server_cloud_ladkau_de/README.md at 82d944a0a8c74bb10d0073d346b022f2705ab8fc

Files

T

ml 82d944a0a8 Add fuelish API; protect the host against memory exhaustion

- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared
  Ollama model and request options
- base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap
- docs and vault/service checks updated

2026-10-04 13:54:09 +02:00

3.4 KiB

Raw Blame History

Info:

Server: Strato STRATO VPS Linux VC4-8

Cores: 4 Cores
RAM: 8 GB RAM
Storage: 240 HDD

IPv4: 217.154.207.148
IPv6: 2a01:239:35b:c400::1

OS: Ubuntu 24.04 LTS

DNS Names: cloud.ladkau.de gitea.ladkau.de nextcloud.ladkau.de sso.ladkau.de mail.ladkau.de cr.ladkau.de k8s.ladkau.de vault.ladkau.de dl.ladkau.de agent.ladkau.de fuelish.ladkau.de

Purpose:

This repository tracks the complete server configuration so the server can be fully reinstalled from scratch using only this repo. Every configuration change must be committed here. The git history serves as the change log.

Architecture:

Provisioning: Ansible Ansible playbooks configure the OS and deploy all services. Roles are idempotent — re-running them brings the server back to the desired state without side effects. The master playbook is ansible/site.yml.

Service runtime: Docker Compose Each service runs as a Docker Compose stack. Compose files live inside their respective Ansible roles (roles//templates/docker-compose.yml.j2). This keeps service definition and deployment config together.

Reverse proxy / TLS: Traefik Traefik is the single entry point for all HTTP/HTTPS traffic. It runs as a Docker Compose service and routes to other containers via Docker labels. TLS certificates are issued automatically via Let's Encrypt (ACME).

Repo layout:

ansible/
	inventory.ini        # host address and connection vars
	site.yml             # master playbook — runs all roles in order
	group_vars/all/      # vars.yml (shared variables) and vault.yml (encrypted secrets)
	roles/
		base/            # OS hardening, non-root user, SSH, ufw firewall
		docker/          # Docker Engine + Compose plugin install
		traefik/         # reverse proxy, TLS termination
		gitea/           # self-hosted Git
		nextcloud/       # file storage and collaboration
		sso/             # Single Sign-On
		mail/            # Roundcube webmail, Dovecot, Fetchmail
		registry/        # container registry (cr.ladkau.de)
		k8s/             # placeholder page (k8s.ladkau.de)
		act_runner/      # Gitea Actions runners
		vaultwarden/     # password vault (vault.ladkau.de)
		dl/              # download server (dl.ladkau.de)
		dashboard/       # status dashboard (cloud.ladkau.de)
		ollama/          # local LLM server (internal network only)
		browserless/     # headless Chromium (internal network only)
		searxng/         # metasearch for the chat web_search tool (internal network only)
		n8n/             # AI chat and scheduled digests (agent.ladkau.de)
		fuelish/         # receipt OCR job API for the Android app (fuelish.ladkau.de)
docs/
	runbook-provisioning.md  # step-by-step reinstall instructions
	runbook-configuration.md # first-run service configuration
	runbook-mail-import.md   # migrating mbox mail to Maildir++
scripts/
	run-bootstrap.sh     # bootstrap deploy user on a fresh server
	bootstrap-deploy-user.sh  # runs on server as root — creates deploy user
	check-vault.sh       # verify vault.yml has all required secrets
	check-services.sh    # verify all service endpoints respond
keys/
	*.pub                # public SSH keys (private keys are gitignored)

SSH keys:

root_cloud_ladkau_de      — root access (initial setup only)
notroot_cloud_ladkau_de   — non-root deploy user (used by Ansible)