Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

infrastructure/samba-ad/ansible/roles/dc_vm/templates/meta-data.j2

@@ -0,0 +1,2 @@
+instance-id: {{ dc_vm_name }}-001
+local-hostname: {{ dc_vm_name }}

infrastructure/samba-ad/ansible/roles/dc_vm/templates/network-config.j2

@@ -0,0 +1,20 @@
+version: 2
+ethernets:
+  primary:
+    # Match the (single) ethernet NIC by kernel name and configure it in place.
+    # NOTE: do NOT add set-name here — netplan only supports set-name when matching
+    # on mac/driver, not on name, and a name-match + rename leaves the NIC unconfigured.
+    match:
+      name: "en*"
+    dhcp4: false
+    dhcp6: false
+    addresses:
+      - {{ dc_vm_ip }}/{{ dc_vm_prefix }}
+    routes:
+      - to: default
+        via: {{ dc_vm_gateway }}
+    nameservers:
+      addresses:
+        - {{ dc_vm_boot_dns }}
+      search:
+        - {{ samba_ad_realm | lower }}

infrastructure/samba-ad/ansible/roles/dc_vm/templates/user-data.j2

@@ -0,0 +1,20 @@
+#cloud-config
+# NoCloud user-data for the Samba AD DC base VM.
+hostname: {{ dc_vm_name }}
+fqdn: {{ dc_vm_name }}.{{ samba_ad_realm | lower }}
+# /etc/hosts is owned by the samba_ad_dc role (pins FQDN to the real IP), not cloud-init.
+manage_etc_hosts: false
+preserve_hostname: false
+
+users:
+  - name: {{ dc_vm_user }}
+    groups: [sudo]
+    shell: /bin/bash
+    sudo: "ALL=(ALL) NOPASSWD:ALL"
+    lock_passwd: true
+    ssh_authorized_keys:
+      - {{ dc_vm_ssh_pubkey }}
+
+ssh_pwauth: false
+package_update: true
+package_upgrade: false