Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/proxmox/ansible/roles/nfs_mounts/defaults/main.yml

@@ -0,0 +1,16 @@
+---
+# Generic NFS client mounts. Shareable: pass a list, get idempotent mounts.
+#
+# Each entry: { src, path, opts (optional), state (optional) }
+nfs_mounts: []
+
+# Defaults chosen for read-mostly media (ISO libraries), NOT for VM disks:
+#   ro       - the share is a library; nothing here should write to it. Also
+#              the only real protection available, because the server exports
+#              it to <world> with no_root_squash.
+#   soft     - a hard mount wedges every process that touches the path when the
+#              server or the WAN-adjacent link blips, including the desktop
+#              file manager. Soft returns EIO instead of hanging forever.
+#   _netdev  - do not attempt the mount before the network is up.
+#   nofail   - a missing NFS server must never stop this host from booting.
+nfs_mounts_default_opts: "ro,soft,timeo=100,retrans=3,_netdev,nofail,noatime"

infrastructure/proxmox/ansible/roles/nfs_mounts/tasks/main.yml

@@ -0,0 +1,43 @@
+---
+- name: Install the NFS client
+  ansible.builtin.apt:
+    name: nfs-common
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+  register: _nfsc
+  retries: 3
+  delay: 15
+  until: _nfsc is succeeded
+
+- name: Create the mount points
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: "0755"
+  loop: "{{ nfs_mounts }}"
+  loop_control:
+    label: "{{ item.path }}"
+
+- name: Mount the NFS shares
+  ansible.posix.mount:
+    src: "{{ item.src }}"
+    path: "{{ item.path }}"
+    fstype: nfs
+    opts: "{{ item.opts | default(nfs_mounts_default_opts) }}"
+    state: "{{ item.state | default('mounted') }}"
+  loop: "{{ nfs_mounts }}"
+  loop_control:
+    label: "{{ item.src }} -> {{ item.path }}"
+
+- name: Verify each share is actually readable
+  # `mount` reporting success is not proof: a stale handle or a squashed uid
+  # shows up only on the first read.
+  ansible.builtin.command:
+    cmd: "ls {{ item.path }}"
+  loop: "{{ nfs_mounts }}"
+  loop_control:
+    label: "{{ item.path }}"
+  register: _nfs_ls
+  changed_when: false
+  when: (item.state | default('mounted')) == 'mounted'