- New vaultwarden role — Vaultwarden container with SQLite storage, admin
panel protected by token, Keycloak SSO enabled on second deploy after
the OIDC client secret is available (SSO_ENABLED conditionally set so
first provisioning deploy works without Keycloak being configured yet)
- Traefik routes vault.ladkau.de with lax rate limiting (SPA loads many assets)
- vault.ladkau.de added to DNS table, check-services.sh, status dashboard,
and check-vault.sh (admin token required; SSO secret is post-provisioning)
- Configuration runbook: step 2.6 for Keycloak client, section 6 for
Vaultwarden setup including admin panel, SSO login, and client configuration
- Add local Dovecot IMAP server exposed via Traefik IMAPS on port 993;
Roundcube now connects to it internally instead of requiring manual server entry
- Add Fetchmail integration for pulling from external POP3 accounts with
configurable per-account poll interval
- Fix Gitea SSO registration: DISABLE_REGISTRATION=false + ALLOW_ONLY_EXTERNAL_REGISTRATION
allows Keycloak-authenticated users to get accounts while blocking public sign-up;
disable legacy OpenID 2.0 sign-in
- Fix Keycloak post-logout redirect for Nextcloud (valid post logout redirect URI)
- Replace all pre-hashed credentials (Traefik dashboard, registry, Dovecot) with
plaintext passwords in vault; Ansible generates deterministic bcrypt/SHA-512 hashes
at deploy time — no more manual htpasswd commands
- Rewrite check-vault.sh with Python/PyYAML to properly validate both scalar and
list-type secrets
- Update provisioning and configuration runbooks throughout
- Traefik rate-limits all routes (60 req/min standard, 300 for Nextcloud)
and writes access logs to /var/log/traefik/access.log
- Fail2ban watches Traefik access logs and bans IPs after 10 x 403/404
within 60 s for 24 h
- Nextcloud html directory created as www-data (UID 33) so Apache can
process .htaccess and serve requests correctly
- scripts/check-services.sh verifies all seven endpoints return the
expected HTTP status after provisioning
- ansible.cfg: suppress Python interpreter discovery warning
- ansible/inventory.ini: add ansible_host; server IP is now defined in
one place and read dynamically by run-bootstrap.sh
- group_vars/all/ → directory layout so vault.yml is auto-loaded by Ansible
(previously vault.yml did not match any group name and was silently ignored)
- scripts/run-bootstrap.sh: read server IP from inventory, chmod 600 private
keys automatically, show actual SSH error when root login fails
- scripts/bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
(deploy user has no password so sudo group membership alone was not enough)
- nextcloud: fix Redis healthcheck (CMD-SHELL pipe was unreliable in Alpine,
switched to CMD form with start_period)
- group_vars/all/vars.yml: fix Roundcube image tag (1.6-apache and 1.6 do not
exist; correct tag is 1.6.x-apache)
- docs/runbook.md: expand prerequisites (SSH keys section), add step 1 for
setting the server IP, expand bootstrap step with preflight detail, fix
step numbering
- scripts/run-bootstrap.sh: copies and runs the deploy user bootstrap on a
fresh server, verifies SSH login, checks vault as a preflight step
- scripts/bootstrap-deploy-user.sh: runs on the server as root, accepts the
SSH public key as an argument (read from keys/ by run-bootstrap.sh)
- scripts/check-vault.sh: decrypts vault.yml and verifies all 11 required
secrets are present and non-empty
- docs/runbook.md: restructured into correct order (collections → DNS → vault
→ bootstrap → playbook), added scripts reference table, moved first-run
notes for Gitea/Keycloak/registry into their own section
- README.md: added scripts/ to repo layout
ml