docs: Add comprehensive geoip-shell and permanent ban documentation

- Add docs/geoip-blocking.md with complete geoip-shell setup documentation
- Update README.md to include geoip blocking in goals, status, and documentation structure
- Update docs/network-security.md with geoip blocking and permanent ban sections
- Mark geoip blocking task as completed in TODO.md
- Document permanent-ban-repeat-offenders.sh script and its cron job

README.md

@@ -13,6 +13,7 @@ Setting up a personal homelab using a ThinkPad laptop running Arch Linux to move
 - [x] Self-hosted media server (Jellyfin)
 - [x] AI voice assistant (local TTS with Piper)
 - [x] Reverse proxy with nginx for multiple services
+- [x] Geographic IP blocking (geoip-shell whitelist)
 - [ ] Gradual migration from commercial cloud services
 
 ## Hardware
@@ -35,6 +36,7 @@ Setting up a personal homelab using a ThinkPad laptop running Arch Linux to move
 - ✅ Dotfiles management with yadm configured and merged
 - ✅ Development environment setup completed
 - ✅ Network domain setup (DuckDNS + Nginx reverse proxy + SSL)
+- ✅ Geographic IP blocking (geoip-shell whitelist for European countries)
 - ✅ Gitea Git server running (Docker container)
 - ✅ Copyparty file server with working WebDAV support
 - ✅ Jellyfin media server (Docker container)
@@ -60,6 +62,7 @@ homelab/
 ├── docs/                       # Detailed documentation
 │   ├── system-setup.md         # Arch Linux installation & config
 │   ├── network-security.md     # SSH, DNS, VPN, firewall
+│   ├── geoip-blocking.md       # Geographic IP blocking setup
 │   ├── services.md             # Self-hosted services
 │   ├── voice-assistant.md      # AI voice setup with Piper TTS
 │   └── troubleshooting/         # Solutions & troubleshooting guides
@@ -83,6 +86,7 @@ homelab/
 ### Documentation Files
 - **[docs/system-setup.md](docs/system-setup.md)** - Complete Arch Linux installation, TTY config, desktop setup
 - **[docs/network-security.md](docs/network-security.md)** - SSH hardening, DuckDNS, WireGuard VPN, firewall setup
+- **[docs/geoip-blocking.md](docs/geoip-blocking.md)** - Geographic IP blocking with geoip-shell whitelist
 - **[docs/services.md](docs/services.md)** - Self-hosted services: Git hosting, cloud storage, media server
 - **[docs/voice-assistant.md](docs/voice-assistant.md)** - AI voice assistant setup with Piper TTS and FastAPI
 - **[TODO.md](TODO.md)** - Centralized task list with progress tracking by category
@@ -93,5 +97,5 @@ homelab/
 - **System**: Arch Linux with XFCE desktop, ter-124b TTY font, Colemak layout
 - **Network**: Static IP (192.168.0.100), SSH port 2222, DuckDNS (ak-homelab.duckdns.org)
 - **Services**: Nginx reverse proxy, Gitea Git server, Copyparty file server with WebDAV, Jellyfin media server, AI voice assistant
-- **Security**: SSH hardened, SSL certificates active, WebDAV authentication enabled
+- **Security**: SSH hardened, SSL certificates active, WebDAV authentication enabled, geographic IP blocking (geoip-shell whitelist)
 - **Development**: yadm dotfiles, tmux with temperature monitoring, zsh with proper history