Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Commit Graph

  • 37fc48275d common: sysctl reload skips keys a container does not have main Ruakij 2026-11-07 19:31:02 +00:00
  • cc9cc6d34f common: valid hex IPv6 stable-secret written before addr_gen_mode, sysctl reload only of the role files Ruakij 2026-11-07 19:23:51 +00:00
  • 975beccf50 netbird_client: deb822 netbird repository, replaces the one-line netbird.list Ruakij 2026-11-07 18:54:20 +00:00
  • 3290d843cc common: ssh tasks use the ssh unit that Ubuntu also has, cloud-init no longer rewrites /etc/hosts at boot Ruakij 2026-11-07 18:51:22 +00:00
  • 4abfea352c docker: docker-compose wrapper is 0755, mode preserve took the 0700 of the local checkout Ruakij 2026-11-07 18:24:18 +00:00
  • b74598d265 common: disk_maintenance.fstrim_mountpoints limits fstrim.service to the listed mountpoints Ruakij 2026-11-07 17:49:34 +00:00
  • 483f3890e5 host_firewall: uplinks drop new forwarded connections that were not DNATed, replaces no_hairpin_ifaces Ruakij 2026-11-06 08:48:29 +00:00
  • 79943e0389 host_firewall: no_hairpin_ifaces drops forwarding back out of the interface it came in on Ruakij 2026-11-06 08:33:42 +00:00
  • 252c703afd host_firewall: log FireHOL level1 and level2 under separate prefixes fw-firehol1-* and fw-firehol2-* Ruakij 2026-11-05 16:57:33 +00:00
  • 1d10f2be39 host_firewall: drop bruteforceblocker, vxvault and cybercrime, only firehol level1 and level2 ban Ruakij 2026-11-05 16:51:45 +00:00
  • 6a1e7b77e7 host_firewall: ban firehol level2, bruteforceblocker, vxvault and cybercrime; greensnow is part of level2 Ruakij 2026-11-05 13:25:48 +00:00
  • ce851f59c6 kopia_backup: set zstd as the global compression policy on every run Ruakij 2026-11-04 06:59:47 +00:00
  • 6334820750 host_firewall: pass journal uploader flows from wt0 to the Traefik pod port with their own address Ruakij 2026-11-04 06:13:52 +00:00
  • f60a2c7e1f host_firewall: pass LAPI client flows from wt0 to the pod port with their own address Ruakij 2026-11-03 21:58:27 +00:00
  • b23466f588 host_firewall: pass cluster ring flows from wt0 into the pod CIDR unmasqueraded and past the NetBird forward filter Ruakij 2026-11-03 18:36:47 +00:00
  • 74a0af2d32 host_firewall: reject forwarded tcp/25 egress like the host output rule Ruakij 2026-11-03 16:59:44 +00:00
  • c30b3d1f0a host_firewall: clear NetBird marks on pod to pod flows so pod sources stay unmasqueraded Ruakij 2026-11-03 16:35:02 +00:00
  • e5922692f6 docker: enable live-restore by merging daemon options into daemon.json Ruakij 2026-11-03 16:20:11 +01:00
  • bacb16b7b2 netbird_client: write the MTU even when an earlier task already stopped netbird Ruakij 2026-11-02 22:58:25 +00:00
  • c7c9f6d5d1 netbird_client: manage the wt0 MTU in default.json Ruakij 2026-11-02 22:35:03 +00:00
  • 0267db247e backup: drop nonexistent --clear-retention flag from retention helper Ruakij 2026-11-01 09:56:44 +00:00
  • add568a242 kopia_backup: render per-source retention overrides from kopia_backup.retention Ruakij 2026-11-01 09:07:04 +00:00
  • ca34bd8363 host_firewall: GreenSnow set greensnow_v4 drops inbound new connections of the listed hosts Ruakij 2026-10-30 09:01:25 +00:00
  • f92b36ceaa host_exporters: purge OpenIPMI on hosts without a BMC, its leftover init script fails at boot Ruakij 2026-10-29 08:03:37 +00:00
  • 32651402c6 Revert "host_firewall: sources zone accepts tcp ports from listed addresses alone" Ruakij 2026-10-28 14:02:36 +00:00
  • 0abc9fb1c3 host_firewall: sources zone accepts tcp ports from listed addresses alone Ruakij 2026-10-28 13:59:37 +00:00
  • c1c71194c6 wireguard-ipv6-converter: download the release assets under their 0.5.0 names wg-ipv6-converter-linux-<arch> Ruakij 2026-10-28 13:16:33 +00:00
  • 66657f3917 kubernetes: k3s resolv-conf from fixed nameservers 1.1.1.1 and 9.9.9.9 instead of a copy of the node Ruakij 2026-10-27 15:24:48 +00:00
  • e1b5639d65 apt_updates: count a package as security when any version newer than the installed one has a security origin Ruakij 2026-10-27 07:40:18 +00:00
  • 7a260afe39 crowdsec_range_bouncer: skip range decisions wider than /8 (IPv4) or /16 (IPv6) and log each skip Ruakij 2026-10-26 19:52:14 +00:00
  • 78a370dbd1 wireguard-ipv6-converter: verified download, restart upheld while the interface is up, percent signs escaped for systemd Ruakij 2026-10-26 19:15:45 +00:00
  • f67edd7a07 kubernetes: routingtabletowg 0.3.0 from ghcr, digest-pinned, syncs only the main table Ruakij 2026-10-26 19:15:44 +00:00
  • 7464f4da0a crowdsec: no crowdsec.list when a deb822 crowdsec.sources already defines the repository Ruakij 2026-10-26 19:15:44 +00:00
  • 923cd85020 mail_relay: the comment points to the security perimeter doc Ruakij 2026-10-26 16:45:10 +00:00
  • 61db0ed55e host_exporters: host_exporters_listen_address binds the node exporter to one address for hosts without host firewall Ruakij 2026-10-26 15:45:34 +00:00
  • 03fc22daf7 apt_updates: the role owns the apt metrics (Debian collector off, explicit zero rows, multi-suite security detection) Ruakij 2026-10-26 15:30:17 +00:00
  • 7604bc4dac host_firewall: rejected handshake flows are remembered for 30s and reset per packet, the first data segment no longer slips through; handshake match needs a bare ACK Ruakij 2026-10-26 14:56:59 +00:00
  • 46fd6a4c40 host_firewall: handshake meter carries the service limit, SYN meters become a flood cap at 2x rate and 2x burst Ruakij 2026-10-26 14:36:39 +00:00
  • ec64ace8f4 apt_updates: textfile metrics of pending apt updates for the node exporter collector Ruakij 2026-10-26 14:47:17 +00:00
  • 5318997b73 host_firewall: handshake meters per source reject over-limit connections with fw-rl-hs:, SYN meters log fw-rl-addr: and fw-rl-range: as evidence, conntrack accounting on Ruakij 2026-10-26 13:47:47 +00:00
  • 4fbc4ad317 unattended_upgrades: apt-listchanges sends no mails Ruakij 2026-10-26 14:17:53 +00:00
  • 470d856332 crowdsec: hubupdate removes the disabled scenarios even when the upgrade fails and exits non-zero afterwards Ruakij 2026-10-26 13:49:03 +00:00
  • 589f899bae host_firewall: public_ips of every inventory host are exempt from the rate-limit meters, ArgoCD fetches and mail submission from the cluster nodes hit the web and submission limits Ruakij 2026-10-26 13:02:42 +00:00
  • c2c8934ec9 host_firewall: per-service new-connection meters per source (/32, /64) and per range (/24, /48) from measured peaks, excess dropped with prefix fw-ratelimit:, replaces the ssh meter Ruakij 2026-10-26 12:07:16 +00:00
  • 5c0783cf86 crowdsec: disabled_scenarios removes hub scenarios replaced by local ones, absent_files removes retired local files Ruakij 2026-10-26 10:23:28 +00:00
  • fee8ec1ff6 docker: hourly prune of objects older than 7 days, root mail only when the prune fails Ruakij 2026-10-26 10:18:29 +00:00
  • d61403ee33 docker: apt source is deb822 signed by /etc/apt/keyrings/docker.asc with the key fetched by get_url Ruakij 2026-10-26 09:55:38 +00:00
  • 885e6f3338 mail_relay: postfix relays all mail through the mailcow submission port with a mailbox per host, replaces mail_aliases Ruakij 2026-10-26 09:44:37 +00:00
  • c91c56b153 mail_aliases: root mail goes to admin@ruekov.eu and newaliases builds the alias database Ruakij 2026-10-26 07:41:30 +00:00
  • 4dc7b23e06 host_exporters: IPMI tools read a static root-owned FreeIPMI config pinned in sudoers, sudo logs allowed commands Ruakij 2026-10-25 15:27:06 +00:00
  • 89821b479b zfs_host: zed and pool capacity and scrub metrics for the node exporter textfile collector Ruakij 2026-10-25 15:09:50 +00:00
  • f91a9b8fc9 host_exporters: IPMI exporter with sudo-pinned FreeIPMI tools for hosts with a BMC Ruakij 2026-10-25 15:04:56 +00:00
  • 7bed387ece kubernetes: kubelet_reserved comment names group_vars as the place of the values Ruakij 2026-10-25 14:49:20 +00:00
  • 8a0c8fb31b kubernetes: kubelet_reserved drop-in 30-reserved.conf and a k3s restart handler that runs only with k3s_restart_allowed Ruakij 2026-10-25 14:44:22 +00:00
  • 4c39069241 journal_upload: uploader drop-in with no start limit and 30s restarts so ingest outages do not end it Ruakij 2026-10-25 14:19:26 +00:00
  • c50c32059e host_firewall: drop inbound traffic from internet-wide scanners (OpenFilters internet-scanners), v4 and v6, daily refresh Ruakij 2026-10-25 12:12:27 +00:00
  • 38d1ac6ced common: tag the timezone task so it runs on its own Ruakij 2026-10-25 10:54:32 +00:00
  • 5160e11dc2 common: ipv6_accept_ra_interfaces sets accept_ra=2 on bridges that sysctl at boot does not see Ruakij 2026-10-25 10:20:55 +00:00
  • c49fd28b76 kubernetes: kubelet_memory writes a KubeletConfiguration drop-in 20-memory.conf for memory reservation and eviction, off by default Ruakij 2026-10-25 09:57:22 +00:00
  • c55a96c0ea host_firewall: FireHOL level1 as its own set firehol_v4 next to Spamhaus, daily updater and firewall.firehol opt-out Ruakij 2026-10-24 17:31:45 +00:00
  • 312be161b9 host_firewall: check the Spamhaus and geo sets under another table name, a dry run against the live name made unlisted addresses match Ruakij 2026-10-24 17:20:11 +00:00
  • 49834b858b common: remove fail2ban only with fail2ban_remove set for the host Ruakij 2026-10-24 16:11:36 +00:00
  • c36f269406 journal_upload: a node leaves its own NetBird address out of /etc/hosts, Traefik sees it as the cilium_host address Ruakij 2026-10-24 16:04:06 +00:00
  • 19a62a43ca common: remove fail2ban where CrowdSec agent and bouncer run, stop installing it Ruakij 2026-10-24 15:57:34 +00:00
  • fd58ee2c16 journal_upload: ship the journal to VictoriaLogs with systemd-journal-upload over NetBird Ruakij 2026-10-24 15:55:22 +00:00
  • d5610a5b34 host_firewall: refresh the Spamhaus sets by rule set reload, flush and refill let unlisted addresses match Ruakij 2026-10-24 14:53:10 +00:00
  • ebb1377470 host_firewall: block Spamhaus DROP, DROPv6 and ASN-DROP networks in, out and forward Ruakij 2026-10-24 14:31:00 +00:00
  • 5e544cdfb5 host_firewall: optional nf_log_all_netns sysctl so the firewall logs of LXC guests reach the host kernel log Ruakij 2026-10-24 13:43:12 +00:00
  • 88c30eb252 host_firewall: log dropped inbound packets with a global rate limit and reject outbound TCP 25 except on the mail host Ruakij 2026-10-24 12:14:47 +00:00
  • 41dbce3641 host_firewall: admin.tcp ports answer the admin set alone, never the geo sets Ruakij 2026-10-24 08:40:31 +00:00
  • 81e7a9dc6a crowdsec_range_bouncer: enforce CrowdSec range decisions in nftables interval sets, the firewall bouncer stores only the network address of a range Ruakij 2026-10-24 08:10:34 +00:00
  • 5cac169224 Give system.slice and the k3s unit CPUWeight 1000 so the control plane wins CPU against pods Ruakij 2026-10-23 21:14:13 +00:00
  • 60a55e6e49 host_exporters: install the node exporter without recommends, smartd and nvmf-autoconnect failed on hugo Ruakij 2026-10-23 21:04:05 +00:00
  • c5b51777c6 Ignore the missing geo timer unit of a host without geo sets in check mode Ruakij 2026-10-23 20:54:31 +00:00
  • a4648e0ea7 Join a fresh host to NetBird idempotently with the keyring, the management URL and the interface blacklist from the vars, and edit the blacklist and log level of a joined one Ruakij 2026-10-23 20:54:30 +00:00
  • a64d082c0c Add a host_exporters role for the node and smartctl exporters and a host_firewall scrapers rule that opens exporter ports on wt0 to named source addresses Ruakij 2026-10-23 20:44:59 +00:00
  • 381e1b285c Add an unattended_upgrades role that installs only Debian and Ubuntu security updates, with no automatic reboot Ruakij 2026-10-22 09:00:33 +00:00
  • bcdc460297 Copy per-host files of kopia_backup from a files list, empty by default Ruakij 2026-10-22 08:25:43 +00:00
  • bd24f01110 Let a host name its CrowdSec machine at the LAPI with crowdsec.machine_name, the short hostname of doris is dev Ruakij 2026-10-21 06:10:01 +00:00
  • 1ede3d3329 Read the fail2ban sshd jail from the journal, Debian 12+ has no auth.log and the jail failed to start Ruakij 2026-10-13 16:36:08 +00:00
  • deb3521bfa Add a proxmox_no_nag role that hides the subscription dialog and reapplies it from an apt hook after every widget-toolkit update Ruakij 2026-10-13 15:55:56 +00:00
  • c8cac22d12 Run the cilium status check in check mode too and never report it as changed Ruakij 2026-10-09 14:37:30 +00:00
  • 6fe03c5f70 Skip the cilium CLI download when it is installed already Ruakij 2026-10-09 14:37:30 +00:00
  • 15b4e54bd5 Read resolv.conf for the k3s nameservers in check mode too Ruakij 2026-10-09 14:37:30 +00:00
  • c016459922 Write the k3s registries.yaml only on a semantic change Ruakij 2026-10-09 14:37:29 +00:00
  • 4d1725f17f Deploy a registries.yaml from registries_config on k3s servers and restart k3s on its change Ruakij 2026-10-09 14:37:29 +00:00
  • 80658c632f Add the cilium network plugin to the kubernetes role, disabling servicelb, and collect the disabled k3s components in one disable list Ruakij 2026-10-09 14:37:29 +00:00
  • 60b67f748e Install the k3s servers one at a time with retries from the latest channel, enable the service and link the kubeconfig to ~/.kube/config Ruakij 2026-10-09 14:37:28 +00:00
  • 4a76aa3a2e Set node-name, node-external-ip and labels_extra in the k3s config and config_extra for agents Ruakij 2026-10-09 14:37:27 +00:00
  • e9f1153482 Add clean_resolv_conf to the kubernetes role to give k3s a resolv.conf with only the nameserver lines Ruakij 2026-10-09 14:37:27 +00:00
  • ca1fcc16b6 Fall back to the default IPv4 and IPv6 address when the k3s node IP interface has none Ruakij 2026-10-09 14:37:27 +00:00
  • fb94fd5997 Deploy the calico operator v3.28.0 Ruakij 2026-10-09 14:37:26 +00:00
  • 713d38d77d Shrink the default IPv6 cluster CIDR of k3s to fd42::/112 Ruakij 2026-10-09 14:37:26 +00:00
  • bc71066de1 Run the k3s install of the kubernetes role only on target_host when it is set Ruakij 2026-10-09 14:37:26 +00:00
  • 5eae9ca348 Drop the docker dependency and the helm install from the kubernetes role Ruakij 2026-10-09 14:37:25 +00:00
  • 844e017f9e Add a tuned role that installs tuned and sets the throughput-performance profile Ruakij 2026-10-09 14:37:25 +00:00
  • 381f3ab7c9 Start the wireguard-ipv6-converter again whenever its bound service starts via a drop-in and always restart it on deploy Ruakij 2026-10-09 14:37:24 +00:00
  • 6390e6288b Disable SSH password auth in the common role only when sshd is active Ruakij 2026-10-09 14:37:24 +00:00
  • 13d60c4f9b Install nmon and fail2ban and upgrade packages on every distribution in the common role Ruakij 2026-10-09 14:37:24 +00:00
  • cb09f77b68 Enable TCP BBR with the fq qdisc on kernels from 4.9 in the common role Ruakij 2026-10-09 14:37:23 +00:00