- New dl role — nginx serves files publicly over HTTPS with directory
listing; atmoz/sftp on port 2223 for key-only uploads; both containers
share /opt/dl/files volume
- check-vault.sh gains a third tier: optional secrets are validated when
present — vaultwarden_sso_client_secret must be non-empty,
dl_sftp_authorized_keys must begin with a recognised SSH public key prefix
- dl.ladkau.de added to DNS table, check-services.sh, and status dashboard
- Configuration runbook section 7: deploy key generation, Gitea Actions
scp workflow example, and SFTP client connection settings
- Provisioning runbook documents the three-tier vault validation behaviour
- New vaultwarden role — Vaultwarden container with SQLite storage, admin
panel protected by token, Keycloak SSO enabled on second deploy after
the OIDC client secret is available (SSO_ENABLED conditionally set so
first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
Vaultwarden setup including admin panel, SSO login, and client configuration
- Traefik rate-limits all routes (60 req/min standard, 300 for Nextcloud)
and writes access logs to /var/log/traefik/access.log
- Fail2ban watches Traefik access logs and bans IPs after 10 x 403/404
within 60 s for 24 h
- Nextcloud html directory created as www-data (UID 33) so Apache can
process .htaccess and serve requests correctly
- scripts/check-services.sh verifies all seven endpoints return the
expected HTTP status after provisioning
ml