Initial commit: infrastructure documentation

Includes:
- Hardware environment reference (Proxmox cluster, VMs, LXCs)
- Services inventory with current deployments
- Caddy & DNS configuration reference
- Runbooks for common deployment procedures

Recent additions:
- SearXNG deployment (utility CT 102, search.echo6.co)
- TOC conversion to Proxmox with cortex VM
- Syncthing sync between Contabo and cortex

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docs/services/services.md

@@ -0,0 +1,68 @@
+# Current Services Inventory
+
+## Active Services
+
+| Service | Location | IP:Port | Access | Notes |
+|---------|----------|---------|--------|-------|
+| MeshMonitor | utility (CT 100) | 192.168.1.100:8080 | https://mesh.echo6.co | Meshtastic mesh monitoring |
+| Utility Caddy | utility (CT 101) | 192.168.1.101 / 100.64.0.8 | 199.6.36.163 (ports 80/443) | Reverse proxy for home services |
+| SearXNG | utility (CT 102) | 192.168.1.102:8080 | https://search.echo6.co | Metasearch engine (Docker) |
+| meshtasticd | aida-nebra | 192.168.1.253:4403 | Internal | Software Meshtastic node |
+| Authentik | Contabo | 5.189.158.149:9000 | https://auth.echo6.co | SSO provider |
+| Forge | Contabo | 5.189.158.149 | https://forge.echo6.co | Git server |
+| Headscale | Contabo | 5.189.158.149 | https://vpn.echo6.co | Tailscale coordination (OIDC enabled) |
+| Headplane | Contabo | 127.0.0.1:3100 | https://vpn.echo6.co/admin | Headscale web UI (OIDC via Authentik) |
+| Mailcow | Contabo | 5.189.158.149 | https://mail.echo6.co | Email server |
+| Vaultwarden | Contabo | 127.0.0.1:8086 | https://vault.echo6.co | Password manager (SSO enabled) |
+| Syncthing | Contabo | 100.64.0.1:22000 | Internal (Tailscale) | File sync — ~/.claude/, ~/projects/ |
+| Syncthing | cortex | 100.64.0.14:22000 | Internal (Tailscale) | File sync — ~/.claude/, ~/projects/ |
+| Proxmox VE | data node | 192.168.1.240:8006 | https://proxmox.echo6.co | Cluster web UI (via Caddy+Tailscale) |
+
+## Services by Server
+
+### toc - Proxmox Host (192.168.1.244 / Tailscale: 100.64.0.13)
+- Proxmox VE node (echo6-cluster)
+- GPU passthrough host for cortex VM
+- No direct services — workloads run on cortex VM
+
+### cortex - VM 150 on toc (192.168.1.150 / Tailscale: 100.64.0.14)
+- GPU compute VM (RTX A4000)
+- Claude Code host
+- Syncthing (syncs with Contabo)
+- **Planned:** Ollama, Open-WebUI, LiteLLM, ARGUS, Aurora
+
+### utility - CT 100 (192.168.1.100 / Tailscale: 100.64.0.7)
+- MeshMonitor (port 8080)
+
+### utility - CT 101 (192.168.1.101 / Tailscale: 100.64.0.8)
+- Utility Caddy (reverse proxy for VPN-only services)
+
+### utility - CT 102 (192.168.1.102 / Tailscale: 100.64.0.15)
+- SearXNG metasearch engine (port 8080)
+- Redis/Valkey cache
+- Compose path: `/opt/searxng/docker-compose.yml`
+
+### aida-nebra (192.168.1.253 / Tailscale: 100.64.0.9)
+- meshtasticd (software Meshtastic node)
+
+### Contabo VPS (5.189.158.149 / Tailscale: 100.64.0.1)
+- Authentik (SSO)
+- Forge (Git)
+- Headscale (mesh VPN)
+- Mailcow (email)
+- Vaultwarden (passwords)
+- Syncthing (syncs with cortex)
+
+## Adding New Services
+
+When deploying a new service, update this file with:
+1. Service name
+2. Host location (server + container if applicable)
+3. IP:Port
+4. Access method (internal only vs public URL)
+5. Brief description
+
+## Naming Conventions
+
+- **Internal services:** Access via Tailscale IP (100.64.x.x) or local IP
+- **Public services:** Access via `*.echo6.co` subdomain through Caddy reverse proxy