ml
e197ba7370
Traefik: - Upgrade v3.3 → v3.6 to fix Docker API version negotiation failure with Docker Engine 29 (which dropped support for API < 1.40) Directory permissions: - Change all service parent directories from 0750 to 0755 so container processes can traverse them after dropping from root to a lower UID - Create db directories owned by postgres UID 999 (mode 0700) so PostgreSQL can access its data files across Ansible runs - Create /opt/gitea/data owned by git UID 1000 (Gitea writes there after dropping privileges) Healthchecks: - Fix Redis healthcheck: use CMD form instead of CMD-SHELL pipe (pipe was unreliable in Alpine) - Fix Keycloak healthcheck: use bash /dev/tcp on management port 9000 (curl not available in UBI image; was incorrectly targeting port 8080) Image tags: - Fix Roundcube: 1.6 and 1.6-apache do not exist; correct tag is 1.6.x-apache Bootstrap scripts: - bootstrap-deploy-user.sh: add sudoers.d entry for passwordless sudo (deploy user has no password so sudo group alone was not enough) - run-bootstrap.sh: read server IP from inventory.ini, chmod 600 keys automatically, show actual SSH error on failure Inventory / config: - Add ansible_host to inventory.ini — server IP now defined in one place - Restructure group_vars/ into all/ directory so vault.yml is auto-loaded (previously it did not match any group name) - Move ansible.cfg to repo root (Ansible looks in cwd, not playbook dir) Docs: - Split runbook.md into runbook-provisioning.md and runbook-configuration.md - Add step 1 (set server IP) to provisioning runbook - Expand prerequisites with SSH key generation and upload instructions - Expand bootstrap step with preflight check details
81 lines
2.6 KiB
Markdown
81 lines
2.6 KiB
Markdown
Info:
|
|
--
|
|
Server:
|
|
Strato STRATO VPS Linux VC4-8
|
|
Order Number: 9478462
|
|
|
|
Customer Number: 73171334
|
|
Customer Login: https://www.strato.de/apps/CustomerService
|
|
|
|
Cores: 4 Cores
|
|
RAM: 8 GB RAM
|
|
Storage: 240 HDD
|
|
|
|
IPv4: 217.154.207.148
|
|
IPv6: 2a01:239:35b:c400::1
|
|
|
|
OS: Ubuntu 24.04 LTS
|
|
|
|
DNS Names:
|
|
cloud.ladkau.de
|
|
gitea.ladkau.de
|
|
nextcloud.ladkau.de
|
|
sso.ladkau.de
|
|
mail.ladkau.de
|
|
cr.ladkau.de
|
|
k8s.ladkau.de
|
|
|
|
Purpose:
|
|
--
|
|
This repository tracks the complete server configuration so the server can be
|
|
fully reinstalled from scratch using only this repo. Every configuration change
|
|
must be committed here. The git history serves as the change log.
|
|
|
|
Architecture:
|
|
--
|
|
Provisioning: Ansible
|
|
Ansible playbooks configure the OS and deploy all services. Roles are
|
|
idempotent — re-running them brings the server back to the desired state
|
|
without side effects. The master playbook is ansible/site.yml.
|
|
|
|
Service runtime: Docker Compose
|
|
Each service runs as a Docker Compose stack. Compose files live inside
|
|
their respective Ansible roles (roles/<service>/files/docker-compose.yml).
|
|
This keeps service definition and deployment config together.
|
|
|
|
Reverse proxy / TLS: Traefik
|
|
Traefik is the single entry point for all HTTP/HTTPS traffic. It runs as
|
|
a Docker Compose service and routes to other containers via Docker labels.
|
|
TLS certificates are issued automatically via Let's Encrypt (ACME).
|
|
|
|
Repo layout:
|
|
--
|
|
ansible/
|
|
inventory.ini # host address and connection vars
|
|
site.yml # master playbook — runs all roles in order
|
|
group_vars/all.yml # shared variables (domains, image versions, ...)
|
|
roles/
|
|
base/ # OS hardening, non-root user, SSH, ufw firewall
|
|
docker/ # Docker Engine + Compose plugin install
|
|
traefik/ # reverse proxy, TLS termination
|
|
gitea/ # self-hosted Git
|
|
nextcloud/ # file storage and collaboration
|
|
sso/ # Single Sign-On
|
|
mail/ # mail server
|
|
registry/ # container registry (cr.ladkau.de)
|
|
k8s/ # k3s Kubernetes node
|
|
docs/
|
|
runbook-provisioning.md # step-by-step reinstall instructions
|
|
runbook-configuration.md # first-run service configuration
|
|
scripts/
|
|
run-bootstrap.sh # bootstrap deploy user on a fresh server
|
|
bootstrap-deploy-user.sh # runs on server as root — creates deploy user
|
|
check-vault.sh # verify vault.yml has all required secrets
|
|
keys/
|
|
*.pub # public SSH keys (private keys are gitignored)
|
|
|
|
SSH keys:
|
|
--
|
|
root_cloud_ladkau_de — root access (initial setup only)
|
|
notroot_cloud_ladkau_de — non-root deploy user (used by Ansible)
|