Establish clean homelab infrastructure baseline

Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.

platform/observability/metrics/scrapes/blocky.yaml

@@ -0,0 +1,30 @@
+# Blocky DNS metrics. Same VMStaticScrape pattern as docker-hosts.yaml, because
+# Blocky runs as a compose stack on the laptop rather than in the cluster
+# (see ../../../../apps/blocky/README.md for why DNS deliberately lives outside k3s).
+#
+# ⚠ Blocky is STAGED, not deployed — this target will be DOWN until it is started.
+# That is expected; do not go hunting for a broken exporter.
+#
+# Worth alerting on once it is live, because there is currently no DNS visibility
+# at all:
+#   blocky_error_total                     — upstream failures
+#   blocky_denylist_cache_entries          — collapses to 0 if a list fetch fails
+#   blocky_cache_hits_total / _misses_total — cache effectiveness
+#   blocky_query_total{response_type=...}  — BLOCKED vs CACHED vs RESOLVED split
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMStaticScrape
+metadata:
+  name: blocky
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/part-of: victoria-metrics
+spec:
+  jobName: blocky
+  targetEndpoints:
+    - targets:
+        - "192.168.10.127:4000"
+      path: /metrics
+      labels:
+        job: blocky
+        host: docker-01

platform/observability/metrics/scrapes/docker-hosts.yaml

@@ -0,0 +1,29 @@
+# Pull metrics from Docker hosts running ../../docker-hosts/compose.yaml.
+# vmagent scrapes each host's node-exporter (:9100) and cAdvisor (:8080) over the LAN.
+# Add one target block per host; keep the `host` label in sync with its HOST_LABEL.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMStaticScrape
+metadata:
+  name: docker-hosts
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/part-of: victoria-metrics
+spec:
+  jobName: docker-hosts
+  targetEndpoints:
+    # --- docker-01 (192.168.10.127) ---
+    - targets:
+        - "192.168.10.127:9100"
+      labels:
+        job: node-exporter
+        host: docker-01
+    - targets:
+        - "192.168.10.127:8080"
+      labels:
+        job: cadvisor
+        host: docker-01
+    # --- add more hosts below, mirroring the two blocks above ---
+    # - targets: ["192.168.10.x:9100"]
+    #   labels: { job: node-exporter, host: docker-02 }
+    # - targets: ["192.168.10.x:8080"]
+    #   labels: { job: cadvisor, host: docker-02 }

platform/observability/metrics/scrapes/kubelet.yaml

@@ -0,0 +1,47 @@
+# Kubelet + cAdvisor metrics (per-node pod/container CPU, memory, network, fs).
+# Scraped over the kubelet's authenticated https port using the vmagent pod's
+# ServiceAccount token. Pattern from the operator docs (VMNodeScrape / cadvisor).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMNodeScrape
+metadata:
+  name: kubelet
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/part-of: victoria-metrics
+spec:
+  scheme: https
+  honorLabels: true
+  honorTimestamps: false
+  interval: 30s
+  tlsConfig:
+    insecureSkipVerify: true
+    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+  bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+  relabelConfigs:
+    - action: labelmap
+      regex: __meta_kubernetes_node_label_(.+)
+    - targetLabel: job
+      replacement: kubelet
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMNodeScrape
+metadata:
+  name: cadvisor
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/part-of: victoria-metrics
+spec:
+  scheme: https
+  honorLabels: true
+  honorTimestamps: false
+  interval: 30s
+  path: /metrics/cadvisor
+  tlsConfig:
+    insecureSkipVerify: true
+    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+  bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+  relabelConfigs:
+    - action: labelmap
+      regex: __meta_kubernetes_node_label_(.+)
+    - targetLabel: job
+      replacement: cadvisor