Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline

Captures the full workspace state built up to this point:

  - CLAUDE.md + README.md describing conventions and the four-host fleet
    (ana-ml2, ana-docker, nh3-docker, esh-docker-vm).
  - Per-host notes under servers/<host>/ with ssh-target fallback files
    and latest system-details snapshots (two in-compose credential leaks
    scrubbed; the upstream compose files still need to move those to .env).
  - scripts/: server_inspect.sh (read-only remote diagnostic),
    refresh-server-info.sh (dir-driven discovery + snapshot capture with
    validation warnings), add-host.sh, sync-stacks.sh (pull
    compose/conf trees), deploy-stack.sh (push with per-file diff + prompt).
  - stacks/: canonical compose for backrest, beszel, dozzle, llama-swap,
    rest-server-ana, rest-server-nh3, vllm-qwen3, plus the retired
    infinity reference. All use the .env-driven + traefik-net + homepage
    label pattern.
  - configs/restic/ana-docker/: first resticprofile config + pre-backup
    hook (Synapse pg_dump, Seafile mysqldump, Vaultwarden SQLite); templates
    for the other three hosts to come.
  - docs/pfi/: general infrastructure reference carried over.
  - .gitignore excludes .env, stacks-mirror/, and assorted secret/state
    filenames to prevent re-leaks on later commits.

servers/ana-docker/README.md

@@ -0,0 +1,67 @@
+# ana-docker
+
+General-purpose Docker host for the Anaheim colo. Runs everything at `10.250.0.0/16` that doesn't need a GPU — pair it with ana-ml2, which handles the GPU workloads.
+
+## Network
+
+- **LAN IP:** 10.250.50.70
+- **FQDN:** `ana-docker.phasefinal.com`
+- **SSH:** standard port 22
+- **Traefik entrypoints:** 80/443 terminate here; cert resolver `anaprod` (Let's Encrypt)
+
+## Hardware
+
+- **CPU:** 8 vCPU (QEMU virtual — this is a VM)
+- **RAM:** 15.6 GB
+- **GPUs:** none
+- **Storage:** 245 GB root (ext4) + NFS mounts from `10.250.50.50` (TrueNAS)
+- **OS:** Debian 12 (bookworm), kernel 6.1.x
+- **Docker:** 20.10.24
+
+## Key paths
+
+| Path | Purpose |
+|------|---------|
+| `/opt/docker/compose/<stack>/` | Compose files (also a git repo) |
+| `/opt/docker/conf/<stack>/` | Config bind mounts |
+| `/opt/docker/data/` | Service state (legacy — most stacks now use named volumes) |
+| `/mnt/compose` | NFS — `10.250.50.50:/mnt/docker` |
+| `/mnt/backup` | NFS — `10.250.50.50:/mnt/backup` (restic target) |
+| `/mnt/tnvms` | NFS — `10.250.50.50:/mnt/pve-VMStorage` |
+
+## Running stacks
+
+| Stack | Port(s) | Notes |
+|-------|---------|-------|
+| traefik | 80 / 443 / 8380 | Reverse proxy + TLS (cert resolver `anaprod`) |
+| crowdsec (+ blocklist-mirror) | 41412 | IPS; bouncer runs as a Traefik plugin |
+| gitea | 3000 / 222 | Git hosting — `gitea.phasefinal.com` |
+| vaultwarden | 9080 | Password vault — `vaultwarden.phasefinal.com` |
+| synapse (+ synapse-db, element-web) | internal | Matrix homeserver — `matrix.phasefinal.com`, client at `chat.phasefinal.com` |
+| seafile (+ mariadb, memcached) | 9180 | File sync — `seafile.phasefinal.com` |
+| searxng | 9996 | Private search metaengine |
+| openwebui | 3100 | Chat UI frontend |
+| sillytavern | 8100 | Chat UI |
+| mailrise | 8025 | SMTP-to-notification gateway |
+| rustdesk (hbbs + hbbr) | host-net 21115-21119 | Remote desktop relay — `rustdesk.phasefinal.com` |
+| dockge | 5001 | Docker stack management UI |
+| beszel | 8090 | Fleet metrics hub (+ local agent); agents on the other hosts report here |
+| dozzle (hub as `dozzle-hub`) | 8088 | Fleet log viewer; agents on the other hosts report here |
+| restic rest-server | 8000 | Anaheim-side restic endpoint (writes to TrueNAS NFS at `/mnt/backup/restic/repo/ana/`); paired with `rest-server-nh3` on the Synology for the NH3 side |
+| backrest | 9898 | Fleet-wide restic snapshot viewer / restore UI — points at both rest-servers |
+| it-tools | 8780 | Dev utilities |
+| mattermost | — | Stopped; kept around for reference |
+
+Portainer was retired from this host; stack management is now handled via Dockge + Beszel.
+
+## Refresh state
+
+```bash
+scripts/refresh-server-info.sh ana-docker
+```
+
+Latest snapshot: `system-details.txt` (regenerate as needed).
+
+## Placement rule
+
+If a new stack needs a GPU it goes on **ana-ml2**, otherwise it lands here.

servers/ana-docker/ssh-target

@@ -0,0 +1 @@
+10.250.50.70