matthias/server_cloud_ladkau_de
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
20 Commits 1 Branch 1 Tag
cc01a61dc3a76fd1e61b570831e508f7bcf38afa
Commit Graph

4 Commits

Author SHA1 Message Date
ml 883893f755 Removing rate-limiting middleware from Gitea 2026-07-02 14:19:12 +02:00
ml c968995481 Adding gitea act_runner roles 2026-07-02 09:02:50 +02:00
ml b15754ba2f Harden against bot floods and add post-provisioning service check 
- Traefik rate-limits all routes (60 req/min standard, 300 for Nextcloud)
  and writes access logs to /var/log/traefik/access.log
- Fail2ban watches Traefik access logs and bans IPs after 10 x 403/404
  within 60 s for 24 h
- Nextcloud html directory created as www-data (UID 33) so Apache can
  process .htaccess and serve requests correctly
- scripts/check-services.sh verifies all seven endpoints return the
  expected HTTP status after provisioning
 2026-06-28 08:02:45 +02:00
ml 75a0f21f74 Implemented all service roles 
- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.
 2026-06-27 15:35:15 +02:00