Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/proxmox/ansible/roles/pve_nfs/defaults/main.yml

@@ -0,0 +1,18 @@
+---
+# NFS storage from the laptop ("core" node, 192.168.10.127), which is
+# deliberately NOT a cluster member — it holds the ZFS pool, serves NFS, and runs
+# netboot.xyz + k3s. See the project memory.
+#
+# This carries ISOs, container templates, backups and snippets. VM/CT DISKS live
+# on LINSTOR (pve-rg / pve-rg-hdd), NOT here: an NFS-backed disk would make every
+# guest depend on the laptop being up, which is exactly the coupling the
+# hyperconverged storage exists to avoid.
+pve_nfs_storage_id: laptop
+pve_nfs_server: 192.168.10.127
+pve_nfs_export: /mnt/pool/proxmox
+# Matches the directories that already exist in the export (dump/template/
+# snippets/import). No `images`/`rootdir` — see above.
+pve_nfs_content: "backup,iso,vztmpl,snippets,import"
+# The export is published by ZFS `sharenfs` (see /etc/exports.d/zfs.exports on
+# the laptop), not /etc/exports — change it with `zfs set sharenfs=...`.
+pve_nfs_options: ""

infrastructure/proxmox/ansible/roles/pve_nfs/tasks/main.yml

@@ -0,0 +1,47 @@
+---
+# Storage config lives in /etc/pve/storage.cfg, which is replicated cluster-wide,
+# so this runs once against a single node.
+
+- name: Check whether the storage is already defined
+  ansible.builtin.command:
+    cmd: "pvesm status --storage {{ pve_nfs_storage_id }}"
+  register: _nfs_exists
+  changed_when: false
+  failed_when: false
+  check_mode: false
+  run_once: true
+
+- name: Add the NFS storage
+  ansible.builtin.command:
+    cmd: >-
+      pvesm add nfs {{ pve_nfs_storage_id }}
+      --server {{ pve_nfs_server }}
+      --export {{ pve_nfs_export }}
+      --content {{ pve_nfs_content }}
+      {% if pve_nfs_options %}--options {{ pve_nfs_options }}{% endif %}
+  when: _nfs_exists.rc != 0
+  run_once: true
+
+- name: Wait for it to come active
+  # NFS storage is only usable once every node has mounted it; PVE mounts lazily.
+  ansible.builtin.command:
+    cmd: "pvesm status --storage {{ pve_nfs_storage_id }}"
+  register: _nfs_status
+  until: "'active' in (_nfs_status.stdout | default(''))"
+  retries: 12
+  delay: 5
+  changed_when: false
+  run_once: true
+
+- name: Verify every node can actually see it
+  # A cluster-wide storage entry that only ONE node can mount is a silent trap:
+  # migrations and backups fail on the others. Check per-node, not just once.
+  ansible.builtin.command:
+    cmd: "pvesm status --storage {{ pve_nfs_storage_id }}"
+  register: _nfs_node
+  changed_when: false
+  failed_when: "'active' not in (_nfs_node.stdout | default(''))"
+
+- name: Report
+  ansible.builtin.debug:
+    msg: "{{ inventory_hostname }}: {{ _nfs_node.stdout_lines | select('search', pve_nfs_storage_id) | list }}"