Restructure into one folder per private repo/host, not a flat Docker/ dump

rocky-docker-lxc/, caddy-vm/, monitoring-vm/ (was missing entirely -
Grafana+Loki+Prometheus stack, refreshed and CA mount stripped same as
everything else), and automation/{ansible,automation-vm,iac}/ for the
three repos that live on the automation VM. Hawser is genuinely
deployed on all three of caddy-vm/monitoring-vm/automation-vm so it's
duplicated in each rather than picking one canonical home.

Old Ansible/ and "Infrastrucutre as Code/" content moved under
automation/ansible/old-playbooks and automation/iac/old-content as-is
for now - contents still need refreshing against the current repos and
a per-folder README, that's the next pass.

monitoring-vm/Grafana-Stack/docker-compose.yaml

@@ -0,0 +1,63 @@
+services:
+  loki:
+    image: grafana/loki:latest
+    container_name: loki
+    user: root
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT_loki}:3100"
+    volumes:
+      - /path/to/monitoring-data/loki:/tmp/loki
+      - /path/to/monitoring/config/loki-config.yaml:/etc/loki/loki-config.yaml:ro
+    command: -config.file=/etc/loki/loki-config.yaml
+    networks:
+      - monitoring-net
+
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: prometheus
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT_prometheus}:9090"
+    volumes:
+      - /path/to/monitoring-data/prometheus:/prometheus
+      - /path/to/monitoring/config/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--web.enable-remote-write-receiver'
+      - '--storage.tsdb.retention.size=900GB'
+    networks:
+      - monitoring-net
+
+  grafana:
+    image: grafana/grafana:latest
+    container_name: grafana
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT_grafana}:3000"
+    env_file: .env
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD}
+      - GF_SERVER_ROOT_URL=${GRAFANA_URL}
+      - GF_AUTH_GENERIC_OAUTH_ENABLED=true
+      - GF_AUTH_GENERIC_OAUTH_NAME=authentik
+      - GF_AUTH_GENERIC_OAUTH_CLIENT_ID=${GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
+      - GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
+      - GF_AUTH_GENERIC_OAUTH_SCOPES=openid profile email
+      - GF_AUTH_GENERIC_OAUTH_AUTH_URL=${AUTHENTIK_URL}/application/o/authorize/
+      - GF_AUTH_GENERIC_OAUTH_TOKEN_URL=${AUTHENTIK_URL}/application/o/token/
+      - GF_AUTH_GENERIC_OAUTH_API_URL=${AUTHENTIK_URL}/application/o/userinfo/
+      - GF_AUTH_GENERIC_OAUTH_LOGIN_ATTRIBUTE_PATH=preferred_username
+      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH=contains(groups[*], 'authentik Admins') && 'Admin'
+      - GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_STRICT=false
+      - GF_AUTH_GENERIC_OAUTH_USE_PKCE=true
+      - GF_AUTH_SIGNOUT_REDIRECT_URL=${AUTHENTIK_URL}/application/o/grafana/end-session/
+      - GF_AUTH_OAUTH_ALLOW_INSECURE_EMAIL_LOOKUP=true
+    volumes:
+      - /path/to/monitoring/grafana:/var/lib/grafana
+    networks:
+      - monitoring-net
+
+networks:
+  monitoring-net:
+    external: true

monitoring-vm/Hawser/docker-compose.yaml

@@ -0,0 +1,19 @@
+services:
+  hawser:
+    image: ghcr.io/finsys/hawser:latest
+    container_name: hawser
+    restart: unless-stopped
+    ports:
+      - "${HTTP_PORT}:2376"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /path/to/hawser/hawser_stacks:/data/stacks
+    environment:
+      - TOKEN=${TOKEN}
+      - TZ=${TZ}
+    networks:
+      - hawser-net
+
+networks:
+  hawser-net:
+    external: true