Restructure into one folder per private repo/host, not a flat Docker/ dump

rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.

Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.

automation/iac/old-content/Ansible/roles/secure_vault/haproxy/templates/haproxy.cfg.j2

@@ -0,0 +1,86 @@
+# ==========================================
+# HAProxy global settings
+# ==========================================
+global
+    log /dev/log local0
+    log /dev/log local1 notice
+    chroot /var/lib/haproxy
+    pidfile /run/haproxy.pid
+    maxconn {{ haproxy_global_maxconn | default(4096) }}
+    user haproxy
+    group haproxy
+    daemon
+
+defaults
+    log global
+    option httplog
+    option dontlognull
+    timeout connect {{ haproxy_timeout_connect_ms | default('5000') }}
+    timeout client {{ haproxy_timeout_client_ms | default('60000') }}
+    timeout server {{ haproxy_timeout_server_ms | default('60000') }}
+    option http-server-close
+    option forwardfor
+    retries 3
+    maxconn 2000
+
+# ==========================================
+# HAProxy frontends and backends template
+# ==========================================
+
+frontend https-in
+    mode http
+    bind *:443 ssl crt {{ haproxy_pem_path }} ca-file {{ haproxy_ca_path }} verify required alpn h2,http/1.1
+    option httplog
+    option forwardfor
+    timeout client 30s
+
+    http-request set-header X-Client-Cert %[ssl_c_der,base64]
+
+{% for service_name, service in securemtls_services.items() %}
+    acl host_{{ service_name }} hdr(host) -i {{ service.hostname }}
+    use_backend {{ service_name }} if host_{{ service_name }}
+{% endfor %}
+
+# ==========================================
+# Backends
+# ==========================================
+{% for service_name, service in securemtls_services.items() %}
+backend {{ service_name }}
+    balance {{ service.balance | default('roundrobin') }}
+    mode {{ service.mode | default('http') }}
+    timeout connect {{ service.timeout_connect | default('5s') }}
+    timeout server {{ service.timeout_server | default('30s') }}
+    option {{ service.options | default('http-server-close') }}
+    default-server inter {{ service.default_server_inter | default('3s') }}
+    default-server rise {{ service.default_server_rise | default('2') }}
+    default-server fall {{ service.default_server_fall | default('3') }}
+
+{% for server in service.backend_servers %}
+    {% if server.proto == "https" %}
+    server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} ssl verify none check
+    {% else %}
+    server {{ service_name }}-{{ loop.index }} {{ server.address }}:{{ server.port }} check
+    {% endif %}
+{% endfor %}
+
+{% if service.headers is defined %}
+{% for hdr in service.headers %}
+    {{ hdr }}
+{% endfor %}
+{% endif %}
+
+{% if service.rewrites is defined %}
+{% for rewrite in service.rewrites %}
+    {{ rewrite }}
+{% endfor %}
+{% endif %}
+
+{% endfor %}
+
+# ==========================================
+# Vault backend for HAProxy
+# ==========================================
+backend vault_backend
+    mode tcp
+    option ssl-hello-chk
+    server vault1 VAULT_IP:VAULT_PORT ssl verify required ca-file {{ haproxy_ca_path }} crt {{ haproxy_cert_path }}