server_cloud_ladkau_de

T

ml 393cfd4060 Fix fetchmail syntax errors for fetchmail 6.6.x on Alpine

fetchmailrc.j2:
- Move `ssl` to user section (inline after password); in 6.6.x it is a
  user-level keyword, not a server-level one — placing it after `proto pop3`
  caused 'unexpected USERNAME at user' syntax error
- Move `interval` before user section (it is server-level)
- Replace `smtphost dovecot` + `smtpport 24` with `smtphost dovecot/24`;
  `smtpport` is not a valid rcfile keyword in 6.6.x — port must be given
  as host/port in the smtphost value

dovecot.conf.j2:
- Add `auth_username_format = %Ln` to protocol lmtp block so that the
  LMTP recipient address `ml@dovecot` (appended by fetchmail) is stripped
  to just `ml` for userdb lookup

2026-07-01 06:58:33 +02:00

ansible

Fix fetchmail syntax errors for fetchmail 6.6.x on Alpine

2026-07-01 06:58:33 +02:00

docs

Fix Dovecot passwd-file format and document mbox mail import

2026-07-01 06:58:25 +02:00

keys

Initial commit

2026-06-27 14:13:23 +02:00

scripts

Fix Redis persistence crash-loop and provisioning dependencies

2026-06-28 17:20:18 +02:00

.gitignore

Fix provisioning errors found during first real run

2026-06-28 05:53:29 +02:00

ansible.cfg

Fix provisioning errors found during first real run

2026-06-28 05:53:29 +02:00

README.md

Fix all issues found during first live provisioning run

2026-06-28 07:05:43 +02:00

README.md

Info:

Server: Strato STRATO VPS Linux VC4-8 Order Number: 9478462

Customer Number: 73171334
Customer Login: https://www.strato.de/apps/CustomerService

Cores: 4 Cores
RAM: 8 GB RAM
Storage: 240 HDD

IPv4: 217.154.207.148
IPv6: 2a01:239:35b:c400::1

OS: Ubuntu 24.04 LTS

DNS Names: cloud.ladkau.de gitea.ladkau.de nextcloud.ladkau.de sso.ladkau.de mail.ladkau.de cr.ladkau.de k8s.ladkau.de

Purpose:

This repository tracks the complete server configuration so the server can be fully reinstalled from scratch using only this repo. Every configuration change must be committed here. The git history serves as the change log.

Architecture:

Provisioning: Ansible Ansible playbooks configure the OS and deploy all services. Roles are idempotent — re-running them brings the server back to the desired state without side effects. The master playbook is ansible/site.yml.

Service runtime: Docker Compose Each service runs as a Docker Compose stack. Compose files live inside their respective Ansible roles (roles//files/docker-compose.yml). This keeps service definition and deployment config together.

Reverse proxy / TLS: Traefik Traefik is the single entry point for all HTTP/HTTPS traffic. It runs as a Docker Compose service and routes to other containers via Docker labels. TLS certificates are issued automatically via Let's Encrypt (ACME).

Repo layout:

ansible/
	inventory.ini        # host address and connection vars
	site.yml             # master playbook — runs all roles in order
	group_vars/all.yml   # shared variables (domains, image versions, ...)
	roles/
		base/            # OS hardening, non-root user, SSH, ufw firewall
		docker/          # Docker Engine + Compose plugin install
		traefik/         # reverse proxy, TLS termination
		gitea/           # self-hosted Git
		nextcloud/       # file storage and collaboration
		sso/             # Single Sign-On
		mail/            # mail server
		registry/        # container registry (cr.ladkau.de)
		k8s/             # k3s Kubernetes node
docs/
	runbook-provisioning.md  # step-by-step reinstall instructions
	runbook-configuration.md # first-run service configuration
scripts/
	run-bootstrap.sh     # bootstrap deploy user on a fresh server
	bootstrap-deploy-user.sh  # runs on server as root — creates deploy user
	check-vault.sh       # verify vault.yml has all required secrets
keys/
	*.pub                # public SSH keys (private keys are gitignored)

SSH keys:

root_cloud_ladkau_de      — root access (initial setup only)
notroot_cloud_ladkau_de   — non-root deploy user (used by Ansible)