 Ruakij
|
e1b5639d65
|
apt_updates: count a package as security when any version newer than the installed one has a security origin
|
2026-10-27 07:40:18 +00:00 |
|
|
Ruakij
|
7a260afe39
|
crowdsec_range_bouncer: skip range decisions wider than /8 (IPv4) or /16 (IPv6) and log each skip
|
2026-10-26 19:52:14 +00:00 |
|
|
Ruakij
|
78a370dbd1
|
wireguard-ipv6-converter: verified download, restart upheld while the interface is up, percent signs escaped for systemd
|
2026-10-26 19:15:46 +00:00 |
|
|
Ruakij
|
f67edd7a07
|
kubernetes: routingtabletowg 0.3.0 from ghcr, digest-pinned, syncs only the main table
|
2026-10-26 19:15:46 +00:00 |
|
|
Ruakij
|
7464f4da0a
|
crowdsec: no crowdsec.list when a deb822 crowdsec.sources already defines the repository
|
2026-10-26 19:15:46 +00:00 |
|
|
Ruakij
|
923cd85020
|
mail_relay: the comment points to the security perimeter doc
|
2026-10-26 16:45:10 +00:00 |
|
|
Ruakij
|
61db0ed55e
|
host_exporters: host_exporters_listen_address binds the node exporter to one address for hosts without host firewall
|
2026-10-26 15:45:34 +00:00 |
|
|
Ruakij
|
03fc22daf7
|
apt_updates: the role owns the apt metrics (Debian collector off, explicit zero rows, multi-suite security detection)
|
2026-10-26 15:30:17 +00:00 |
|
|
Ruakij
|
7604bc4dac
|
host_firewall: rejected handshake flows are remembered for 30s and reset per packet, the first data segment no longer slips through; handshake match needs a bare ACK
|
2026-10-26 14:56:59 +00:00 |
|
|
Ruakij
|
46fd6a4c40
|
host_firewall: handshake meter carries the service limit, SYN meters become a flood cap at 2x rate and 2x burst
|
2026-10-26 14:48:25 +00:00 |
|
|
Ruakij
|
ec64ace8f4
|
apt_updates: textfile metrics of pending apt updates for the node exporter collector
|
2026-10-26 14:47:17 +00:00 |
|
|
Ruakij
|
5318997b73
|
host_firewall: handshake meters per source reject over-limit connections with fw-rl-hs:, SYN meters log fw-rl-addr: and fw-rl-range: as evidence, conntrack accounting on
|
2026-10-26 14:35:28 +00:00 |
|
|
Ruakij
|
4fbc4ad317
|
unattended_upgrades: apt-listchanges sends no mails
|
2026-10-26 14:17:53 +00:00 |
|
|
Ruakij
|
470d856332
|
crowdsec: hubupdate removes the disabled scenarios even when the upgrade fails and exits non-zero afterwards
|
2026-10-26 13:49:03 +00:00 |
|
|
Ruakij
|
589f899bae
|
host_firewall: public_ips of every inventory host are exempt from the rate-limit meters, ArgoCD fetches and mail submission from the cluster nodes hit the web and submission limits
|
2026-10-26 13:21:20 +00:00 |
|
|
Ruakij
|
c2c8934ec9
|
host_firewall: per-service new-connection meters per source (/32, /64) and per range (/24, /48) from measured peaks, excess dropped with prefix fw-ratelimit:, replaces the ssh meter
|
2026-10-26 12:24:31 +00:00 |
|
|
Ruakij
|
5c0783cf86
|
crowdsec: disabled_scenarios removes hub scenarios replaced by local ones, absent_files removes retired local files
|
2026-10-26 12:24:30 +00:00 |
|
|
Ruakij
|
fee8ec1ff6
|
docker: hourly prune of objects older than 7 days, root mail only when the prune fails
|
2026-10-26 10:18:29 +00:00 |
|
|
Ruakij
|
d61403ee33
|
docker: apt source is deb822 signed by /etc/apt/keyrings/docker.asc with the key fetched by get_url
|
2026-10-26 09:55:38 +00:00 |
|
|
Ruakij
|
885e6f3338
|
mail_relay: postfix relays all mail through the mailcow submission port with a mailbox per host, replaces mail_aliases
|
2026-10-26 09:44:37 +00:00 |
|
|
Ruakij
|
c91c56b153
|
mail_aliases: root mail goes to admin@ruekov.eu and newaliases builds the alias database
|
2026-10-26 07:41:30 +00:00 |
|
|
Ruakij
|
4dc7b23e06
|
host_exporters: IPMI tools read a static root-owned FreeIPMI config pinned in sudoers, sudo logs allowed commands
|
2026-10-25 15:27:06 +00:00 |
|
|
Ruakij
|
89821b479b
|
zfs_host: zed and pool capacity and scrub metrics for the node exporter textfile collector
|
2026-10-25 15:09:50 +00:00 |
|
|
Ruakij
|
f91a9b8fc9
|
host_exporters: IPMI exporter with sudo-pinned FreeIPMI tools for hosts with a BMC
|
2026-10-25 15:04:56 +00:00 |
|
|
Ruakij
|
7bed387ece
|
kubernetes: kubelet_reserved comment names group_vars as the place of the values
|
2026-10-25 14:49:20 +00:00 |
|
|
Ruakij
|
8a0c8fb31b
|
kubernetes: kubelet_reserved drop-in 30-reserved.conf and a k3s restart handler that runs only with k3s_restart_allowed
|
2026-10-25 14:44:22 +00:00 |
|
|
Ruakij
|
4c39069241
|
journal_upload: uploader drop-in with no start limit and 30s restarts so ingest outages do not end it
|
2026-10-25 14:19:26 +00:00 |
|
|
Ruakij
|
c50c32059e
|
host_firewall: drop inbound traffic from internet-wide scanners (OpenFilters internet-scanners), v4 and v6, daily refresh
|
2026-10-25 12:12:27 +00:00 |
|
|
Ruakij
|
38d1ac6ced
|
common: tag the timezone task so it runs on its own
|
2026-10-25 10:54:32 +00:00 |
|
|
Ruakij
|
5160e11dc2
|
common: ipv6_accept_ra_interfaces sets accept_ra=2 on bridges that sysctl at boot does not see
|
2026-10-25 10:20:56 +00:00 |
|
|
Ruakij
|
c49fd28b76
|
kubernetes: kubelet_memory writes a KubeletConfiguration drop-in 20-memory.conf for memory reservation and eviction, off by default
|
2026-10-25 09:57:22 +00:00 |
|
|
Ruakij
|
c55a96c0ea
|
host_firewall: FireHOL level1 as its own set firehol_v4 next to Spamhaus, daily updater and firewall.firehol opt-out
|
2026-10-24 17:31:45 +00:00 |
|
|
Ruakij
|
312be161b9
|
host_firewall: check the Spamhaus and geo sets under another table name, a dry run against the live name made unlisted addresses match
|
2026-10-24 17:20:11 +00:00 |
|
|
Ruakij
|
49834b858b
|
common: remove fail2ban only with fail2ban_remove set for the host
|
2026-10-24 16:11:36 +00:00 |
|
|
Ruakij
|
c36f269406
|
journal_upload: a node leaves its own NetBird address out of /etc/hosts, Traefik sees it as the cilium_host address
|
2026-10-24 16:04:06 +00:00 |
|
|
Ruakij
|
19a62a43ca
|
common: remove fail2ban where CrowdSec agent and bouncer run, stop installing it
|
2026-10-24 15:57:34 +00:00 |
|
|
Ruakij
|
fd58ee2c16
|
journal_upload: ship the journal to VictoriaLogs with systemd-journal-upload over NetBird
|
2026-10-24 15:55:22 +00:00 |
|
|
Ruakij
|
d5610a5b34
|
host_firewall: refresh the Spamhaus sets by rule set reload, flush and refill let unlisted addresses match
|
2026-10-24 14:53:10 +00:00 |
|
|
Ruakij
|
ebb1377470
|
host_firewall: block Spamhaus DROP, DROPv6 and ASN-DROP networks in, out and forward
|
2026-10-24 14:31:00 +00:00 |
|
|
Ruakij
|
5e544cdfb5
|
host_firewall: optional nf_log_all_netns sysctl so the firewall logs of LXC guests reach the host kernel log
|
2026-10-24 13:43:12 +00:00 |
|
|
Ruakij
|
88c30eb252
|
host_firewall: log dropped inbound packets with a global rate limit and reject outbound TCP 25 except on the mail host
|
2026-10-24 12:14:47 +00:00 |
|
|
Ruakij
|
41dbce3641
|
host_firewall: admin.tcp ports answer the admin set alone, never the geo sets
|
2026-10-24 08:40:31 +00:00 |
|
|
Ruakij
|
81e7a9dc6a
|
crowdsec_range_bouncer: enforce CrowdSec range decisions in nftables interval sets, the firewall bouncer stores only the network address of a range
|
2026-10-24 08:10:34 +00:00 |
|
|
Ruakij
|
5cac169224
|
Give system.slice and the k3s unit CPUWeight 1000 so the control plane wins CPU against pods
|
2026-10-23 21:14:13 +00:00 |
|
|
Ruakij
|
60a55e6e49
|
host_exporters: install the node exporter without recommends, smartd and nvmf-autoconnect failed on hugo
|
2026-10-23 21:04:05 +00:00 |
|
|
Ruakij
|
c5b51777c6
|
Ignore the missing geo timer unit of a host without geo sets in check mode
|
2026-10-23 20:54:31 +00:00 |
|
|
Ruakij
|
a4648e0ea7
|
Join a fresh host to NetBird idempotently with the keyring, the management URL and the interface blacklist from the vars, and edit the blacklist and log level of a joined one
|
2026-10-23 20:54:30 +00:00 |
|
|
Ruakij
|
a64d082c0c
|
Add a host_exporters role for the node and smartctl exporters and a host_firewall scrapers rule that opens exporter ports on wt0 to named source addresses
|
2026-10-23 20:44:59 +00:00 |
|
|
Ruakij
|
381e1b285c
|
Add an unattended_upgrades role that installs only Debian and Ubuntu security updates, with no automatic reboot
|
2026-10-22 09:00:33 +00:00 |
|
|
Ruakij
|
bcdc460297
|
Copy per-host files of kopia_backup from a files list, empty by default
|
2026-10-22 08:25:43 +00:00 |
|