scaffold: hub-and-spoke layout, 4-network topology, 13 stack stubs

Initial structure for R&D infrastructure:

- stacks/ — 13 reusable, runnable stack stubs (kebab-case)
  cloud-and-edge: node-red, influxdb, grafana, keycloak, portainer,
                  nginx-proxy, mqtt, postfix
  cloud-only:     wireguard-server, gitea, jenkins, sql (postgres stub)
  edge-only:      wireguard-client

- cloud/ — single central hub composition with 4 networks
           (edge, app, data internal, mgmt) and include: stubs
- sites/ — per-plant edge folders (template README only for now)
- docs/architecture.md — hub-and-spoke + ingress + segmentation rationale

Network model: only nginx-proxy (80/443/8883) and wireguard-server
(51820/udp) publish ports on the cloud host. Edge nginx publishes
80/443 on plant-LAN interface only. MQTT cloud-side via nginx stream
proxy; MQTT edge-side internal-only; Postfix outbound-only.

OT layer (OPCUA, PLCs) is out of scope for this repo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloud/.env.example

@@ -0,0 +1,43 @@
+# Aggregated env for the cloud composition.
+# Copy to .env and fill in real values. Never commit .env.
+
+TZ=Europe/Amsterdam
+
+# Domain / TLS
+PRIMARY_DOMAIN=
+LETSENCRYPT_EMAIL=
+
+# WireGuard server
+WG_SERVER_PORT=51820
+WG_SERVER_PUBLIC_HOST=
+
+# Keycloak (admin bootstrap)
+KEYCLOAK_ADMIN=admin
+KEYCLOAK_ADMIN_PASSWORD=
+
+# InfluxDB
+INFLUX_ADMIN_USER=admin
+INFLUX_ADMIN_PASSWORD=
+INFLUX_ADMIN_TOKEN=
+INFLUX_ORG=wbd
+INFLUX_BUCKET=telemetry
+
+# Grafana
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=
+
+# SQL (single point of config)
+SQL_DB=config
+SQL_USER=config
+SQL_PASSWORD=
+
+# Postfix
+POSTFIX_RELAYHOST=
+POSTFIX_FROM_DOMAIN=
+
+# Gitea
+GITEA_ROOT_URL=
+
+# Jenkins
+JENKINS_ADMIN_USER=admin
+JENKINS_ADMIN_PASSWORD=

cloud/README.md

@@ -0,0 +1,34 @@
+# cloud
+
+The single central hub. One deployment, internet-facing.
+
+## What runs here
+
+nginx-proxy, wireguard-server, keycloak, portainer, influxdb, grafana, node-red, mqtt, postfix, gitea, jenkins, sql.
+
+See [`../docs/architecture.md`](../docs/architecture.md) for the full network topology and ingress table.
+
+## Run
+
+```bash
+cp .env.example .env     # fill in real secrets first
+docker compose up -d
+docker compose ps
+```
+
+## Ingress (host port bindings)
+
+| Port | Container |
+|---|---|
+| tcp/80, 443 | nginx-proxy |
+| tcp/8883 | nginx-proxy (MQTT-TLS via stream block) |
+| udp/51820 | wireguard-server |
+
+Everything else stays on the internal `app` / `data` / `mgmt` networks.
+
+## Adding a new stack
+
+1. Create `stacks/<name>/` with `compose.yml`, `.env.example`, `README.md`.
+2. Uncomment (or add) the `include:` entry in `compose.yml`.
+3. Add the stack's env vars to `.env.example`.
+4. `docker compose pull && docker compose up -d`.

cloud/compose.yml

@@ -0,0 +1,35 @@
+# Cloud / Central layer composition.
+# Includes all cloud-relevant stacks and defines the 4-network topology.
+# Run: cp .env.example .env  &&  docker compose up -d
+
+name: cloud
+
+# Uncomment includes as each stack is scaffolded with real services.
+include:
+  # - ../stacks/nginx-proxy/compose.yml
+  # - ../stacks/wireguard-server/compose.yml
+  # - ../stacks/keycloak/compose.yml
+  # - ../stacks/portainer/compose.yml
+  # - ../stacks/influxdb/compose.yml
+  # - ../stacks/grafana/compose.yml
+  # - ../stacks/node-red/compose.yml
+  # - ../stacks/mqtt/compose.yml
+  # - ../stacks/postfix/compose.yml
+  # - ../stacks/gitea/compose.yml
+  # - ../stacks/jenkins/compose.yml
+  # - ../stacks/sql/compose.yml
+
+networks:
+  edge:
+    name: cloud-edge
+    driver: bridge
+  app:
+    name: cloud-app
+    driver: bridge
+  data:
+    name: cloud-data
+    driver: bridge
+    internal: true     # databases — no internet egress
+  mgmt:
+    name: cloud-mgmt
+    driver: bridge