Initial commit: PFI fleet inventory, stacks, tooling, and backup pipeline

Captures the full workspace state built up to this point:

  - CLAUDE.md + README.md describing conventions and the four-host fleet
    (ana-ml2, ana-docker, nh3-docker, esh-docker-vm).
  - Per-host notes under servers/<host>/ with ssh-target fallback files
    and latest system-details snapshots (two in-compose credential leaks
    scrubbed; the upstream compose files still need to move those to .env).
  - scripts/: server_inspect.sh (read-only remote diagnostic),
    refresh-server-info.sh (dir-driven discovery + snapshot capture with
    validation warnings), add-host.sh, sync-stacks.sh (pull
    compose/conf trees), deploy-stack.sh (push with per-file diff + prompt).
  - stacks/: canonical compose for backrest, beszel, dozzle, llama-swap,
    rest-server-ana, rest-server-nh3, vllm-qwen3, plus the retired
    infinity reference. All use the .env-driven + traefik-net + homepage
    label pattern.
  - configs/restic/ana-docker/: first resticprofile config + pre-backup
    hook (Synapse pg_dump, Seafile mysqldump, Vaultwarden SQLite); templates
    for the other three hosts to come.
  - docs/pfi/: general infrastructure reference carried over.
  - .gitignore excludes .env, stacks-mirror/, and assorted secret/state
    filenames to prevent re-leaks on later commits.

stacks/rest-server-ana/compose.yaml

@@ -0,0 +1,59 @@
+# rest-server (Anaheim) — restic backup target for the fleet.
+#
+# Deploys to ana-docker. Data dir is on the TrueNAS NFS mount
+# (/mnt/backup/restic/repo/ana) so snapshots on the NAS side protect the
+# backup blobs themselves.
+#
+# Mirrors stacks/rest-server-nh3/ in every meaningful way — same auth
+# model, same on-disk layout, same operational semantics — so each client
+# host uses an identical URL shape against either endpoint:
+#
+#   rest:http://<user>:<pw>@10.100.50.50:8000/<user>/     (NH3 Synology)
+#   rest:http://<user>:<pw>@10.250.50.70:8000/<user>/     (this stack)
+#
+# Auth model:
+#   --private-repos : URL path must start with /<user>/ and the HTTP
+#                     basic-auth user must match. Per-host repos are
+#                     strictly isolated.
+#   --append-only   : on-disk data can be added but not removed or
+#                     rewritten; a compromised host can't wipe its own
+#                     history. Prune requires disabling this (see README).
+#
+# Credentials come from /data/.htpasswd — see README for populating it.
+#
+# All tunables live in .env — edit that, not this file.
+
+services:
+  rest-server:
+    image: restic/rest-server:${REST_SERVER_VERSION}
+    container_name: rest-server
+    restart: unless-stopped
+    # Run as the UID that owns the NFS-backed data dir, so file I/O
+    # is not subject to NFS root_squash. On ana-docker this is lkraven (1000).
+    user: "${REST_UID:-1000}:${REST_GID:-1000}"
+    ports:
+      - "${REST_PORT}:8000"
+    volumes:
+      - ${DATA_DIR}:/data
+    environment:
+      - OPTIONS=--private-repos --append-only --prometheus ${EXTRA_OPTIONS:-}
+      - TZ=${TZ:-America/Los_Angeles}
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8000/metrics >/dev/null 2>&1 || [ $? -eq 6 ] && exit 0 || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+    networks:
+      - tnet
+    labels:
+      - homepage.group=PFI-ANA
+      - homepage.name=Restic (rest-server)
+      - homepage.icon=mdi-cloud-upload
+      - homepage.description=Anaheim restic endpoint (data on TrueNAS NFS)
+      - homepage.href=http://10.250.50.70:${REST_PORT}
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true