | Nix binary cache + remote builder | Proxmox LXC |
+| `proxmox-pxe-boot` | Network boot server | Proxmox LXC |
+| `proxmox-tailscale-router` | Tailscale subnet router | Proxmox LXC |
+| `proxmox-ha-server-1/2` | HA file server cluster | Proxmox VMs |
+| `baremetal-gui` | Daily-driver workstation | Bare metal |
+
+## Key commands
+
+```bash
+# Build without switching (validate)
+nix build ./nixos#proxmox-docker
+
+# Deploy to a host
+nixos-rebuild switch --flake ./nixos#proxmox-docker --target-host docker.sweet.home
+
+# Or use the Switch-nix alias on the NixOS host itself
+```
diff --git a/scripts/check-secrets.sh b/scripts/check-secrets.sh
new file mode 100755
index 0000000..73f6c20
--- /dev/null
+++ b/scripts/check-secrets.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Run gitleaks against the full git history and staged changes.
+# Exits non-zero if any secrets are found.
+set -euo pipefail
+
+if ! command -v gitleaks &>/dev/null; then
+    echo "gitleaks not found. Install: https://github.com/gitleaks/gitleaks#installing" >&2
+    exit 1
+fi
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+echo "==> Scanning full git history..."
+gitleaks detect --config .gitleaks.toml --no-banner
+
+echo "==> Scanning staged changes..."
+gitleaks protect --staged --config .gitleaks.toml --no-banner
+
+echo "Secret scan passed."
diff --git a/scripts/docs-build.sh b/scripts/docs-build.sh
new file mode 100755
index 0000000..b3ba674
--- /dev/null
+++ b/scripts/docs-build.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Build infrastructure documentation.
+# Generates dynamic content then builds both internal and external MkDocs sites.
+#
+# Usage:
+#   ./scripts/docs-build.sh                  # generate + build both sites
+#   ./scripts/docs-build.sh --generate-only  # only regenerate dynamic content
+#   ./scripts/docs-build.sh --serve          # build + serve internal docs locally
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+GENERATE_ONLY=false
+SERVE=false
+for arg in "$@"; do
+    case "$arg" in
+        --generate-only) GENERATE_ONLY=true ;;
+        --serve)         SERVE=true ;;
+    esac
+done
+
+echo "==> Generating dynamic documentation..."
+
+# Service catalog from docker compose files
+if [ -d stacks/docker ]; then
+    python3 scripts/generate-service-catalog.py \
+        --stacks-dir stacks/ \
+        --output docs/generated/service-catalog.md 2>/dev/null || \
+        echo "  [skip] service catalog generator not yet implemented"
+fi
+
+# Host inventory from ansible
+python3 - <<'PYEOF' 2>/dev/null || echo "  [skip] inventory generator not yet implemented"
+import yaml, pathlib
+
+hosts_file = pathlib.Path("ansible/inventory/hosts.yml")
+out = pathlib.Path("docs/generated/host-inventory.md")
+out.parent.mkdir(parents=True, exist_ok=True)
+
+if hosts_file.exists():
+    data = yaml.safe_load(hosts_file.read_text())
+    lines = ["# Host Inventory\n", "Auto-generated from `ansible/inventory/hosts.yml`.\n\n"]
+    lines.append("| Host | Group | Role |\n|------|-------|------|\n")
+    def walk(node, parent=""):
+        if isinstance(node, dict):
+            for k, v in node.items():
+                if k == "hosts" and isinstance(v, dict):
+                    for host in v:
+                        lines.append(f"| `{host}` | `{parent}` | — |\n")
+                elif k not in ("vars", "children"):
+                    walk(v, k)
+                elif k == "children":
+                    walk(v, parent)
+    walk(data.get("all", {}))
+    out.write_text("".join(lines))
+    print(f"  Written {out}")
+PYEOF
+
+if [ "$GENERATE_ONLY" = true ]; then
+    echo "Dynamic content generated."
+    exit 0
+fi
+
+echo "==> Building internal documentation..."
+mkdocs build --config-file docs/mkdocs.yml --site-dir site/internal
+
+echo "==> Building external documentation..."
+mkdocs build --config-file docs/mkdocs-external.yml --site-dir site/external
+
+if [ "$SERVE" = true ]; then
+    echo "==> Serving internal docs at http://127.0.0.1:8000..."
+    mkdocs serve --config-file docs/mkdocs.yml
+fi
+
+echo "Documentation built successfully."
diff --git a/scripts/drift-detect.sh b/scripts/drift-detect.sh
new file mode 100755
index 0000000..a9908f4
--- /dev/null
+++ b/scripts/drift-detect.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Local drift detection runner.
+# Runs terraform plan (all workspaces) and ansible --check, then summarises.
+#
+# Usage:
+#   ./scripts/drift-detect.sh               # run everything
+#   ./scripts/drift-detect.sh --terraform   # terraform only
+#   ./scripts/drift-detect.sh --ansible     # ansible only
+#   ./scripts/drift-detect.sh --check-only  # alias for full run (no apply)
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+RUN_TF=true
+RUN_ANSIBLE=true
+
+for arg in "$@"; do
+    case "$arg" in
+        --terraform)    RUN_ANSIBLE=false ;;
+        --ansible)      RUN_TF=false ;;
+        --check-only)   ;;  # default, no-op
+        *) echo "Unknown flag: $arg" >&2; exit 1 ;;
+    esac
+done
+
+DRIFT_FOUND=0
+
+# ── Terraform ──────────────────────────────────────────────────────────────────
+
+if [ "$RUN_TF" = true ]; then
+    echo ""
+    echo "━━━ Terraform drift detection ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+    for workspace in terraform/proxmox terraform/dns terraform/pihole; do
+        if [ ! -f "${workspace}/providers.tf" ] && [ ! -f "${workspace}/provider.tf" ]; then
+            echo "[SKIP] ${workspace} — no providers.tf found"
+            continue
+        fi
+
+        echo ""
+        echo "--- ${workspace} ---"
+        (
+            cd "$workspace"
+            if [ ! -d .terraform ]; then
+                terraform init -input=false -no-color >/dev/null 2>&1
+            fi
+            set +e
+            terraform plan -detailed-exitcode -input=false -no-color
+            EXIT=$?
+            set -e
+            if [ "$EXIT" -eq 2 ]; then
+                echo "DRIFT: ${workspace} has pending changes"
+                DRIFT_FOUND=1
+            elif [ "$EXIT" -ne 0 ]; then
+                echo "ERROR in ${workspace} — plan failed (exit ${EXIT})"
+                DRIFT_FOUND=1
+            fi
+        )
+    done
+fi
+
+# ── Ansible ────────────────────────────────────────────────────────────────────
+
+if [ "$RUN_ANSIBLE" = true ]; then
+    echo ""
+    echo "━━━ Ansible drift detection (--check --diff) ━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+    (
+        cd ansible
+        ansible-playbook playbooks/site.yml --check --diff 2>&1 | tee /tmp/ansible-drift.log
+        if grep -q 'changed=' /tmp/ansible-drift.log; then
+            echo "DRIFT: Ansible found pending changes"
+            DRIFT_FOUND=1
+        fi
+    )
+fi
+
+# ── Summary ────────────────────────────────────────────────────────────────────
+
+echo ""
+echo "━━━ Summary ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+if [ "$DRIFT_FOUND" -eq 0 ]; then
+    echo "No drift detected. All infrastructure matches declared state."
+else
+    echo "Drift detected — review the plan output above."
+fi
+
+exit "$DRIFT_FOUND"
diff --git a/scripts/install-hooks.sh b/scripts/install-hooks.sh
new file mode 100755
index 0000000..08dcce5
--- /dev/null
+++ b/scripts/install-hooks.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Install git pre-commit hook that runs gitleaks before every commit.
+# Idempotent — safe to re-run.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+HOOK="${REPO_ROOT}/.git/hooks/pre-commit"
+
+cat > "$HOOK" <<'EOF'
+#!/usr/bin/env bash
+set -e
+if ! command -v gitleaks &>/dev/null; then
+    echo "gitleaks not found — skipping pre-commit secret scan"
+    echo "Install: https://github.com/gitleaks/gitleaks#installing"
+    exit 0
+fi
+exec gitleaks protect --staged --config .gitleaks.toml --no-banner
+EOF
+
+chmod +x "$HOOK"
+echo "Pre-commit hook installed at ${HOOK}"
diff --git a/stacks/docker/README.md b/stacks/docker/README.md
new file mode 100644
index 0000000..21d9512
--- /dev/null
+++ b/stacks/docker/README.md
@@ -0,0 +1,37 @@
+# stacks/docker/
+
+Main self-hosted application stack. This directory will be populated via `git subtree`
+from the existing `docker` repo to preserve full commit history.
+
+## Migration (Phase 1 of implementation plan)
+
+```bash
+# From the repo root — do this once after initial push to Gitea:
+git subtree add --prefix=stacks/docker /home/wayne/repos/docker main --squash
+
+# To pull future updates from the source repo:
+git subtree pull --prefix=stacks/docker /home/wayne/repos/docker main --squash
+```
+
+## Services
+
+Once migrated, this directory contains:
+
+| Layer | Services |
+|-------|---------|
+| `core/` | Traefik, Authelia, CrowdSec, Docker Socket Proxy, Error Pages |
+| `apps/` | Nextcloud, Passbolt, Gitea, Gramps Web, SearXNG |
+| `monitoring/` | Beszel, Gotify, Uptime Kuma, WUD |
+
+## Quick reference
+
+```bash
+# Start all services
+./services-up.sh up -d
+
+# Validate compose interpolation (no deployment)
+./services-up.sh config
+
+# Check status
+./services-up.sh ps
+```
diff --git a/stacks/raspi/README.md b/stacks/raspi/README.md
new file mode 100644
index 0000000..80e55a8
--- /dev/null
+++ b/stacks/raspi/README.md
@@ -0,0 +1,36 @@
+# stacks/raspi/
+
+Raspberry Pi edge monitoring stack. This directory will be populated via `git subtree`
+from the existing `raspi` repo to preserve full commit history.
+
+## Migration (Phase 1 of implementation plan)
+
+```bash
+# From the repo root — do this once after initial push to Gitea:
+git subtree add --prefix=stacks/raspi /home/wayne/repos/raspi main --squash
+
+# To pull future updates from the source repo:
+git subtree pull --prefix=stacks/raspi /home/wayne/repos/raspi main --squash
+```
+
+## Services
+
+| Service | Purpose |
+|---------|---------|
+| Traefik | Reverse proxy + TLS (LetsEncrypt) |
+| Uptime Kuma | Uptime monitoring dashboard |
+| CrowdSec | Threat detection (Traefik plugin) |
+| Beszel Agent | Host metrics → central hub on docker host |
+| Docker Socket Proxy | Secure Docker API access |
+
+## Deployment
+
+The Raspberry Pi is accessed via Tailscale (`raspberrypi.tail13f623.ts.net`).
+
+```bash
+# Deploy from within the raspi/ directory on the Pi:
+./services-up.sh up -d
+
+# Or from this workstation via SSH:
+ssh wayne@raspberrypi.tail13f623.ts.net "cd ~/raspi && ./services-up.sh up -d"
+```
diff --git a/terraform/.gitignore b/terraform/.gitignore
new file mode 100644
index 0000000..60bb0ee
--- /dev/null
+++ b/terraform/.gitignore
@@ -0,0 +1,14 @@
+.terraform/
+*.tfstate
+*.tfstate.*
+*.tfvars
+*.tfvars.json
+crash.log
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+*.tfplan
+plan.out
+state/
+artifacts/
diff --git a/terraform/README.md b/terraform/README.md
new file mode 100644
index 0000000..81add4d
--- /dev/null
+++ b/terraform/README.md
@@ -0,0 +1,52 @@
+# terraform/
+
+Infrastructure state management. Each subdirectory is an independent Terraform workspace
+with its own state backend.
+
+## Workspaces
+
+| Directory | What it manages | State backend |
+|-----------|----------------|---------------|
+| `proxmox/` | Proxmox VMs and LXCs on pve1 | Remote (configure in bootstrap/) |
+| `dns/` | Dynu dynamic DNS records | Remote |
+| `docker/` | Docker container catalog (documentation-only, read-only) | Local |
+| `bootstrap/` | Remote state backend resources | Local (chicken-and-egg) |
+
+## Usage
+
+```bash
+# Dry-run: show what would change
+cd terraform/proxmox
+terraform init
+terraform plan
+
+# Detect drift only (exit 2 = drift, exit 0 = in sync)
+terraform plan -detailed-exitcode
+
+# Apply (confirm first — always review the plan)
+terraform apply
+```
+
+## Credentials
+
+Never commit credentials. Use `terraform.tfvars` (git-ignored) or environment variables:
+
+```bash
+# Proxmox
+export TF_VAR_proxmox_endpoint="https://pve1.sweet.home:8006/"
+export TF_VAR_proxmox_api_token_id="terraform@pve!tf"
+export TF_VAR_proxmox_api_token_secret="<token>"
+
+# Dynu DNS
+export TF_VAR_dynu_api_key="<api_key>"
+```
+
+## Importing existing resources
+
+See `docs/internal/implementation-plan.md` Phase 2 for the `terraform import` commands
+to bring existing Proxmox resources under state management.
+
+## Drift detection
+
+The `drift-detect` CI workflow runs `terraform plan -detailed-exitcode` daily on all
+workspaces and sends a Gotify notification if any drift is detected.
diff --git a/terraform/bootstrap/backend.tf b/terraform/bootstrap/backend.tf
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/bootstrap/main.tf b/terraform/bootstrap/main.tf
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/bootstrap/outputs.tf b/terraform/bootstrap/outputs.tf
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/bootstrap/providers.tf b/terraform/bootstrap/providers.tf
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/bootstrap/variables.tf b/terraform/bootstrap/variables.tf
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/dns/README.md b/terraform/dns/README.md
new file mode 100644
index 0000000..3fa39ee
--- /dev/null
+++ b/terraform/dns/README.md
@@ -0,0 +1,187 @@
+# Dynu Terraform Layer (Brownfield DNS Reconciliation)
+
+This Terraform root is for **Dynu DNS brownfield reconciliation**. The intended pattern is:
+
+1. Import the existing root domain object.
+2. Read inventory through `data.dynu_dns_records.root`.
+3. Generate reviewable `dynu_dns_record` resources and import commands.
+4. Import every existing DNS record into matching Terraform resources.
+5. Use `terraform plan` as the reconciliation check before any apply.
+
+## Provider behavior to keep in mind
+
+- Source: `beatz174-bit/dynu`
+- `dynu_domain` import requires a **numeric Dynu domain ID**.
+- Importing `dynu_domain` imports only the root domain object.
+- It **does not** import DNS records/subdomains.
+- `dynu_dns_record` imports require `<domain_id>/<record_id>`.
+
+## Variables
+
+- `dynu_root_domain` (default: `lan.ddnsgeek.com`)
+- `dynu_api_key` (sensitive)
+- `dynu_username` / `dynu_password` (optional)
+
+## Safe validation commands
+
+```bash
+cd infrastructure/terraform/dynu
+terraform fmt -check -recursive
+terraform init -backend=false -input=false
+terraform validate
+python3 -m py_compile scripts/generate-brownfield-records.py
+```
+
+## Brownfield workflow
+
+```bash
+cd infrastructure/terraform/dynu
+
+terraform init
+terraform import dynu_domain.lan_ddnsgeek_com '<numeric-dynu-domain-id>'
+
+terraform apply -refresh-only
+terraform output -json dynu_dns_records > /tmp/dynu-records.json
+
+python3 scripts/generate-brownfield-records.py --dry-run
+python3 scripts/generate-brownfield-records.py --overwrite
+
+# Review generated/dynu_dns_records.generated.tf
+# Review generated/import-dynu-dns-records.sh
+
+bash generated/import-dynu-dns-records.sh
+
+terraform plan
+```
+
+## What each component means
+
+- `data.dynu_dns_records.root`: read-only live inventory from Dynu.
+- `generated/dynu_dns_records.generated.tf`: generated management-intent resources; includes `prevent_destroy = true` on each record.
+- `generated/import-dynu-dns-records.sh`: imports each discovered record to its generated `dynu_dns_record` address using `<domain_id>/<record_id>`.
+- `terraform plan` after imports: reconciliation checkpoint. Any create/update/delete must be reviewed manually before apply.
+
+## Generated artifacts
+
+The helper script writes these files under `generated/`:
+
+- `generated/dynu_dns_records_inventory.json`
+- `generated/dynu_dns_records.generated.tf`
+- `generated/import-dynu-dns-records.sh`
+
+These are generated outputs meant for operator review before use in production.
+
+
+### Generator output selection (interactive + automation)
+
+The brownfield generator defaults to Terraform output `dynu_dns_records`:
+
+```bash
+python3 scripts/generate-brownfield-records.py --dry-run
+```
+
+If the default output is missing/unusable and stdin is interactive, the script shows a picker of available Terraform outputs and indicates which ones are usable for DNS imports.
+
+```bash
+# Interactive mode: choose from available Terraform outputs
+python3 scripts/generate-brownfield-records.py --dry-run
+
+# Non-interactive mode: specify output explicitly
+python3 scripts/generate-brownfield-records.py \
+  --records-output dynu_dns_inventory \
+  --dry-run
+
+# Disable menu and fail fast
+python3 scripts/generate-brownfield-records.py \
+  --no-interactive \
+  --dry-run
+
+# Use saved terraform output JSON and choose interactively
+terraform output -json > generated/terraform-output.json
+python3 scripts/generate-brownfield-records.py \
+  --from-file generated/terraform-output.json \
+  --dry-run
+```
+
+Notes:
+
+- The menu shows Terraform outputs currently stored in state.
+- If newly added outputs do not appear, run:
+
+```bash
+terraform apply -refresh-only
+```
+
+- The selected output must contain real Dynu provider record fields:
+  - `id`
+  - `domain_id`
+  - `hostname`
+  - `record_type`
+
+## Troubleshooting
+
+### Plan shows a large wall of `+` values under outputs
+
+Cause:
+
+Terraform is planning to save **new output values** to state (for example, live records from `data.dynu_dns_records.root`). This is not creating DNS records by itself.
+
+How to verify:
+
+- Output-only changes appear under `Changes to Outputs`.
+- Real DNS changes appear as `dynu_dns_record` resource create/update/delete actions.
+
+Use:
+
+```bash
+terraform apply -refresh-only
+```
+
+to persist refreshed data source and output values only.
+
+### Error: `There is no function named "regexreplace"`
+
+Cause:
+
+`regexreplace` is not a Terraform function. Resource-name slugification should not be implemented in Terraform HCL for this workflow.
+
+Fix:
+
+- Keep `inventory.tf` focused on reading live records via `data.dynu_dns_records.root`.
+- Keep Terraform outputs simple (for example, `<domain_id>/<record_id>` mappings).
+- Let `scripts/generate-brownfield-records.py` generate Terraform-safe resource names with Python `tf_name(record)`.
+
+### Error: `'"'"'dynu_dns_records'"'"'`
+
+Cause:
+
+The helper script reads `terraform output -json` and expects an output named `dynu_dns_records`.
+
+Fix:
+
+```bash
+cd infrastructure/terraform/dynu
+terraform init
+terraform apply -refresh-only
+terraform output -json | jq 'keys'
+```
+
+Confirm `dynu_dns_records` appears in the key list.
+
+If it does not, check that the Terraform config contains:
+
+```hcl
+data "dynu_dns_records" "root" {
+  hostname = var.dynu_root_domain
+}
+
+output "dynu_dns_records" {
+  value = data.dynu_dns_records.root.records
+}
+```
+
+Then rerun:
+
+```bash
+python3 scripts/generate-brownfield-records.py --dry-run
+```
diff --git a/terraform/dns/domain_ids.tf.old b/terraform/dns/domain_ids.tf.old
new file mode 100644
index 0000000..618f007
--- /dev/null
+++ b/terraform/dns/domain_ids.tf.old
@@ -0,0 +1,7 @@
+data "dynu_domain" "lan" {
+  hostname = "lan.ddnsgeek.com"
+}
+
+output "dynu_domain_id" {
+  value = data.dynu_domain.lan.domain.id
+}
diff --git a/terraform/dns/domains.tf b/terraform/dns/domains.tf
new file mode 100644
index 0000000..cbb260d
--- /dev/null
+++ b/terraform/dns/domains.tf
@@ -0,0 +1,11 @@
+locals {
+  dynu_domain = var.dynu_root_domain
+}
+
+# Import-first resource skeleton for the production Dynu zone.
+# `name` is required by provider schema and can be reconciled after import.
+resource "dynu_domain" "lan_ddnsgeek_com" {
+  name = local.dynu_domain
+}
+
+
diff --git a/terraform/dns/dynu_dns_records.generated.tf b/terraform/dns/dynu_dns_records.generated.tf
new file mode 100644
index 0000000..fa5d985
--- /dev/null
+++ b/terraform/dns/dynu_dns_records.generated.tf
@@ -0,0 +1,518 @@
+# ---------------------------------------------------------------------------
+# GENERATED FILE - REVIEW BEFORE USE
+#
+# Generated from Dynu brownfield DNS inventory.
+# Do not blindly apply this file to production DNS.
+# Import records into Terraform state before allowing Terraform to manage them.
+# ---------------------------------------------------------------------------
+
+resource "dynu_dns_record" "auth_lan_ddnsgeek_com_a_18483099" {
+  hostname    = "auth.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "auth"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "auth_lan_ddnsgeek_com_a_19646048" {
+  hostname    = "auth.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "auth"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "edge_lan_ddnsgeek_com_a_10453241" {
+  hostname    = "edge.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "edge"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "edge_lan_ddnsgeek_com_a_19646062" {
+  hostname    = "edge.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "edge"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "familytree_lan_ddnsgeek_com_a_17017685" {
+  hostname    = "familytree.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "familytree"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "familytree_lan_ddnsgeek_com_a_19646056" {
+  hostname    = "familytree.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "familytree"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "gitea_lan_ddnsgeek_com_a_14682463" {
+  hostname    = "gitea.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "gitea"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "gitea_lan_ddnsgeek_com_a_19646063" {
+  hostname    = "gitea.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "gitea"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "gotify_lan_ddnsgeek_com_a_17439061" {
+  hostname    = "gotify.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "gotify"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "gotify_lan_ddnsgeek_com_a_19646047" {
+  hostname    = "gotify.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "gotify"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "grafana_lan_ddnsgeek_com_a_18113762" {
+  hostname    = "grafana.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "grafana"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "grafana_lan_ddnsgeek_com_a_19646050" {
+  hostname    = "grafana.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "grafana"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "influxdb_lan_ddnsgeek_com_a_18562198" {
+  hostname    = "influxdb.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "influxdb"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "influxdb_lan_ddnsgeek_com_a_19646059" {
+  hostname    = "influxdb.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "influxdb"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "kuma_lan_ddnsgeek_com_a_17454978" {
+  hostname    = "kuma.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 90
+  enabled     = true
+  content     = "120.155.99.146"
+  node_name   = "kuma"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "lan_ddnsgeek_com_soa_8299670" {
+  hostname    = "lan.ddnsgeek.com"
+  record_type = "SOA"
+  ttl         = 120
+  enabled     = true
+  content     = "ns1.dynu.com. administrator.dynu.com. 0 3600 900 604800 300"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "monitor_kuma_lan_ddnsgeek_com_a_17462342" {
+  hostname    = "monitor-kuma.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "monitor-kuma"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "monitor_kuma_lan_ddnsgeek_com_a_19646051" {
+  hostname    = "monitor-kuma.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "monitor-kuma"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "mtls_bridge_lan_ddnsgeek_com_a_19232643" {
+  hostname    = "mtls-bridge.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "mtls-bridge"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "mtls_bridge_lan_ddnsgeek_com_a_19646058" {
+  hostname    = "mtls-bridge.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "mtls-bridge"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "nextcloud_lan_ddnsgeek_com_a_10453260" {
+  hostname    = "nextcloud.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "nextcloud"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "nextcloud_lan_ddnsgeek_com_a_19646057" {
+  hostname    = "nextcloud.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "nextcloud"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "node_red_lan_ddnsgeek_com_a_19041230" {
+  hostname    = "node-red.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "node-red"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "node_red_lan_ddnsgeek_com_a_19646053" {
+  hostname    = "node-red.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "node-red"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "passbolt_lan_ddnsgeek_com_a_10453262" {
+  hostname    = "passbolt.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "passbolt"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "passbolt_lan_ddnsgeek_com_a_19646049" {
+  hostname    = "passbolt.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "passbolt"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "portainer_lan_ddnsgeek_com_a_17458810" {
+  hostname    = "portainer.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "portainer"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "portainer_lan_ddnsgeek_com_a_19646046" {
+  hostname    = "portainer.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "portainer"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "prometheus_lan_ddnsgeek_com_a_18483311" {
+  hostname    = "prometheus.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "prometheus"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "prometheus_lan_ddnsgeek_com_a_19646061" {
+  hostname    = "prometheus.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "prometheus"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "searxng_lan_ddnsgeek_com_a_10453263" {
+  hostname    = "searxng.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "searxng"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "searxng_lan_ddnsgeek_com_a_19646055" {
+  hostname    = "searxng.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "searxng"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "shifts_lan_ddnsgeek_com_a_15901565" {
+  hostname    = "shifts.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "shifts"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "shifts_lan_ddnsgeek_com_a_19646052" {
+  hostname    = "shifts.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "shifts"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "stockfill_lan_ddnsgeek_com_a_17081867" {
+  hostname    = "stockfill.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "stockfill"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "stockfill_lan_ddnsgeek_com_a_19646060" {
+  hostname    = "stockfill.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "stockfill"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "traefik_lan_ddnsgeek_com_a_10453240" {
+  hostname    = "traefik.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name   = "traefik"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "traefik_lan_ddnsgeek_com_a_19646054" {
+  hostname    = "traefik.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group       = "home"
+  node_name   = "traefik"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
diff --git a/terraform/dns/generated/dynu_dns_records.generated.tf b/terraform/dns/generated/dynu_dns_records.generated.tf
new file mode 100644
index 0000000..cf73bbc
--- /dev/null
+++ b/terraform/dns/generated/dynu_dns_records.generated.tf
@@ -0,0 +1,518 @@
+# ---------------------------------------------------------------------------
+# GENERATED FILE - REVIEW BEFORE USE
+#
+# Generated from Dynu brownfield DNS inventory.
+# Do not blindly apply this file to production DNS.
+# Import records into Terraform state before allowing Terraform to manage them.
+# ---------------------------------------------------------------------------
+
+resource "dynu_dns_record" "auth_lan_ddnsgeek_com_a_18483099" {
+  hostname    = "auth.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "auth"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "auth_lan_ddnsgeek_com_a_19646048" {
+  hostname    = "auth.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "auth"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "edge_lan_ddnsgeek_com_a_10453241" {
+  hostname    = "edge.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "edge"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "edge_lan_ddnsgeek_com_a_19646062" {
+  hostname    = "edge.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "edge"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "familytree_lan_ddnsgeek_com_a_17017685" {
+  hostname    = "familytree.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "familytree"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "familytree_lan_ddnsgeek_com_a_19646056" {
+  hostname    = "familytree.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "familytree"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "gitea_lan_ddnsgeek_com_a_14682463" {
+  hostname    = "gitea.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "gitea"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "gitea_lan_ddnsgeek_com_a_19646063" {
+  hostname    = "gitea.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "gitea"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "gotify_lan_ddnsgeek_com_a_17439061" {
+  hostname    = "gotify.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "gotify"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "gotify_lan_ddnsgeek_com_a_19646047" {
+  hostname    = "gotify.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "gotify"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "grafana_lan_ddnsgeek_com_a_18113762" {
+  hostname    = "grafana.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "grafana"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "grafana_lan_ddnsgeek_com_a_19646050" {
+  hostname    = "grafana.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "grafana"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "influxdb_lan_ddnsgeek_com_a_18562198" {
+  hostname    = "influxdb.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "influxdb"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "influxdb_lan_ddnsgeek_com_a_19646059" {
+  hostname    = "influxdb.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "influxdb"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "kuma_lan_ddnsgeek_com_a_17454978" {
+  hostname    = "kuma.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 60
+  enabled     = true
+  content     = "120.155.99.146"
+  node_name  = "kuma"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "lan_ddnsgeek_com_soa_8299670" {
+  hostname    = "lan.ddnsgeek.com"
+  record_type = "SOA"
+  ttl         = 120
+  enabled     = true
+  content     = "ns1.dynu.com. administrator.dynu.com. 0 3600 900 604800 300"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "monitor_kuma_lan_ddnsgeek_com_a_17462342" {
+  hostname    = "monitor-kuma.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "monitor-kuma"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "monitor_kuma_lan_ddnsgeek_com_a_19646051" {
+  hostname    = "monitor-kuma.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "monitor-kuma"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "mtls_bridge_lan_ddnsgeek_com_a_19232643" {
+  hostname    = "mtls-bridge.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "mtls-bridge"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "mtls_bridge_lan_ddnsgeek_com_a_19646058" {
+  hostname    = "mtls-bridge.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "mtls-bridge"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "nextcloud_lan_ddnsgeek_com_a_10453260" {
+  hostname    = "nextcloud.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "nextcloud"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "nextcloud_lan_ddnsgeek_com_a_19646057" {
+  hostname    = "nextcloud.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "nextcloud"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "node_red_lan_ddnsgeek_com_a_19041230" {
+  hostname    = "node-red.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "node-red"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "node_red_lan_ddnsgeek_com_a_19646053" {
+  hostname    = "node-red.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "node-red"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "passbolt_lan_ddnsgeek_com_a_10453262" {
+  hostname    = "passbolt.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "passbolt"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "passbolt_lan_ddnsgeek_com_a_19646049" {
+  hostname    = "passbolt.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "passbolt"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "portainer_lan_ddnsgeek_com_a_17458810" {
+  hostname    = "portainer.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "portainer"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "portainer_lan_ddnsgeek_com_a_19646046" {
+  hostname    = "portainer.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "portainer"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "prometheus_lan_ddnsgeek_com_a_18483311" {
+  hostname    = "prometheus.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "prometheus"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "prometheus_lan_ddnsgeek_com_a_19646061" {
+  hostname    = "prometheus.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "prometheus"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "searxng_lan_ddnsgeek_com_a_10453263" {
+  hostname    = "searxng.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "searxng"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "searxng_lan_ddnsgeek_com_a_19646055" {
+  hostname    = "searxng.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "searxng"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "shifts_lan_ddnsgeek_com_a_15901565" {
+  hostname    = "shifts.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "shifts"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "shifts_lan_ddnsgeek_com_a_19646052" {
+  hostname    = "shifts.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "shifts"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "stockfill_lan_ddnsgeek_com_a_17081867" {
+  hostname    = "stockfill.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "stockfill"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "stockfill_lan_ddnsgeek_com_a_19646060" {
+  hostname    = "stockfill.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "stockfill"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "traefik_lan_ddnsgeek_com_a_10453240" {
+  hostname    = "traefik.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  dynamic     = true
+  node_name  = "traefik"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "dynu_dns_record" "traefik_lan_ddnsgeek_com_a_19646054" {
+  hostname    = "traefik.lan.ddnsgeek.com"
+  record_type = "A"
+  ttl         = 120
+  enabled     = true
+  content     = "167.179.167.166"
+  group      = "home"
+  node_name  = "traefik"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
diff --git a/terraform/dns/generated/dynu_dns_records_inventory.json b/terraform/dns/generated/dynu_dns_records_inventory.json
new file mode 100644
index 0000000..199ea75
--- /dev/null
+++ b/terraform/dns/generated/dynu_dns_records_inventory.json
@@ -0,0 +1 @@
+{"domain":"lan.ddnsgeek.com","provider":"dynu","record_count":15,"records":{"auth":{"fqdn":"auth.lan.ddnsgeek.com","hostname":"auth","proxied":null,"purpose":"Authentication portal","record_type":null,"service":"authelia","source":"core/authelia/docker-compose.yml","target":null,"ttl":null},"familytree":{"fqdn":"familytree.lan.ddnsgeek.com","hostname":"familytree","proxied":null,"purpose":"Family tree application","record_type":null,"service":"gramps","source":"apps/gramps/docker-compose.yml","target":null,"ttl":null},"gitea":{"fqdn":"gitea.lan.ddnsgeek.com","hostname":"gitea","proxied":null,"purpose":"Gitea service endpoint","record_type":null,"service":"gitea","source":"apps/gitea/docker-compose.yml","target":null,"ttl":null},"gotify":{"fqdn":"gotify.lan.ddnsgeek.com","hostname":"gotify","proxied":null,"purpose":"Gotify notifications","record_type":null,"service":"gotify","source":"monitoring/gotify/docker-compose.yml","target":null,"ttl":null},"grafana":{"fqdn":"grafana.lan.ddnsgeek.com","hostname":"grafana","proxied":null,"purpose":"Grafana monitoring UI","record_type":null,"service":"grafana","source":"monitoring/grafana/docker-compose.yml","target":null,"ttl":null},"influxdb":{"fqdn":"influxdb.lan.ddnsgeek.com","hostname":"influxdb","proxied":null,"purpose":"InfluxDB metrics endpoint","record_type":null,"service":"influxdb","source":"monitoring/influxdb/docker-compose.yml","target":null,"ttl":null},"monitor_kuma":{"fqdn":"monitor-kuma.lan.ddnsgeek.com","hostname":"monitor-kuma","proxied":null,"purpose":"Uptime Kuma monitoring UI","record_type":null,"service":"uptime-kuma","source":"monitoring/uptime-kuma/docker-compose.yml","target":null,"ttl":null},"mtls_bridge":{"fqdn":"mtls-bridge.lan.ddnsgeek.com","hostname":"mtls-bridge","proxied":null,"purpose":"mTLS bridge API","record_type":null,"service":"mtls-bridge","source":"monitoring/mtls-bridge/docker-compose.yml","target":null,"ttl":null},"nextcloud":{"fqdn":"nextcloud.lan.ddnsgeek.com","hostname":"nextcloud","proxied":null,"purpose":"Nextcloud service endpoint","record_type":null,"service":"nextcloud-webapp","source":"apps/nextcloud/docker-compose.yml","target":null,"ttl":null},"node_red":{"fqdn":"node-red.lan.ddnsgeek.com","hostname":"node-red","proxied":null,"purpose":"Node-RED automation UI/API","record_type":null,"service":"node-red","source":"monitoring/node-red/docker-compose.yml","target":null,"ttl":null},"passbolt":{"fqdn":"passbolt.lan.ddnsgeek.com","hostname":"passbolt","proxied":null,"purpose":"Passbolt password management","record_type":null,"service":"passbolt-webapp","source":"apps/passbolt/docker-compose.yml","target":null,"ttl":null},"portainer":{"fqdn":"portainer.lan.ddnsgeek.com","hostname":"portainer","proxied":null,"purpose":"Portainer admin endpoint","record_type":null,"service":"portainer","source":"monitoring/portainer/docker-compose.yml","target":null,"ttl":null},"prometheus":{"fqdn":"prometheus.lan.ddnsgeek.com","hostname":"prometheus","proxied":null,"purpose":"Prometheus metrics endpoint","record_type":null,"service":"prometheus","source":"monitoring/prometheus/docker-compose.yml","target":null,"ttl":null},"searxng":{"fqdn":"searxng.lan.ddnsgeek.com","hostname":"searxng","proxied":null,"purpose":"SearXNG search endpoint","record_type":null,"service":"searxng","source":"apps/searxng/docker-compose.yml","target":null,"ttl":null},"traefik":{"fqdn":"traefik.lan.ddnsgeek.com","hostname":"traefik","proxied":null,"purpose":"Traefik dashboard/API endpoint","record_type":null,"service":"traefik","source":"core/traefik/docker-compose.yml","target":null,"ttl":null}}}
diff --git a/terraform/dns/generated/import-dynu-dns-records.sh b/terraform/dns/generated/import-dynu-dns-records.sh
new file mode 100755
index 0000000..397185a
--- /dev/null
+++ b/terraform/dns/generated/import-dynu-dns-records.sh
@@ -0,0 +1,243 @@
+#!/usr/bin/env bash
+# ---------------------------------------------------------------------------
+# GENERATED FILE - REVIEW BEFORE USE
+#
+# Imports existing Dynu DNS records into Terraform state.
+# Does not apply changes.
+# ---------------------------------------------------------------------------
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TF_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+cd "${TF_ROOT}"
+
+# Re-running imports will fail for resources already in state.
+# This script skips imports when state already contains the resource address.
+
+if terraform state show 'dynu_dns_record.auth_lan_ddnsgeek_com_a_18483099' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.auth_lan_ddnsgeek_com_a_18483099'
+else
+  terraform import 'dynu_dns_record.auth_lan_ddnsgeek_com_a_18483099' '9695470/18483099'
+fi
+
+if terraform state show 'dynu_dns_record.auth_lan_ddnsgeek_com_a_19646048' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.auth_lan_ddnsgeek_com_a_19646048'
+else
+  terraform import 'dynu_dns_record.auth_lan_ddnsgeek_com_a_19646048' '9695470/19646048'
+fi
+
+if terraform state show 'dynu_dns_record.edge_lan_ddnsgeek_com_a_10453241' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.edge_lan_ddnsgeek_com_a_10453241'
+else
+  terraform import 'dynu_dns_record.edge_lan_ddnsgeek_com_a_10453241' '9695470/10453241'
+fi
+
+if terraform state show 'dynu_dns_record.edge_lan_ddnsgeek_com_a_19646062' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.edge_lan_ddnsgeek_com_a_19646062'
+else
+  terraform import 'dynu_dns_record.edge_lan_ddnsgeek_com_a_19646062' '9695470/19646062'
+fi
+
+if terraform state show 'dynu_dns_record.familytree_lan_ddnsgeek_com_a_17017685' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.familytree_lan_ddnsgeek_com_a_17017685'
+else
+  terraform import 'dynu_dns_record.familytree_lan_ddnsgeek_com_a_17017685' '9695470/17017685'
+fi
+
+if terraform state show 'dynu_dns_record.familytree_lan_ddnsgeek_com_a_19646056' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.familytree_lan_ddnsgeek_com_a_19646056'
+else
+  terraform import 'dynu_dns_record.familytree_lan_ddnsgeek_com_a_19646056' '9695470/19646056'
+fi
+
+if terraform state show 'dynu_dns_record.gitea_lan_ddnsgeek_com_a_14682463' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.gitea_lan_ddnsgeek_com_a_14682463'
+else
+  terraform import 'dynu_dns_record.gitea_lan_ddnsgeek_com_a_14682463' '9695470/14682463'
+fi
+
+if terraform state show 'dynu_dns_record.gitea_lan_ddnsgeek_com_a_19646063' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.gitea_lan_ddnsgeek_com_a_19646063'
+else
+  terraform import 'dynu_dns_record.gitea_lan_ddnsgeek_com_a_19646063' '9695470/19646063'
+fi
+
+if terraform state show 'dynu_dns_record.gotify_lan_ddnsgeek_com_a_17439061' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.gotify_lan_ddnsgeek_com_a_17439061'
+else
+  terraform import 'dynu_dns_record.gotify_lan_ddnsgeek_com_a_17439061' '9695470/17439061'
+fi
+
+if terraform state show 'dynu_dns_record.gotify_lan_ddnsgeek_com_a_19646047' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.gotify_lan_ddnsgeek_com_a_19646047'
+else
+  terraform import 'dynu_dns_record.gotify_lan_ddnsgeek_com_a_19646047' '9695470/19646047'
+fi
+
+if terraform state show 'dynu_dns_record.grafana_lan_ddnsgeek_com_a_18113762' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.grafana_lan_ddnsgeek_com_a_18113762'
+else
+  terraform import 'dynu_dns_record.grafana_lan_ddnsgeek_com_a_18113762' '9695470/18113762'
+fi
+
+if terraform state show 'dynu_dns_record.grafana_lan_ddnsgeek_com_a_19646050' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.grafana_lan_ddnsgeek_com_a_19646050'
+else
+  terraform import 'dynu_dns_record.grafana_lan_ddnsgeek_com_a_19646050' '9695470/19646050'
+fi
+
+if terraform state show 'dynu_dns_record.influxdb_lan_ddnsgeek_com_a_18562198' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.influxdb_lan_ddnsgeek_com_a_18562198'
+else
+  terraform import 'dynu_dns_record.influxdb_lan_ddnsgeek_com_a_18562198' '9695470/18562198'
+fi
+
+if terraform state show 'dynu_dns_record.influxdb_lan_ddnsgeek_com_a_19646059' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.influxdb_lan_ddnsgeek_com_a_19646059'
+else
+  terraform import 'dynu_dns_record.influxdb_lan_ddnsgeek_com_a_19646059' '9695470/19646059'
+fi
+
+if terraform state show 'dynu_dns_record.kuma_lan_ddnsgeek_com_a_17454978' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.kuma_lan_ddnsgeek_com_a_17454978'
+else
+  terraform import 'dynu_dns_record.kuma_lan_ddnsgeek_com_a_17454978' '9695470/17454978'
+fi
+
+if terraform state show 'dynu_dns_record.lan_ddnsgeek_com_soa_8299670' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.lan_ddnsgeek_com_soa_8299670'
+else
+  terraform import 'dynu_dns_record.lan_ddnsgeek_com_soa_8299670' '9695470/8299670'
+fi
+
+if terraform state show 'dynu_dns_record.monitor_kuma_lan_ddnsgeek_com_a_17462342' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.monitor_kuma_lan_ddnsgeek_com_a_17462342'
+else
+  terraform import 'dynu_dns_record.monitor_kuma_lan_ddnsgeek_com_a_17462342' '9695470/17462342'
+fi
+
+if terraform state show 'dynu_dns_record.monitor_kuma_lan_ddnsgeek_com_a_19646051' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.monitor_kuma_lan_ddnsgeek_com_a_19646051'
+else
+  terraform import 'dynu_dns_record.monitor_kuma_lan_ddnsgeek_com_a_19646051' '9695470/19646051'
+fi
+
+if terraform state show 'dynu_dns_record.mtls_bridge_lan_ddnsgeek_com_a_19232643' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.mtls_bridge_lan_ddnsgeek_com_a_19232643'
+else
+  terraform import 'dynu_dns_record.mtls_bridge_lan_ddnsgeek_com_a_19232643' '9695470/19232643'
+fi
+
+if terraform state show 'dynu_dns_record.mtls_bridge_lan_ddnsgeek_com_a_19646058' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.mtls_bridge_lan_ddnsgeek_com_a_19646058'
+else
+  terraform import 'dynu_dns_record.mtls_bridge_lan_ddnsgeek_com_a_19646058' '9695470/19646058'
+fi
+
+if terraform state show 'dynu_dns_record.nextcloud_lan_ddnsgeek_com_a_10453260' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.nextcloud_lan_ddnsgeek_com_a_10453260'
+else
+  terraform import 'dynu_dns_record.nextcloud_lan_ddnsgeek_com_a_10453260' '9695470/10453260'
+fi
+
+if terraform state show 'dynu_dns_record.nextcloud_lan_ddnsgeek_com_a_19646057' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.nextcloud_lan_ddnsgeek_com_a_19646057'
+else
+  terraform import 'dynu_dns_record.nextcloud_lan_ddnsgeek_com_a_19646057' '9695470/19646057'
+fi
+
+if terraform state show 'dynu_dns_record.node_red_lan_ddnsgeek_com_a_19041230' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.node_red_lan_ddnsgeek_com_a_19041230'
+else
+  terraform import 'dynu_dns_record.node_red_lan_ddnsgeek_com_a_19041230' '9695470/19041230'
+fi
+
+if terraform state show 'dynu_dns_record.node_red_lan_ddnsgeek_com_a_19646053' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.node_red_lan_ddnsgeek_com_a_19646053'
+else
+  terraform import 'dynu_dns_record.node_red_lan_ddnsgeek_com_a_19646053' '9695470/19646053'
+fi
+
+if terraform state show 'dynu_dns_record.passbolt_lan_ddnsgeek_com_a_10453262' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.passbolt_lan_ddnsgeek_com_a_10453262'
+else
+  terraform import 'dynu_dns_record.passbolt_lan_ddnsgeek_com_a_10453262' '9695470/10453262'
+fi
+
+if terraform state show 'dynu_dns_record.passbolt_lan_ddnsgeek_com_a_19646049' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.passbolt_lan_ddnsgeek_com_a_19646049'
+else
+  terraform import 'dynu_dns_record.passbolt_lan_ddnsgeek_com_a_19646049' '9695470/19646049'
+fi
+
+if terraform state show 'dynu_dns_record.portainer_lan_ddnsgeek_com_a_17458810' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.portainer_lan_ddnsgeek_com_a_17458810'
+else
+  terraform import 'dynu_dns_record.portainer_lan_ddnsgeek_com_a_17458810' '9695470/17458810'
+fi
+
+if terraform state show 'dynu_dns_record.portainer_lan_ddnsgeek_com_a_19646046' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.portainer_lan_ddnsgeek_com_a_19646046'
+else
+  terraform import 'dynu_dns_record.portainer_lan_ddnsgeek_com_a_19646046' '9695470/19646046'
+fi
+
+if terraform state show 'dynu_dns_record.prometheus_lan_ddnsgeek_com_a_18483311' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.prometheus_lan_ddnsgeek_com_a_18483311'
+else
+  terraform import 'dynu_dns_record.prometheus_lan_ddnsgeek_com_a_18483311' '9695470/18483311'
+fi
+
+if terraform state show 'dynu_dns_record.prometheus_lan_ddnsgeek_com_a_19646061' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.prometheus_lan_ddnsgeek_com_a_19646061'
+else
+  terraform import 'dynu_dns_record.prometheus_lan_ddnsgeek_com_a_19646061' '9695470/19646061'
+fi
+
+if terraform state show 'dynu_dns_record.searxng_lan_ddnsgeek_com_a_10453263' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.searxng_lan_ddnsgeek_com_a_10453263'
+else
+  terraform import 'dynu_dns_record.searxng_lan_ddnsgeek_com_a_10453263' '9695470/10453263'
+fi
+
+if terraform state show 'dynu_dns_record.searxng_lan_ddnsgeek_com_a_19646055' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.searxng_lan_ddnsgeek_com_a_19646055'
+else
+  terraform import 'dynu_dns_record.searxng_lan_ddnsgeek_com_a_19646055' '9695470/19646055'
+fi
+
+if terraform state show 'dynu_dns_record.shifts_lan_ddnsgeek_com_a_15901565' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.shifts_lan_ddnsgeek_com_a_15901565'
+else
+  terraform import 'dynu_dns_record.shifts_lan_ddnsgeek_com_a_15901565' '9695470/15901565'
+fi
+
+if terraform state show 'dynu_dns_record.shifts_lan_ddnsgeek_com_a_19646052' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.shifts_lan_ddnsgeek_com_a_19646052'
+else
+  terraform import 'dynu_dns_record.shifts_lan_ddnsgeek_com_a_19646052' '9695470/19646052'
+fi
+
+if terraform state show 'dynu_dns_record.stockfill_lan_ddnsgeek_com_a_17081867' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.stockfill_lan_ddnsgeek_com_a_17081867'
+else
+  terraform import 'dynu_dns_record.stockfill_lan_ddnsgeek_com_a_17081867' '9695470/17081867'
+fi
+
+if terraform state show 'dynu_dns_record.stockfill_lan_ddnsgeek_com_a_19646060' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.stockfill_lan_ddnsgeek_com_a_19646060'
+else
+  terraform import 'dynu_dns_record.stockfill_lan_ddnsgeek_com_a_19646060' '9695470/19646060'
+fi
+
+if terraform state show 'dynu_dns_record.traefik_lan_ddnsgeek_com_a_10453240' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.traefik_lan_ddnsgeek_com_a_10453240'
+else
+  terraform import 'dynu_dns_record.traefik_lan_ddnsgeek_com_a_10453240' '9695470/10453240'
+fi
+
+if terraform state show 'dynu_dns_record.traefik_lan_ddnsgeek_com_a_19646054' >/dev/null 2>&1; then
+  echo 'Skipping already imported: dynu_dns_record.traefik_lan_ddnsgeek_com_a_19646054'
+else
+  terraform import 'dynu_dns_record.traefik_lan_ddnsgeek_com_a_19646054' '9695470/19646054'
+fi
diff --git a/terraform/dns/imports.tf.example b/terraform/dns/imports.tf.example
new file mode 100644
index 0000000..d41f3df
--- /dev/null
+++ b/terraform/dns/imports.tf.example
@@ -0,0 +1,16 @@
+# Copy this file to imports.tf and adjust IDs after confirming the
+# published provider docs for import ID formats.
+# For dynu_domain, import ID is commonly the root domain name.
+
+import {
+  to = dynu_domain.lan_ddnsgeek_com
+  id = var.dynu_root_domain
+}
+
+# DNS record imports are intentionally examples only because the provider
+# requires explicit record_type/hostname in config before import.
+#
+# import {
+#   to = dynu_dns_record.grafana_lan_ddnsgeek_com
+#   id = var.dynu_record_import_id
+# }
diff --git a/terraform/dns/inventory.tf b/terraform/dns/inventory.tf
new file mode 100644
index 0000000..ff63537
--- /dev/null
+++ b/terraform/dns/inventory.tf
@@ -0,0 +1,3 @@
+data "dynu_dns_records" "root" {
+  hostname = var.dynu_root_domain
+}
diff --git a/terraform/dns/outputs.tf b/terraform/dns/outputs.tf
new file mode 100644
index 0000000..e209ee4
--- /dev/null
+++ b/terraform/dns/outputs.tf
@@ -0,0 +1,47 @@
+output "dynu_domain" {
+  description = "Primary Dynu domain represented by this Terraform root."
+  value       = local.dynu_domain
+}
+
+output "dynu_dns_records_catalog" {
+  description = "Documentation catalog of expected Dynu DNS records discovered from repo service exposure."
+  value       = local.dynu_dns_records_catalog
+}
+
+output "dynu_dns_inventory" {
+  description = "Documentation-friendly Dynu DNS inventory for export and merge into broader infrastructure docs."
+  value = {
+    provider     = "dynu"
+    domain       = local.dynu_domain
+    record_count = length(local.dynu_dns_records_catalog)
+    records      = local.dynu_dns_records_catalog
+  }
+}
+
+output "dynu_root_domain_id" {
+  description = "Dynu numeric domain ID resolved from dynu_root_domain."
+  value       = data.dynu_dns_records.root.domain_id
+}
+
+output "dynu_root_domain_name" {
+  description = "Dynu root domain name resolved from dynu_root_domain."
+  value       = data.dynu_dns_records.root.domain_name
+}
+
+output "dynu_dns_records" {
+  description = "Full read-only DNS record inventory returned by Dynu."
+  value       = data.dynu_dns_records.root.records
+}
+
+output "dynu_dns_hostnames" {
+  description = "Sorted hostname list discovered for dynu_root_domain."
+  value       = sort(distinct([for record in data.dynu_dns_records.root.records : record.hostname]))
+}
+
+output "dynu_dns_record_import_ids" {
+  description = "Map of Dynu DNS record identity to provider import IDs in domain_id/record_id format."
+  value = {
+    for record in data.dynu_dns_records.root.records :
+    format("%s/%s/%s", record.hostname, record.record_type, record.id) => format("%s/%s", record.domain_id, record.id)
+  }
+}
diff --git a/terraform/dns/provider.tf b/terraform/dns/provider.tf
new file mode 100644
index 0000000..bb3cfe3
--- /dev/null
+++ b/terraform/dns/provider.tf
@@ -0,0 +1,4 @@
+provider "dynu" {
+  # Keep auth local-only; do not commit credentials.
+  api_key = var.dynu_api_key
+}
diff --git a/terraform/dns/records.tf b/terraform/dns/records.tf
new file mode 100644
index 0000000..00847bd
--- /dev/null
+++ b/terraform/dns/records.tf
@@ -0,0 +1,161 @@
+locals {
+  dynu_dns_records_catalog_base = {
+    auth = {
+      hostname    = "auth"
+      service     = "authelia"
+      source      = "core/authelia/docker-compose.yml"
+      purpose     = "Authentication portal"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    gitea = {
+      hostname    = "gitea"
+      service     = "gitea"
+      source      = "apps/gitea/docker-compose.yml"
+      purpose     = "Gitea service endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    gotify = {
+      hostname    = "gotify"
+      service     = "gotify"
+      source      = "monitoring/gotify/docker-compose.yml"
+      purpose     = "Gotify notifications"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    grafana = {
+      hostname    = "grafana"
+      service     = "grafana"
+      source      = "monitoring/grafana/docker-compose.yml"
+      purpose     = "Grafana monitoring UI"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    familytree = {
+      hostname    = "familytree"
+      service     = "gramps"
+      source      = "apps/gramps/docker-compose.yml"
+      purpose     = "Family tree application"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    influxdb = {
+      hostname    = "influxdb"
+      service     = "influxdb"
+      source      = "monitoring/influxdb/docker-compose.yml"
+      purpose     = "InfluxDB metrics endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    monitor_kuma = {
+      hostname    = "monitor-kuma"
+      service     = "uptime-kuma"
+      source      = "monitoring/uptime-kuma/docker-compose.yml"
+      purpose     = "Uptime Kuma monitoring UI"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    mtls_bridge = {
+      hostname    = "mtls-bridge"
+      service     = "mtls-bridge"
+      source      = "monitoring/mtls-bridge/docker-compose.yml"
+      purpose     = "mTLS bridge API"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    nextcloud = {
+      hostname    = "nextcloud"
+      service     = "nextcloud-webapp"
+      source      = "apps/nextcloud/docker-compose.yml"
+      purpose     = "Nextcloud service endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    node_red = {
+      hostname    = "node-red"
+      service     = "node-red"
+      source      = "monitoring/node-red/docker-compose.yml"
+      purpose     = "Node-RED automation UI/API"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    passbolt = {
+      hostname    = "passbolt"
+      service     = "passbolt-webapp"
+      source      = "apps/passbolt/docker-compose.yml"
+      purpose     = "Passbolt password management"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    portainer = {
+      hostname    = "portainer"
+      service     = "portainer"
+      source      = "monitoring/portainer/docker-compose.yml"
+      purpose     = "Portainer admin endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    prometheus = {
+      hostname    = "prometheus"
+      service     = "prometheus"
+      source      = "monitoring/prometheus/docker-compose.yml"
+      purpose     = "Prometheus metrics endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    searxng = {
+      hostname    = "searxng"
+      service     = "searxng"
+      source      = "apps/searxng/docker-compose.yml"
+      purpose     = "SearXNG search endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+    traefik = {
+      hostname    = "traefik"
+      service     = "traefik"
+      source      = "core/traefik/docker-compose.yml"
+      purpose     = "Traefik dashboard/API endpoint"
+      record_type = null
+      ttl         = null
+      target      = null
+      proxied     = null
+    }
+  }
+
+  dynu_dns_records_catalog = {
+    for key, record in local.dynu_dns_records_catalog_base :
+    key => merge(record, {
+      fqdn = format("%s.%s", record.hostname, local.dynu_domain)
+    })
+  }
+}
diff --git a/terraform/dns/scripts/generate-brownfield-records.py b/terraform/dns/scripts/generate-brownfield-records.py
new file mode 100644
index 0000000..7881382
--- /dev/null
+++ b/terraform/dns/scripts/generate-brownfield-records.py
@@ -0,0 +1,349 @@
+#!/usr/bin/env python3
+"""Generate Terraform dynu_dns_record resources/import commands from Dynu inventory outputs."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+SCRIPT_PATH = Path(__file__).resolve()
+TF_ROOT = SCRIPT_PATH.parents[1]
+GENERATED_DIR = TF_ROOT / "generated"
+TF_FILE = GENERATED_DIR / "dynu_dns_records.generated.tf"
+IMPORT_SCRIPT = GENERATED_DIR / "import-dynu-dns-records.sh"
+INVENTORY_FILE = GENERATED_DIR / "dynu_dns_records_inventory.json"
+DEFAULT_RECORDS_OUTPUT = "dynu_dns_records"
+REQUIRED_RECORD_FIELDS = ("id", "domain_id", "hostname", "record_type")
+
+HEADER_TF = """# ---------------------------------------------------------------------------
+# GENERATED FILE - REVIEW BEFORE USE
+#
+# Generated from Dynu brownfield DNS inventory.
+# Do not blindly apply this file to production DNS.
+# Import records into Terraform state before allowing Terraform to manage them.
+# ---------------------------------------------------------------------------
+"""
+
+HEADER_SH = """#!/usr/bin/env bash
+# ---------------------------------------------------------------------------
+# GENERATED FILE - REVIEW BEFORE USE
+#
+# Imports existing Dynu DNS records into Terraform state.
+# Does not apply changes.
+# ---------------------------------------------------------------------------
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TF_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+cd "${TF_ROOT}"
+
+# Re-running imports will fail for resources already in state.
+# This script skips imports when state already contains the resource address.
+"""
+
+OPTIONAL_FIELDS = ["group", "host", "priority", "weight", "port", "flags", "tag", "value", "node_name"]
+
+
+def run_terraform_output() -> dict:
+    if not (TF_ROOT / ".terraform").exists():
+        raise RuntimeError("Terraform is not initialized in infrastructure/terraform/dynu. Run: terraform init")
+
+    cmd = ["terraform", "output", "-json"]
+    proc = subprocess.run(cmd, cwd=TF_ROOT, capture_output=True, text=True)
+    if proc.returncode != 0:
+        raise RuntimeError(f"Failed to run {' '.join(cmd)}:\n{proc.stderr.strip()}")
+    return json.loads(proc.stdout)
+
+
+def type_shape_name(value: object) -> str:
+    if isinstance(value, list):
+        return "list"
+    if isinstance(value, dict):
+        return "object"
+    return type(value).__name__
+
+
+def extract_records(payload: object, output_name: str) -> list[dict]:
+    source = payload
+    if isinstance(payload, list):
+        source = payload
+    elif isinstance(payload, dict):
+        if isinstance(payload.get("value"), list):
+            source = payload["value"]
+        elif isinstance(payload.get("records"), list):
+            source = payload["records"]
+        elif isinstance(payload.get("value"), dict) and isinstance(payload["value"].get("records"), list):
+            source = payload["value"]["records"]
+        elif output_name in payload and isinstance(payload[output_name], dict):
+            output_wrapper = payload[output_name]
+            if isinstance(output_wrapper.get("value"), list):
+                source = output_wrapper["value"]
+            elif isinstance(output_wrapper.get("value"), dict) and isinstance(output_wrapper["value"].get("records"), list):
+                source = output_wrapper["value"]["records"]
+            elif isinstance(output_wrapper.get("records"), list):
+                source = output_wrapper["records"]
+            else:
+                raise RuntimeError(f"Output '{output_name}' does not contain a records list.")
+        else:
+            raise RuntimeError(f"Output '{output_name}' not found and no records list discovered.")
+    else:
+        raise RuntimeError(f"Unsupported JSON payload type: {type(payload).__name__}")
+
+    if not isinstance(source, list):
+        raise RuntimeError(f"Output '{output_name}' did not resolve to a list of records.")
+    return source
+
+
+def validate_records(records: list[dict], output_name: str) -> None:
+    for i, record in enumerate(records):
+        if not isinstance(record, dict):
+            raise RuntimeError(f"Selected output '{output_name}' has non-object record at index {i}: {type(record).__name__}.")
+        missing = [field for field in REQUIRED_RECORD_FIELDS if field not in record]
+        if missing:
+            missing_text = ", ".join(missing)
+            raise RuntimeError(
+                f"Selected output '{output_name}' contains records, but they are not importable Dynu provider records. "
+                f"Record #{i} is missing required fields: {missing_text}. "
+                "Choose an output sourced from data.dynu_dns_records.root, such as dynu_dns_records or dynu_dns_inventory."
+            )
+
+
+def describe_output(output_name: str, output_wrapper: object, full_outputs: dict) -> dict:
+    details = {
+        "name": output_name,
+        "usable": False,
+        "shape": type_shape_name(output_wrapper),
+        "record_count": "none",
+        "error": "no records list found",
+    }
+    if isinstance(output_wrapper, dict) and "value" in output_wrapper:
+        details["shape"] = type_shape_name(output_wrapper.get("value"))
+
+    try:
+        records = extract_records(full_outputs, output_name)
+    except RuntimeError as exc:
+        details["error"] = str(exc)
+        return details
+
+    details["record_count"] = len(records)
+    try:
+        validate_records(records, output_name)
+    except RuntimeError as exc:
+        details["error"] = str(exc)
+        if isinstance(output_wrapper, dict) and isinstance(output_wrapper.get("value"), dict) and isinstance(output_wrapper["value"].get("records"), list):
+            details["shape"] = "object with records list"
+        elif isinstance(output_wrapper, dict) and isinstance(output_wrapper.get("value"), list):
+            details["shape"] = "list"
+        return details
+
+    details["usable"] = True
+    details["error"] = None
+    if isinstance(output_wrapper, dict) and isinstance(output_wrapper.get("value"), dict) and isinstance(output_wrapper["value"].get("records"), list):
+        details["shape"] = "object with records list"
+    elif isinstance(output_wrapper, dict) and isinstance(output_wrapper.get("value"), list):
+        details["shape"] = "list"
+    return details
+
+
+def choose_output_interactively(outputs: dict, descriptions: list[dict]) -> str | None:
+    print("\nAvailable Terraform outputs:\n")
+    indexed = {str(i): item for i, item in enumerate(descriptions, 1)}
+    by_name = {item["name"]: item for item in descriptions}
+
+    for i, item in enumerate(descriptions, 1):
+        print(f"  {i}) {item['name']}")
+        print(f"     usable: {'yes' if item['usable'] else 'no'}")
+        print(f"     shape: {item['shape']}")
+        print(f"     record count: {item['record_count']}")
+        if item["error"]:
+            print(f"     reason: {item['error']}")
+        print()
+
+    attempts = 0
+    while attempts < 3:
+        attempts += 1
+        try:
+            selection = input(f"Choose an output to use for DNS records [1-{len(descriptions)}], or press Enter to cancel: ").strip()
+        except KeyboardInterrupt:
+            print("\nSelection cancelled.")
+            return None
+
+        if selection == "":
+            print("Selection cancelled.")
+            return None
+
+        candidate = indexed.get(selection) or by_name.get(selection)
+        if candidate is None:
+            print("Invalid selection. Enter a number from the list or an exact output name.")
+            continue
+
+        if not candidate["usable"]:
+            print(f"Output '{candidate['name']}' is not usable: {candidate['error']}")
+            continue
+
+        return candidate["name"]
+
+    raise RuntimeError("Too many invalid selections. Exiting without writing files.")
+
+
+def tf_name(record: dict) -> str:
+    base = f"{record.get('hostname', '')}_{record.get('record_type', '')}_{record.get('id', '')}".lower()
+    base = base.replace("*", "wildcard")
+    base = re.sub(r"[^a-z0-9_]+", "_", base)
+    base = re.sub(r"_+", "_", base).strip("_")
+    if not base or not re.match(r"^[a-z]", base):
+        base = f"record_{base}" if base else "record"
+    if not base.endswith(str(record.get("id", ""))):
+        base = f"{base}_{record.get('id', '')}"
+    return base
+
+
+def hcl_value(value):
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)):
+        return str(value)
+    return json.dumps(value)
+
+
+def generate_resources(records: list[dict]) -> str:
+    chunks = [HEADER_TF.rstrip(), ""]
+    for rec in records:
+        name = tf_name(rec)
+        lines = [f'resource "dynu_dns_record" "{name}" {{']
+        lines.append(f"  hostname    = {hcl_value(rec.get('hostname'))}")
+        lines.append(f"  record_type = {hcl_value(rec.get('record_type'))}")
+        if rec.get("ttl") is not None:
+            lines.append(f"  ttl         = {hcl_value(rec.get('ttl'))}")
+        enabled = rec.get("enabled")
+        if enabled is None:
+            enabled = rec.get("state")
+        if enabled is not None:
+            lines.append(f"  enabled     = {hcl_value(enabled)}")
+
+        content = rec.get("content")
+        rtype = str(rec.get("record_type", "")).upper()
+        if content in (None, "") and rtype in {"A", "AAAA"}:
+            lines.append("  dynamic     = true")
+        elif content not in (None, ""):
+            lines.append(f"  content     = {hcl_value(content)}")
+
+        for field in OPTIONAL_FIELDS:
+            value = rec.get(field)
+            if value not in (None, ""):
+                lines.append(f"  {field.ljust(11)}= {hcl_value(value)}")
+
+        lines.extend([
+            "",
+            "  lifecycle {",
+            "    prevent_destroy = true",
+            "  }",
+            "}",
+            "",
+        ])
+        chunks.extend(lines)
+    return "\n".join(chunks).rstrip() + "\n"
+
+
+def generate_import_script(records: list[dict]) -> str:
+    lines = [HEADER_SH.rstrip(), ""]
+    for rec in records:
+        name = tf_name(rec)
+        import_id = f"{rec['domain_id']}/{rec['id']}"
+        addr = f"dynu_dns_record.{name}"
+        lines.append(f"if terraform state show '{addr}' >/dev/null 2>&1; then")
+        lines.append(f"  echo 'Skipping already imported: {addr}'")
+        lines.append("else")
+        lines.append(f"  terraform import '{addr}' '{import_id}'")
+        lines.append("fi")
+        lines.append("")
+    return "\n".join(lines).rstrip() + "\n"
+
+
+def write_file(path: Path, content: str, dry_run: bool, overwrite: bool) -> None:
+    if path.exists() and not overwrite:
+        raise RuntimeError(f"Refusing to overwrite existing file: {path}. Re-run with --overwrite.")
+    if dry_run:
+        print(f"[dry-run] Would write {path}")
+        return
+    path.write_text(content, encoding="utf-8")
+    print(f"Wrote {path}")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--dry-run", action="store_true", help="Print intended output paths without writing files.")
+    parser.add_argument("--overwrite", "--force", action="store_true", dest="overwrite", help="Overwrite existing generated files.")
+    parser.add_argument("--from-file", type=Path, help="Load inventory JSON from a file instead of calling terraform output.")
+    parser.add_argument(
+        "--records-output",
+        default=None,
+        help=(
+            "Terraform output name containing Dynu DNS records. "
+            f"Defaults to {DEFAULT_RECORDS_OUTPUT}; if missing in an interactive terminal, "
+            "the script prompts you to choose from available outputs."
+        ),
+    )
+    parser.add_argument("--no-interactive", action="store_true", help="Disable interactive output selection.")
+    args = parser.parse_args()
+
+    records_output_explicit = args.records_output is not None
+    records_output = args.records_output or DEFAULT_RECORDS_OUTPUT
+
+    try:
+        payload = json.loads(args.from_file.read_text(encoding="utf-8")) if args.from_file else run_terraform_output()
+
+        selected_output = records_output
+        descriptions: list[dict] = []
+        if isinstance(payload, dict):
+            descriptions = [describe_output(name, payload[name], payload) for name in sorted(payload)]
+
+        try:
+            records = extract_records(payload, selected_output)
+            validate_records(records, selected_output)
+        except RuntimeError as exc:
+            is_interactive = sys.stdin.isatty() and not args.no_interactive
+            should_prompt = isinstance(payload, dict) and not records_output_explicit and is_interactive
+            if should_prompt:
+                print(f"Terraform output '{selected_output}' was not found or is unusable.\n")
+                chosen = choose_output_interactively(payload, descriptions)
+                if chosen is None:
+                    print("Exiting without writing files.")
+                    return 1
+                selected_output = chosen
+                records = extract_records(payload, selected_output)
+                validate_records(records, selected_output)
+            else:
+                if isinstance(payload, dict):
+                    available = ", ".join(sorted(payload.keys())) or "(none)"
+                    if records_output_explicit:
+                        raise RuntimeError(
+                            f"Missing or unusable Terraform output '{selected_output}'. "
+                            f"Available outputs: {available}. Details: {exc}"
+                        )
+                    raise RuntimeError(
+                        f"Missing or unusable Terraform output '{selected_output}'. "
+                        f"Available outputs: {available}.\n\n"
+                        "Run interactively to choose an output, or pass one explicitly, for example:\n\n"
+                        "  python3 scripts/generate-brownfield-records.py --records-output dynu_dns_inventory --dry-run"
+                    )
+                raise
+
+        GENERATED_DIR.mkdir(parents=True, exist_ok=True)
+        write_file(INVENTORY_FILE, json.dumps(records, indent=2, sort_keys=True) + "\n", args.dry_run, args.overwrite)
+        write_file(TF_FILE, generate_resources(records), args.dry_run, args.overwrite)
+        write_file(IMPORT_SCRIPT, generate_import_script(records), args.dry_run, args.overwrite)
+        if not args.dry_run:
+            IMPORT_SCRIPT.chmod(0o755)
+        return 0
+    except Exception as exc:  # noqa: BLE001
+        print(f"Error: {exc}", file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/terraform/dns/terraform.tfvars.example b/terraform/dns/terraform.tfvars.example
new file mode 100644
index 0000000..0ba977f
--- /dev/null
+++ b/terraform/dns/terraform.tfvars.example
@@ -0,0 +1,7 @@
+# Local-only credentials. Do not commit real values.
+dynu_api_key  = "replace-with-dynu-api-key"
+dynu_username = null
+dynu_password = null
+
+dynu_root_domain = "lan.ddnsgeek.com"
+dynu_record_import_id = "REPLACE_WITH_DYNU_RECORD_IMPORT_ID"
diff --git a/terraform/dns/variables.tf b/terraform/dns/variables.tf
new file mode 100644
index 0000000..1379c57
--- /dev/null
+++ b/terraform/dns/variables.tf
@@ -0,0 +1,33 @@
+
+variable "dynu_root_domain" {
+  description = "Dynu root domain name to reconcile/import (for example: lan.ddnsgeek.com)."
+  type        = string
+  default     = "lan.ddnsgeek.com"
+}
+
+variable "dynu_api_key" {
+  description = "Dynu API key/token used by the Dynu Terraform provider."
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "dynu_username" {
+  description = "Optional Dynu username, only if required by the provider."
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "dynu_password" {
+  description = "Optional Dynu password, only if required by the provider."
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "dynu_record_import_id" {
+  description = "Placeholder import ID for a single dynu_dns_record during one-at-a-time reconciliation."
+  type        = string
+  default     = "REPLACE_WITH_DYNU_RECORD_IMPORT_ID"
+}
diff --git a/terraform/dns/versions.tf b/terraform/dns/versions.tf
new file mode 100644
index 0000000..3bbe029
--- /dev/null
+++ b/terraform/dns/versions.tf
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    dynu = {
+      source = "beatz174-bit/dynu"
+    }
+  }
+}
diff --git a/terraform/docker/README.md b/terraform/docker/README.md
new file mode 100644
index 0000000..e119b52
--- /dev/null
+++ b/terraform/docker/README.md
@@ -0,0 +1,43 @@
+# Terraform Docker Mirror Layer
+
+This directory tracks selected existing Docker containers in Terraform for inventory/documentation purposes.
+
+## Purpose
+
+- Mirror specific running containers as Terraform resources.
+- Reconcile imported state into maintainable code.
+- Produce structured outputs/reminders that support documentation workflows.
+
+## Boundary with Docker Compose
+
+Docker Compose + `services-up.sh` remain runtime composition authority.
+
+Terraform resources here are **not** the primary day-to-day deployment mechanism for app services.
+
+## Current contents
+
+- `main.tf` — import-first workflow notes and minimal scaffolding.
+- `searxng-webapp.tf` — generated/reconciled example container resource.
+- `outputs.tf` — documentation-oriented reminders/outputs.
+- `terraform.tfvars.example` — safe template for local values.
+
+## Import/reconciliation workflow
+
+1. Start with one existing container.
+2. Import with `import {}` block or `terraform import`.
+3. Inspect state / generated config.
+4. Reduce generated attributes to meaningful, stable arguments.
+5. Keep lifecycle `ignore_changes` narrow and justified.
+6. Iterate until plan is clean for the intended resource.
+
+## Guardrails
+
+- Do not attempt to mirror all containers in one pass.
+- Do not commit local state or real credentials.
+- Treat generated config as draft input that needs review.
+
+## Related docs
+
+- [../README.md](../README.md)
+- [../../../docs/source-of-truth.md](../../../docs/source-of-truth.md)
+- [../../../docs/terraform-workflows.md](../../../docs/terraform-workflows.md)
diff --git a/terraform/docker/authelia.tf b/terraform/docker/authelia.tf
new file mode 100644
index 0000000..9e1bb5d
--- /dev/null
+++ b/terraform/docker/authelia.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "authelia" {
+  name  = local.docker_containers["authelia"].container_name
+  image = local.docker_containers["authelia"].image
+
+  restart = local.docker_containers["authelia"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/container-catalog.tf b/terraform/docker/container-catalog.tf
new file mode 100644
index 0000000..47536a5
--- /dev/null
+++ b/terraform/docker/container-catalog.tf
@@ -0,0 +1,613 @@
+locals {
+  docker_containers = {
+    "authelia" = {
+      terraform_resource = "docker_container.authelia"
+      compose_project    = "core"
+      compose_service    = "authelia"
+      compose_file       = "core/authelia/docker-compose.yml"
+      container_name     = "authelia"
+      image              = "authelia/authelia"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["traefik"]
+      mounts             = ["bind:/home/nixos/docker/core/authelia->/config"]
+      published_ports    = []
+      build_context      = "/home/nixos/docker/core/authelia"
+      build_dockerfile   = "Dockerfile"
+      useful_labels = {
+        "traefik.enable"                                                    = "true"
+        "traefik.http.middlewares.authelia.forwardauth.address"             = "http://authelia:9091/api/verify?rd=https://auth.lan.ddnsgeek.com/"
+        "traefik.http.middlewares.authelia.forwardauth.authResponseHeaders" = "Remote-User,Remote-Groups"
+        "traefik.http.middlewares.authelia.forwardauth.maxResponseBodySize" = "2097152"
+        "traefik.http.middlewares.authelia.forwardauth.trustForwardHeader"  = "true"
+        "traefik.http.routers.authelia.entrypoints"                         = "websecure"
+        "traefik.http.routers.authelia.rule"                                = "Host(`auth.lan.ddnsgeek.com`)"
+        "traefik.http.routers.authelia.tls"                                 = "true"
+        "traefik.http.routers.authelia.tls.certresolver"                    = "myresolver"
+      }
+    }
+    "crowdsec" = {
+      terraform_resource = "docker_container.crowdsec"
+      compose_project    = "core"
+      compose_service    = "crowdsec"
+      compose_file       = "core/crowdsec/docker-compose.yml"
+      container_name     = "crowdsec"
+      image              = "core-crowdsec"
+      image_source       = "compose_build_inferred"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["traefik"]
+      mounts             = ["bind:/home/nixos/docker/core/crowdsec/logs->/logs:ro", "bind:/home/nixos/docker/core/crowdsec/data->/var/lib/crowdsec/data", "bind:/home/nixos/docker/core/crowdsec/config->/etc/crowdsec"]
+      published_ports    = []
+      build_context      = "/home/nixos/docker/core/crowdsec"
+      build_dockerfile   = "Dockerfile"
+      useful_labels      = {}
+    }
+    "docker-socket-proxy" = {
+      terraform_resource = "docker_container.docker_socket_proxy"
+      compose_project    = "core"
+      compose_service    = "docker-socket-proxy"
+      compose_file       = "monitoring/docker-socket-proxy/docker-compose.yml"
+      container_name     = "docker-socket-proxy"
+      image              = "tecnativa/docker-socket-proxy:latest"
+      image_source       = "declared_image"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor", "traefik"]
+      mounts             = ["bind:/var/run/docker.sock->/var/run/docker.sock:ro"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "docker-update-exporter" = {
+      terraform_resource = "docker_container.docker_update_exporter"
+      compose_project    = "core"
+      compose_service    = "docker-update-exporter"
+      compose_file       = "monitoring/docker-exporter/docker-compose.yml"
+      container_name     = "docker-update-exporter"
+      image              = "core-docker-update-exporter"
+      image_source       = "compose_build_inferred"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor"]
+      mounts             = ["bind:/root/.docker/config.json->/root/.docker/config.json:ro", "bind:/home/nixos/docker/monitoring/docker-exporter/data->/data", "bind:/home/nixos/docker->/compose:ro"]
+      published_ports    = []
+      build_context      = "/home/nixos/docker/monitoring/docker-exporter"
+      build_dockerfile   = "Dockerfile"
+      useful_labels      = {}
+    }
+    "error-pages" = {
+      terraform_resource = "docker_container.error_pages"
+      compose_project    = "core"
+      compose_service    = "error-pages"
+      compose_file       = "core/error-pages/docker-compose.yml"
+      container_name     = "error-pages"
+      image              = "tarampampam/error-pages:3"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["traefik"]
+      mounts             = []
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.enable"                                                     = "true"
+        "traefik.http.middlewares.error-pages-middleware.errors.query"       = "/{status}.html"
+        "traefik.http.middlewares.error-pages-middleware.errors.service"     = "error-pages-service"
+        "traefik.http.middlewares.error-pages-middleware.errors.status"      = "400-599"
+        "traefik.http.routers.error-pages-router.entrypoints"                = "web"
+        "traefik.http.routers.error-pages-router.middlewares"                = "error-pages-middleware"
+        "traefik.http.routers.error-pages-router.rule"                       = "HostRegexp(`{host:.+}`)"
+        "traefik.http.services.error-pages-service.loadbalancer.server.port" = "8080"
+      }
+    }
+    "gitea" = {
+      terraform_resource = "docker_container.gitea"
+      compose_project    = "core"
+      compose_service    = "gitea"
+      compose_file       = "apps/gitea/docker-compose.yml"
+      container_name     = "gitea"
+      image              = "gitea/gitea:latest"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["traefik"]
+      mounts             = ["bind:/home/nixos/docker/apps/gitea/data->/data"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.docker.network"                               = "core_traefik"
+        "traefik.enable"                                       = "true"
+        "traefik.http.routers.gitea.entrypoints"               = "websecure"
+        "traefik.http.routers.gitea.rule"                      = "Host(`gitea.lan.ddnsgeek.com`)"
+        "traefik.http.routers.gitea.tls"                       = "true"
+        "traefik.http.routers.gitea.tls.certresolver"          = "myresolver"
+        "traefik.http.services.gitea.loadbalancer.server.port" = "3000"
+      }
+    }
+    "gotify" = {
+      terraform_resource = "docker_container.gotify"
+      compose_project    = "core"
+      compose_service    = "gotify"
+      compose_file       = "monitoring/gotify/docker-compose.yml"
+      container_name     = "gotify"
+      image              = "gotify/server:latest"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["traefik"]
+      mounts             = ["bind:/home/nixos/docker/monitoring/gotify/data->/app/data"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.docker.network"                                = "core_traefik"
+        "traefik.enable"                                        = "true"
+        "traefik.http.routers.gotify.entrypoints"               = "websecure"
+        "traefik.http.routers.gotify.rule"                      = "Host(`gotify.lan.ddnsgeek.com`)"
+        "traefik.http.routers.gotify.tls.certresolver"          = "myresolver"
+        "traefik.http.routers.gotify.tls.options"               = "mtls-private-admin@file"
+        "traefik.http.services.gotify.loadbalancer.server.port" = "80"
+      }
+    }
+    "grafana" = {
+      terraform_resource = "docker_container.grafana"
+      compose_project    = "core"
+      compose_service    = "grafana"
+      compose_file       = "monitoring/grafana/docker-compose.yml"
+      container_name     = "grafana"
+      image              = "grafana/grafana:latest"
+      image_source       = "declared_image"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/monitoring/grafana/data->/var/lib/grafana"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.docker.network"                                 = "core_traefik"
+        "traefik.enable"                                         = "true"
+        "traefik.http.routers.grafana.entrypoints"               = "websecure"
+        "traefik.http.routers.grafana.rule"                      = "Host(`grafana.lan.ddnsgeek.com`)"
+        "traefik.http.routers.grafana.tls.certresolver"          = "myresolver"
+        "traefik.http.routers.grafana.tls.options"               = "mtls-private-admin@file"
+        "traefik.http.services.grafana.loadbalancer.server.port" = "3000"
+      }
+    }
+    "gramps-redis" = {
+      terraform_resource = "docker_container.gramps_redis"
+      compose_project    = "core"
+      compose_service    = "gramps-redis"
+      compose_file       = "apps/gramps/docker-compose.yml"
+      container_name     = "gramps-redis"
+      image              = "valkey/valkey:8-alpine"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["gramps"]
+      mounts             = []
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "gramps-web" = {
+      terraform_resource = "docker_container.gramps_web"
+      compose_project    = "core"
+      compose_service    = "grampsweb"
+      compose_file       = "apps/gramps/docker-compose.yml"
+      container_name     = "gramps-web"
+      image              = "ghcr.io/gramps-project/grampsweb:latest"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["gramps", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/apps/gramps/data/users->/app/users", "bind:/home/nixos/docker/apps/gramps/data/index->/app/indexdir", "bind:/home/nixos/docker/apps/gramps/data/thumbnail_cache->/app/thumbnail_cache", "bind:/home/nixos/docker/apps/gramps/data/cache->/app/cache", "bind:/home/nixos/docker/apps/gramps/data/secret->/app/secret", "bind:/home/nixos/docker/apps/gramps/data/db->/root/.gramps/grampsdb", "bind:/home/nixos/docker/apps/gramps/data/media->/app/media", "bind:/home/nixos/docker/apps/gramps/data/tmp->/tmp"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.docker.network"                                = "core_traefik"
+        "traefik.enable"                                        = "true"
+        "traefik.http.routers.gramps.entrypoints"               = "websecure"
+        "traefik.http.routers.gramps.rule"                      = "Host(`familytree.lan.ddnsgeek.com`)"
+        "traefik.http.routers.gramps.tls.certresolver"          = "myresolver"
+        "traefik.http.services.gramps.loadbalancer.server.port" = "5000"
+      }
+    }
+    "gramps-web-celery" = {
+      terraform_resource = "docker_container.gramps_web_celery"
+      compose_project    = "core"
+      compose_service    = "grampsweb_celery"
+      compose_file       = "apps/gramps/docker-compose.yml"
+      container_name     = "gramps-web-celery"
+      image              = "ghcr.io/gramps-project/grampsweb:latest"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["gramps"]
+      mounts             = ["bind:/home/nixos/docker/apps/gramps/data/users->/app/users", "bind:/home/nixos/docker/apps/gramps/data/index->/app/indexdir", "bind:/home/nixos/docker/apps/gramps/data/thumbnail_cache->/app/thumbnail_cache", "bind:/home/nixos/docker/apps/gramps/data/cache->/app/cache", "bind:/home/nixos/docker/apps/gramps/data/secret->/app/secret", "bind:/home/nixos/docker/apps/gramps/data/db->/root/.gramps/grampsdb", "bind:/home/nixos/docker/apps/gramps/data/media->/app/media", "bind:/home/nixos/docker/apps/gramps/data/tmp->/tmp"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "influxdb" = {
+      terraform_resource = "docker_container.influxdb"
+      compose_project    = "core"
+      compose_service    = "influxdb"
+      compose_file       = "monitoring/influxdb/docker-compose.yml"
+      container_name     = "influxdb"
+      image              = "influxdb:2.7"
+      image_source       = "declared_image"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/monitoring/influxdb->/var/lib/influxdb2"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.docker.network"                                  = "core_traefik"
+        "traefik.enable"                                          = "true"
+        "traefik.http.routers.influxdb.entrypoints"               = "websecure"
+        "traefik.http.routers.influxdb.middlewares"               = "authelia"
+        "traefik.http.routers.influxdb.rule"                      = "Host(`influxdb.lan.ddnsgeek.com`)"
+        "traefik.http.routers.influxdb.tls.certresolver"          = "myresolver"
+        "traefik.http.routers.influxdb.tls.options"               = "mtls-private-admin@file"
+        "traefik.http.services.influxdb.loadbalancer.server.port" = "8086"
+      }
+    }
+    "monitor-kuma" = {
+      terraform_resource = "docker_container.monitor_kuma"
+      compose_project    = "core"
+      compose_service    = "monitor-kuma"
+      compose_file       = "monitoring/uptime-kuma/docker-compose.yml"
+      container_name     = "monitor-kuma"
+      image              = "louislam/uptime-kuma:2.1.1"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["monitor", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/monitoring/uptime-kuma/data->/app/data"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.docker.network"                                 = "core_traefik"
+        "traefik.enable"                                         = "true"
+        "traefik.http.routers.monitor.entrypoints"               = "websecure"
+        "traefik.http.routers.monitor.rule"                      = "Host(`monitor-kuma.lan.ddnsgeek.com`)"
+        "traefik.http.routers.monitor.tls"                       = "true"
+        "traefik.http.routers.monitor.tls.certresolver"          = "myresolver"
+        "traefik.http.routers.monitor.tls.options"               = "mtls-private-admin@file"
+        "traefik.http.services.monitor.loadbalancer.server.port" = "3001"
+      }
+    }
+    "mtls-bridge" = {
+      terraform_resource = "docker_container.mtls_bridge"
+      compose_project    = "core"
+      compose_service    = "mtls-bridge"
+      compose_file       = "monitoring/mtls-bridge/docker-compose.yml"
+      container_name     = "mtls-bridge"
+      image              = "core-mtls-bridge"
+      image_source       = "compose_build_inferred"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/core/traefik/certs->/certs:ro"]
+      published_ports    = []
+      build_context      = "/home/nixos/docker/monitoring/mtls-bridge"
+      build_dockerfile   = "Dockerfile"
+      useful_labels = {
+        "traefik.docker.network"                                                          = "core_traefik"
+        "traefik.enable"                                                                  = "true"
+        "traefik.http.middlewares.mtls-bridge-auth.basicauth.users"                       = ""
+        "traefik.http.middlewares.mtls-bridge-cors.headers.accesscontrolallowcredentials" = "true"
+        "traefik.http.middlewares.mtls-bridge-cors.headers.accesscontrolallowheaders"     = "authorization,content-type,x-grafana-action,x-grafana-device-id"
+        "traefik.http.middlewares.mtls-bridge-cors.headers.accesscontrolallowmethods"     = "GET,POST,PUT,PATCH,DELETE,OPTIONS"
+        "traefik.http.middlewares.mtls-bridge-cors.headers.accesscontrolalloworiginlist"  = "https://grafana.lan.ddnsgeek.com"
+        "traefik.http.middlewares.mtls-bridge-cors.headers.addvaryheader"                 = "true"
+        "traefik.http.routers.mtls-bridge-preflight.entrypoints"                          = "websecure"
+        "traefik.http.routers.mtls-bridge-preflight.middlewares"                          = "mtls-bridge-cors"
+        "traefik.http.routers.mtls-bridge-preflight.priority"                             = "100"
+        "traefik.http.routers.mtls-bridge-preflight.rule"                                 = "Host(`mtls-bridge.lan.ddnsgeek.com`) && Method(`OPTIONS`)"
+        "traefik.http.routers.mtls-bridge-preflight.service"                              = "mtls-bridge"
+        "traefik.http.routers.mtls-bridge-preflight.tls.certresolver"                     = "myresolver"
+        "traefik.http.routers.mtls-bridge.entrypoints"                                    = "websecure"
+        "traefik.http.routers.mtls-bridge.middlewares"                                    = "mtls-bridge-auth,mtls-bridge-cors"
+        "traefik.http.routers.mtls-bridge.rule"                                           = "Host(`mtls-bridge.lan.ddnsgeek.com`)"
+        "traefik.http.routers.mtls-bridge.tls.certresolver"                               = "myresolver"
+        "traefik.http.services.mtls-bridge.loadbalancer.server.port"                      = "8080"
+      }
+    }
+    "nextcloud-db" = {
+      terraform_resource = "docker_container.nextcloud_db"
+      compose_project    = "core"
+      compose_service    = "nextcloud-db"
+      compose_file       = "apps/nextcloud/docker-compose.yml"
+      container_name     = "nextcloud-db"
+      image              = "mariadb:11.4"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["nextcloud"]
+      mounts             = ["bind:/home/nixos/docker/apps/nextcloud/database->/var/lib/mysql"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "nextcloud-redis" = {
+      terraform_resource = "docker_container.nextcloud_redis"
+      compose_project    = "core"
+      compose_service    = "nextcloud-redis"
+      compose_file       = "apps/nextcloud/docker-compose.yml"
+      container_name     = "nextcloud-redis"
+      image              = "redis"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["nextcloud"]
+      mounts             = ["bind:/home/nixos/docker/apps/nextcloud/data/redis->/data"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "nextcloud-webapp" = {
+      terraform_resource = "docker_container.nextcloud_webapp"
+      compose_project    = "core"
+      compose_service    = "nextcloud-webapp"
+      compose_file       = "apps/nextcloud/docker-compose.yml"
+      container_name     = "nextcloud-webapp"
+      image              = "core-nextcloud-webapp"
+      image_source       = "compose_build_inferred"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["nextcloud", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/apps/nextcloud/data->/var/www/html/data", "bind:/home/nixos/docker/apps/nextcloud/config->/var/www/html/config", "tmpfs:->/tmp:exec"]
+      published_ports    = []
+      build_context      = "/home/nixos/docker/apps/nextcloud"
+      build_dockerfile   = "Dockerfile"
+      useful_labels = {
+        "traefik.docker.network"                                                   = "core_traefik"
+        "traefik.enable"                                                           = "true"
+        "traefik.http.middlewares.nextcloud-dav.replacepathregex.regex"            = "^/.well-known/ca(l|rd)dav"
+        "traefik.http.middlewares.nextcloud-dav.replacepathregex.replacement"      = "/remote.php/dav/"
+        "traefik.http.middlewares.nextcloud-nodeinfo.replacepathregex.regex"       = "^/.well-known/nodeinfo"
+        "traefik.http.middlewares.nextcloud-nodeinfo.replacepathregex.replacement" = "/nextcloud/index.php/.well-known/nodeinfo/"
+        "traefik.http.middlewares.nextcloud-webfinger.redirectregex.permanent"     = "true"
+        "traefik.http.middlewares.nextcloud-webfinger.redirectregex.regex"         = "https://(.*)/.well-known/webfinger"
+        "traefik.http.middlewares.nextcloud-webfinger.redirectregex.replacement"   = "https://$${1}/nextcloud/index.php/.well-known/webfinger"
+        "traefik.http.routers.nextcloud.entrypoints"                               = "websecure"
+        "traefik.http.routers.nextcloud.middlewares"                               = "nextcloud-dav, nextcloud-webfinger"
+        "traefik.http.routers.nextcloud.rule"                                      = "Host(`nextcloud.lan.ddnsgeek.com`)"
+        "traefik.http.routers.nextcloud.tls.certresolver"                          = "myresolver"
+      }
+    }
+    "node-exporter" = {
+      terraform_resource = "docker_container.node_exporter"
+      compose_project    = "core"
+      compose_service    = "node-exporter"
+      compose_file       = "monitoring/node-exporter/docker-compose.yml"
+      container_name     = "node-exporter"
+      image              = "prom/node-exporter:latest"
+      image_source       = "declared_image"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor"]
+      mounts             = ["bind:/proc->/host/proc:ro", "bind:/sys->/host/sys:ro", "bind:/->/rootfs:ro"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "node-red" = {
+      terraform_resource = "docker_container.node_red"
+      compose_project    = "core"
+      compose_service    = "node-red"
+      compose_file       = "monitoring/node-red/docker-compose.yml"
+      container_name     = "node-red"
+      image              = "core-node-red"
+      image_source       = "compose_build_inferred"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/monitoring/node-red/data->/data", "bind:/home/nixos/docker->/compose/docker:ro", "bind:/home/nixos/raspi->/compose/raspi:ro"]
+      published_ports    = []
+      build_context      = "/home/nixos/docker/monitoring/node-red"
+      build_dockerfile   = "Dockerfile"
+      useful_labels = {
+        "traefik.docker.network"                                  = "core_traefik"
+        "traefik.enable"                                          = "true"
+        "traefik.http.routers.node-red.entrypoints"               = "websecure"
+        "traefik.http.routers.node-red.middlewares"               = "authelia"
+        "traefik.http.routers.node-red.rule"                      = "Host(`node-red.lan.ddnsgeek.com`)"
+        "traefik.http.routers.node-red.tls.certresolver"          = "myresolver"
+        "traefik.http.routers.node-red.tls.options"               = "mtls-private-admin@file"
+        "traefik.http.services.node-red.loadbalancer.server.port" = "1880"
+      }
+    }
+    "passbolt-db" = {
+      terraform_resource = "docker_container.passbolt_db"
+      compose_project    = "core"
+      compose_service    = "passbolt-db"
+      compose_file       = "apps/passbolt/docker-compose.yml"
+      container_name     = "passbolt-db"
+      image              = "mariadb:12"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["passbolt"]
+      mounts             = ["bind:/home/nixos/docker/apps/passbolt/data/database->/var/lib/mysql"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "passbolt-webapp" = {
+      terraform_resource = "docker_container.passbolt_webapp"
+      compose_project    = "core"
+      compose_service    = "passbolt-webapp"
+      compose_file       = "apps/passbolt/docker-compose.yml"
+      container_name     = "passbolt-webapp"
+      image              = "passbolt/passbolt:latest-ce"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["passbolt", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/apps/passbolt/data/gpg->/etc/passbolt/gpg", "bind:/home/nixos/docker/apps/passbolt/data/jwt->/etc/passbolt/jwt"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.docker.network"                         = "core_traefik"
+        "traefik.enable"                                 = "true"
+        "traefik.http.routers.passbolt.entrypoints"      = "websecure"
+        "traefik.http.routers.passbolt.rule"             = "Host(`passbolt.lan.ddnsgeek.com`)"
+        "traefik.http.routers.passbolt.tls.certresolver" = "myresolver"
+      }
+    }
+    "pihole-exporter" = {
+      terraform_resource = "docker_container.pihole_exporter"
+      compose_project    = "core"
+      compose_service    = "pihole-exporter"
+      compose_file       = "monitoring/pihole-exporter/docker-compose.yml"
+      container_name     = "pihole-exporter"
+      image              = "ekofr/pihole-exporter:latest"
+      image_source       = "declared_image"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor"]
+      mounts             = []
+      published_ports    = ["9617:9617/tcp"]
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "portainer" = {
+      terraform_resource = "docker_container.portainer"
+      compose_project    = "core"
+      compose_service    = "portainer"
+      compose_file       = "monitoring/portainer/docker-compose.yml"
+      container_name     = "portainer"
+      image              = "portainer/portainer-ce:latest"
+      image_source       = "declared_image"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["traefik"]
+      mounts             = ["bind:/home/nixos/docker/monitoring/portainer/data->/data"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.enable"                                           = "true"
+        "traefik.http.routers.portainer.entrypoints"               = "websecure"
+        "traefik.http.routers.portainer.rule"                      = "Host(`portainer.lan.ddnsgeek.com`)"
+        "traefik.http.routers.portainer.tls"                       = "true"
+        "traefik.http.routers.portainer.tls.certresolver"          = "myresolver"
+        "traefik.http.routers.portainer.tls.options"               = "mtls-private-admin@file"
+        "traefik.http.services.portainer.loadbalancer.server.port" = "9000"
+      }
+    }
+    "prometheus" = {
+      terraform_resource = "docker_container.prometheus"
+      compose_project    = "core"
+      compose_service    = "prometheus"
+      compose_file       = "monitoring/prometheus/docker-compose.yml"
+      container_name     = "prometheus"
+      image              = "prom/prometheus:latest"
+      image_source       = "declared_image"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor", "traefik"]
+      mounts             = ["bind:/home/nixos/docker/monitoring/prometheus/prometheus.yml->/etc/prometheus/prometheus.yml:ro", "bind:/home/nixos/docker/monitoring/prometheus/data->/prometheus", "bind:/home/nixos/docker/monitoring/prometheus/rules->/etc/prometheus/rules:ro", "bind:/home/nixos/docker/secrets/prometheus_kuma_basic_auth_password.txt->/run/secrets/prometheus_kuma_basic_auth_password:ro"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.docker.network"                                    = "core_traefik"
+        "traefik.enable"                                            = "true"
+        "traefik.http.routers.prometheus.entrypoints"               = "websecure"
+        "traefik.http.routers.prometheus.middlewares"               = "authelia"
+        "traefik.http.routers.prometheus.rule"                      = "Host(`prometheus.lan.ddnsgeek.com`)"
+        "traefik.http.routers.prometheus.tls.certresolver"          = "myresolver"
+        "traefik.http.routers.prometheus.tls.options"               = "mtls-private-admin@file"
+        "traefik.http.services.prometheus.loadbalancer.server.port" = "9090"
+      }
+    }
+    "searxng-webapp" = {
+      terraform_resource = "docker_container.searxng-webapp"
+      compose_project    = "core"
+      compose_service    = "searxng-webapp"
+      compose_file       = "apps/searxng/docker-compose.yml"
+      container_name     = "searxng-webapp"
+      image              = "searxng/searxng"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["traefik"]
+      mounts             = []
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels = {
+        "traefik.enable"                                         = "true"
+        "traefik.http.routers.searxng.entrypoints"               = "websecure"
+        "traefik.http.routers.searxng.rule"                      = "Host(`searxng.lan.ddnsgeek.com`)"
+        "traefik.http.routers.searxng.tls.certresolver"          = "myresolver"
+        "traefik.http.services.searxng.loadbalancer.server.port" = "8080"
+      }
+    }
+    "telegraf" = {
+      terraform_resource = "docker_container.telegraf"
+      compose_project    = "core"
+      compose_service    = "telegraf"
+      compose_file       = "monitoring/telegraf/docker-compose.yml"
+      container_name     = "telegraf"
+      image              = "telegraf:latest"
+      image_source       = "declared_image"
+      restart_policy     = "unless-stopped"
+      network_mode       = null
+      networks           = ["monitor"]
+      mounts             = ["bind:/home/nixos/docker/monitoring/telegraf/telegraf.conf->/etc/telegraf/telegraf.conf:ro", "bind:/home/nixos/docker/monitoring/node-red/data->/var/log/node-red:ro"]
+      published_ports    = []
+      build_context      = null
+      build_dockerfile   = null
+      useful_labels      = {}
+    }
+    "traefik" = {
+      terraform_resource = "docker_container.traefik"
+      compose_project    = "core"
+      compose_service    = "traefik"
+      compose_file       = "core/traefik/docker-compose.yml"
+      container_name     = "traefik"
+      image              = "traefik:3"
+      image_source       = "declared_image"
+      restart_policy     = "always"
+      network_mode       = null
+      networks           = ["traefik"]
+      mounts             = ["bind:/home/nixos/docker/core/traefik/data/letsencrypt->/letsencrypt", "bind:/home/nixos/docker/core/traefik/data/logs->/logs", "bind:/home/nixos/docker/core/traefik/certs->/etc/traefik/certs:ro", "bind:/home/nixos/docker/core/traefik/dynamic.yml->/etc/traefik/dynamic.yml:ro", "bind:/home/nixos/docker/core/traefik/traefik.yml->/etc/traefik/traefik.yml:ro", "bind:/home/nixos/docker/core/traefik/data/plugins->/plugins-storage"]
+      published_ports    = ["80:80/tcp", "443:443/tcp"]
+      build_context      = "/home/nixos/docker/core"
+      build_dockerfile   = "Dockerfile"
+      useful_labels = {
+        "traefik.docker.network"                             = "core_traefik"
+        "traefik.enable"                                     = "true"
+        "traefik.http.routers.traefik.entrypoints"           = "websecure"
+        "traefik.http.routers.traefik.middlewares"           = "authelia"
+        "traefik.http.routers.traefik.observability.tracing" = "true"
+        "traefik.http.routers.traefik.rule"                  = "Host(`traefik.lan.ddnsgeek.com`)"
+        "traefik.http.routers.traefik.service"               = "api@internal"
+        "traefik.http.routers.traefik.tls.certresolver"      = "myresolver"
+        "traefik.http.routers.traefik.tls.options"           = "mtls-private-admin@file"
+      }
+    }
+  }
+}
diff --git a/terraform/docker/crowdsec.tf b/terraform/docker/crowdsec.tf
new file mode 100644
index 0000000..2dae90d
--- /dev/null
+++ b/terraform/docker/crowdsec.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "crowdsec" {
+  name  = local.docker_containers["crowdsec"].container_name
+  image = local.docker_containers["crowdsec"].image
+
+  restart = local.docker_containers["crowdsec"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/docker-socket-proxy.tf b/terraform/docker/docker-socket-proxy.tf
new file mode 100644
index 0000000..8d67095
--- /dev/null
+++ b/terraform/docker/docker-socket-proxy.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "docker_socket_proxy" {
+  name  = local.docker_containers["docker-socket-proxy"].container_name
+  image = local.docker_containers["docker-socket-proxy"].image
+
+  restart = local.docker_containers["docker-socket-proxy"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/docker-update-exporter.tf b/terraform/docker/docker-update-exporter.tf
new file mode 100644
index 0000000..130ff1e
--- /dev/null
+++ b/terraform/docker/docker-update-exporter.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "docker_update_exporter" {
+  name  = local.docker_containers["docker-update-exporter"].container_name
+  image = local.docker_containers["docker-update-exporter"].image
+
+  restart = local.docker_containers["docker-update-exporter"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/error-pages.tf b/terraform/docker/error-pages.tf
new file mode 100644
index 0000000..318c868
--- /dev/null
+++ b/terraform/docker/error-pages.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "error_pages" {
+  name  = local.docker_containers["error-pages"].container_name
+  image = local.docker_containers["error-pages"].image
+
+  restart = local.docker_containers["error-pages"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/gitea.tf b/terraform/docker/gitea.tf
new file mode 100644
index 0000000..459788f
--- /dev/null
+++ b/terraform/docker/gitea.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "gitea" {
+  name  = local.docker_containers["gitea"].container_name
+  image = local.docker_containers["gitea"].image
+
+  restart = local.docker_containers["gitea"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/gotify.tf b/terraform/docker/gotify.tf
new file mode 100644
index 0000000..e0a5885
--- /dev/null
+++ b/terraform/docker/gotify.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "gotify" {
+  name  = local.docker_containers["gotify"].container_name
+  image = local.docker_containers["gotify"].image
+
+  restart = local.docker_containers["gotify"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/grafana.tf b/terraform/docker/grafana.tf
new file mode 100644
index 0000000..d64fc3c
--- /dev/null
+++ b/terraform/docker/grafana.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "grafana" {
+  name  = local.docker_containers["grafana"].container_name
+  image = local.docker_containers["grafana"].image
+
+  restart = local.docker_containers["grafana"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/gramps-redis.tf b/terraform/docker/gramps-redis.tf
new file mode 100644
index 0000000..93df3b3
--- /dev/null
+++ b/terraform/docker/gramps-redis.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "gramps_redis" {
+  name  = local.docker_containers["gramps-redis"].container_name
+  image = local.docker_containers["gramps-redis"].image
+
+  restart = local.docker_containers["gramps-redis"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/gramps-web-celery.tf b/terraform/docker/gramps-web-celery.tf
new file mode 100644
index 0000000..d259f9c
--- /dev/null
+++ b/terraform/docker/gramps-web-celery.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "gramps_web_celery" {
+  name  = local.docker_containers["gramps-web-celery"].container_name
+  image = local.docker_containers["gramps-web-celery"].image
+
+  restart = local.docker_containers["gramps-web-celery"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/gramps-web.tf b/terraform/docker/gramps-web.tf
new file mode 100644
index 0000000..0b90a90
--- /dev/null
+++ b/terraform/docker/gramps-web.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "gramps_web" {
+  name  = local.docker_containers["gramps-web"].container_name
+  image = local.docker_containers["gramps-web"].image
+
+  restart = local.docker_containers["gramps-web"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/influxdb.tf b/terraform/docker/influxdb.tf
new file mode 100644
index 0000000..cefbb62
--- /dev/null
+++ b/terraform/docker/influxdb.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "influxdb" {
+  name  = local.docker_containers["influxdb"].container_name
+  image = local.docker_containers["influxdb"].image
+
+  restart = local.docker_containers["influxdb"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/main.tf b/terraform/docker/main.tf
new file mode 100644
index 0000000..4bc7867
--- /dev/null
+++ b/terraform/docker/main.tf
@@ -0,0 +1,2 @@
+# Docker container resources are split into one file per container.
+# See container-catalog.tf for documentation-oriented metadata used by outputs.
diff --git a/terraform/docker/monitor-kuma.tf b/terraform/docker/monitor-kuma.tf
new file mode 100644
index 0000000..dbca121
--- /dev/null
+++ b/terraform/docker/monitor-kuma.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "monitor_kuma" {
+  name  = local.docker_containers["monitor-kuma"].container_name
+  image = local.docker_containers["monitor-kuma"].image
+
+  restart = local.docker_containers["monitor-kuma"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/mtls-bridge.tf b/terraform/docker/mtls-bridge.tf
new file mode 100644
index 0000000..1af1644
--- /dev/null
+++ b/terraform/docker/mtls-bridge.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "mtls_bridge" {
+  name  = local.docker_containers["mtls-bridge"].container_name
+  image = local.docker_containers["mtls-bridge"].image
+
+  restart = local.docker_containers["mtls-bridge"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/nextcloud-db.tf b/terraform/docker/nextcloud-db.tf
new file mode 100644
index 0000000..b3d910d
--- /dev/null
+++ b/terraform/docker/nextcloud-db.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "nextcloud_db" {
+  name  = local.docker_containers["nextcloud-db"].container_name
+  image = local.docker_containers["nextcloud-db"].image
+
+  restart = local.docker_containers["nextcloud-db"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/nextcloud-redis.tf b/terraform/docker/nextcloud-redis.tf
new file mode 100644
index 0000000..832e04a
--- /dev/null
+++ b/terraform/docker/nextcloud-redis.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "nextcloud_redis" {
+  name  = local.docker_containers["nextcloud-redis"].container_name
+  image = local.docker_containers["nextcloud-redis"].image
+
+  restart = local.docker_containers["nextcloud-redis"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/nextcloud-webapp.tf b/terraform/docker/nextcloud-webapp.tf
new file mode 100644
index 0000000..632dcca
--- /dev/null
+++ b/terraform/docker/nextcloud-webapp.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "nextcloud_webapp" {
+  name  = local.docker_containers["nextcloud-webapp"].container_name
+  image = local.docker_containers["nextcloud-webapp"].image
+
+  restart = local.docker_containers["nextcloud-webapp"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/node-exporter.tf b/terraform/docker/node-exporter.tf
new file mode 100644
index 0000000..a0d7035
--- /dev/null
+++ b/terraform/docker/node-exporter.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "node_exporter" {
+  name  = local.docker_containers["node-exporter"].container_name
+  image = local.docker_containers["node-exporter"].image
+
+  restart = local.docker_containers["node-exporter"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/node-red.tf b/terraform/docker/node-red.tf
new file mode 100644
index 0000000..2256b1b
--- /dev/null
+++ b/terraform/docker/node-red.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "node_red" {
+  name  = local.docker_containers["node-red"].container_name
+  image = local.docker_containers["node-red"].image
+
+  restart = local.docker_containers["node-red"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/outputs.tf b/terraform/docker/outputs.tf
new file mode 100644
index 0000000..f2db582
--- /dev/null
+++ b/terraform/docker/outputs.tf
@@ -0,0 +1,38 @@
+output "docker_host_in_use" {
+  description = "Docker daemon endpoint currently targeted by this workspace."
+  value       = var.docker_host
+}
+
+output "docker_containers" {
+  description = "Documentation-shaped inventory of Docker containers managed via services-up.sh compose sources."
+  value       = local.docker_containers
+}
+
+output "docker_inventory" {
+  description = "Compact Docker inventory suitable for export and merging into broader infrastructure docs."
+  value = {
+    compose_project = "core"
+    container_count = length(local.docker_containers)
+    containers = {
+      for key, container in local.docker_containers : key => {
+        compose_service = container.compose_service
+        compose_file    = container.compose_file
+        container_name  = container.container_name
+        image           = container.image
+        image_source    = container.image_source
+        build_context   = container.build_context
+        network_mode    = container.network_mode
+        networks        = container.networks
+        published_ports = container.published_ports
+        mounts          = container.mounts
+        restart_policy  = container.restart_policy
+        labels          = container.useful_labels
+      }
+    }
+  }
+}
+
+output "managed_container_names" {
+  description = "Names of containers intentionally tracked in Terraform documentation resources."
+  value       = sort(keys(local.docker_containers))
+}
diff --git a/terraform/docker/passbolt-db.tf b/terraform/docker/passbolt-db.tf
new file mode 100644
index 0000000..9e2af1e
--- /dev/null
+++ b/terraform/docker/passbolt-db.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "passbolt_db" {
+  name  = local.docker_containers["passbolt-db"].container_name
+  image = local.docker_containers["passbolt-db"].image
+
+  restart = local.docker_containers["passbolt-db"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/passbolt-webapp.tf b/terraform/docker/passbolt-webapp.tf
new file mode 100644
index 0000000..8429c2b
--- /dev/null
+++ b/terraform/docker/passbolt-webapp.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "passbolt_webapp" {
+  name  = local.docker_containers["passbolt-webapp"].container_name
+  image = local.docker_containers["passbolt-webapp"].image
+
+  restart = local.docker_containers["passbolt-webapp"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/pihole-exporter.tf b/terraform/docker/pihole-exporter.tf
new file mode 100644
index 0000000..16d2d10
--- /dev/null
+++ b/terraform/docker/pihole-exporter.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "pihole_exporter" {
+  name  = local.docker_containers["pihole-exporter"].container_name
+  image = local.docker_containers["pihole-exporter"].image
+
+  restart = local.docker_containers["pihole-exporter"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/portainer.tf b/terraform/docker/portainer.tf
new file mode 100644
index 0000000..5f62e2a
--- /dev/null
+++ b/terraform/docker/portainer.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "portainer" {
+  name  = local.docker_containers["portainer"].container_name
+  image = local.docker_containers["portainer"].image
+
+  restart = local.docker_containers["portainer"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/prometheus.tf b/terraform/docker/prometheus.tf
new file mode 100644
index 0000000..44594c5
--- /dev/null
+++ b/terraform/docker/prometheus.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "prometheus" {
+  name  = local.docker_containers["prometheus"].container_name
+  image = local.docker_containers["prometheus"].image
+
+  restart = local.docker_containers["prometheus"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/providers.tf b/terraform/docker/providers.tf
new file mode 100644
index 0000000..b002244
--- /dev/null
+++ b/terraform/docker/providers.tf
@@ -0,0 +1,4 @@
+provider "docker" {
+  # Local Docker socket default for incremental import/documentation workflow.
+  host = var.docker_host
+}
diff --git a/terraform/docker/searxng-webapp.tf b/terraform/docker/searxng-webapp.tf
new file mode 100644
index 0000000..15b54a0
--- /dev/null
+++ b/terraform/docker/searxng-webapp.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "searxng-webapp" {
+  name  = local.docker_containers["searxng-webapp"].container_name
+  image = local.docker_containers["searxng-webapp"].image
+
+  restart = local.docker_containers["searxng-webapp"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/telegraf.tf b/terraform/docker/telegraf.tf
new file mode 100644
index 0000000..9bf166c
--- /dev/null
+++ b/terraform/docker/telegraf.tf
@@ -0,0 +1,14 @@
+resource "docker_container" "telegraf" {
+  name  = local.docker_containers["telegraf"].container_name
+  image = local.docker_containers["telegraf"].image
+
+  restart = local.docker_containers["telegraf"].restart_policy
+
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/terraform.tfvars.example b/terraform/docker/terraform.tfvars.example
new file mode 100644
index 0000000..fe5449d
--- /dev/null
+++ b/terraform/docker/terraform.tfvars.example
@@ -0,0 +1,9 @@
+# Example only. Copy to terraform.tfvars for local use if needed.
+# Do not commit host-specific overrides.
+
+# docker_host = "unix:///var/run/docker.sock"
+
+# Optional: list container names intentionally tracked in Terraform outputs.
+managed_container_names = [
+  "example-container-name"
+]
diff --git a/terraform/docker/traefik.tf b/terraform/docker/traefik.tf
new file mode 100644
index 0000000..7ce0158
--- /dev/null
+++ b/terraform/docker/traefik.tf
@@ -0,0 +1,69 @@
+resource "docker_container" "traefik" {
+  name  = local.docker_containers["traefik"].container_name
+  image = local.docker_containers["traefik"].image
+
+  restart = local.docker_containers["traefik"].restart_policy
+
+  network_mode = "core_traefik"
+
+  ports {
+    internal = 80
+    external = 80
+    protocol = "tcp"
+  }
+
+  ports {
+    internal = 443
+    external = 443
+    protocol = "tcp"
+  }
+
+  mounts {
+    type      = "bind"
+    source    = "/home/nixos/docker/core/traefik/data/letsencrypt"
+    target    = "/letsencrypt"
+    read_only = false
+  }
+
+  mounts {
+    type      = "bind"
+    source    = "/home/nixos/docker/core/traefik/data/logs"
+    target    = "/logs"
+    read_only = false
+  }
+
+  mounts {
+    type      = "bind"
+    source    = "/home/nixos/docker/core/traefik/certs"
+    target    = "/etc/traefik/certs"
+    read_only = true
+  }
+
+  mounts {
+    type      = "bind"
+    source    = "/home/nixos/docker/core/traefik/dynamic.yml"
+    target    = "/etc/traefik/dynamic.yml"
+    read_only = true
+  }
+
+  mounts {
+    type      = "bind"
+    source    = "/home/nixos/docker/core/traefik/traefik.yml"
+    target    = "/etc/traefik/traefik.yml"
+    read_only = true
+  }
+
+  mounts {
+    type      = "bind"
+    source    = "/home/nixos/docker/core/traefik/data/plugins"
+    target    = "/plugins-storage"
+    read_only = false
+  }
+
+  lifecycle {
+    ignore_changes = [
+      env,
+      labels,
+    ]
+  }
+}
diff --git a/terraform/docker/variables.tf b/terraform/docker/variables.tf
new file mode 100644
index 0000000..6a60b2f
--- /dev/null
+++ b/terraform/docker/variables.tf
@@ -0,0 +1,5 @@
+variable "docker_host" {
+  description = "Docker daemon host for local import workflow."
+  type        = string
+  default     = "unix:///var/run/docker.sock"
+}
diff --git a/terraform/docker/versions.tf b/terraform/docker/versions.tf
new file mode 100644
index 0000000..04a5754
--- /dev/null
+++ b/terraform/docker/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    docker = {
+      source  = "kreuzwerker/docker"
+      version = "3.0.2"
+    }
+  }
+}
diff --git a/terraform/modules/docker_container_placeholder/README.md b/terraform/modules/docker_container_placeholder/README.md
new file mode 100644
index 0000000..04e60fd
--- /dev/null
+++ b/terraform/modules/docker_container_placeholder/README.md
@@ -0,0 +1,6 @@
+# docker_container_placeholder module
+
+Placeholder module directory for future shared Docker container patterns.
+
+This is intentionally empty during initial import-first adoption.
+Keep per-container resources explicit in `../../docker/main.tf` until stable patterns emerge.
diff --git a/terraform/modules/proxmox_vm_placeholder/README.md b/terraform/modules/proxmox_vm_placeholder/README.md
new file mode 100644
index 0000000..12b4aec
--- /dev/null
+++ b/terraform/modules/proxmox_vm_placeholder/README.md
@@ -0,0 +1,6 @@
+# proxmox_vm_placeholder module
+
+Placeholder module directory for future shared Proxmox VM patterns.
+
+This is intentionally empty until provider schemas, import ID formats,
+and non-destructive reconciliation strategy are validated.
diff --git a/terraform/proxmox/README.md b/terraform/proxmox/README.md
new file mode 100644
index 0000000..4fda99b
--- /dev/null
+++ b/terraform/proxmox/README.md
@@ -0,0 +1,44 @@
+# Terraform Proxmox Inventory Layer
+
+This directory codifies existing Proxmox infrastructure using an import-first reconciliation model.
+
+## Purpose
+
+- Track existing Proxmox VMs in Terraform.
+- Reconcile imported VM configuration into maintainable, explicit files.
+- Represent physical host metadata as structured Terraform locals/outputs.
+- Support documentation inventory and future downstream tooling.
+
+## Current repository status
+
+This directory already contains imported/reconciled VM resources (for example `docker`, `server-nixos`, `nix-cache`, `pbs`, `pihole`) plus host metadata locals/outputs.
+
+This means it is no longer just a scaffold; treat it as active infrastructure inventory code.
+
+## Workflow standard (brownfield)
+
+1. Import one existing VM at a time.
+2. Confirm provider-specific import ID format.
+3. Inspect state/plan details.
+4. Keep hand-maintained `.tf` files focused and readable.
+5. Use `ignore_changes` only where drift noise is unavoidable.
+6. Stop when plan is sane/no-op for intended scope.
+
+## File organization expectations
+
+- Prefer one-resource-per-file patterns when practical.
+- Keep shared metadata in `locals`/outputs with clear descriptions.
+- Keep generated comments/config under ongoing cleanup rather than assuming generated output is final.
+
+## Safety notes
+
+- Do not run broad applies casually.
+- Do not commit real credentials or `.tfstate*`.
+- Keep changes incremental and reviewable.
+
+## Related docs
+
+- [../README.md](../README.md)
+- [../../../docs/source-of-truth.md](../../../docs/source-of-truth.md)
+- [../../../docs/terraform-workflows.md](../../../docs/terraform-workflows.md)
+- [../../../docs/infrastructure-inventory.md](../../../docs/infrastructure-inventory.md)
diff --git a/terraform/proxmox/docker.tf b/terraform/proxmox/docker.tf
new file mode 100644
index 0000000..c1ad462
--- /dev/null
+++ b/terraform/proxmox/docker.tf
@@ -0,0 +1,76 @@
+# proxmox_virtual_environment_vm.docker:
+resource "proxmox_virtual_environment_vm" "docker" {
+  name          = "docker"
+  node_name     = "pve"
+  scsi_hardware = "virtio-scsi-single"
+  vm_id         = 103
+
+  agent {
+    enabled = true
+    timeout = "15m"
+    trim    = false
+  }
+
+  cpu {
+    cores   = 4
+    numa    = false
+    sockets = 1
+    type    = "host"
+    units   = 1024
+  }
+
+  disk {
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi0"
+    iothread          = false
+    path_in_datastore = "vm-103-disk-0"
+    replicate         = true
+    size              = 120
+    ssd               = false
+  }
+  disk {
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi1"
+    iothread          = false
+    path_in_datastore = "vm-103-disk-1"
+    replicate         = true
+    size              = 250
+    ssd               = false
+  }
+
+  memory {
+    dedicated      = 8192
+    floating       = 4096
+    keep_hugepages = false
+    shared         = 0
+  }
+
+  network_device {
+    bridge       = "vmbr0"
+    disconnected = false
+    enabled      = true
+    firewall     = true
+  }
+
+  operating_system {
+    type = "l26"
+  }
+
+  lifecycle {
+    ignore_changes = [
+      vga,
+      keyboard_layout,
+      tablet_device,
+      agent,
+    ]
+  }
+
+}
diff --git a/terraform/proxmox/main.tf b/terraform/proxmox/main.tf
new file mode 100644
index 0000000..3d150dd
--- /dev/null
+++ b/terraform/proxmox/main.tf
@@ -0,0 +1,51 @@
+# Proxmox import-first workflow
+#
+# 1) Add one minimal resource block for one existing VM.
+# 2) Add an import block for that VM using the provider's required import ID format.
+# 3) Run:
+#      terraform init
+#      terraform plan
+#   or:
+#      ../scripts/reconcile_from_plan.sh -- -var-file=terraform.tfvars
+# 4) Review generated config carefully.
+# 5) Move only the useful arguments into a hand-maintained .tf file.
+# 6) Repeat until `terraform plan` is a no-op.
+
+# IMPORTANT:
+# - Start with exactly ONE existing VM.
+# - Do not apply until plan is clean.
+# - Confirm the provider's exact import ID format before running import/plan.
+# - Do not import your whole environment at once.
+
+# Example placeholder for one existing VM
+#resource "proxmox_virtual_environment_vm" "server-nixos" {
+#  name      = "server-nixos"
+#  node_name = "pve"
+#}
+
+# Example import block
+# REPLACE the id below with the exact import ID format required by your provider.
+# This is provider-specific and must be confirmed before use.
+#
+# Commonly this will involve the Proxmox node name and VM ID in some form.
+#
+import {
+  to = proxmox_virtual_environment_vm.nix-cache
+  id = "pve/105"
+}
+import {
+  to = proxmox_virtual_environment_vm.server-nixos
+  id = "pve/104"
+}
+import {
+  to = proxmox_virtual_environment_vm.pihole
+  id = "pve/108"
+}
+import {
+  to = proxmox_virtual_environment_vm.pbs
+  id = "pve/106"
+}
+import {
+  to = proxmox_virtual_environment_vm.docker
+  id = "pve/103"
+}
diff --git a/terraform/proxmox/nix-cache.tf b/terraform/proxmox/nix-cache.tf
new file mode 100644
index 0000000..faa4bbf
--- /dev/null
+++ b/terraform/proxmox/nix-cache.tf
@@ -0,0 +1,63 @@
+# proxmox_virtual_environment_vm.nix-cache:
+resource "proxmox_virtual_environment_vm" "nix-cache" {
+  name          = "nix-cache"
+  node_name     = "pve"
+  scsi_hardware = "virtio-scsi-single"
+  vm_id         = 105
+
+  agent {
+    enabled = true
+    timeout = "15m"
+    trim    = false
+  }
+
+  cpu {
+    cores   = 2
+    numa    = false
+    sockets = 1
+    type    = "x86-64-v2-AES"
+    units   = 1024
+  }
+
+  disk {
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi0"
+    iothread          = false
+    path_in_datastore = "vm-105-disk-0"
+    replicate         = true
+    size              = 100
+    ssd               = false
+  }
+
+  memory {
+    dedicated      = 2048
+    floating       = 0
+    keep_hugepages = false
+    shared         = 0
+  }
+
+  network_device {
+    bridge       = "vmbr0"
+    disconnected = false
+    enabled      = true
+    firewall     = true
+  }
+
+  operating_system {
+    type = "l26"
+  }
+  lifecycle {
+    ignore_changes = [
+      vga,
+      keyboard_layout,
+      tablet_device,
+      agent,
+    ]
+  }
+
+}
+
diff --git a/terraform/proxmox/outputs.tf b/terraform/proxmox/outputs.tf
new file mode 100644
index 0000000..f8e8266
--- /dev/null
+++ b/terraform/proxmox/outputs.tf
@@ -0,0 +1,28 @@
+output "proxmox_scaffold_ready" {
+  description = "Indicates this directory is a placeholder scaffold for future Proxmox adoption."
+  value       = true
+}
+
+output "proxmox_endpoint_configured" {
+  description = "Whether a non-empty endpoint has been provided."
+  value       = var.proxmox_endpoint != ""
+}
+
+output "physical_hosts" {
+  description = "Physical host inventory used for documentation"
+  value       = local.physical_hosts
+}
+
+output "virtual_hosts" {
+  description = "Virtual host/VM inventory used for documentation"
+  value       = local.virtual_hosts
+}
+
+
+output "infrastructure_inventory" {
+  description = "Combined infrastructure inventory"
+  value = {
+    physical_hosts = local.physical_hosts
+    virtual_hosts  = local.virtual_hosts
+  }
+}
diff --git a/terraform/proxmox/pbs.tf b/terraform/proxmox/pbs.tf
new file mode 100644
index 0000000..df0a158
--- /dev/null
+++ b/terraform/proxmox/pbs.tf
@@ -0,0 +1,72 @@
+# __generated__ by Terraform
+# Please review these resources and move them into your main configuration files.
+
+# __generated__ by Terraform
+resource "proxmox_virtual_environment_vm" "pbs" {
+  name          = "pbs"
+  node_name     = "pve"
+  scsi_hardware = "virtio-scsi-single"
+  vm_id         = 106
+  agent {
+    enabled = true
+    timeout = "15m"
+    trim    = false
+  }
+  cpu {
+    cores   = 4
+    numa    = false
+    sockets = 1
+    type    = "x86-64-v2-AES"
+    units   = 1024
+  }
+  disk {
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi0"
+    iothread          = false
+    path_in_datastore = "vm-106-disk-0"
+    replicate         = true
+    size              = 100
+    ssd               = false
+  }
+  disk {
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi1"
+    iothread          = false
+    path_in_datastore = "vm-106-disk-1"
+    replicate         = true
+    size              = 700
+    ssd               = false
+  }
+  memory {
+    dedicated      = 8192
+    floating       = 4096
+    keep_hugepages = false
+    shared         = 0
+  }
+  network_device {
+    bridge       = "vmbr0"
+    disconnected = false
+    enabled      = true
+    firewall     = true
+  }
+  operating_system {
+    type = "l26"
+  }
+  lifecycle {
+    ignore_changes = [
+      vga,
+      keyboard_layout,
+      tablet_device,
+      agent,
+    ]
+  }
+
+}
diff --git a/terraform/proxmox/pihole.tf b/terraform/proxmox/pihole.tf
new file mode 100644
index 0000000..dc90159
--- /dev/null
+++ b/terraform/proxmox/pihole.tf
@@ -0,0 +1,14 @@
+# Pi-hole VM — DECOMMISSIONED
+# Pi-hole was decommissioned. DNS is now handled by FreeIPA (domain-controller.sweet.home).
+# DHCP is on the router. PXE DHCP is handled by the pxe-boot LXC.
+#
+# This resource block is kept as historical documentation of VMID 108.
+# If the VM has been destroyed on Proxmox, remove this file entirely.
+# If it still exists and needs to be removed via Terraform:
+#   terraform destroy -target=proxmox_virtual_environment_vm.pihole
+
+# resource "proxmox_virtual_environment_vm" "pihole" {
+#   name      = "pihole"
+#   node_name = "pve"
+#   vm_id     = 108
+# }
diff --git a/terraform/proxmox/providers.tf b/terraform/proxmox/providers.tf
new file mode 100644
index 0000000..a168755
--- /dev/null
+++ b/terraform/proxmox/providers.tf
@@ -0,0 +1,11 @@
+provider "proxmox" {
+  # Placeholder-only scaffold.
+  # Confirm exact provider auth mode and endpoint details before real use.
+  endpoint = var.proxmox_endpoint
+  insecure = var.proxmox_insecure
+
+  #  username = var.proxmox_username
+  #  password = var.proxmox_password
+
+  api_token = "${var.proxmox_api_token_id}=${var.proxmox_api_token_secret}"
+}
diff --git a/terraform/proxmox/pve.tf b/terraform/proxmox/pve.tf
new file mode 100644
index 0000000..8a05a11
--- /dev/null
+++ b/terraform/proxmox/pve.tf
@@ -0,0 +1,79 @@
+locals {
+  physical_hosts = {
+    pve = {
+      hostname      = "pve"
+      type          = "physical"
+      role          = "proxmox"
+      management_ip = "pve.sweet.home"
+      os_family     = "debian"
+      hypervisor    = "proxmox"
+      location      = "home"
+      notes         = "Primary Proxmox VE host"
+    }
+    raspberrypi = {
+      hostname      = "raspberrypi"
+      type          = "physical"
+      role          = "edge"
+      management_ip = "raspberrypi.tail13f623.ts.net"
+      os_family     = "debian"
+      hypervisor    = null
+      location      = "riverglades"
+      notes         = "Raspberry Pi host"
+    }
+  }
+
+  # Virtual host inventory for documentation output. This is intentionally
+  # concise and shaped for docs tooling (not a full provider object dump).
+  virtual_hosts = {
+    docker = {
+      name          = "docker"
+      type          = "virtual"
+      role          = "docker-host"
+      proxmox_node  = "pve"
+      vm_id         = 103
+      management_ip = ""
+      os_family     = "linux"
+      notes         = "Primary Docker VM"
+    }
+    server_nixos = {
+      name          = "server-nixos"
+      type          = "virtual"
+      role          = "nixos-server"
+      proxmox_node  = "pve"
+      vm_id         = 104
+      management_ip = ""
+      os_family     = "nixos"
+      notes         = "General-purpose NixOS VM"
+    }
+    nix_cache = {
+      name          = "nix-cache"
+      type          = "virtual"
+      role          = "cache"
+      proxmox_node  = "pve"
+      vm_id         = 105
+      management_ip = ""
+      os_family     = "linux"
+      notes         = "Nix binary cache VM"
+    }
+    pbs = {
+      name          = "pbs"
+      type          = "virtual"
+      role          = "backup"
+      proxmox_node  = "pve"
+      vm_id         = 106
+      management_ip = ""
+      os_family     = "linux"
+      notes         = "Proxmox Backup Server VM"
+    }
+    pihole = {
+      name          = "pihole"
+      type          = "virtual"
+      role          = "dns"
+      proxmox_node  = "pve"
+      vm_id         = 108
+      management_ip = ""
+      os_family     = "linux"
+      notes         = "DNS filtering VM"
+    }
+  }
+}
diff --git a/terraform/proxmox/server-nixos.tf b/terraform/proxmox/server-nixos.tf
new file mode 100644
index 0000000..746369f
--- /dev/null
+++ b/terraform/proxmox/server-nixos.tf
@@ -0,0 +1,88 @@
+# __generated__ by Terraform
+# Please review these resources and move them into your main configuration files.
+
+# __generated__ by Terraform
+resource "proxmox_virtual_environment_vm" "server-nixos" {
+  name          = "server-nixos"
+  node_name     = "pve"
+  scsi_hardware = "virtio-scsi-single"
+  vm_id         = 104
+  agent {
+    enabled = true
+    timeout = "15m"
+    trim    = false
+  }
+  cpu {
+    cores   = 4
+    numa    = false
+    sockets = 1
+    type    = "x86-64-v2-AES"
+    units   = 1024
+  }
+  disk {
+    aio               = "io_uring"
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi0"
+    iothread          = false
+    path_in_datastore = "vm-104-disk-0"
+    replicate         = true
+    size              = 32
+    ssd               = false
+  }
+  disk {
+    aio               = "io_uring"
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi1"
+    iothread          = false
+    path_in_datastore = "vm-104-disk-1"
+    replicate         = true
+    size              = 200
+    ssd               = false
+  }
+  disk {
+    aio               = "io_uring"
+    backup            = true
+    cache             = "none"
+    datastore_id      = "local-lvm"
+    discard           = "ignore"
+    file_format       = "raw"
+    interface         = "scsi2"
+    iothread          = false
+    path_in_datastore = "vm-104-disk-2"
+    replicate         = true
+    size              = 200
+    ssd               = false
+  }
+  memory {
+    dedicated      = 4096
+    floating       = 2048
+    keep_hugepages = false
+    shared         = 0
+  }
+  network_device {
+    bridge       = "vmbr0"
+    disconnected = false
+    enabled      = true
+    firewall     = true
+  }
+  operating_system {
+    type = "l26"
+  }
+  lifecycle {
+    ignore_changes = [
+      vga,
+      keyboard_layout,
+      tablet_device,
+      agent,
+    ]
+  }
+
+}
diff --git a/terraform/proxmox/terraform.tfvars.example b/terraform/proxmox/terraform.tfvars.example
new file mode 100644
index 0000000..adbce78
--- /dev/null
+++ b/terraform/proxmox/terraform.tfvars.example
@@ -0,0 +1,9 @@
+# Example placeholders only. Do not commit real credentials.
+
+proxmox_endpoint = "https://pve.example.local:8006/api2/json"
+proxmox_insecure = false
+
+# Use either username/password or API token based on your chosen auth flow.
+proxmox_username  = "root@pam"
+proxmox_password  = "REPLACE_ME"
+proxmox_api_token = "REPLACE_ME"
diff --git a/terraform/proxmox/variables.tf b/terraform/proxmox/variables.tf
new file mode 100644
index 0000000..f91b19a
--- /dev/null
+++ b/terraform/proxmox/variables.tf
@@ -0,0 +1,37 @@
+variable "proxmox_endpoint" {
+  description = "Proxmox API endpoint URL, for example https://pve.example.local:8006/api2/json"
+  type        = string
+  default     = ""
+}
+
+variable "proxmox_insecure" {
+  description = "Set true only for local testing with self-signed TLS; prefer false in stable environments."
+  type        = bool
+  default     = false
+}
+
+#variable "proxmox_username" {
+#  description = "Username for password-based auth (placeholder; optional if token auth is used)."
+#  type        = string
+#  default     = ""
+#}
+
+#variable "proxmox_password" {
+#  description = "Password for password-based auth (placeholder; optional if token auth is used)."
+#  type        = string
+#  default     = ""
+#  sensitive   = true
+#}
+
+variable "proxmox_api_token_id" {
+  type        = string
+  description = "Proxmox API token ID, e.g. terraform@pve!tf"
+  sensitive   = true
+}
+
+variable "proxmox_api_token_secret" {
+  description = "API token for token-based auth (placeholder; optional if username/password is used)."
+  type        = string
+  default     = ""
+  sensitive   = true
+}
diff --git a/terraform/proxmox/versions.tf b/terraform/proxmox/versions.tf
new file mode 100644
index 0000000..4f4dee4
--- /dev/null
+++ b/terraform/proxmox/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    proxmox = {
+      source  = "bpg/proxmox"
+      version = "0.68.0"
+    }
+  }
+}
diff --git a/terraform/scripts/reconcile_from_plan.sh b/terraform/scripts/reconcile_from_plan.sh
new file mode 100755
index 0000000..cf11360
--- /dev/null
+++ b/terraform/scripts/reconcile_from_plan.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  reconcile_from_plan.sh [--output-file <path>] [--] [terraform plan args...]
+
+Description:
+  Runs `terraform plan` with `-generate-config-out` and writes the generated
+  configuration into a tracked Terraform file (default:
+  `zz_generated_from_plan.auto.tf`).
+
+  This is designed for import-first workflows where `import { ... }` blocks are
+  present and Terraform can generate missing resource arguments from live
+  infrastructure.
+
+Options:
+  --output-file <path>  Destination .tf/.auto.tf file to receive generated
+                        configuration. Default: zz_generated_from_plan.auto.tf
+  -h, --help            Show this help text.
+
+Examples:
+  ./reconcile_from_plan.sh
+  ./reconcile_from_plan.sh --output-file generated_imports.auto.tf -- -var-file=terraform.tfvars
+USAGE
+}
+
+output_file="zz_generated_from_plan.auto.tf"
+plan_args=()
+
+while (($# > 0)); do
+  case "$1" in
+    --output-file)
+      if (($# < 2)); then
+        echo "error: --output-file requires a value" >&2
+        exit 1
+      fi
+      output_file="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    --)
+      shift
+      plan_args=("$@")
+      break
+      ;;
+    *)
+      plan_args+=("$1")
+      shift
+      ;;
+  esac
+done
+
+if ! command -v terraform >/dev/null 2>&1; then
+  echo "error: terraform is not installed or not in PATH" >&2
+  exit 1
+fi
+
+if [[ ! -f "main.tf" ]] && ! compgen -G "*.tf" >/dev/null; then
+  echo "error: no Terraform configuration (*.tf) found in $(pwd)" >&2
+  echo "run this script from a Terraform module directory" >&2
+  exit 1
+fi
+
+generated_tmp_dir="$(mktemp -d -t terraform-generated-XXXXXX)"
+generated_tmp="$generated_tmp_dir/generated.tf"
+# terraform plan -generate-config-out requires a path that does not already exist
+trap 'rm -rf "$generated_tmp_dir"' EXIT
+
+echo "Running: terraform plan -generate-config-out=$generated_tmp ${plan_args[*]-}"
+set +e
+terraform plan -generate-config-out="$generated_tmp" "${plan_args[@]}"
+plan_exit=$?
+set -e
+
+if [[ $plan_exit -ne 0 && $plan_exit -ne 2 ]]; then
+  echo "error: terraform plan failed with exit code $plan_exit" >&2
+  exit "$plan_exit"
+fi
+
+if [[ ! -s "$generated_tmp" ]]; then
+  echo "No generated configuration was produced."
+  echo "Tip: ensure you have import blocks and resources eligible for config generation."
+  exit 0
+fi
+
+cat > "$output_file" <<EOF2
+# -----------------------------------------------------------------------------
+# AUTO-GENERATED BY reconcile_from_plan.sh
+# Generated: $(date -u +"%Y-%m-%dT%H:%M:%SZ")
+# Source: terraform plan -generate-config-out
+# Review carefully before apply.
+# -----------------------------------------------------------------------------
+
+EOF2
+cat "$generated_tmp" >> "$output_file"
+
+terraform fmt "$output_file" >/dev/null
+
+echo "Generated configuration written to: $output_file"
+echo "Next step: review this file and run terraform plan again to confirm intent."