Add public download server at dl.ladkau.de and improve vault validation
- New dl role — nginx serves files publicly over HTTPS with directory listing; atmoz/sftp on port 2223 for key-only uploads; both containers share /opt/dl/files volume - check-vault.sh gains a third tier: optional secrets are validated when present — vaultwarden_sso_client_secret must be non-empty, dl_sftp_authorized_keys must begin with a recognised SSH public key prefix - dl.ladkau.de added to DNS table, check-services.sh, and status dashboard - Configuration runbook section 7: deploy key generation, Gitea Actions scp workflow example, and SFTP client connection settings - Provisioning runbook documents the three-tier vault validation behaviour
This commit is contained in:
ml
@@ -24,6 +24,7 @@ The script checks these endpoints and verifies the expected HTTP status code:
|
||||
| `https://cr.ladkau.de/v2/` | 401 | Registry API — auth required, correct without credentials |
|
||||
| `https://k8s.ladkau.de` | 200 | Placeholder page |
|
||||
| `https://vault.ladkau.de` | 200 | Vaultwarden web vault |
|
||||
| `https://dl.ladkau.de` | 200 | Public download server |
|
||||
|
||||
A `000` result means the connection was refused or timed out — a container that
|
||||
did not start. Keycloak and Nextcloud may return `502` for up to 90 seconds on
|
||||
@@ -234,7 +235,58 @@ automatically (public self-registration is otherwise disabled).
|
||||
In any official Bitwarden client, set the **Server URL** to
|
||||
`https://vault.ladkau.de` before logging in.
|
||||
|
||||
## 7. Container registry
|
||||
## 7. Download server
|
||||
|
||||
Files placed under `dl.ladkau.de` are publicly browsable and downloadable over
|
||||
HTTPS. Upload is via SFTP on port 2223, key auth only.
|
||||
|
||||
### 7.1 Generate the deploy key
|
||||
|
||||
Run this once locally and keep both files:
|
||||
|
||||
```bash
|
||||
ssh-keygen -t ed25519 -f dl_deploy_key -N "" -C "gitea-actions"
|
||||
```
|
||||
|
||||
- Add the contents of `dl_deploy_key.pub` to the vault as `dl_sftp_authorized_keys`
|
||||
and redeploy (`--tags dl`) to authorise the key.
|
||||
- Store `dl_deploy_key` (the private key) as a Gitea Actions secret named
|
||||
`DL_SSH_KEY` in any repository that needs to publish releases.
|
||||
|
||||
### 7.2 Upload from Gitea Actions
|
||||
|
||||
Add a step to your workflow after building the binary:
|
||||
|
||||
```yaml
|
||||
- name: Upload release
|
||||
run: |
|
||||
echo "${{ secrets.DL_SSH_KEY }}" > /tmp/deploy_key
|
||||
chmod 600 /tmp/deploy_key
|
||||
ssh -i /tmp/deploy_key -p 2223 \
|
||||
-o StrictHostKeyChecking=no \
|
||||
uploader@dl.ladkau.de \
|
||||
"mkdir -p files/releases/${{ gitea.ref_name }}"
|
||||
scp -i /tmp/deploy_key -P 2223 \
|
||||
-o StrictHostKeyChecking=no \
|
||||
dist/myapp-linux-amd64 \
|
||||
uploader@dl.ladkau.de:files/releases/${{ gitea.ref_name }}/
|
||||
rm /tmp/deploy_key
|
||||
```
|
||||
|
||||
The file is then available at:
|
||||
`https://dl.ladkau.de/releases/v1.2.3/myapp-linux-amd64`
|
||||
|
||||
### 7.3 Connect an SFTP client
|
||||
|
||||
| Setting | Value |
|
||||
|-----------|--------------------|
|
||||
| Host | `dl.ladkau.de` |
|
||||
| Port | `2223` |
|
||||
| User | `uploader` |
|
||||
| Auth | SSH key |
|
||||
| Root path | `files/` |
|
||||
|
||||
## 8. Container registry
|
||||
|
||||
```bash
|
||||
# Login
|
||||
|
||||
@@ -79,6 +79,7 @@ Let's Encrypt certificates on first start and DNS must resolve at that point.
|
||||
| cr.ladkau.de | A → server IP |
|
||||
| k8s.ladkau.de | A → server IP |
|
||||
| vault.ladkau.de | A → server IP |
|
||||
| dl.ladkau.de | A → server IP |
|
||||
|
||||
### 4. Create the vault and populate secrets
|
||||
|
||||
@@ -124,6 +125,12 @@ vaultwarden_admin_token: "" # generate: openssl rand -hex 32
|
||||
# vaultwarden_sso_client_secret is added after Keycloak is configured — see
|
||||
# step 2.6 of runbook-configuration.md
|
||||
|
||||
# Download server — SFTP upload key
|
||||
# Generate: ssh-keygen -t ed25519 -f dl_deploy_key -N "" -C "gitea-actions"
|
||||
# Paste the contents of dl_deploy_key.pub here; store dl_deploy_key as a Gitea Actions secret
|
||||
dl_sftp_authorized_keys: |
|
||||
ssh-ed25519 AAAA...
|
||||
|
||||
# Dovecot IMAP users
|
||||
dovecot_users:
|
||||
- username: alice
|
||||
@@ -147,6 +154,16 @@ Verify all secrets are present and non-empty:
|
||||
bash scripts/check-vault.sh
|
||||
```
|
||||
|
||||
The script enforces three tiers:
|
||||
- **Required scalars** — must be present and non-empty (all secrets above except
|
||||
`vaultwarden_sso_client_secret` and `dl_sftp_authorized_keys`)
|
||||
- **Required lists** — must be present and contain at least one entry
|
||||
(`traefik_dashboard_users`, `registry_users`, `dovecot_users`)
|
||||
- **Optional but validated when present** — if the key exists in the vault it
|
||||
must pass a format check:
|
||||
- `vaultwarden_sso_client_secret` — non-empty string (added after Keycloak is configured)
|
||||
- `dl_sftp_authorized_keys` — must begin with a recognised SSH public key prefix
|
||||
|
||||
To edit the vault later:
|
||||
|
||||
```bash
|
||||
@@ -165,8 +182,8 @@ The script runs the following steps in order:
|
||||
1. Verifies all four key files exist under `keys/` (both root and deploy key pairs)
|
||||
2. Verifies `scripts/bootstrap-deploy-user.sh` exists
|
||||
3. Sets `chmod 600` on the private key files (SSH refuses keys with open permissions)
|
||||
4. Runs `scripts/check-vault.sh` — decrypts the vault and confirms all 11 required
|
||||
secrets are present and non-empty
|
||||
4. Runs `scripts/check-vault.sh` — decrypts the vault, confirms all required
|
||||
secrets are present and non-empty, and validates optional secrets when present
|
||||
|
||||
**Remote actions**
|
||||
5. Opens a test SSH connection as `root` to confirm the root key works
|
||||
@@ -197,7 +214,8 @@ This runs all roles in order:
|
||||
| 8 | `registry` | Docker Registry v2 with htpasswd auth |
|
||||
| 9 | `k8s` | Placeholder page at k8s.ladkau.de |
|
||||
| 10 | `vaultwarden` | Vaultwarden password vault at vault.ladkau.de |
|
||||
| 11 | `dashboard` | Public status dashboard at cloud.ladkau.de — service health and server stats |
|
||||
| 11 | `dl` | Public download server at dl.ladkau.de — nginx HTTPS + SFTP upload |
|
||||
| 12 | `dashboard` | Public status dashboard at cloud.ladkau.de — service health and server stats |
|
||||
|
||||
To apply a single role:
|
||||
|
||||
@@ -211,5 +229,5 @@ ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags <role> --ask-v
|
||||
|--------|---------|
|
||||
| `scripts/run-bootstrap.sh` | Copy and run the deploy user bootstrap on a fresh server |
|
||||
| `scripts/bootstrap-deploy-user.sh` | Runs on the server as root — creates the deploy user |
|
||||
| `scripts/check-vault.sh` | Verify vault.yml exists and all required secrets are non-empty |
|
||||
| `scripts/check-vault.sh` | Verify required secrets are present; validate optional secrets (`vaultwarden_sso_client_secret`, `dl_sftp_authorized_keys`) when present |
|
||||
| `scripts/check-services.sh` | Verify all service endpoints are reachable (run after provisioning) |
|
||||
|
||||
Reference in New Issue
Block a user