Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/proxmox/ansible/roles/tap_bridge/defaults/main.yml

@@ -0,0 +1,23 @@
+---
+# A bare Linux bridge with one physical port and NO IP address, used as the
+# attach point for emulator TAP interfaces (86Box, PCem, qemu, ...).
+#
+# WHY a bridge at all: 86Box's TAP backend creates its own tap device
+# (TUNSETIFF) and then enslaves it to a bridge you name (SIOCBRADDIF). It does
+# NOT bridge to a raw NIC, so the NIC has to already be in a bridge for the
+# emulated guests to reach the wire.
+#
+# WHY no IP on the bridge: the host deliberately does not sit on the retro
+# segment. Guests use the VyOS SDN gateway (10.61.0.1) directly. Giving the
+# host an address here would put an up-to-date Linux box inside the retro
+# broadcast domain for no reason, and would make the retro guests able to
+# reach this host's services.
+tap_bridge_name: br0
+
+# Matched by MAC, not by name: the kernel's predictable-interface name depends
+# on PCI slot ordering, which moves if the VM's NIC layout changes. The MACs
+# are pinned in pve_vm defaults precisely so they can be matched on.
+tap_bridge_member: ""
+tap_bridge_member_mac: ""
+
+tap_bridge_netplan_file: /etc/netplan/60-tap-bridge.yaml

infrastructure/proxmox/ansible/roles/tap_bridge/handlers/main.yml

@@ -0,0 +1,9 @@
+---
+- name: Apply netplan
+  # `netplan apply` re-applies EVERY netplan file, including the cloud-init one
+  # that owns the management NIC this play is connected over. It does not
+  # normally bounce an unchanged interface, but if a run ever hangs here that
+  # is the reason -- check the console via `qm terminal 101`.
+  ansible.builtin.command:
+    cmd: netplan apply
+  changed_when: true

infrastructure/proxmox/ansible/roles/tap_bridge/tasks/main.yml

@@ -0,0 +1,59 @@
+---
+- name: Check the bridge role is configured
+  ansible.builtin.assert:
+    that:
+      - tap_bridge_member | length > 0
+      - tap_bridge_member_mac | length > 0
+    fail_msg: "tap_bridge_member and tap_bridge_member_mac must be set"
+
+- name: Install bridge utilities
+  # bridge-utils is not needed by netplan (it uses netlink), but brctl is the
+  # quickest way to see which taps an emulator has attached while debugging.
+  ansible.builtin.apt:
+    name: bridge-utils
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+  register: _brutils
+  retries: 3
+  delay: 15
+  until: _brutils is succeeded
+
+- name: Configure the bridge in netplan
+  ansible.builtin.template:
+    src: netplan.yaml.j2
+    dest: "{{ tap_bridge_netplan_file }}"
+    # 0600: netplan warns loudly about world-readable config and ignores such
+    # files in newer releases.
+    mode: "0600"
+    owner: root
+    group: root
+  notify: Apply netplan
+
+- name: Flush handlers so the bridge exists before it is verified
+  ansible.builtin.meta: flush_handlers
+
+- name: Read back the bridge state
+  ansible.builtin.command:
+    cmd: "ip -br link show {{ tap_bridge_name }}"
+  register: _br
+  changed_when: false
+  failed_when: false
+
+- name: Read back the enslaved port
+  # `master <bridge>` in `ip link` output is the authoritative proof that the
+  # NIC is actually in the bridge -- netplan reporting success is not.
+  ansible.builtin.shell:
+    cmd: "ip -o link show {{ tap_bridge_member }} | grep -o 'master [^ ]*' || true"
+  register: _member
+  changed_when: false
+
+- name: Verify the bridge is up with the port enslaved
+  ansible.builtin.assert:
+    that:
+      - _br.rc == 0
+      - "'master ' ~ tap_bridge_name in _member.stdout"
+    fail_msg: >-
+      Bridge {{ tap_bridge_name }} is not correctly set up.
+      bridge: {{ _br.stdout | default('absent') }} / port: {{ _member.stdout | default('none') }}
+    success_msg: "{{ tap_bridge_name }} up, {{ tap_bridge_member }} enslaved"

infrastructure/proxmox/ansible/roles/tap_bridge/templates/netplan.yaml.j2

@@ -0,0 +1,33 @@
+# {{ ansible_managed }}
+# Bridge for emulator TAP interfaces. Separate from 50-cloud-init.yaml on
+# purpose: cloud-init rewrites its own file, and it only claims the primary
+# NIC (matched by MAC), so this file can own the second NIC without conflict.
+network:
+  version: 2
+  ethernets:
+    {{ tap_bridge_member }}:
+      match:
+        macaddress: "{{ tap_bridge_member_mac }}"
+      set-name: {{ tap_bridge_member }}
+      dhcp4: false
+      dhcp6: false
+      accept-ra: false
+      # optional: do not let systemd-networkd-wait-online block boot for a port
+      # that has no L3 config and may have nothing plugged behind it.
+      optional: true
+  bridges:
+    {{ tap_bridge_name }}:
+      interfaces: [{{ tap_bridge_member }}]
+      dhcp4: false
+      dhcp6: false
+      accept-ra: false
+      optional: true
+      parameters:
+        # STP off + zero forward delay: taps appear and disappear every time an
+        # emulated machine is powered on. With STP the bridge would hold each
+        # new port in learning state for ~15s and silently drop the guest's
+        # first packets, which looks exactly like a broken guest TCP/IP stack.
+        # Safe here because this bridge has a single uplink -- no loop is
+        # possible.
+        stp: false
+        forward-delay: 0