Add public download server at dl.ladkau.de and improve vault validation

- New dl role — nginx serves files publicly over HTTPS with directory
  listing; atmoz/sftp on port 2223 for key-only uploads; both containers
  share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
  present — vaultwarden_sso_client_secret must be non-empty,
  dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
  scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour

This commit is contained in:

2026-06-28 16:20:47 +02:00

parent 1c36b7bbcb

commit f53ccbab4a

11 changed files with 240 additions and 14 deletions

									
										scripts/check-services.sh
									
		+1
		
												View File
												
				@@ -17,6 +17,7 @@ CHECKS=(

				  "https://cr.ladkau.de/v2/ 401 10"

				  "https://k8s.ladkau.de 200 10"

				  "https://vault.ladkau.de 200 10"

				  "https://dl.ladkau.de 200 10"

				)

				if ! command -v curl &>/dev/null; then