infra: full IaC state after hf-pdocker-01 rebuild (2026-03-08)

Replaces initial Nomad/Consul/Terraform skeleton with current Docker-based
infrastructure across all three nodes (hf-pdocker-01, hf-pdocker-02, bart).

Key changes:
- CLAUDE.md: updated service distribution reflecting hf-pdocker-01 restored
- docs/plans/2026-03-08-hf-pdocker-01-rebuild.md: new rebuild plan doc
- compose/bart/: ai-agents, guacamole, matrix, media, openvas, smarthome, watchtower
- compose/hf-pdocker-02/: traefik, monitoring, adguard, gitea, semaphore, wikijs,
  unifi, vaultwarden, actual-budget, mcpo, netclaw, trivy, watchtower, n8n
- compose/hf-pdocker-01/: frigate, frigate-notify, farm-agent
- stacks/: all Swarm stack definitions (monitoring, traefik, smarthome, matrix,
  guacamole, media, ai-agents, frigate, gitea, semaphore, wikijs, unifi, etc.)
- .gitignore: exclude .env credential files and acme.json certs
- .env.example: placeholder credential files for all services
- .claude/agents/: gitea-backup and other infrastructure agent configs
- scripts/: frigate media cleanup and NAS sync scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compose/hf-pdocker-02/monitoring/docker-compose.yml

@@ -0,0 +1,158 @@
+networks:
+  monitoring-net:
+    name: monitoring-net
+
+services:
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    restart: unless-stopped
+    user: "104"
+    networks:
+      - monitoring-net
+    ports:
+      - "3001:3000"
+    volumes:
+      - /mnt/docker-data/configs/grafana:/var/lib/grafana
+    mem_limit: 512M
+    memswap_limit: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/api/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    restart: unless-stopped
+    dns_search: ""
+    extra_hosts:
+      - "blackbox-exporter:172.24.0.4"
+      - "alertmanager:172.24.0.5"
+      - "influxdb:172.24.0.7"
+    networks:
+      - monitoring-net
+    ports:
+      - "9095:9090"
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--web.console.libraries=/usr/share/prometheus/console_libraries'
+      - '--web.console.templates=/usr/share/prometheus/consoles'
+      - '--web.enable-lifecycle'
+    volumes:
+      - /mnt/docker-data/configs/prometheus:/etc/prometheus
+    mem_limit: 512M
+    memswap_limit: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:9090/-/healthy || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  alertmanager:
+    image: prom/alertmanager:latest
+    container_name: alertmanager
+    restart: unless-stopped
+    networks:
+      - monitoring-net
+    ports:
+      - "9093:9093"
+    command:
+      - '--config.file=/etc/alertmanager/alertmanager.yml'
+      - '--storage.path=/alertmanager'
+    volumes:
+      - /mnt/docker-data/configs/alertmanager:/etc/alertmanager
+      - alertmanager-data:/alertmanager
+    mem_limit: 256M
+    memswap_limit: 256M
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:9093/-/healthy || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  influxdb:
+    image: influxdb:1.8-alpine
+    container_name: influxdb
+    restart: unless-stopped
+    networks:
+      - monitoring-net
+    ports:
+      - "8086:8086"
+    volumes:
+      - /mnt/docker-data/configs/influxdb:/var/lib/influxdb
+    mem_limit: 1G
+    memswap_limit: 1G
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8086/ping || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  matrix-alertmanager-receiver:
+    image: metio/matrix-alertmanager-receiver:2026.2.25
+    container_name: matrix-alertmanager-receiver
+    restart: unless-stopped
+    networks:
+      - monitoring-net
+    ports:
+      - "9094:9094"
+    volumes:
+      - /mnt/docker-data/configs/alertmanager/matrix-receiver-config.yml:/config/config.yml:ro
+    command: ["--config-path", "/config/config.yml"]
+    mem_limit: 128M
+    memswap_limit: 128M
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+  blackbox-exporter:
+    image: prom/blackbox-exporter:latest
+    container_name: blackbox-exporter
+    restart: unless-stopped
+    networks:
+      - monitoring-net
+    ports:
+      - "9115:9115"
+    command:
+      - '--config.file=/config/blackbox.yml'
+    volumes:
+      - /mnt/docker-data/configs/blackbox:/config:ro
+    mem_limit: 128M
+    memswap_limit: 128M
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"
+
+volumes:
+  alertmanager-data: