ml
e197ba7370
Traefik: - Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure with Docker Engine 29 (which dropped support for API < 1.40) Directory permissions: - Change all service parent directories from 0750 to 0755 so container processes can traverse them after dropping from root to a lower UID - Create db directories owned by postgres UID 999 (mode 0700) so PostgreSQL can access its data files across Ansible runs - Create /opt/gitea/data owned by git UID 1000 (Gitea writes there after dropping privileges) Healthchecks: - Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe (pipe was unreliable in Alpine) - Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000 (curl not available in UBI image; was incorrectly targeting port 8080) Image tags: - Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache Bootstrap scripts: - bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo (deploy user has no password so sudo group alone was not enough) - run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys automatically, show actual SSH error on failure Inventory / config: - Add ansible_host to inventory.ini — server IP now defined in one place - Restructure group_vars/ into all/ directory so vault.yml is auto-loaded (previously it did not match any group name) - Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir) Docs: - Split runbook.md into runbook-provisioning.md and runbook-configuration.md - Add step 1 (set server IP) to provisioning runbook - Expand prerequisites with SSH key generation and upload instructions - Expand bootstrap step with preflight check details
2.6 KiB
Info:
Server: Strato STRATO VPS Linux VC4-8 Order Number: 9478462
Customer Number: 73171334
Customer Login: https://www.strato.de/apps/CustomerService
Cores: 4 Cores
RAM: 8 GB RAM
Storage: 240 HDD
IPv4: 217.154.207.148
IPv6: 2a01:239:35b:c400::1
OS: Ubuntu 24.04 LTS
DNS Names: cloud.ladkau.de gitea.ladkau.de nextcloud.ladkau.de sso.ladkau.de mail.ladkau.de cr.ladkau.de k8s.ladkau.de
Purpose:
This repository tracks the complete server configuration so the server can be fully reinstalled from scratch using only this repo. Every configuration change must be committed here. The git history serves as the change log.
Architecture:
Provisioning: Ansible Ansible playbooks configure the OS and deploy all services. Roles are idempotent — re-running them brings the server back to the desired state without side effects. The master playbook is ansible/site.yml.
Service runtime: Docker Compose Each service runs as a Docker Compose stack. Compose files live inside their respective Ansible roles (roles//files/docker-compose.yml). This keeps service definition and deployment config together.
Reverse proxy / TLS: Traefik Traefik is the single entry point for all HTTP/HTTPS traffic. It runs as a Docker Compose service and routes to other containers via Docker labels. TLS certificates are issued automatically via Let's Encrypt (ACME).
Repo layout:
ansible/
inventory.ini # host address and connection vars
site.yml # master playbook — runs all roles in order
group_vars/all.yml # shared variables (domains, image versions, ...)
roles/
base/ # OS hardening, non-root user, SSH, ufw firewall
docker/ # Docker Engine + Compose plugin install
traefik/ # reverse proxy, TLS termination
gitea/ # self-hosted Git
nextcloud/ # file storage and collaboration
sso/ # Single Sign-On
mail/ # mail server
registry/ # container registry (cr.ladkau.de)
k8s/ # k3s Kubernetes node
docs/
runbook-provisioning.md # step-by-step reinstall instructions
runbook-configuration.md # first-run service configuration
scripts/
run-bootstrap.sh # bootstrap deploy user on a fresh server
bootstrap-deploy-user.sh # runs on server as root — creates deploy user
check-vault.sh # verify vault.yml has all required secrets
keys/
*.pub # public SSH keys (private keys are gitignored)
SSH keys:
root_cloud_ladkau_de — root access (initial setup only)
notroot_cloud_ladkau_de — non-root deploy user (used by Ansible)