Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline

Captures the full workspace state built up to this point:

  - CLAUDE.md + README.md describing conventions and the four-host fleet
    (ana-ml2, ana-docker, nh3-docker, esh-docker-vm).
  - Per-host notes under servers/<host>/ with ssh-target fallback files
    and latest system-details snapshots (two in-compose credential leaks
    scrubbed; the upstream compose files still need to move those to .env).
  - scripts/: server_inspect.sh (read-only remote diagnostic),
    refresh-server-info.sh (dir-driven discovery + snapshot capture with
    validation warnings), add-host.sh, sync-stacks.sh (pull
    compose/conf trees), deploy-stack.sh (push with per-file diff + prompt).
  - stacks/: canonical compose for backrest, beszel, dozzle, llama-swap,
    rest-server-ana, rest-server-nh3, vllm-qwen3, plus the retired
    infinity reference. All use the .env-driven + traefik-net + homepage
    label pattern.
  - configs/restic/ana-docker/: first resticprofile config + pre-backup
    hook (Synapse pg_dump, Seafile mysqldump, Vaultwarden SQLite); templates
    for the other three hosts to come.
  - docs/pfi/: general infrastructure reference carried over.
  - .gitignore excludes .env, stacks-mirror/, and assorted secret/state
    filenames to prevent re-leaks on later commits.

stacks/dozzle/compose.yaml

@@ -0,0 +1,66 @@
+# Dozzle — container log viewer.
+#
+# Multi-host layout via compose profiles:
+#   COMPOSE_PROFILES=hub   → runs the web UI (deploy on ana-docker)
+#   COMPOSE_PROFILES=agent → runs the remote agent (deploy on ana-ml2)
+#
+# Same compose.yaml on both servers; per-host `.env` picks the profile.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  dozzle:
+    image: amir20/dozzle:${DOZZLE_VERSION}
+    container_name: dozzle
+    profiles: [hub]
+    restart: unless-stopped
+    ports:
+      - "${DOZZLE_PORT}:8080"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - dozzle_data:/data
+    environment:
+      - DOZZLE_HOSTNAME=${DOZZLE_HOSTNAME}
+      - DOZZLE_REMOTE_AGENT=${DOZZLE_REMOTE_AGENT:-}
+      - DOZZLE_AUTH_PROVIDER=${DOZZLE_AUTH_PROVIDER:-none}
+      - DOZZLE_USERNAME=${DOZZLE_USERNAME:-}
+      - DOZZLE_PASSWORD=${DOZZLE_PASSWORD:-}
+    healthcheck:
+      test: ["CMD", "/dozzle", "healthcheck"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    networks:
+      - tnet
+    labels:
+      - homepage.group=PFI-ANA
+      - homepage.name=Dozzle
+      - homepage.icon=mdi-text-box-search
+      - homepage.description=Container logs (ana-docker + ana-ml2)
+      - homepage.href=http://10.250.50.70:${DOZZLE_PORT}
+
+  dozzle-agent:
+    image: amir20/dozzle:${DOZZLE_VERSION}
+    container_name: dozzle-agent
+    profiles: [agent]
+    restart: unless-stopped
+    command: agent
+    ports:
+      - "${DOZZLE_AGENT_BIND:-0.0.0.0}:${DOZZLE_AGENT_PORT}:7007"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - dozzle_agent_data:/data
+    environment:
+      - DOZZLE_HOSTNAME=${DOZZLE_HOSTNAME}
+    networks:
+      - tnet
+
+volumes:
+  dozzle_data:
+  dozzle_agent_data:
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true