Initial infrastructure mono-repo scaffold

Consolidates nixos, docker, raspi, and debian-configuration into a single
infrastructure-as-code repo. Includes:

- ansible/: full inventory + proxmox-hardening, freeipa, and raspberrypi
  roles (converted from debian-configuration bash scripts)
- terraform/: Proxmox VMs, Dynu DNS, Pi-hole (decommissioned stub),
  Docker container catalog — migrated from docker/infrastructure/terraform/
- stacks/docker/, stacks/raspi/, nixos/: placeholder READMEs pending
  git subtree population (see implementation plan)
- docs/: internal MkDocs site with architecture, network topology, runbooks,
  and drift-detection guide; external sanitized site
- scripts/: drift-detect.sh, docs-build.sh, install-hooks.sh, check-secrets.sh
- CI: secret-scan (push/PR), drift-detect (daily), docs-build (on change)
- Pi-hole removed throughout — DNS is FreeIPA, DHCP is router

See docs/internal/implementation-plan.md for the phased rollout after
pushing to Gitea.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP

.gitleaks.toml

@@ -0,0 +1,80 @@
+# Gitleaks configuration for the infrastructure mono-repo.
+# Extends the default ruleset with patterns for all managed services.
+# https://github.com/gitleaks/gitleaks
+
+title = "infrastructure secret scan"
+
+[extend]
+  useDefault = true
+
+# ── Pi-hole ────────────────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "pihole-pwhash"
+  description = "Pi-hole password hash (pihole.toml webserver.api.pwhash)"
+  regex       = '''pwhash\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "password"]
+
+[[rules]]
+  id          = "pihole-totp-secret"
+  description = "Pi-hole 2FA TOTP secret"
+  regex       = '''totp_secret\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "2fa"]
+
+[[rules]]
+  id          = "pihole-app-pwhash"
+  description = "Pi-hole app password hash"
+  regex       = '''app_pwhash\s*=\s*"[^"]{10,}"'''
+  tags        = ["pihole", "password"]
+
+# ── Ansible / Terraform ────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "ansible-vault-inline"
+  description = "Ansible vault encrypted value in a file that isn't a vault file"
+  regex       = '''\$ANSIBLE_VAULT;[0-9]+\.[0-9]+'''
+  tags        = ["ansible", "vault"]
+
+[[rules]]
+  id          = "terraform-tfvars-secret"
+  description = "Terraform tfvars token assignment"
+  regex       = '''(api_token|token_secret|password|secret)\s*=\s*"[^"]{8,}"'''
+  tags        = ["terraform", "credentials"]
+
+# ── Authelia ───────────────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "authelia-user-hash"
+  description = "Authelia user database bcrypt/argon2 hash"
+  regex       = '''\$argon2|\$2[aby]\$'''
+  tags        = ["authelia", "password"]
+
+# ── Docker secrets ─────────────────────────────────────────────────────────────
+
+[[rules]]
+  id          = "docker-secrets-env"
+  description = "Docker secrets env file password assignment"
+  regex       = '''(PASSWORD|SECRET|TOKEN|KEY)\s*=\s*[^\s#]{12,}'''
+  tags        = ["docker", "credentials"]
+
+# ── ─────────────────────────────────────────────────────────────────────────────
+
+[allowlist]
+  description = "Known-safe patterns in this repo"
+  regexes     = [
+    # TLS cert path reference — not the key itself
+    '''cert\s*=\s*"/etc/pihole/tls\.pem"''',
+    # Ansible example password placeholders
+    '''changeme|CHANGEME|example_password|your_password_here''',
+    # Terraform variable default empty strings
+    '''default\s*=\s*""''',
+  ]
+  paths       = [
+    # Template and example files are intentionally non-live
+    '''\.example$''',
+    '''\.example\..*$''',
+    # Test fixtures
+    '''test.*fixture''',
+    # This config file itself
+    '''\.gitleaks\.toml$''',
+  ]