<p align="center">
  <img src="logo.png" alt="cloud.ladkau.de logo" width="200">
</p>

Info:
--
Server:
	Strato STRATO VPS Linux VC4-8

	Cores: 4 Cores
	RAM: 8 GB RAM
	Storage: 240 HDD

	IPv4: 217.154.207.148
	IPv6: 2a01:239:35b:c400::1

	OS: Ubuntu 24.04 LTS

DNS Names:
	cloud.ladkau.de
	gitea.ladkau.de
	nextcloud.ladkau.de
	sso.ladkau.de
	mail.ladkau.de
	cr.ladkau.de
	k8s.ladkau.de
	vault.ladkau.de
	dl.ladkau.de
	agent.ladkau.de
	fuelish.ladkau.de

Purpose:
--
This repository tracks the complete server configuration so the server can be
fully reinstalled from scratch using only this repo. Every configuration change
must be committed here. The git history serves as the change log.

Architecture:
--
Provisioning: Ansible
	Ansible playbooks configure the OS and deploy all services. Roles are
	idempotent — re-running them brings the server back to the desired state
	without side effects. The master playbook is ansible/site.yml.

Service runtime: Docker Compose
	Each service runs as a Docker Compose stack. Compose files live inside
	their respective Ansible roles (roles/<service>/templates/docker-compose.yml.j2).
	This keeps service definition and deployment config together.

Reverse proxy / TLS: Traefik
	Traefik is the single entry point for all HTTP/HTTPS traffic. It runs as
	a Docker Compose service and routes to other containers via Docker labels.
	TLS certificates are issued automatically via Let's Encrypt (ACME).

Repo layout:
--
	ansible/
		inventory.ini        # host address and connection vars
		site.yml             # master playbook — runs all roles in order
		group_vars/all/      # vars.yml (shared variables) and vault.yml (encrypted secrets)
		roles/
			base/            # OS hardening, non-root user, SSH, ufw firewall
			docker/          # Docker Engine + Compose plugin install
			traefik/         # reverse proxy, TLS termination
			gitea/           # self-hosted Git
			nextcloud/       # file storage and collaboration
			sso/             # Single Sign-On
			mail/            # Roundcube webmail, Dovecot, Fetchmail
			registry/        # container registry (cr.ladkau.de)
			k8s/             # placeholder page (k8s.ladkau.de)
			act_runner/      # Gitea Actions runners
			vaultwarden/     # password vault (vault.ladkau.de)
			dl/              # download server (dl.ladkau.de)
			dashboard/       # status dashboard (cloud.ladkau.de)
			ollama/          # local LLM server (internal network only)
			browserless/     # headless Chromium (internal network only)
			searxng/         # metasearch for the chat web_search tool (internal network only)
			n8n/             # AI chat and scheduled digests (agent.ladkau.de)
			fuelish/         # receipt OCR job API for the Android app (fuelish.ladkau.de)
	docs/
		runbook-provisioning.md  # step-by-step reinstall instructions
		runbook-configuration.md # first-run service configuration
		runbook-mail-import.md   # migrating mbox mail to Maildir++
	scripts/
		run-bootstrap.sh     # bootstrap deploy user on a fresh server
		bootstrap-deploy-user.sh  # runs on server as root — creates deploy user
		check-vault.sh       # verify vault.yml has all required secrets
		check-services.sh    # verify all service endpoints respond
	keys/
		*.pub                # public SSH keys (private keys are gitignored)

SSH keys:
--
	root_cloud_ladkau_de      — root access (initial setup only)
	notroot_cloud_ladkau_de   — non-root deploy user (used by Ansible)