 Ruakij
|
fd58ee2c16
|
journal_upload: ship the journal to VictoriaLogs with systemd-journal-upload over NetBird
|
2026-10-24 15:55:22 +00:00 |
|
|
Ruakij
|
d5610a5b34
|
host_firewall: refresh the Spamhaus sets by rule set reload, flush and refill let unlisted addresses match
|
2026-10-24 14:53:10 +00:00 |
|
|
Ruakij
|
ebb1377470
|
host_firewall: block Spamhaus DROP, DROPv6 and ASN-DROP networks in, out and forward
|
2026-10-24 14:31:00 +00:00 |
|
|
Ruakij
|
5e544cdfb5
|
host_firewall: optional nf_log_all_netns sysctl so the firewall logs of LXC guests reach the host kernel log
|
2026-10-24 13:43:12 +00:00 |
|
|
Ruakij
|
88c30eb252
|
host_firewall: log dropped inbound packets with a global rate limit and reject outbound TCP 25 except on the mail host
|
2026-10-24 12:14:47 +00:00 |
|
|
Ruakij
|
41dbce3641
|
host_firewall: admin.tcp ports answer the admin set alone, never the geo sets
|
2026-10-24 08:40:31 +00:00 |
|
|
Ruakij
|
81e7a9dc6a
|
crowdsec_range_bouncer: enforce CrowdSec range decisions in nftables interval sets, the firewall bouncer stores only the network address of a range
|
2026-10-24 08:10:34 +00:00 |
|
|
Ruakij
|
5cac169224
|
Give system.slice and the k3s unit CPUWeight 1000 so the control plane wins CPU against pods
|
2026-10-23 21:14:13 +00:00 |
|
|
Ruakij
|
60a55e6e49
|
host_exporters: install the node exporter without recommends, smartd and nvmf-autoconnect failed on hugo
|
2026-10-23 21:04:05 +00:00 |
|
|
Ruakij
|
c5b51777c6
|
Ignore the missing geo timer unit of a host without geo sets in check mode
|
2026-10-23 20:54:31 +00:00 |
|
|
Ruakij
|
a4648e0ea7
|
Join a fresh host to NetBird idempotently with the keyring, the management URL and the interface blacklist from the vars, and edit the blacklist and log level of a joined one
|
2026-10-23 20:54:30 +00:00 |
|
|
Ruakij
|
a64d082c0c
|
Add a host_exporters role for the node and smartctl exporters and a host_firewall scrapers rule that opens exporter ports on wt0 to named source addresses
|
2026-10-23 20:44:59 +00:00 |
|
|
Ruakij
|
381e1b285c
|
Add an unattended_upgrades role that installs only Debian and Ubuntu security updates, with no automatic reboot
|
2026-10-22 09:00:33 +00:00 |
|
|
Ruakij
|
bcdc460297
|
Copy per-host files of kopia_backup from a files list, empty by default
|
2026-10-22 08:25:43 +00:00 |
|
|
Ruakij
|
bd24f01110
|
Let a host name its CrowdSec machine at the LAPI with crowdsec.machine_name, the short hostname of doris is dev
|
2026-10-21 06:10:01 +00:00 |
|
|
Ruakij
|
1ede3d3329
|
Read the fail2ban sshd jail from the journal, Debian 12+ has no auth.log and the jail failed to start
|
2026-10-13 16:36:08 +00:00 |
|
|
Ruakij
|
deb3521bfa
|
Add a proxmox_no_nag role that hides the subscription dialog and reapplies it from an apt hook after every widget-toolkit update
|
2026-10-13 15:55:56 +00:00 |
|
|
Ruakij
|
c8cac22d12
|
Run the cilium status check in check mode too and never report it as changed
|
2026-10-09 14:37:30 +00:00 |
|
|
Ruakij
|
6fe03c5f70
|
Skip the cilium CLI download when it is installed already
|
2026-10-09 14:37:30 +00:00 |
|
|
Ruakij
|
15b4e54bd5
|
Read resolv.conf for the k3s nameservers in check mode too
|
2026-10-09 14:37:30 +00:00 |
|
|
Ruakij
|
c016459922
|
Write the k3s registries.yaml only on a semantic change
|
2026-10-09 14:37:29 +00:00 |
|
|
Ruakij
|
4d1725f17f
|
Deploy a registries.yaml from registries_config on k3s servers and restart k3s on its change
|
2026-10-09 14:37:29 +00:00 |
|
|
Ruakij
|
80658c632f
|
Add the cilium network plugin to the kubernetes role, disabling servicelb, and collect the disabled k3s components in one disable list
|
2026-10-09 14:37:29 +00:00 |
|
|
Ruakij
|
60b67f748e
|
Install the k3s servers one at a time with retries from the latest channel, enable the service and link the kubeconfig to ~/.kube/config
|
2026-10-09 14:37:28 +00:00 |
|
|
Ruakij
|
4a76aa3a2e
|
Set node-name, node-external-ip and labels_extra in the k3s config and config_extra for agents
|
2026-10-09 14:37:27 +00:00 |
|
|
Ruakij
|
e9f1153482
|
Add clean_resolv_conf to the kubernetes role to give k3s a resolv.conf with only the nameserver lines
|
2026-10-09 14:37:27 +00:00 |
|
|
Ruakij
|
ca1fcc16b6
|
Fall back to the default IPv4 and IPv6 address when the k3s node IP interface has none
|
2026-10-09 14:37:27 +00:00 |
|
|
Ruakij
|
fb94fd5997
|
Deploy the calico operator v3.28.0
|
2026-10-09 14:37:26 +00:00 |
|
|
Ruakij
|
713d38d77d
|
Shrink the default IPv6 cluster CIDR of k3s to fd42::/112
|
2026-10-09 14:37:26 +00:00 |
|
|
Ruakij
|
bc71066de1
|
Run the k3s install of the kubernetes role only on target_host when it is set
|
2026-10-09 14:37:26 +00:00 |
|
|
Ruakij
|
5eae9ca348
|
Drop the docker dependency and the helm install from the kubernetes role
|
2026-10-09 14:37:25 +00:00 |
|
|
Ruakij
|
844e017f9e
|
Add a tuned role that installs tuned and sets the throughput-performance profile
|
2026-10-09 14:37:25 +00:00 |
|
|
Ruakij
|
381f3ab7c9
|
Start the wireguard-ipv6-converter again whenever its bound service starts via a drop-in and always restart it on deploy
|
2026-10-09 14:37:24 +00:00 |
|
|
Ruakij
|
6390e6288b
|
Disable SSH password auth in the common role only when sshd is active
|
2026-10-09 14:37:24 +00:00 |
|
|
Ruakij
|
13d60c4f9b
|
Install nmon and fail2ban and upgrade packages on every distribution in the common role
|
2026-10-09 14:37:24 +00:00 |
|
|
Ruakij
|
cb09f77b68
|
Enable TCP BBR with the fq qdisc on kernels from 4.9 in the common role
|
2026-10-09 14:37:23 +00:00 |
|
|
Ruakij
|
84fd52b678
|
Generate a random IPv6 stable secret once per host for the default interface in the common role
|
2026-10-09 14:37:23 +00:00 |
|
|
Ruakij
|
c7eceae087
|
Ensure the .bashrc exists, expand aliases after sudo and color grep in the common role aliases
|
2026-10-09 14:37:23 +00:00 |
|
|
Ruakij
|
23ed82b113
|
Own the k3s config.yaml in the kubernetes role template, write it only on a semantic change and run the installer only when the pinned k3s version differs
|
2026-10-09 14:13:21 +00:00 |
|
|
Ruakij
|
37e21ead36
|
Expose the etcd metrics on the node IP of the etcd members of k3s
|
2026-10-09 12:56:24 +00:00 |
|
|
Ruakij
|
2798853153
|
Raise the inotify limits of the k3s nodes to 65536 instances and 4194304 watches, except in LXC
|
2026-10-09 12:55:46 +00:00 |
|
|
Ruakij
|
e9ba272d70
|
Manage the kubelet image garbage collection drop-in and its config-dir kubelet-arg in the kubernetes role
|
2026-10-09 12:54:41 +00:00 |
|
|
Ruakij
|
b62992f21e
|
Cap the systemd journal at 512M on disk, 128M in memory and two weeks in the common role
|
2026-10-09 12:53:44 +00:00 |
|
|
Ruakij
|
fd73949412
|
Whitelist the public_ips of every inventory host in crowdsec and keep a LAPI allowlist equal to the whitelist
|
2026-10-08 09:19:51 +00:00 |
|
|
Ruakij
|
d345ccf585
|
Add a pre_command to kopia_backup for host dump scripts and install gpg for the apt key
|
2026-10-08 08:51:23 +00:00 |
|
|
Ruakij
|
b45a07da56
|
Add forward_guard to host_firewall for a forward chain that drops traffic to guarded guests outside the allowed interfaces, ports and ICMP types
|
2026-10-08 08:48:40 +00:00 |
|
|
Ruakij
|
9ded6814c3
|
Pin the fstrim timer and the monthly ZFS trim and scrub per host in the common role to keep them out of the backup window
|
2026-10-07 22:42:08 +00:00 |
|
|
Ruakij
|
a9a60e3106
|
Keep the clock on systemd-timesyncd and the timezone on UTC in the common role
|
2026-10-07 21:22:01 +00:00 |
|
|
Ruakij
|
5da89fdf29
|
Run the kopia_backup timer at 03:30 UTC by default since the hosts run in different timezones
|
2026-10-07 21:19:09 +00:00 |
|
|
Ruakij
|
9e2e6cbb99
|
Add IPv4 port forwards and masquerade to host_firewall in an ip host_nat table
|
2026-10-07 21:10:35 +00:00 |
|
|
Ruakij
|
c9d2334906
|
Add a kopia_backup role for the daily Kopia snapshot script and timer against an existing S3 repository
|
2026-10-07 21:00:25 +00:00 |
|
|
Ruakij
|
c87af201aa
|
Add a crowdsec role for agents and the nftables bouncer against a central LAPI
|
2026-10-07 11:02:59 +00:00 |
|
|
Ruakij
|
cfe87002c5
|
Replace the nftables role with host_firewall, one atomic inet host input table with zones, geo sets and lockout rollback
|
2026-10-07 11:02:59 +00:00 |
|
|
Ruakij
|
27e9d4a1ab
|
Merge branch 'role_nftables'
|
2023-06-21 17:35:09 +02:00 |
|
|
Ruakij
|
755f9b2e1a
|
Initial role
|
2023-05-21 20:57:43 +02:00 |
|
|
Ruakij
|
753f456ef3
|
Merge branch 'role_kubernetes-k3s'
|
2023-04-14 10:21:06 +02:00 |
|
|
Ruakij
|
093612f3a7
|
Change restart-check to started/restarted check
|
2023-04-14 10:20:16 +02:00 |
|
|
Ruakij
|
a92409c56f
|
Add failed_when to deploy calico operator
|
2023-04-14 10:01:42 +02:00 |
|
|
Ruakij
|
f50e3ac33c
|
Use first node's IP for joining cluster
|
2023-04-14 09:50:39 +02:00 |
|
|
Ruakij
|
668ff23ee6
|
Fix service task wrong usage
|
2023-04-14 09:42:46 +02:00 |
|
|
Ruakij
|
c2c6a2872f
|
Fix conditional for changed after install
|
2023-04-12 23:12:10 +02:00 |
|
|
Ruakij
|
c1c7ec9e56
|
Remove workaround as k3s is now at 1.26
|
2023-04-12 22:39:43 +02:00 |
|
|
Ruakij
|
550f6868ff
|
Fix old usage of network_plugin var
|
2023-04-12 20:49:38 +02:00 |
|
|
Ruakij
|
3fe288f6a5
|
Merge branch 'role_wireguard-ipv6-converter'
|
2023-04-12 20:40:01 +02:00 |
|
|
Ruakij
|
ab9220d042
|
Add pause & gather_facts at end when service was started
|
2023-04-12 20:39:49 +02:00 |
|
|
Ruakij
|
15ad7920d4
|
Merge branch 'role_wireguard-ipv6-converter'
|
2023-04-12 20:24:27 +02:00 |
|
|
Ruakij
|
7012e1ea2b
|
Separate enable and re-/start service for fine-control
|
2023-04-12 20:23:08 +02:00 |
|
|
Ruakij
|
13ebd48c5d
|
Add register for task download
|
2023-04-12 20:22:34 +02:00 |
|
|
Ruakij
|
1a76b94a46
|
Add download-version
|
2023-04-12 14:58:43 +02:00 |
|
|
Ruakij
|
1b765689e6
|
Make sure daemon is reloaded before service-start
|
2023-04-12 14:50:14 +02:00 |
|
|
Ruakij
|
5b607df2de
|
Add checks if var is set
|
2023-04-12 14:47:02 +02:00 |
|
|
Ruakij
|
521b76453a
|
Add start to naming
|
2023-04-12 14:45:55 +02:00 |
|
|
Ruakij
|
7f503d983a
|
Fix download-location
|
2023-04-12 14:45:43 +02:00 |
|
|
Ruakij
|
b143d9c848
|
Fix checks
|
2023-04-12 14:45:31 +02:00 |
|
|
Ruakij
|
f95bcbc38d
|
change defaults
|
2023-04-12 14:44:10 +02:00 |
|
|
Ruakij
|
248a3c08b8
|
Initial role-data
|
2023-04-12 13:36:14 +02:00 |
|
|
Ruakij
|
f2c86dc22d
|
Merge branch 'role_kubernetes-k3s'
|
2023-04-05 20:20:03 +02:00 |
|
|
Ruakij
|
a79f2cac8a
|
Merge branch 'role_netbird_client'
|
2023-04-05 20:19:44 +02:00 |
|
|
Ruakij
|
c8f90f0f8d
|
Update calico
|
2023-04-05 20:15:31 +02:00 |
|
|
Ruakij
|
41570ea40d
|
Create new block for network-stuff
|
2023-04-05 20:14:36 +02:00 |
|
|
Ruakij
|
a3c887748a
|
Move network-helper to own file independend from calico
|
2023-04-05 20:14:12 +02:00 |
|
|
Ruakij
|
d113625fa8
|
Fix env-value not being string
|
2023-04-05 20:08:25 +02:00 |
|
|
Ruakij
|
dadd077723
|
Fix service and conditional
|
2023-04-05 14:13:22 +02:00 |
|
|
Ruakij
|
0d43d07ad4
|
Add extra-config option
|
2023-04-05 14:12:56 +02:00 |
|
|
Ruakij
|
d6f8f975bb
|
Reload when config changed, but install already done
|
2023-04-05 13:32:14 +02:00 |
|
|
Ruakij
|
7c86a5d77d
|
Add register for config
|
2023-04-05 13:30:22 +02:00 |
|
|
Ruakij
|
8c4e3c2401
|
Update routingtabletowg and use new sync feature
|
2023-03-30 14:54:49 +02:00 |
|
|
Ruakij
|
b46d35c8a5
|
Add labels
|
2023-03-30 14:54:28 +02:00 |
|
|
Ruakij
|
791ad96849
|
Add ipv6-check to calico deploy
|
2023-03-19 15:17:45 +01:00 |
|
|
Ruakij
|
fc3d9845d6
|
Fix undeterministic node-selection but uses group
|
2023-03-19 15:17:02 +01:00 |
|
|
Ruakij
|
590b75ac23
|
Add quotes to token-usage for special chars
|
2023-03-19 14:01:19 +01:00 |
|
|
Ruakij
|
0c82504299
|
Separate getting name and ips to fix bug easily
|
2023-03-19 14:00:46 +01:00 |
|
|
Ruakij
|
2fee9a1747
|
Only enable ipv6 when available and activated
|
2023-03-19 14:00:15 +01:00 |
|
|
Ruakij
|
fb44c39969
|
Add install of often-used packets
|
2023-03-19 13:58:47 +01:00 |
|
|
Ruakij
|
5452303992
|
Remove netmaker from dependency
|
2023-03-19 13:58:05 +01:00 |
|
|
Ruakij
|
4321d78cf8
|
Add comments to variables
|
2023-03-19 13:57:57 +01:00 |
|
|
Ruakij
|
f9a859e95c
|
Add ingress-option
|
2023-03-19 13:56:26 +01:00 |
|
|
Ruakij
|
fd302e4ebc
|
Move regather facts to join when changed
|
2023-03-19 13:47:01 +01:00 |
|
|
Ruakij
|
b5729caa0e
|
Add wait for interface to come up
|
2023-03-19 13:46:44 +01:00 |
|
|
Ruakij
|
dca40ed835
|
Remove throttle
|
2023-03-19 13:46:21 +01:00 |
|