docs: iac commit IDs after its history rewrite (ISO removed, content unchanged)

Covers the design rationale, the refill-cycle mechanism, three real
issues found and fixed via live testing against a real Kodi session
(a silent result-key mismatch that meant the daemon never once
resolved a track, a starved similarity candidate pool, and a
4-minute poll-interval blind spot), and live proof of a working
auto-queued run of similar tracks.

docs/architecture-overview.md

@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-18
-     rocky-docker-lxc@7dd5025 : caddy/Caddyfile
+     rocky-docker-lxc@d225776 : caddy/conf/Caddyfile
-     caddy-vm@9369f8b : caddy/Caddyfile
+     caddy-vm@c5c3420 : caddy/conf/Caddyfile
      trilium : 2wCPV6NXQa3l, 0mu75aAXGH8X, fscYadnUtmD5, QMTh5G7ldlLV, TIbCwYGitboy, Cl4TWBZ7ytYr, 6cJurv76PNDR, nAPJq9A1iuX8, DvKxK0gHXsng
 -->
 

docs/disaster-recovery.md

@@ -1,5 +1,5 @@
 <!-- verified: 2026-09-18
-     iac@f770e1c : ansible/roles_metadata.yml
+     iac@ae315de : ansible/roles_metadata.yml
      ansible@24e1bf0 : roles/os_update, playbooks/os_update_vms.yml, playbooks/os_update_pve.yml, playbooks/os_update_pbs.yml, playbooks/app_update.yml
      trilium : xJRSQovMncQr, 6AbdS9cUE45T, bW84ccRoAJ5i, p45qNP2sIuhA, 6oESvJYzj1at
 -->

docs/firewall-and-network.md

@@ -1,5 +1,5 @@
 <!-- verified: 2026-09-06
-     iac@49ff427 : ansible/roles/bootstrap_roles/firewall_ssh, ansible/roles/secure_vault/firewall_rich_rules_per_vm, ansible/roles/cis_hardening/password_policy
+     iac@49d9773 : ansible/roles/bootstrap_roles/firewall_ssh, ansible/roles/secure_vault/firewall_rich_rules_per_vm, ansible/roles/cis_hardening/password_policy
      trilium : 0mu75aAXGH8X, o3DDWo1v54vI, oEbKGleDKuvb, EpssgVXxqIbE, 0R8GeBmH7boV, TIbCwYGitboy, fscYadnUtmD5, yUJqswizuET2, QMTh5G7ldlLV, jBPOx07B1Y2Z, Cl4TWBZ7ytYr, 6cJurv76PNDR, kwbbLjeI6ody, MSVD5o5HiJ69, kA00FQiQWVem
 -->
 

docs/homelab-inventory.md

@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-07
      ansible@9a4ba6d : roles/homelab_inventory_hardware, roles/homelab_inventory_vms, roles/homelab_inventory_services, playbooks/homelab_inventory_hardware.yml, playbooks/homelab_inventory_vms.yml, playbooks/homelab_inventory_services.yml
-     rocky-docker-lxc@145d3df : caddy/Caddyfile, dashy/docker-compose.yaml
+     rocky-docker-lxc@d225776 : caddy/conf/Caddyfile, dashy/docker-compose.yaml
      trilium : O0d4fqw0mr05
 -->
 

docs/iac-pipeline.md

@@ -1,5 +1,5 @@
 <!-- verified: 2026-09-19
-     iac@f770e1c : packer/rocky10-proxmox-template, terraform, ansible/roles_metadata.yml, ansible/playbooks/provisioning.yml, ansible/host_vars/technitium/host_tags.yml, ansible/roles/cis_hardening/password_policy
+     iac@ae315de : packer/rocky10-proxmox-template, terraform, ansible/roles_metadata.yml, ansible/playbooks/provisioning.yml, ansible/host_vars/technitium/host_tags.yml, ansible/roles/cis_hardening/password_policy
      trilium : c5JADrRVvjIn, f1uTcvXvq0u3, 7anU4VULpp7n, sovEBDmn16hh, sqVGFejKPOFn, kA00FQiQWVem, MSVD5o5HiJ69, NwwrSew7mP2z, QgviHP8r14t2
 -->
 

docs/netbird-zero-trust.md

@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-19
-     netbird-lxc@13b5d80 : netbird/Caddyfile, netbird/docker-compose.yaml, netbird/config.yaml.ctmpl
+     netbird-lxc@ea8967e : netbird/conf/Caddyfile, netbird/docker-compose.yaml, netbird/config.yaml.ctmpl
-     iac@f770e1c : ansible/roles/secure_vault/netbird_agent, terraform/containers.tf
+     iac@ae315de : ansible/roles/secure_vault/netbird_agent, terraform/containers.tf
      trilium : qWLU4xqYLdJ3, oYuIjaczDrZA, nAPJq9A1iuX8, Cl4TWBZ7ytYr
 -->
 
@@ -56,9 +56,10 @@ The real path a request takes:
 And this is the actual splitter doing that work — the real config, not a description of the logic:
 
 ```
-$ cat Caddyfile
+$ cat conf/Caddyfile
 {
-	admin off
+	# Container loopback only (port not published) - `caddy reload` needs it.
+	admin localhost:2019
 	auto_https off
 	servers {
 		protocols h1 h2 h2c

docs/notifications.md

@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-19
      automation-vm@7c057de : mosquitto
-     iac@f770e1c : ansible/roles/monitoring/mqtt_client
+     iac@ae315de : ansible/roles/monitoring/mqtt_client
      trilium : tt4idCVJPpZM, EAU5LUwFFQ0E, rGfAb4CddKMi, otSPaU6IfjlP, klrmnlh3Wrnd
 -->
 

docs/observability.md

@@ -1,5 +1,5 @@
 <!-- verified: 2026-09-19
-     iac@f770e1c : ansible/roles/monitoring/observability_agent
+     iac@ae315de : ansible/roles/monitoring/observability_agent
      trilium : eeiUz4iTEgPL, zquji4XOpw5M, s5tWZshDEpQb, oWr1jJhvqitv
 -->
 

docs/registry-and-build.md

@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-19
      ansible@24e1bf0 : host_vars/rocky-docker/docker_stacks.yml, host_vars/netbird/docker_stacks.yml, roles/container_update, playbooks/container_update.yml
-     iac@f770e1c : ansible/roles/secure_vault/vault_agent/defaults/main.yml
+     iac@ae315de : ansible/roles/secure_vault/vault_agent/defaults/main.yml
      trilium : dcRUArk5dWH8, bW84ccRoAJ5i, hWiIGZIlvQiN
 -->
 

docs/secret-distribution.md

@@ -1,5 +1,5 @@
 <!-- verified: 2026-09-19
-     iac@f770e1c : ansible/roles/secure_vault/ssh_ca_client, ansible/roles/secure_vault/vault_agent/defaults/main.yml, ansible/roles/secure_vault/SecureVault – Vault Contract.md, ansible/roles/secure_vault/securevault-vault-facts.md
+     iac@ae315de : ansible/roles/secure_vault/ssh_ca_client, ansible/roles/secure_vault/vault_agent/defaults/main.yml, ansible/roles/secure_vault/SecureVault – Vault Contract.md, ansible/roles/secure_vault/securevault-vault-facts.md
      ansible@24e1bf0 : roles/app_update/defaults/main.yml
      trilium : DvKxK0gHXsng, wovVrgvoDVy2, GW8BMoTKtRBe, 1seDR2nBmxKO
 -->

docs/secrets-and-pki.md

@@ -1,6 +1,6 @@
 <!-- verified: 2026-09-19
-     iac@f770e1c : ansible/roles/secure_vault, ansible/group_vars/all/vault_provisioner.yml, ansible/roles/monitoring/mqtt_client
+     iac@ae315de : ansible/roles/secure_vault, ansible/group_vars/all/vault_provisioner.yml, ansible/roles/monitoring/mqtt_client
-     rocky-docker-lxc@7dd5025 : caddy/Caddyfile
+     rocky-docker-lxc@d225776 : caddy/conf/Caddyfile
      trilium : Eu0wns00QOBG, wovVrgvoDVy2, 1seDR2nBmxKO, GW8BMoTKtRBe, JbKe9CHzOP9D, Tu7FX48fxSQZ, DvKxK0gHXsng, otSPaU6IfjlP
 -->
 

docs/security-monitoring.md

@@ -1,5 +1,5 @@
 <!-- verified: 2026-09-19
-     iac@f770e1c : ansible/roles/monitoring/wazuh_agent_tuning, ansible/roles/monitoring/docker_bench, ansible/roles/cis_hardening
+     iac@ae315de : ansible/roles/monitoring/wazuh_agent_tuning, ansible/roles/monitoring/docker_bench, ansible/roles/cis_hardening
      wazuh-vm@07ed482 : wazuh/docker-compose.yml
      trilium : KpvtX1USDhkY, TstjWVV5Q1TS, OtIgVyQC5lJg, MSVD5o5HiJ69, kA00FQiQWVem, oY5CbyuxZRyS
 -->

docs/sso-and-identity.md

@@ -1,7 +1,7 @@
 <!-- verified: 2026-09-18
-     rocky-docker-lxc@7dd5025 : caddy/Caddyfile
+     rocky-docker-lxc@d225776 : caddy/conf/Caddyfile
-     caddy-vm@9369f8b : caddy/Caddyfile
+     caddy-vm@c5c3420 : caddy/conf/Caddyfile
-     iac@f770e1c : ansible/roles/bootstrap_roles/docker_git_setup
+     iac@ae315de : ansible/roles/bootstrap_roles/docker_git_setup
      trilium : baWhWTUejvY6, hWiIGZIlvQiN, nAPJq9A1iuX8
 -->
 

stacks/platform/caddy-internal/docker-compose.yaml

@@ -6,11 +6,11 @@ services:
     ports:
       - "${HTTPS_PORT}:443"
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./conf:/etc/caddy:ro
       - /path/to/caddy-internal/caddy_data:/data
       - /path/to/caddy-internal/caddy_config:/config
       - /path/to/caddy-internal/logs:/var/log/caddy
-      - ./certs/pki_int_ca.crt:/etc/caddy/certs/pki_int_ca.crt:ro
+      - ./certs:/etc/caddy/certs:ro
     networks:
       - caddy-net
 

stacks/platform/caddy/docker-compose.yaml

@@ -6,7 +6,7 @@ services:
     ports:
       - "${HTTPS_PORT}:443"
     volumes:
-      - ./Caddyfile:/etc/caddy/Caddyfile
+      - ./conf:/etc/caddy:ro
       - /path/to/caddy/caddy_data:/data
       - /path/to/caddy/caddy_config:/config
       - /etc/caddy/certs:/etc/caddy/certs