server_cloud_ladkau_de

matthias/server_cloud_ladkau_de

Fork 0

Commit Graph

Author	SHA1	Message	Date
ml	b15754ba2f	Harden against bot floods and add post-provisioning service check - Traefik rate-limits all routes (60 req/min standard, 300 for Nextcloud) and writes access logs to /var/log/traefik/access.log - Fail2ban watches Traefik access logs and bans IPs after 10 x 403/404 within 60 s for 24 h - Nextcloud html directory created as www-data (UID 33) so Apache can process .htaccess and serve requests correctly - scripts/check-services.sh verifies all seven endpoints return the expected HTTP status after provisioning	2026-06-28 08:02:45 +02:00
ml	75a0f21f74	Implemented all service roles - docker: install Docker Engine from official apt repo, configure log rotation, create shared traefik_public network - traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on cloud.ladkau.de behind basic auth - gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222 - sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on - nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV well-known redirects - mail: Roundcube webmail client with PostgreSQL - registry: Docker Registry v2 with htpasswd auth, no upload size limit - k8s: placeholder nginx page All secrets documented in vault.yml; runbook updated with per-service first-run notes.	2026-06-27 15:35:15 +02:00

Author

SHA1

Message

Date

b15754ba2f

Harden against bot floods and add post-provisioning service check

- Traefik rate-limits all routes (60 req/min standard, 300 for Nextcloud)
  and writes access logs to /var/log/traefik/access.log
- Fail2ban watches Traefik access logs and bans IPs after 10 x 403/404
  within 60 s for 24 h
- Nextcloud html directory created as www-data (UID 33) so Apache can
  process .htaccess and serve requests correctly
- scripts/check-services.sh verifies all seven endpoints return the
  expected HTTP status after provisioning

2026-06-28 08:02:45 +02:00

75a0f21f74

Implemented all service roles

- docker: install Docker Engine from official apt repo, configure log rotation,
  create shared traefik_public network
- traefik: reverse proxy with automatic Let's Encrypt TLS, dashboard on
  cloud.ladkau.de behind basic auth
- gitea: self-hosted Git with PostgreSQL, Git-over-SSH on port 2222
- sso: Keycloak with PostgreSQL for OIDC/OAuth2 single sign-on
- nextcloud: file storage with PostgreSQL, Redis, cron sidecar, CalDAV/CardDAV
  well-known redirects
- mail: Roundcube webmail client with PostgreSQL
- registry: Docker Registry v2 with htpasswd auth, no upload size limit
- k8s: placeholder nginx page

All secrets documented in vault.yml; runbook updated with per-service
first-run notes.

2026-06-27 15:35:15 +02:00

2 Commits