Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

apps/smtp-relay/scripts/enable-dkim-finish.ps1

@@ -0,0 +1,18 @@
+# DKIM step 2 of 2: enable signing, once the CNAME targets from enable-dkim.ps1 are
+# published and resolving. Validates the CNAMEs and turns on DKIM signing.
+#
+#     ! pwsh ~/services/apps/smtp-relay/scripts/enable-dkim-finish.ps1
+param(
+  [string]$Domain = 'ddupan.top'
+)
+Import-Module ExchangeOnlineManagement
+Connect-ExchangeOnline -Device -ShowBanner:$false
+try {
+  Set-DkimSigningConfig -Identity $Domain -Enabled $true -ErrorAction Stop
+  Write-Host "DKIM enabled for $Domain."
+} catch {
+  Write-Host "Enable failed: $($_.Exception.Message)"
+  Write-Host "If it mentions CNAME records, they aren't visible to Exchange yet — wait and re-run."
+}
+Get-DkimSigningConfig -Identity $Domain | Format-List Name, Enabled, Status, Selector1CNAME, Selector2CNAME
+Disconnect-ExchangeOnline -Confirm:$false

apps/smtp-relay/scripts/enable-dkim.ps1

@@ -0,0 +1,31 @@
+# DKIM step 1 of 2: create the signing config (disabled) and PRINT the exact CNAME
+# targets. The 2025 CNAME format includes a per-tenant character only Exchange knows,
+# so we must read Selector1CNAME/Selector2CNAME from here, publish them, THEN enable.
+#
+#     ! pwsh ~/services/apps/smtp-relay/scripts/enable-dkim.ps1
+# Sign in as a tenant admin. Paste the CNAME values back so DNS can be updated.
+param(
+  [string]$Domain = 'ddupan.top'
+)
+Import-Module ExchangeOnlineManagement
+Connect-ExchangeOnline -Device -ShowBanner:$false
+
+# Create directly (disabled). Don't pre-check with Get — on a missing domain it only
+# WARNS (not errors), which defeats try/catch. Catch the "already exists" case instead.
+try {
+  New-DkimSigningConfig -DomainName $Domain -KeySize 2048 -Enabled $false -ErrorAction Stop | Out-Null
+  Write-Host "Created DKIM config for $Domain (disabled)."
+} catch {
+  if ("$($_.Exception.Message)" -match 'already exist') {
+    Write-Host "DKIM config already exists — continuing."
+  } else {
+    Write-Host "New-DkimSigningConfig failed: $($_.Exception.Message)"
+    Disconnect-ExchangeOnline -Confirm:$false
+    return
+  }
+}
+
+Write-Host "`n== PUBLISH THESE EXACT CNAME TARGETS (paste them back) =="
+Get-DkimSigningConfig -Identity $Domain | Format-List Name, Enabled, Status, Selector1CNAME, Selector2CNAME
+Write-Host "After the CNAMEs are updated + resolving, run scripts/enable-dkim-finish.ps1 to enable."
+Disconnect-ExchangeOnline -Confirm:$false

apps/smtp-relay/scripts/enable-smtp-auth.ps1

@@ -0,0 +1,19 @@
+# Enables Authenticated SMTP (SMTP AUTH) on [email protected] so OAuth SMTP works.
+# Run it yourself (interactive admin device-login):
+#     ! pwsh ~/services/apps/smtp-relay/scripts/enable-smtp-auth.ps1
+# At the prompt, open https://microsoft.com/devicelogin and sign in as a tenant ADMIN.
+param(
+  [string]$Mailbox = '[email protected]'
+)
+Import-Module ExchangeOnlineManagement
+Connect-ExchangeOnline -Device -ShowBanner:$false
+
+$mbx = Get-CASMailbox -Identity $Mailbox -ErrorAction SilentlyContinue
+if (-not $mbx) {
+  Write-Host "Mailbox '$Mailbox' isn't provisioned yet (licensing can take a few minutes). Wait and re-run."
+} else {
+  Set-CASMailbox -Identity $Mailbox -SmtpClientAuthenticationDisabled:$false
+  Write-Host "== Authenticated SMTP status =="
+  Get-CASMailbox -Identity $Mailbox | Format-List Name, SmtpClientAuthenticationDisabled
+}
+Disconnect-ExchangeOnline -Confirm:$false