Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

apps/smtp-relay/scripts/enable-dkim.ps1

@@ -0,0 +1,31 @@
+# DKIM step 1 of 2: create the signing config (disabled) and PRINT the exact CNAME
+# targets. The 2025 CNAME format includes a per-tenant character only Exchange knows,
+# so we must read Selector1CNAME/Selector2CNAME from here, publish them, THEN enable.
+#
+#     ! pwsh ~/services/apps/smtp-relay/scripts/enable-dkim.ps1
+# Sign in as a tenant admin. Paste the CNAME values back so DNS can be updated.
+param(
+  [string]$Domain = 'ddupan.top'
+)
+Import-Module ExchangeOnlineManagement
+Connect-ExchangeOnline -Device -ShowBanner:$false
+
+# Create directly (disabled). Don't pre-check with Get — on a missing domain it only
+# WARNS (not errors), which defeats try/catch. Catch the "already exists" case instead.
+try {
+  New-DkimSigningConfig -DomainName $Domain -KeySize 2048 -Enabled $false -ErrorAction Stop | Out-Null
+  Write-Host "Created DKIM config for $Domain (disabled)."
+} catch {
+  if ("$($_.Exception.Message)" -match 'already exist') {
+    Write-Host "DKIM config already exists — continuing."
+  } else {
+    Write-Host "New-DkimSigningConfig failed: $($_.Exception.Message)"
+    Disconnect-ExchangeOnline -Confirm:$false
+    return
+  }
+}
+
+Write-Host "`n== PUBLISH THESE EXACT CNAME TARGETS (paste them back) =="
+Get-DkimSigningConfig -Identity $Domain | Format-List Name, Enabled, Status, Selector1CNAME, Selector2CNAME
+Write-Host "After the CNAMEs are updated + resolving, run scripts/enable-dkim-finish.ps1 to enable."
+Disconnect-ExchangeOnline -Confirm:$false