Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

platform/observability/logs/collector-values.yaml

@@ -0,0 +1,22 @@
+# victoria-logs-collector — deploys vlagent as a DaemonSet that discovers and tails
+# every pod's container logs on each node and ships them to VictoriaLogs. Buffers to
+# a local volume when VictoriaLogs is unavailable.
+#
+# NOTE: confirm key names against the installed chart before applying:
+#   helm show values vm/victoria-logs-collector
+# (chart value layout occasionally shifts between versions.)
+
+remoteWrite:
+  - url: "http://vlsingle-main.monitoring.svc:9428"
+
+# Tolerate control-plane taints so logs are collected from every node.
+tolerations:
+  - operator: Exists
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi

platform/observability/logs/helm.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Deploy the pod-log collector (vlagent DaemonSet) that ships container logs to the
+# VLSingle instance created by ./vlsingle.yaml. Apply vlsingle.yaml first.
+set -euo pipefail
+
+kubectl apply -f vlsingle.yaml
+
+helm repo add vm https://victoriametrics.github.io/helm-charts/
+helm repo update vm
+
+# Pin --version after the first install (helm search repo vm/victoria-logs-collector --versions).
+helm upgrade --install victoria-logs-collector vm/victoria-logs-collector \
+  --namespace monitoring \
+  --values collector-values.yaml \
+  --wait

platform/observability/logs/vlogs-ingress.yaml

@@ -0,0 +1,24 @@
+# Private tailnet exposure of the VictoriaLogs INGEST endpoint so off-cluster log
+# shippers (Vector on Docker hosts) can push to it. Provisions vlogs.<tailnet>.ts.net.
+# Ingestion is unauthenticated — acceptable on the private tailnet; do not expose publicly.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: victorialogs
+  namespace: monitoring
+spec:
+  ingressClassName: tailscale
+  rules:
+    - host: vlogs
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vlsingle-main
+                port:
+                  number: 9428
+  tls:
+    - hosts:
+        - vlogs

platform/observability/logs/vlsingle.yaml

@@ -0,0 +1,25 @@
+# Single-node VictoriaLogs, managed by the same VM operator as the metrics stack.
+# Service exposed by the operator: vlsingle-main.monitoring.svc:9428
+# Query via Grafana (VictoriaLogs datasource) with LogsQL.
+# NOTE: the VictoriaLogs/Traces CRDs are served under .../v1 (metrics CRDs use v1beta1).
+apiVersion: operator.victoriametrics.com/v1
+kind: VLSingle
+metadata:
+  name: main
+  namespace: monitoring
+spec:
+  retentionPeriod: "30d"
+  storage:
+    accessModes:
+      - ReadWriteOnce
+    storageClassName: localpv-zfs-ceph
+    resources:
+      requests:
+        storage: 30Gi
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1"
+      memory: 2Gi