scaffold: hub-and-spoke layout, 4-network topology, 13 stack stubs

Initial structure for R&D infrastructure:

- stacks/ — 13 reusable, runnable stack stubs (kebab-case)
  cloud-and-edge: node-red, influxdb, grafana, keycloak, portainer,
                  nginx-proxy, mqtt, postfix
  cloud-only:     wireguard-server, gitea, jenkins, sql (postgres stub)
  edge-only:      wireguard-client

- cloud/ — single central hub composition with 4 networks
           (edge, app, data internal, mgmt) and include: stubs
- sites/ — per-plant edge folders (template README only for now)
- docs/architecture.md — hub-and-spoke + ingress + segmentation rationale

Network model: only nginx-proxy (80/443/8883) and wireguard-server
(51820/udp) publish ports on the cloud host. Edge nginx publishes
80/443 on plant-LAN interface only. MQTT cloud-side via nginx stream
proxy; MQTT edge-side internal-only; Postfix outbound-only.

OT layer (OPCUA, PLCs) is out of scope for this repo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

stacks/sql/.env.example

@@ -0,0 +1,3 @@
+SQL_DB=config
+SQL_USER=config
+SQL_PASSWORD=

stacks/sql/README.md

@@ -0,0 +1,11 @@
+# sql
+
+Central configuration database — the "single point of config" backing Keycloak, Gitea, and other stacks that need a relational store. **Cloud-only stack.**
+
+- **Network**: `data` only (no internet egress)
+- **Engine**: stub uses **postgres:16-alpine** pending decision (postgres vs mariadb vs mysql)
+- **Volume**: `sql-data`
+- **TODO**:
+  - confirm engine choice (likely postgres for keycloak + gitea compatibility)
+  - per-app database/role provisioning (init scripts in `config/init.d/`)
+  - backup strategy (pg_dump cron sidecar vs streaming replica)

stacks/sql/compose.yml

@@ -0,0 +1,22 @@
+# sql — single point of config DB (cloud only)
+# Networks: data (no internet egress)
+# TBD: postgres / mariadb / mysql — stub uses postgres pending decision
+
+services:
+  sql:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    networks: [data]
+    environment:
+      POSTGRES_DB: ${SQL_DB}
+      POSTGRES_USER: ${SQL_USER}
+      POSTGRES_PASSWORD: ${SQL_PASSWORD}
+      TZ: ${TZ:-Europe/Amsterdam}
+    volumes:
+      - sql-data:/var/lib/postgresql/data
+
+networks:
+  data:
+
+volumes:
+  sql-data: