Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/samba-ad/ansible/group_vars/all/vars.yml

@@ -0,0 +1,84 @@
+---
+# Non-secret variables shared by all plays. EDIT THESE to your environment.
+# Secrets live in group_vars/vault.yml (encrypted) — see vault.example.yml.
+
+# --- Domain identity (used by both the DC and the Windows join) ---
+samba_ad_realm: "AD.DDUPAN.TOP"
+samba_ad_domain: "DDUPAN"
+samba_ad_dc_hostname: "dc1"
+samba_ad_dc_ip: "192.168.10.5"
+samba_ad_dns_forwarder: "192.168.10.1"
+samba_ad_reverse_zone: "10.168.192.in-addr.arpa"   # reverse of 192.168.10.0/24
+
+# Extra A records for non-domain hosts published in the AD DNS zone.
+samba_ad_extra_a_records:
+  - { name: "bao", ip: "192.168.10.8" }            # OpenBao (../openbao), not domain-joined
+  # Proxmox cluster nodes (../proxmox). Not domain-joined; they authenticate
+  # USERS against this DC rather than being members themselves.
+  - { name: "pve1", ip: "192.168.10.4" }
+  - { name: "pve2", ip: "192.168.10.7" }
+  - { name: "pve3", ip: "192.168.10.9" }
+  # Lab VMs on the SDN VNets (routed via the VyOS router, see ../../proxmox).
+  # These are NOT on 192.168.10.0/24, so they have no PTR in the existing
+  # reverse zone — forward resolution only unless a 0.60.10.in-addr.arpa zone
+  # is added later.
+  - { name: "retrolab", ip: "10.60.0.10" }
+  # k3s services exposed on the LAN through the Envoy gateway (../../../platform/envoy-gateway;
+  # Contour was retired 2026-07-25). They all point at the k3s node, which is where
+  # Envoy's LoadBalancer lands; the gateway routes by Host header and serves the
+  # *.ad.ddupan.top wildcard cert.
+  # Adding another such service = one more line here + an HTTPRoute, nothing else.
+  - { name: "netbox", ip: "192.168.10.127" }        # NetBox (../../../apps/netbox)
+  # SeaweedFS S3. Exists so Terraform state does NOT ride the Cloudflare tunnel:
+  # obj.ddupan.top works, but it hairpins through the WAN, and on 2026-07-28 that
+  # path was blackholed for hours by a dead VPN tunnel. State must stay on the LAN.
+  - { name: "s3", ip: "192.168.10.127" }            # SeaweedFS S3 (../../../apps/seaweedfs)
+
+# Support legacy clients (Win9x/NT4/2000/XP)? INSECURE — see README "Retro clients".
+samba_ad_legacy_clients: false
+
+# --- KMS auto-activation via DNS ---
+# Adds a _vlmcs._tcp SRV record so any domain-joined Windows self-activates against
+# vlmcsd. Set the IP where vlmcsd listens (:1688); empty string disables.
+samba_ad_kms_host_ip: "192.168.10.127"    # vlmcsd runs here (docker, 0.0.0.0:1688)
+samba_ad_kms_hostname: "kms"              # A record kms.ad.ddupan.top -> that IP
+samba_ad_kms_port: 1688
+
+# --- Windows admin box ---
+win_dc_ip: "{{ samba_ad_dc_ip }}"
+win_domain_dns_name: "{{ samba_ad_realm | lower }}"
+win_domain_admin_user: "{{ samba_ad_domain }}\\Administrator"
+win_kms_host: ""                       # e.g. "kms.example.com:1688" (existing vlmcsd)
+win_kms_client_key: ""                 # public GVLK for the Windows edition
+
+# --- Secret indirection: real values come from the encrypted vault ---
+samba_ad_admin_password: "{{ vault_samba_ad_admin_password }}"
+win_domain_admin_password: "{{ vault_samba_ad_admin_password }}"
+
+# --- Service accounts for apps that BIND to LDAP (passwords in vault.yml) ---
+# Previously created by hand (svc-authelia); codified so a DC rebuild restores them.
+samba_ad_service_accounts:
+  - name: svc-pve
+    password: "{{ vault_pve_bind_password }}"
+    description: "Proxmox VE realm bind + user/group sync (read-only)"
+
+# --- Groups used for RBAC by downstream apps ---
+# NOTE: PVE renames synced groups to "<name>-<realm>", so pve-admins becomes
+# "pve-admins-ad" inside Proxmox. Grant ACLs to THAT name, not this one.
+samba_ad_groups:
+  - name: pve-admins
+    members: [panxiao81]
+
+  # NetBox: Authelia forward-auth restricts the site to this group, and NetBox maps it
+  # to is_superuser + is_staff via REMOTE_AUTH_SUPERUSER_GROUPS / STAFF_GROUPS
+  # (../../../apps/netbox). Membership is re-evaluated on every request, so removing someone
+  # here revokes their NetBox admin immediately.
+  - name: netbox-admins
+    members: [panxiao81]
+
+  # Who may log in to AD-joined workstations (SSSD simple_allow_groups).
+  # NESTING DIRECTION MATTERS: pve-admins is a MEMBER OF this group, so admins
+  # get lab access. The reverse (this group inside pve-admins) would hand every
+  # lab user Proxmox Administrator on / — see the ACL in proxmox/ansible.
+  - name: retrolab-users
+    members: [pve-admins]

infrastructure/samba-ad/ansible/group_vars/all/vault.example.yml

@@ -0,0 +1,8 @@
+---
+# Copy to vault.yml and encrypt:  ansible-vault encrypt group_vars/vault.yml
+# NEVER commit the decrypted vault.yml.
+vault_samba_ad_admin_password: "CHANGE-ME-Strong.Passw0rd"
+vault_win_local_admin_password: "CHANGE-ME-Local.Passw0rd"
+
+# Bind account for the Proxmox VE 'ad' realm (read-only user/group sync).
+vault_pve_bind_password: 'CHANGEME-strong-random'

infrastructure/samba-ad/ansible/group_vars/all/vault.yml

@@ -0,0 +1,26 @@
+$ANSIBLE_VAULT;1.1;AES256
+65313862663465383663666633613563346532633332313236633666373861373263393366363061
+3637336438393766643564363033666564316630626533370a316136323131376666363761333465
+36386466653037303161346435316632396534393331643939303336613961366632353664656436
+3636363837356131310a306565396334396363633563316366316131623065393135656239613131
+62386134383234366465306435653230326362386131616431313030656637303662353066643434
+62326237303664623530323531333063343032343231363830656235616134623864653761303231
+37366361653032303839383866373038363765633162636437633639343933383631383533346366
+39386438386237326632313437626535636638386437323131353438666464623435653233313237
+35326466313533653661373938626239666465646637396566653230396164363233303238336638
+63313937363631373663303661313935313738313734663634353161663365363236353162373432
+33326464303535353131363562323831653262366161643031353238343265653462643130326539
+39643635326136353934363438336231393866663338613864363835303564303034663430376363
+63323765643133383536636133376537336534393534626462636335373661353535313961383934
+38323934383462613533343665313432333938323938613736383430393661643562346235386438
+38323332366132653664366135383662623263356534613234323238303963643537636631363832
+65646164616331336131636464363461366664386433313633623662333936623637656330343463
+66306331303733336563653134323837306535336136636531663130316435353366343664656333
+33613735663431343437333636663735326136643464363963346133323238303239336431316230
+37636132363735383735393533333630646165393966656235633037623931326362373230636139
+64313034336236363434346133386537323033326163316432323430333766376461643738323030
+35306438346633643631316461303635633966666536636531386238393339643437326535363034
+37326464623133623564626465373936336432323034333161363363333637386532323136383664
+31303835356431343737656635396131613062633162366562633333636337613131643062373031
+62303233356466633761356339343532633836333262396132613461343635326262656434376665
+6430