matthias/server_cloud_ladkau_de
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4 Commits 1 Branch 1 Tag
03d2f6d57aed4a998cb92ac6bb514c349c6f73b4
Commit Graph

4 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
ml 03d2f6d57a Add bootstrap scripts and restructure runbook 
- scripts/run-bootstrap.sh: copies and runs the deploy user bootstrap on a
  fresh server, verifies SSH login, checks vault as a preflight step
- scripts/bootstrap-deploy-user.sh: runs on the server as root, accepts the
  SSH public key as an argument (read from keys/ by run-bootstrap.sh)
- scripts/check-vault.sh: decrypts vault.yml and verifies all 11 required
  secrets are present and non-empty
- docs/runbook.md: restructured into correct order (collections → DNS → vault
  → bootstrap → playbook), added scripts reference table, moved first-run
  notes for Gitea/Keycloak/registry into their own section
- README.md: added scripts/ to repo layout
 2026-06-28 05:03:05 +02:00
ml 75a0f21f74 Implemented all service roles 
- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.
 2026-06-27 15:35:15 +02:00
ml 6115d9d48f Set up repo structure and implement base role 
- Document architecture decisions in README (Ansible + Docker Compose + Traefik)
- Scaffold Ansible layout: inventory, site.yml, group_vars, 9 service roles
- Implement base role: package install, deploy user, SSH hardening,
  UFW firewall (22/80/443), fail2ban, unattended-upgrades
- Add reinstall runbook in docs/runbook.md
- Add ansible/requirements.yml for community.general and ansible.posix
 2026-06-27 15:02:21 +02:00
ml 694d6d5526 Initial commit 
- Adding .gitignore
  - Adding public ssh keys
 2026-06-27 14:13:23 +02:00