ml
974486bc53
Remove the Clay role (Claude Code web UI) and its Anthropic API key. New roles: - ollama: local CPU LLM (qwen3:4b-instruct), internal network only - browserless: headless Chromium for JavaScript-heavy pages - searxng: metasearch backend for the chat web_search tool - n8n at agent.ladkau.de: web chat (/chat), scheduled workflows, Telegram bot; workflows and credentials are imported from the repo Telegram bot: Gemini 3.8 -> Gemini 3.5 -> local Qwen fallback chain, /qwen to force the local model, /stocks and a weekday schedule (07:30, 13:00, 17:40) for the MTE.DE / PTX.F stock report. Also: dashboard and check-services entries for the chat, vault checks for the new secrets (n8n, SearXNG, Gemini, Telegram, SMTP), updated CLAUDE.md, runbooks and README.
94 lines
3.3 KiB
Markdown
94 lines
3.3 KiB
Markdown
<p align="center">
|
|
<img src="logo.png" alt="cloud.ladkau.de logo" width="200">
|
|
</p>
|
|
|
|
Info:
|
|
--
|
|
Server:
|
|
Strato STRATO VPS Linux VC4-8
|
|
|
|
Cores: 4 Cores
|
|
RAM: 8 GB RAM
|
|
Storage: 240 HDD
|
|
|
|
IPv4: 217.154.207.148
|
|
IPv6: 2a01:239:35b:c400::1
|
|
|
|
OS: Ubuntu 24.04 LTS
|
|
|
|
DNS Names:
|
|
cloud.ladkau.de
|
|
gitea.ladkau.de
|
|
nextcloud.ladkau.de
|
|
sso.ladkau.de
|
|
mail.ladkau.de
|
|
cr.ladkau.de
|
|
k8s.ladkau.de
|
|
vault.ladkau.de
|
|
dl.ladkau.de
|
|
agent.ladkau.de
|
|
|
|
Purpose:
|
|
--
|
|
This repository tracks the complete server configuration so the server can be
|
|
fully reinstalled from scratch using only this repo. Every configuration change
|
|
must be committed here. The git history serves as the change log.
|
|
|
|
Architecture:
|
|
--
|
|
Provisioning: Ansible
|
|
Ansible playbooks configure the OS and deploy all services. Roles are
|
|
idempotent — re-running them brings the server back to the desired state
|
|
without side effects. The master playbook is ansible/site.yml.
|
|
|
|
Service runtime: Docker Compose
|
|
Each service runs as a Docker Compose stack. Compose files live inside
|
|
their respective Ansible roles (roles/<service>/templates/docker-compose.yml.j2).
|
|
This keeps service definition and deployment config together.
|
|
|
|
Reverse proxy / TLS: Traefik
|
|
Traefik is the single entry point for all HTTP/HTTPS traffic. It runs as
|
|
a Docker Compose service and routes to other containers via Docker labels.
|
|
TLS certificates are issued automatically via Let's Encrypt (ACME).
|
|
|
|
Repo layout:
|
|
--
|
|
ansible/
|
|
inventory.ini # host address and connection vars
|
|
site.yml # master playbook — runs all roles in order
|
|
group_vars/all/ # vars.yml (shared variables) and vault.yml (encrypted secrets)
|
|
roles/
|
|
base/ # OS hardening, non-root user, SSH, ufw firewall
|
|
docker/ # Docker Engine + Compose plugin install
|
|
traefik/ # reverse proxy, TLS termination
|
|
gitea/ # self-hosted Git
|
|
nextcloud/ # file storage and collaboration
|
|
sso/ # Single Sign-On
|
|
mail/ # Roundcube webmail, Dovecot, Fetchmail
|
|
registry/ # container registry (cr.ladkau.de)
|
|
k8s/ # placeholder page (k8s.ladkau.de)
|
|
act_runner/ # Gitea Actions runners
|
|
vaultwarden/ # password vault (vault.ladkau.de)
|
|
dl/ # download server (dl.ladkau.de)
|
|
dashboard/ # status dashboard (cloud.ladkau.de)
|
|
ollama/ # local LLM server (internal network only)
|
|
browserless/ # headless Chromium (internal network only)
|
|
searxng/ # metasearch for the chat web_search tool (internal network only)
|
|
n8n/ # AI chat and scheduled digests (agent.ladkau.de)
|
|
docs/
|
|
runbook-provisioning.md # step-by-step reinstall instructions
|
|
runbook-configuration.md # first-run service configuration
|
|
runbook-mail-import.md # migrating mbox mail to Maildir++
|
|
scripts/
|
|
run-bootstrap.sh # bootstrap deploy user on a fresh server
|
|
bootstrap-deploy-user.sh # runs on server as root — creates deploy user
|
|
check-vault.sh # verify vault.yml has all required secrets
|
|
check-services.sh # verify all service endpoints respond
|
|
keys/
|
|
*.pub # public SSH keys (private keys are gitignored)
|
|
|
|
SSH keys:
|
|
--
|
|
root_cloud_ladkau_de — root access (initial setup only)
|
|
notroot_cloud_ladkau_de — non-root deploy user (used by Ansible)
|