 Ruakij
|
cc9cc6d34f
|
common: valid hex IPv6 stable-secret written before addr_gen_mode, sysctl reload only of the role files
|
2026-11-07 19:23:51 +00:00 |
|
|
Ruakij
|
975beccf50
|
netbird_client: deb822 netbird repository, replaces the one-line netbird.list
|
2026-11-07 18:54:20 +00:00 |
|
|
Ruakij
|
3290d843cc
|
common: ssh tasks use the ssh unit that Ubuntu also has, cloud-init no longer rewrites /etc/hosts at boot
|
2026-11-07 18:51:22 +00:00 |
|
|
Ruakij
|
4abfea352c
|
docker: docker-compose wrapper is 0755, mode preserve took the 0700 of the local checkout
|
2026-11-07 18:24:18 +00:00 |
|
|
Ruakij
|
b74598d265
|
common: disk_maintenance.fstrim_mountpoints limits fstrim.service to the listed mountpoints
|
2026-11-07 17:49:34 +00:00 |
|
|
Ruakij
|
483f3890e5
|
host_firewall: uplinks drop new forwarded connections that were not DNATed, replaces no_hairpin_ifaces
|
2026-11-06 08:48:29 +00:00 |
|
|
Ruakij
|
79943e0389
|
host_firewall: no_hairpin_ifaces drops forwarding back out of the interface it came in on
|
2026-11-06 08:33:42 +00:00 |
|
|
Ruakij
|
252c703afd
|
host_firewall: log FireHOL level1 and level2 under separate prefixes fw-firehol1-* and fw-firehol2-*
|
2026-11-05 16:57:33 +00:00 |
|
|
Ruakij
|
1d10f2be39
|
host_firewall: drop bruteforceblocker, vxvault and cybercrime, only firehol level1 and level2 ban
|
2026-11-05 16:51:45 +00:00 |
|
|
Ruakij
|
6a1e7b77e7
|
host_firewall: ban firehol level2, bruteforceblocker, vxvault and cybercrime; greensnow is part of level2
|
2026-11-05 13:25:48 +00:00 |
|
|
Ruakij
|
ce851f59c6
|
kopia_backup: set zstd as the global compression policy on every run
|
2026-11-04 06:59:47 +00:00 |
|
|
Ruakij
|
6334820750
|
host_firewall: pass journal uploader flows from wt0 to the Traefik pod port with their own address
|
2026-11-04 06:13:52 +00:00 |
|
|
Ruakij
|
f60a2c7e1f
|
host_firewall: pass LAPI client flows from wt0 to the pod port with their own address
|
2026-11-03 21:58:27 +00:00 |
|
|
Ruakij
|
b23466f588
|
host_firewall: pass cluster ring flows from wt0 into the pod CIDR unmasqueraded and past the NetBird forward filter
|
2026-11-03 18:36:47 +00:00 |
|
|
Ruakij
|
74a0af2d32
|
host_firewall: reject forwarded tcp/25 egress like the host output rule
|
2026-11-03 16:59:44 +00:00 |
|
|
Ruakij
|
c30b3d1f0a
|
host_firewall: clear NetBird marks on pod to pod flows so pod sources stay unmasqueraded
|
2026-11-03 16:35:02 +00:00 |
|
|
Ruakij
|
e5922692f6
|
docker: enable live-restore by merging daemon options into daemon.json
|
2026-11-03 16:20:11 +01:00 |
|
|
Ruakij
|
bacb16b7b2
|
netbird_client: write the MTU even when an earlier task already stopped netbird
|
2026-11-02 22:58:25 +00:00 |
|
|
Ruakij
|
c7c9f6d5d1
|
netbird_client: manage the wt0 MTU in default.json
|
2026-11-02 22:35:03 +00:00 |
|
|
Ruakij
|
0267db247e
|
backup: drop nonexistent --clear-retention flag from retention helper
|
2026-11-01 09:56:44 +00:00 |
|
|
Ruakij
|
add568a242
|
kopia_backup: render per-source retention overrides from kopia_backup.retention
|
2026-11-01 09:07:04 +00:00 |
|
|
Ruakij
|
ca34bd8363
|
host_firewall: GreenSnow set greensnow_v4 drops inbound new connections of the listed hosts
|
2026-10-30 09:01:25 +00:00 |
|
|
Ruakij
|
f92b36ceaa
|
host_exporters: purge OpenIPMI on hosts without a BMC, its leftover init script fails at boot
|
2026-10-29 08:03:37 +00:00 |
|
|
Ruakij
|
32651402c6
|
Revert "host_firewall: sources zone accepts tcp ports from listed addresses alone"
This reverts commit 0abc9fb1c3.
|
2026-10-28 14:02:36 +00:00 |
|
|
Ruakij
|
0abc9fb1c3
|
host_firewall: sources zone accepts tcp ports from listed addresses alone
|
2026-10-28 13:59:37 +00:00 |
|
|
Ruakij
|
c1c71194c6
|
wireguard-ipv6-converter: download the release assets under their 0.5.0 names wg-ipv6-converter-linux-<arch>
|
2026-10-28 13:16:33 +00:00 |
|
|
Ruakij
|
66657f3917
|
kubernetes: k3s resolv-conf from fixed nameservers 1.1.1.1 and 9.9.9.9 instead of a copy of the node
|
2026-10-27 15:24:48 +00:00 |
|
|
Ruakij
|
e1b5639d65
|
apt_updates: count a package as security when any version newer than the installed one has a security origin
|
2026-10-27 07:40:18 +00:00 |
|
|
Ruakij
|
7a260afe39
|
crowdsec_range_bouncer: skip range decisions wider than /8 (IPv4) or /16 (IPv6) and log each skip
|
2026-10-26 19:52:14 +00:00 |
|
|
Ruakij
|
78a370dbd1
|
wireguard-ipv6-converter: verified download, restart upheld while the interface is up, percent signs escaped for systemd
|
2026-10-26 19:15:46 +00:00 |
|
|
Ruakij
|
f67edd7a07
|
kubernetes: routingtabletowg 0.3.0 from ghcr, digest-pinned, syncs only the main table
|
2026-10-26 19:15:46 +00:00 |
|
|
Ruakij
|
7464f4da0a
|
crowdsec: no crowdsec.list when a deb822 crowdsec.sources already defines the repository
|
2026-10-26 19:15:46 +00:00 |
|
|
Ruakij
|
923cd85020
|
mail_relay: the comment points to the security perimeter doc
|
2026-10-26 16:45:10 +00:00 |
|
|
Ruakij
|
61db0ed55e
|
host_exporters: host_exporters_listen_address binds the node exporter to one address for hosts without host firewall
|
2026-10-26 15:45:34 +00:00 |
|
|
Ruakij
|
03fc22daf7
|
apt_updates: the role owns the apt metrics (Debian collector off, explicit zero rows, multi-suite security detection)
|
2026-10-26 15:30:17 +00:00 |
|
|
Ruakij
|
7604bc4dac
|
host_firewall: rejected handshake flows are remembered for 30s and reset per packet, the first data segment no longer slips through; handshake match needs a bare ACK
|
2026-10-26 14:56:59 +00:00 |
|
|
Ruakij
|
46fd6a4c40
|
host_firewall: handshake meter carries the service limit, SYN meters become a flood cap at 2x rate and 2x burst
|
2026-10-26 14:48:25 +00:00 |
|
|
Ruakij
|
ec64ace8f4
|
apt_updates: textfile metrics of pending apt updates for the node exporter collector
|
2026-10-26 14:47:17 +00:00 |
|
|
Ruakij
|
5318997b73
|
host_firewall: handshake meters per source reject over-limit connections with fw-rl-hs:, SYN meters log fw-rl-addr: and fw-rl-range: as evidence, conntrack accounting on
|
2026-10-26 14:35:28 +00:00 |
|
|
Ruakij
|
4fbc4ad317
|
unattended_upgrades: apt-listchanges sends no mails
|
2026-10-26 14:17:53 +00:00 |
|
|
Ruakij
|
470d856332
|
crowdsec: hubupdate removes the disabled scenarios even when the upgrade fails and exits non-zero afterwards
|
2026-10-26 13:49:03 +00:00 |
|
|
Ruakij
|
589f899bae
|
host_firewall: public_ips of every inventory host are exempt from the rate-limit meters, ArgoCD fetches and mail submission from the cluster nodes hit the web and submission limits
|
2026-10-26 13:21:20 +00:00 |
|
|
Ruakij
|
c2c8934ec9
|
host_firewall: per-service new-connection meters per source (/32, /64) and per range (/24, /48) from measured peaks, excess dropped with prefix fw-ratelimit:, replaces the ssh meter
|
2026-10-26 12:24:31 +00:00 |
|
|
Ruakij
|
5c0783cf86
|
crowdsec: disabled_scenarios removes hub scenarios replaced by local ones, absent_files removes retired local files
|
2026-10-26 12:24:30 +00:00 |
|
|
Ruakij
|
fee8ec1ff6
|
docker: hourly prune of objects older than 7 days, root mail only when the prune fails
|
2026-10-26 10:18:29 +00:00 |
|
|
Ruakij
|
d61403ee33
|
docker: apt source is deb822 signed by /etc/apt/keyrings/docker.asc with the key fetched by get_url
|
2026-10-26 09:55:38 +00:00 |
|
|
Ruakij
|
885e6f3338
|
mail_relay: postfix relays all mail through the mailcow submission port with a mailbox per host, replaces mail_aliases
|
2026-10-26 09:44:37 +00:00 |
|
|
Ruakij
|
c91c56b153
|
mail_aliases: root mail goes to admin@ruekov.eu and newaliases builds the alias database
|
2026-10-26 07:41:30 +00:00 |
|
|
Ruakij
|
4dc7b23e06
|
host_exporters: IPMI tools read a static root-owned FreeIPMI config pinned in sudoers, sudo logs allowed commands
|
2026-10-25 15:27:06 +00:00 |
|
|
Ruakij
|
89821b479b
|
zfs_host: zed and pool capacity and scrub metrics for the node exporter textfile collector
|
2026-10-25 15:09:50 +00:00 |
|