Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
164 Commits 14 Branches 0 Tags
4c390692415889b02e057a536dacf24f4f53b6d2
Commit Graph
164 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ruakij 4c39069241 journal_upload: uploader drop-in with no start limit and 30s restarts so ingest outages do not end it 2026-10-25 14:19:26 +00:00
Ruakij c50c32059e host_firewall: drop inbound traffic from internet-wide scanners (OpenFilters internet-scanners), v4 and v6, daily refresh 2026-10-25 12:12:27 +00:00
Ruakij 38d1ac6ced common: tag the timezone task so it runs on its own 2026-10-25 10:54:32 +00:00
Ruakij 5160e11dc2 common: ipv6_accept_ra_interfaces sets accept_ra=2 on bridges that sysctl at boot does not see 2026-10-25 10:20:56 +00:00
Ruakij c49fd28b76 kubernetes: kubelet_memory writes a KubeletConfiguration drop-in 20-memory.conf for memory reservation and eviction, off by default 2026-10-25 09:57:22 +00:00
Ruakij c55a96c0ea host_firewall: FireHOL level1 as its own set firehol_v4 next to Spamhaus, daily updater and firewall.firehol opt-out 2026-10-24 17:31:45 +00:00
Ruakij 312be161b9 host_firewall: check the Spamhaus and geo sets under another table name, a dry run against the live name made unlisted addresses match 2026-10-24 17:20:11 +00:00
Ruakij 49834b858b common: remove fail2ban only with fail2ban_remove set for the host 2026-10-24 16:11:36 +00:00
Ruakij c36f269406 journal_upload: a node leaves its own NetBird address out of /etc/hosts, Traefik sees it as the cilium_host address 2026-10-24 16:04:06 +00:00
Ruakij 19a62a43ca common: remove fail2ban where CrowdSec agent and bouncer run, stop installing it 2026-10-24 15:57:34 +00:00
Ruakij fd58ee2c16 journal_upload: ship the journal to VictoriaLogs with systemd-journal-upload over NetBird 2026-10-24 15:55:22 +00:00
Ruakij d5610a5b34 host_firewall: refresh the Spamhaus sets by rule set reload, flush and refill let unlisted addresses match 2026-10-24 14:53:10 +00:00
Ruakij ebb1377470 host_firewall: block Spamhaus DROP, DROPv6 and ASN-DROP networks in, out and forward 2026-10-24 14:31:00 +00:00
Ruakij 5e544cdfb5 host_firewall: optional nf_log_all_netns sysctl so the firewall logs of LXC guests reach the host kernel log 2026-10-24 13:43:12 +00:00
Ruakij 88c30eb252 host_firewall: log dropped inbound packets with a global rate limit and reject outbound TCP 25 except on the mail host 2026-10-24 12:14:47 +00:00
Ruakij 41dbce3641 host_firewall: admin.tcp ports answer the admin set alone, never the geo sets 2026-10-24 08:40:31 +00:00
Ruakij 81e7a9dc6a crowdsec_range_bouncer: enforce CrowdSec range decisions in nftables interval sets, the firewall bouncer stores only the network address of a range 2026-10-24 08:10:34 +00:00
Ruakij 5cac169224 Give system.slice and the k3s unit CPUWeight 1000 so the control plane wins CPU against pods 2026-10-23 21:14:13 +00:00
Ruakij 60a55e6e49 host_exporters: install the node exporter without recommends, smartd and nvmf-autoconnect failed on hugo 2026-10-23 21:04:05 +00:00
Ruakij c5b51777c6 Ignore the missing geo timer unit of a host without geo sets in check mode 2026-10-23 20:54:31 +00:00
Ruakij a4648e0ea7 Join a fresh host to NetBird idempotently with the keyring, the management URL and the interface blacklist from the vars, and edit the blacklist and log level of a joined one 2026-10-23 20:54:30 +00:00
Ruakij a64d082c0c Add a host_exporters role for the node and smartctl exporters and a host_firewall scrapers rule that opens exporter ports on wt0 to named source addresses 2026-10-23 20:44:59 +00:00
Ruakij 381e1b285c Add an unattended_upgrades role that installs only Debian and Ubuntu security updates, with no automatic reboot 2026-10-22 09:00:33 +00:00
Ruakij bcdc460297 Copy per-host files of kopia_backup from a files list, empty by default 2026-10-22 08:25:43 +00:00
Ruakij bd24f01110 Let a host name its CrowdSec machine at the LAPI with crowdsec.machine_name, the short hostname of doris is dev 2026-10-21 06:10:01 +00:00
Ruakij 1ede3d3329 Read the fail2ban sshd jail from the journal, Debian 12+ has no auth.log and the jail failed to start 2026-10-13 16:36:08 +00:00
Ruakij deb3521bfa Add a proxmox_no_nag role that hides the subscription dialog and reapplies it from an apt hook after every widget-toolkit update 2026-10-13 15:55:56 +00:00
Ruakij c8cac22d12 Run the cilium status check in check mode too and never report it as changed 2026-10-09 14:37:30 +00:00
Ruakij 6fe03c5f70 Skip the cilium CLI download when it is installed already 2026-10-09 14:37:30 +00:00
Ruakij 15b4e54bd5 Read resolv.conf for the k3s nameservers in check mode too 2026-10-09 14:37:30 +00:00
Ruakij c016459922 Write the k3s registries.yaml only on a semantic change 2026-10-09 14:37:29 +00:00
Ruakij 4d1725f17f Deploy a registries.yaml from registries_config on k3s servers and restart k3s on its change 2026-10-09 14:37:29 +00:00
Ruakij 80658c632f Add the cilium network plugin to the kubernetes role, disabling servicelb, and collect the disabled k3s components in one disable list 2026-10-09 14:37:29 +00:00
Ruakij 60b67f748e Install the k3s servers one at a time with retries from the latest channel, enable the service and link the kubeconfig to ~/.kube/config 2026-10-09 14:37:28 +00:00
Ruakij 4a76aa3a2e Set node-name, node-external-ip and labels_extra in the k3s config and config_extra for agents 2026-10-09 14:37:27 +00:00
Ruakij e9f1153482 Add clean_resolv_conf to the kubernetes role to give k3s a resolv.conf with only the nameserver lines 2026-10-09 14:37:27 +00:00
Ruakij ca1fcc16b6 Fall back to the default IPv4 and IPv6 address when the k3s node IP interface has none 2026-10-09 14:37:27 +00:00
Ruakij fb94fd5997 Deploy the calico operator v3.28.0 2026-10-09 14:37:26 +00:00
Ruakij 713d38d77d Shrink the default IPv6 cluster CIDR of k3s to fd42::/112 2026-10-09 14:37:26 +00:00
Ruakij bc71066de1 Run the k3s install of the kubernetes role only on target_host when it is set 2026-10-09 14:37:26 +00:00
Ruakij 5eae9ca348 Drop the docker dependency and the helm install from the kubernetes role 2026-10-09 14:37:25 +00:00
Ruakij 844e017f9e Add a tuned role that installs tuned and sets the throughput-performance profile 2026-10-09 14:37:25 +00:00
Ruakij 381f3ab7c9 Start the wireguard-ipv6-converter again whenever its bound service starts via a drop-in and always restart it on deploy 2026-10-09 14:37:24 +00:00
Ruakij 6390e6288b Disable SSH password auth in the common role only when sshd is active 2026-10-09 14:37:24 +00:00
Ruakij 13d60c4f9b Install nmon and fail2ban and upgrade packages on every distribution in the common role 2026-10-09 14:37:24 +00:00
Ruakij cb09f77b68 Enable TCP BBR with the fq qdisc on kernels from 4.9 in the common role 2026-10-09 14:37:23 +00:00
Ruakij 84fd52b678 Generate a random IPv6 stable secret once per host for the default interface in the common role 2026-10-09 14:37:23 +00:00
Ruakij c7eceae087 Ensure the .bashrc exists, expand aliases after sudo and color grep in the common role aliases 2026-10-09 14:37:23 +00:00
Ruakij 23ed82b113 Own the k3s config.yaml in the kubernetes role template, write it only on a semantic change and run the installer only when the pinned k3s version differs 2026-10-09 14:13:21 +00:00
Ruakij 37e21ead36 Expose the etcd metrics on the node IP of the etcd members of k3s 2026-10-09 12:56:24 +00:00