Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline

Captures the full workspace state built up to this point:

  - CLAUDE.md + README.md describing conventions and the four-host fleet
    (ana-ml2, ana-docker, nh3-docker, esh-docker-vm).
  - Per-host notes under servers/<host>/ with ssh-target fallback files
    and latest system-details snapshots (two in-compose credential leaks
    scrubbed; the upstream compose files still need to move those to .env).
  - scripts/: server_inspect.sh (read-only remote diagnostic),
    refresh-server-info.sh (dir-driven discovery + snapshot capture with
    validation warnings), add-host.sh, sync-stacks.sh (pull
    compose/conf trees), deploy-stack.sh (push with per-file diff + prompt).
  - stacks/: canonical compose for backrest, beszel, dozzle, llama-swap,
    rest-server-ana, rest-server-nh3, vllm-qwen3, plus the retired
    infinity reference. All use the .env-driven + traefik-net + homepage
    label pattern.
  - configs/restic/ana-docker/: first resticprofile config + pre-backup
    hook (Synapse pg_dump, Seafile mysqldump, Vaultwarden SQLite); templates
    for the other three hosts to come.
  - docs/pfi/: general infrastructure reference carried over.
  - .gitignore excludes .env, stacks-mirror/, and assorted secret/state
    filenames to prevent re-leaks on later commits.

stacks/backrest/compose.yaml

@@ -0,0 +1,58 @@
+# Backrest — web UI over restic repositories.
+#
+# Role here: single central viewer for every host's restic repo on both
+# site-local S3 endpoints (TrueNAS at ana, Synology at nh3). Per-host
+# `restic` runs will still be driven by systemd timers on each host; this
+# stack is how we see what ran, browse snapshots, and restore.
+#
+# Repos and S3 credentials are configured in the Backrest UI after first
+# boot — nothing baked into this file. Data (its own SQLite + queue) lives
+# in a named volume so the config survives container recreation.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  backrest:
+    image: garethgeorge/backrest:${BACKREST_VERSION}
+    container_name: backrest
+    hostname: backrest
+    restart: unless-stopped
+    ports:
+      - "${BACKREST_PORT}:9898"
+    volumes:
+      - backrest_data:/data
+      - backrest_config:/config
+      - backrest_cache:/cache
+      - backrest_tmp:/tmp
+    environment:
+      - BACKREST_DATA=/data
+      - BACKREST_CONFIG=/config/config.json
+      - XDG_CACHE_HOME=/cache
+      - TMPDIR=/tmp
+      - TZ=${TZ:-America/Los_Angeles}
+      - BACKREST_PORT=0.0.0.0:9898
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:9898/"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    networks:
+      - tnet
+    labels:
+      - homepage.group=PFI-ANA
+      - homepage.name=Backrest
+      - homepage.icon=mdi-backup-restore
+      - homepage.description=Restic snapshot viewer / restore UI
+      - homepage.href=http://10.250.50.70:${BACKREST_PORT}
+
+volumes:
+  backrest_data:
+  backrest_config:
+  backrest_cache:
+  backrest_tmp:
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true