- Traefik rate-limits all routes (60 req/min standard, 300 for Nextcloud)
and writes access logs to /var/log/traefik/access.log
- Fail2ban watches Traefik access logs and bans IPs after 10 x 403/404
within 60 s for 24 h
- Nextcloud html directory created as www-data (UID 33) so Apache can
process .htaccess and serve requests correctly
- scripts/check-services.sh verifies all seven endpoints return the
expected HTTP status after provisioning
Traefik:
- Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure
with Docker Engine 29 (which dropped support for API < 1.40)
Directory permissions:
- Change all service parent directories from 0750 to 0755 so container
processes can traverse them after dropping from root to a lower UID
- Create db directories owned by postgres UID 999 (mode 0700) so
PostgreSQL can access its data files across Ansible runs
- Create /opt/gitea/data owned by git UID 1000 (Gitea writes there
after dropping privileges)
Healthchecks:
- Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe
(pipe was unreliable in Alpine)
- Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000
(curl not available in UBI image; was incorrectly targeting port 8080)
Image tags:
- Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache
Bootstrap scripts:
- bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
(deploy user has no password so sudo group alone was not enough)
- run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys
automatically, show actual SSH error on failure
Inventory / config:
- Add ansible_host to inventory.ini — server IP now defined in one place
- Restructure group_vars/ into all/ directory so vault.yml is
auto-loaded (previously it did not match any group name)
- Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir)
Docs:
- Split runbook.md into runbook-provisioning.md and
runbook-configuration.md
- Add step 1 (set server IP) to provisioning runbook
- Expand prerequisites with SSH key generation and upload instructions
- Expand bootstrap step with preflight check details
- ansible.cfg: suppress Python interpreter discovery warning
- ansible/inventory.ini: add ansible_host; server IP is now defined in
one place and read dynamically by run-bootstrap.sh
- group_vars/all/ → directory layout so vault.yml is auto-loaded by Ansible
(previously vault.yml did not match any group name and was silently ignored)
- scripts/run-bootstrap.sh: read server IP from inventory, chmod 600 private
keys automatically, show actual SSH error when root login fails
- scripts/bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo
(deploy user has no password so sudo group membership alone was not enough)
- nextcloud: fix Redis healthcheck (CMD-SHELL pipe was unreliable in Alpine,
switched to CMD form with start_period)
- group_vars/all/vars.yml: fix Roundcube image tag (1.6-apache and 1.6 do not
exist; correct tag is 1.6.x-apache)
- docs/runbook.md: expand prerequisites (SSH keys section), add step 1 for
setting the server IP, expand bootstrap step with preflight detail, fix
step numbering
- scripts/run-bootstrap.sh: copies and runs the deploy user bootstrap on a
fresh server, verifies SSH login, checks vault as a preflight step
- scripts/bootstrap-deploy-user.sh: runs on the server as root, accepts the
SSH public key as an argument (read from keys/ by run-bootstrap.sh)
- scripts/check-vault.sh: decrypts vault.yml and verifies all 11 required
secrets are present and non-empty
- docs/runbook.md: restructured into correct order (collections → DNS → vault
→ bootstrap → playbook), added scripts reference table, moved first-run
notes for Gitea/Keycloak/registry into their own section
- README.md: added scripts/ to repo layout
ml