Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/proxmox/ansible/roles/pve_network/defaults/main.yml

@@ -0,0 +1,30 @@
+---
+# Jumbo frames on the LAN.
+#
+# VERIFIED 2026-07-25: the unmanaged switch passes 8972-byte payloads with DF set
+# between all three nodes, so jumbo works despite there being no managed switch.
+#
+# WHY: (1) DRBD/LINSTOR replicates every write across this single 1G link —
+# larger frames mean fewer interrupts and better throughput on the storage path.
+# (2) It gives VXLAN room for its ~50-byte overhead, so SDN guests keep a normal
+# 1500 MTU instead of being cut to 1450 (retro OSes handle PMTUD badly).
+#
+# SAFETY on a mixed-MTU segment (router/DC/laptop remain 1500): TCP exchanges MSS
+# in the SYN, so each side sends no more than the other advertised — verified,
+# 1472B pings to all three still pass. The residual risk is only large UDP to a
+# 1500-MTU host; there is none here (corosync uses its own netmtu 1500, DNS is
+# small, NFS is TCP).
+pve_network_mtu: 9000
+
+# Make vmbr0 VLAN-aware so PVE SDN "vlan" zones can hang tagged VNets off it.
+#
+# VERIFIED on this LAN 2026-07-25: the unmanaged switch forwards 802.1Q-tagged
+# frames untouched (tested VLAN 100 between nodes at both 1472B and 8972B). Dumb
+# switches forward on MAC only — the tag is opaque payload to them.
+#
+# So VLAN zones beat VXLAN here: native forwarding, no encapsulation overhead, no
+# MTU maths. Trade-off: a dumb switch enforces no isolation, so VLANs give
+# SEGMENTATION, not security — anything on the LAN could inject tagged frames.
+# Fine for lab networks; do not treat a VLAN here as a security boundary.
+pve_network_vlan_aware: true
+pve_network_bridge_vids: "2-4094"

infrastructure/proxmox/ansible/roles/pve_network/tasks/main.yml

@@ -0,0 +1,66 @@
+---
+- name: Find the bridge port behind vmbr0
+  # Differs per node (pve1 eno1, pve2/pve3 enp1s0f0), so detect rather than hardcode.
+  ansible.builtin.shell:
+    cmd: "ip -br link show master vmbr0 | awk '{print $1}' | head -1"
+  register: _phys
+  changed_when: false
+  check_mode: false
+
+- name: Set MTU persistently on the physical port
+  ansible.builtin.lineinfile:
+    path: /etc/network/interfaces
+    insertafter: "^iface {{ _phys.stdout | trim }} inet manual"
+    line: "\tmtu {{ pve_network_mtu }}"
+    regexp: "^\tmtu "
+    firstmatch: true
+    backup: true
+  register: _phys_mtu
+
+- name: Set MTU persistently on vmbr0
+  ansible.builtin.blockinfile:
+    path: /etc/network/interfaces
+    insertafter: "^\tbridge-fd 0"
+    marker: "#{mark} ANSIBLE pve_network mtu"
+    block: "\tmtu {{ pve_network_mtu }}"
+  register: _br_mtu
+
+- name: Make vmbr0 VLAN-aware
+  ansible.builtin.blockinfile:
+    path: /etc/network/interfaces
+    insertafter: "^\tbridge-fd 0"
+    marker: "#{mark} ANSIBLE pve_network vlan-aware"
+    # Double-quoted so \t is a YAML ESCAPE: a literal tab cannot be used
+    # for indentation inside a block scalar -- YAML rejects tabs outright.
+    block: "\tbridge-vlan-aware yes\n\tbridge-vids {{ pve_network_bridge_vids }}"
+  when: pve_network_vlan_aware | bool
+  register: _vlan_aware
+
+- name: Reload networking if the bridge definition changed
+  # ifreload applies in place; it does NOT drop the management IP for a simple
+  # vlan-aware flip, but this is still done serially (site.yml runs serial:1) so
+  # a mistake cannot take all three nodes at once.
+  ansible.builtin.command:
+    cmd: ifreload -a
+  when: _vlan_aware is changed
+  changed_when: true
+
+- name: Apply at runtime too (no reboot needed)
+  ansible.builtin.shell:
+    cmd: |
+      ip link set {{ _phys.stdout | trim }} mtu {{ pve_network_mtu }}
+      ip link set vmbr0 mtu {{ pve_network_mtu }}
+  when: _phys_mtu is changed or _br_mtu is changed
+  changed_when: true
+
+- name: Verify the MTU is live
+  ansible.builtin.shell:
+    cmd: "ip link show vmbr0 | grep -o 'mtu [0-9]*'"
+  register: _mtu_now
+  changed_when: false
+
+- name: Assert it took
+  ansible.builtin.assert:
+    that: "pve_network_mtu | string in _mtu_now.stdout"
+    fail_msg: "vmbr0 MTU is {{ _mtu_now.stdout }}, expected {{ pve_network_mtu }}"
+    quiet: true