- Deploy Clay (claude Code web UI) at agent.ladkau.de behind basic auth;
Traefik proxies to clay's HTTPS port 2633 with insecureSkipVerify
- Document MCP server persistence: binaries need to be baked into the
Dockerfile, config in /opt/clay/data survives rebuilds
- Document scheduled agent workflows via Gitea Actions on.schedule with
email reporting via Gmail SMTP
- Fix registry UI: split /v2/ (registry) and / (UI) into separate Traefik
routers; add registry_internal network
- Add weekly registry GC cron job (/usr/local/bin/registry-gc)
- Remove rate-limit middleware from Gitea router (act_runner polling
exceeded 60 req/min limit)
- Set Traefik websecure readTimeout: 0 to fix large layer upload 499s
- passwd.j2: append '::::::' so entries have full 8-field passwd format.
Without this Dovecot's userdb lookup fails ('user is missing userdb
info') even though passdb auth succeeds, causing login to return 401.
- main.yml: fix passwd file mode from 0640 to 0644 so Dovecot can read it.
- Add runbook-mail-import.md: full procedure for migrating mbox-format mail
(old Dovecot server with ~/mail/ flat files) to Maildir++ including the
conversion script that handles fetchmail >From envelope lines.
- runbook-configuration.md: reference new runbook in the mail import section.
- New dl role — nginx serves files publicly over HTTPS with directory
listing; atmoz/sftp on port 2223 for key-only uploads; both containers
share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
present — vaultwarden_sso_client_secret must be non-empty,
dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour
- New vaultwarden role — Vaultwarden container with SQLite storage, admin
panel protected by token, Keycloak SSO enabled on second deploy after
the OIDC client secret is available (SSO_ENABLED conditionally set so
first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
Vaultwarden setup including admin panel, SSO login, and client configuration
- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
allows Keycloak-authenticated users to get accounts while blocking public sign-up;
disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
list-type secrets
- Update provisioning and configuration runbooks throughout
- Traefik rate-limits all routes (60 req/min standard, 300 for Nextcloud)
and writes access logs to /var/log/traefik/access.log
- Fail2ban watches Traefik access logs and bans IPs after 10 x 403/404
within 60 s for 24 h
- Nextcloud html directory created as www-data (UID 33) so Apache can
process .htaccess and serve requests correctly
- scripts/check-services.sh verifies all seven endpoints return the
expected HTTP status after provisioning
Traefik:
- Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure
with Docker Engine 29 (which dropped support for API < 1.40)
Directory permissions:
- Change all service parent directories from 0750 to 0755 so container
processes can traverse them after dropping from root to a lower UID
- Create db directories owned by postgres UID 999 (mode 0700) so
PostgreSQL can access its data files across Ansible runs
- Create /opt/gitea/data owned by git UID 1000 (Gitea writes there
after dropping privileges)
Healthchecks:
- Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe
(pipe was unreliable in Alpine)
- Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000
(curl not available in UBI image; was incorrectly targeting port 8080)
Image tags:
- Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache
Bootstrap scripts:
- bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
(deploy user has no password so sudo group alone was not enough)
- run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys
automatically, show actual SSH error on failure
Inventory / config:
- Add ansible_host to inventory.ini — server IP now defined in one place
- Restructure group_vars/ into all/ directory so vault.yml is
auto-loaded (previously it did not match any group name)
- Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir)
Docs:
- Split runbook.md into runbook-provisioning.md and
runbook-configuration.md
- Add step 1 (set server IP) to provisioning runbook
- Expand prerequisites with SSH key generation and upload instructions
- Expand bootstrap step with preflight check details
ml