infra: full IaC state after hf-pdocker-01 rebuild (2026-03-08)

Replaces initial Nomad/Consul/Terraform skeleton with current Docker-based
infrastructure across all three nodes (hf-pdocker-01, hf-pdocker-02, bart).

Key changes:
- CLAUDE.md: updated service distribution reflecting hf-pdocker-01 restored
- docs/plans/2026-03-08-hf-pdocker-01-rebuild.md: new rebuild plan doc
- compose/bart/: ai-agents, guacamole, matrix, media, openvas, smarthome, watchtower
- compose/hf-pdocker-02/: traefik, monitoring, adguard, gitea, semaphore, wikijs,
  unifi, vaultwarden, actual-budget, mcpo, netclaw, trivy, watchtower, n8n
- compose/hf-pdocker-01/: frigate, frigate-notify, farm-agent
- stacks/: all Swarm stack definitions (monitoring, traefik, smarthome, matrix,
  guacamole, media, ai-agents, frigate, gitea, semaphore, wikijs, unifi, etc.)
- .gitignore: exclude .env credential files and acme.json certs
- .env.example: placeholder credential files for all services
- .claude/agents/: gitea-backup and other infrastructure agent configs
- scripts/: frigate media cleanup and NAS sync scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compose/hf-pdocker-02/traefik/.env.example

@@ -0,0 +1 @@
+CF_DNS_API_TOKEN=change_me_cloudflare_api_token

compose/hf-pdocker-02/traefik/docker-compose.yml

@@ -0,0 +1,39 @@
+services:
+  traefik:
+    image: traefik:v3.6
+    container_name: traefik
+    restart: unless-stopped
+    command:
+      - "--api.insecure=true"
+      - "--providers.file.directory=/config/dynamic"
+      - "--providers.file.watch=true"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+      - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare"
+      - "--certificatesresolvers.letsencrypt.acme.email=jeremydanielhobbs@gmail.com"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+    environment:
+      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
+    ports:
+      - "80:80"
+      - "443:443"
+      - "8090:8080"
+    volumes:
+      - /mnt/docker-data/traefik/letsencrypt:/letsencrypt
+      - /mnt/docker-data/traefik/dynamic:/config/dynamic:ro
+    mem_limit: 512M
+    memswap_limit: 512M
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8080/api/overview || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "50m"
+        max-file: "3"

compose/hf-pdocker-02/traefik/dynamic-routes.yml

@@ -0,0 +1,88 @@
+http:
+  routers:
+    yoda:
+      rule: "Host(`yoda.hobbs.farm`)"
+      service: yoda
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+
+    mess:
+      rule: "Host(`mess.hobbs.farm`)"
+      service: mess
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+
+    mess-federation:
+      rule: "Host(`mess.hobbs.farm`) && PathPrefix(`/_matrix/federation`)"
+      service: mess
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+
+    wellknown:
+      rule: "Host(`hobbs.farm`) && PathPrefix(`/.well-known/matrix`)"
+      service: wellknown
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+
+    solo:
+      rule: "Host(`solo.hobbs.farm`)"
+      service: solo
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+
+    vault:
+      rule: "Host(`vault.hobbs.farm`)"
+      service: vault
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+
+    git:
+      rule: "Host(`git.hobbs.farm`)"
+      service: git
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    yoda:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.167:8123"
+
+    mess:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.167:8008"
+
+    wellknown:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.167:8010"
+
+    solo:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.167:8199"
+
+    vault:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.100:26226"
+
+    git:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.86.100:3003"