Restructure into one folder per private repo/host, not a flat Docker/ dump

rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.

Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.

automation/iac/old-content/Packer/rocky10-proxmox-template/scripts/setup-admin-user.sh

@@ -0,0 +1,108 @@
+#!/bin/bash
+set -euo pipefail
+
+USERNAME="$1"
+HASHED_PASSWORD="$2"
+SSH_KEY="$3"
+
+echo "Creating admin user: $USERNAME"
+
+# --- Install dependencies early
+if command -v dnf &>/dev/null; then
+  dnf install -y zsh git curl sudo util-linux-user
+elif command -v apt-get &>/dev/null; then
+  apt-get update
+  apt-get install -y zsh git curl sudo
+else
+  echo "Unsupported package manager"
+  exit 1
+fi
+
+# --- Create user if not exists
+if ! id "$USERNAME" &>/dev/null; then
+  useradd -m -s /bin/zsh "$USERNAME"
+  echo "${USERNAME}:${HASHED_PASSWORD}" | chpasswd -e
+# Disable forced password change and expiration
+chage -M 99999 -I -1 -E -1 "$USERNAME"
+else
+  echo "User $USERNAME already exists, skipping creation"
+fi
+
+USER_HOME=$(eval echo "~$USERNAME")
+
+# --- Create fastfetch config
+mkdir -p "$USER_HOME/.config/fastfetch"
+cat <<'EOF' > "$USER_HOME/.config/fastfetch/config.jsonc"
+{
+  "displayMode": "default",
+  "modules": [
+    "os", "host", "kernel", "uptime", "packages", "shell",
+    "cpu", "memory",
+    {
+      "type": "disk",
+      "folders": ["/", "/home", "/tmp", "/var", "/var/log", "/var/log/audit", "/var/tmp"]
+    },
+    "locale"
+  ]
+}
+EOF
+
+chown -R "$USERNAME:$USERNAME" "$USER_HOME/.config"
+chmod -R 700 "$USER_HOME/.config"
+
+# --- SSH Setup
+mkdir -p "$USER_HOME/.ssh"
+echo "$SSH_KEY" > "$USER_HOME/.ssh/authorized_keys"
+chmod 700 "$USER_HOME/.ssh"
+chmod 600 "$USER_HOME/.ssh/authorized_keys"
+chown -R "$USERNAME:$USERNAME" "$USER_HOME/.ssh"
+
+# --- Groups and Sudo
+if ! getent group docker >/dev/null; then
+  groupadd docker
+fi
+
+if getent group sudo >/dev/null; then
+  usermod -aG sudo,docker "$USERNAME"
+elif getent group wheel >/dev/null; then
+  usermod -aG wheel,docker "$USERNAME"
+else
+  echo "No sudo-equivalent group found, skipping"
+fi
+
+echo "$USERNAME ALL=(ALL) NOPASSWD:ALL" > "/etc/sudoers.d/99_$USERNAME"
+chmod 440 "/etc/sudoers.d/99_$USERNAME"
+
+# --- Install Oh My Zsh and config as the user
+runuser -l "$USERNAME" -c 'export RUNZSH=no CHSH=no KEEP_ZSHRC=yes && \
+  sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" --unattended'
+
+# --- Install autosuggestions plugin
+runuser -l "$USERNAME" -c "git clone https://github.com/zsh-users/zsh-autosuggestions \
+  ~/.oh-my-zsh/custom/plugins/zsh-autosuggestions"
+
+# --- Generate custom .zshrc
+cat << 'EOF' > "$USER_HOME/.zshrc"
+export ZSH="\$HOME/.oh-my-zsh"
+ZSH_THEME="robbyrussell"
+plugins=(git zsh-autosuggestions)
+source \$ZSH/oh-my-zsh.sh
+
+PS1='%F{51}%n%F{255}@%F{227}%m %F{84}%~%f %F{15}$ '
+fastfetch
+EOF
+
+chown "$USERNAME:$USERNAME" "$USER_HOME/.zshrc"
+chmod 644 "$USER_HOME/.zshrc"
+
+# --- Set shell (do this last to avoid breaking script if user shell changes mid-run)
+chsh -s "$(command -v zsh)" "$USERNAME"
+
+# --- Deny admin from using Ansible
+cat <<EOF > /etc/sudoers.d/99_no_ansible_for_admin
+$USERNAME ALL=(ALL) !/usr/bin/ansible, !/usr/bin/ansible-playbook
+EOF
+
+chmod 440 /etc/sudoers.d/99_no_ansible_for_admin
+
+echo "✅ User $USERNAME configured successfully"