ml
82d944a0a8
- fuelish role: receipt OCR API at fuelish.ladkau.de, API-key auth, shared Ollama model and request options - base: 4 GB swap file; act_runner: job containers capped at 4 GB without swap - docs and vault/service checks updated
96 lines
3.4 KiB
Markdown
96 lines
3.4 KiB
Markdown
<p align="center">
|
|
<img src="logo.png" alt="cloud.ladkau.de logo" width="200">
|
|
</p>
|
|
|
|
Info:
|
|
--
|
|
Server:
|
|
Strato STRATO VPS Linux VC4-8
|
|
|
|
Cores: 4 Cores
|
|
RAM: 8 GB RAM
|
|
Storage: 240 HDD
|
|
|
|
IPv4: 217.154.207.148
|
|
IPv6: 2a01:239:35b:c400::1
|
|
|
|
OS: Ubuntu 24.04 LTS
|
|
|
|
DNS Names:
|
|
cloud.ladkau.de
|
|
gitea.ladkau.de
|
|
nextcloud.ladkau.de
|
|
sso.ladkau.de
|
|
mail.ladkau.de
|
|
cr.ladkau.de
|
|
k8s.ladkau.de
|
|
vault.ladkau.de
|
|
dl.ladkau.de
|
|
agent.ladkau.de
|
|
fuelish.ladkau.de
|
|
|
|
Purpose:
|
|
--
|
|
This repository tracks the complete server configuration so the server can be
|
|
fully reinstalled from scratch using only this repo. Every configuration change
|
|
must be committed here. The git history serves as the change log.
|
|
|
|
Architecture:
|
|
--
|
|
Provisioning: Ansible
|
|
Ansible playbooks configure the OS and deploy all services. Roles are
|
|
idempotent — re-running them brings the server back to the desired state
|
|
without side effects. The master playbook is ansible/site.yml.
|
|
|
|
Service runtime: Docker Compose
|
|
Each service runs as a Docker Compose stack. Compose files live inside
|
|
their respective Ansible roles (roles/<service>/templates/docker-compose.yml.j2).
|
|
This keeps service definition and deployment config together.
|
|
|
|
Reverse proxy / TLS: Traefik
|
|
Traefik is the single entry point for all HTTP/HTTPS traffic. It runs as
|
|
a Docker Compose service and routes to other containers via Docker labels.
|
|
TLS certificates are issued automatically via Let's Encrypt (ACME).
|
|
|
|
Repo layout:
|
|
--
|
|
ansible/
|
|
inventory.ini # host address and connection vars
|
|
site.yml # master playbook — runs all roles in order
|
|
group_vars/all/ # vars.yml (shared variables) and vault.yml (encrypted secrets)
|
|
roles/
|
|
base/ # OS hardening, non-root user, SSH, ufw firewall
|
|
docker/ # Docker Engine + Compose plugin install
|
|
traefik/ # reverse proxy, TLS termination
|
|
gitea/ # self-hosted Git
|
|
nextcloud/ # file storage and collaboration
|
|
sso/ # Single Sign-On
|
|
mail/ # Roundcube webmail, Dovecot, Fetchmail
|
|
registry/ # container registry (cr.ladkau.de)
|
|
k8s/ # placeholder page (k8s.ladkau.de)
|
|
act_runner/ # Gitea Actions runners
|
|
vaultwarden/ # password vault (vault.ladkau.de)
|
|
dl/ # download server (dl.ladkau.de)
|
|
dashboard/ # status dashboard (cloud.ladkau.de)
|
|
ollama/ # local LLM server (internal network only)
|
|
browserless/ # headless Chromium (internal network only)
|
|
searxng/ # metasearch for the chat web_search tool (internal network only)
|
|
n8n/ # AI chat and scheduled digests (agent.ladkau.de)
|
|
fuelish/ # receipt OCR job API for the Android app (fuelish.ladkau.de)
|
|
docs/
|
|
runbook-provisioning.md # step-by-step reinstall instructions
|
|
runbook-configuration.md # first-run service configuration
|
|
runbook-mail-import.md # migrating mbox mail to Maildir++
|
|
scripts/
|
|
run-bootstrap.sh # bootstrap deploy user on a fresh server
|
|
bootstrap-deploy-user.sh # runs on server as root — creates deploy user
|
|
check-vault.sh # verify vault.yml has all required secrets
|
|
check-services.sh # verify all service endpoints respond
|
|
keys/
|
|
*.pub # public SSH keys (private keys are gitignored)
|
|
|
|
SSH keys:
|
|
--
|
|
root_cloud_ladkau_de — root access (initial setup only)
|
|
notroot_cloud_ladkau_de — non-root deploy user (used by Ansible)
|