infra: full IaC state after hf-pdocker-01 rebuild (2026-03-08)

Replaces initial Nomad/Consul/Terraform skeleton with current Docker-based
infrastructure across all three nodes (hf-pdocker-01, hf-pdocker-02, bart).

Key changes:
- CLAUDE.md: updated service distribution reflecting hf-pdocker-01 restored
- docs/plans/2026-03-08-hf-pdocker-01-rebuild.md: new rebuild plan doc
- compose/bart/: ai-agents, guacamole, matrix, media, openvas, smarthome, watchtower
- compose/hf-pdocker-02/: traefik, monitoring, adguard, gitea, semaphore, wikijs,
  unifi, vaultwarden, actual-budget, mcpo, netclaw, trivy, watchtower, n8n
- compose/hf-pdocker-01/: frigate, frigate-notify, farm-agent
- stacks/: all Swarm stack definitions (monitoring, traefik, smarthome, matrix,
  guacamole, media, ai-agents, frigate, gitea, semaphore, wikijs, unifi, etc.)
- .gitignore: exclude .env credential files and acme.json certs
- .env.example: placeholder credential files for all services
- .claude/agents/: gitea-backup and other infrastructure agent configs
- scripts/: frigate media cleanup and NAS sync scripts

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/cleanup-frigate-media.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+# =============================================================================
+# Frigate Media Cleanup
+# Removes recordings, clips, and snapshots older than 90 days from NAS
+# Run via cron: 0 3 * * 0 /mnt/docker-data/scripts/cleanup-frigate-media.sh
+# =============================================================================
+
+MEDIA_DIR="/mnt/docker-data/media/frigate"
+MAX_AGE_DAYS=90
+LOG_FILE="/var/log/frigate-cleanup.log"
+DRY_RUN=false
+
+if [ "$1" = "--dry-run" ]; then
+    DRY_RUN=true
+fi
+
+log() {
+    echo "$(date '+%Y-%m-%d %H:%M:%S') $1" | tee -a "$LOG_FILE"
+}
+
+if [ ! -d "$MEDIA_DIR" ]; then
+    log "ERROR: $MEDIA_DIR does not exist"
+    exit 1
+fi
+
+log "=== Frigate media cleanup started (max age: ${MAX_AGE_DAYS} days, dry_run: ${DRY_RUN}) ==="
+
+# Get size before cleanup
+SIZE_BEFORE=$(du -sh "$MEDIA_DIR" 2>/dev/null | cut -f1)
+log "Size before: $SIZE_BEFORE"
+
+# Find and remove old files in recordings/, clips/, exports/
+for subdir in recordings clips exports; do
+    DIR="$MEDIA_DIR/$subdir"
+    if [ -d "$DIR" ]; then
+        COUNT=$(find "$DIR" -type f -mtime +${MAX_AGE_DAYS} | wc -l)
+        log "Found $COUNT files older than ${MAX_AGE_DAYS} days in $subdir/"
+        if [ "$DRY_RUN" = true ]; then
+            find "$DIR" -type f -mtime +${MAX_AGE_DAYS} -print | head -20
+            log "(dry run - no files deleted)"
+        else
+            find "$DIR" -type f -mtime +${MAX_AGE_DAYS} -delete
+            # Remove empty directories left behind
+            find "$DIR" -type d -empty -delete 2>/dev/null
+            log "Cleaned $subdir/"
+        fi
+    fi
+done
+
+# Get size after cleanup
+SIZE_AFTER=$(du -sh "$MEDIA_DIR" 2>/dev/null | cut -f1)
+log "Size after: $SIZE_AFTER"
+log "=== Cleanup complete ==="

scripts/sync-frigate-to-nas.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+# =============================================================================
+# Frigate Clip Sync: USB Drive → NAS
+# Copies alert/detection clips and exports to NAS for long-term retention.
+# Frigate handles short-term cleanup on USB (7 days).
+# The cleanup-frigate-media.sh script handles NAS cleanup (90 days).
+# Run via cron: 0 2 * * * /mnt/docker-data/scripts/sync-frigate-to-nas.sh
+# =============================================================================
+
+USB_DIR="/mnt/frigate-recordings"
+NAS_DIR="/mnt/docker-data/media/frigate"
+LOG_FILE="/var/log/frigate-sync.log"
+
+log() {
+    echo "$(date '+%Y-%m-%d %H:%M:%S') $1" | tee -a "$LOG_FILE"
+}
+
+# Verify both paths exist
+if [ ! -d "$USB_DIR" ]; then
+    log "ERROR: USB drive not mounted at $USB_DIR"
+    exit 1
+fi
+
+if [ ! -d "$NAS_DIR" ]; then
+    log "ERROR: NAS not mounted at $NAS_DIR"
+    exit 1
+fi
+
+log "=== Frigate clip sync started ==="
+
+# Sync clips (alert/detection event media)
+if [ -d "$USB_DIR/clips" ]; then
+    log "Syncing clips..."
+    rsync -av --no-o --no-g "$USB_DIR/clips/" "$NAS_DIR/clips/" >> "$LOG_FILE" 2>&1
+    log "Clips sync complete"
+fi
+
+# Sync exports (user-saved clips)
+if [ -d "$USB_DIR/exports" ]; then
+    log "Syncing exports..."
+    rsync -av --no-o --no-g "$USB_DIR/exports/" "$NAS_DIR/exports/" >> "$LOG_FILE" 2>&1
+    log "Exports sync complete"
+fi
+
+# Report sizes
+USB_CLIPS=$(du -sh "$USB_DIR/clips" 2>/dev/null | cut -f1)
+USB_RECORDINGS=$(du -sh "$USB_DIR/recordings" 2>/dev/null | cut -f1)
+NAS_CLIPS=$(du -sh "$NAS_DIR/clips" 2>/dev/null | cut -f1)
+NAS_EXPORTS=$(du -sh "$NAS_DIR/exports" 2>/dev/null | cut -f1)
+
+log "USB clips: $USB_CLIPS | USB recordings: $USB_RECORDINGS"
+log "NAS clips: $NAS_CLIPS | NAS exports: $NAS_EXPORTS"
+log "=== Sync complete ==="