jokester/ansible-playbooks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
96 Commits 1 Branch 0 Tags
314fa715fd9847240eed5334e4ccead5c4117f10
Commit Graph
96 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Clément Désiles 314fa715fd fix(nginx): prevent cert leak on IPv6 / unknown SNI 
Two issues caused TLS to break on photos.carabosse.cloud over IPv6
(GrapheneOS + Immich app via Orange 5G NAT64):

1. Per-service vhosts only listened on IPv4 (listen 443 ssl). On IPv6,
   nginx fell back to the first vhost loaded alphabetically and served
   its certificate, breaking hostname verification on every other vhost.

2. /etc/letsencrypt/{live,archive} were 0700 root:root after certbot
   created them, so the nginx worker (user http on Arch) could not read
   the chained intermediates and served the leaf-only chain.

Changes:
- Add catch-all 00-default.conf default_server on :80 and :443 (v4+v6)
  with a self-signed cert and 'return 444'. ACME challenges still
  answered on :80.
- Add IPv6 listeners ([::]:80 and [::]:443 ssl) to immich, gitea, ntfy,
  uptime_kuma vhosts and to the temporary ACME provisioning vhost.
- Apply 0755 on /etc/letsencrypt/live and /etc/letsencrypt/archive on
  every run, not only at initial cert provisioning.
 2026-05-30 17:06:10 +02:00
Clément Désiles 80026fac0b fix: pin ansible.posix >=2.2.0 to silence _text deprecation warning 2026-05-30 17:05:58 +02:00
Clément Désiles c9e2ff930c feat(net_config): safer ufw restart on NAT/forwarding changes 
- Replace 'ufw disable && ufw --force enable' single-shot handler with a
  block that dry-runs the ruleset, disables, re-enables, then verifies
  ufw is active. No '&&' short-circuit, so failures are loud instead of
  leaving the host firewall-less.
- Rename handler to 'Restart ufw (ip-forwarding settings changed)' to
  reflect that this is a full restart (required to pick up
  /etc/default/ufw and /etc/ufw/before.rules changes per ufw(8)).
- Add NAT/masquerade tasks: enable ipv4 forwarding, set
  DEFAULT_FORWARD_POLICY=ACCEPT, and write a per-interface *nat block
  in /etc/ufw/before.rules.
- Declare requires_ansible >=2.15 in meta/runtime.yml (handler uses
  block:, supported since 2.12; 2.15 is a safe modern floor).
- README: document Ansible version requirement, port reservation
  rules, and Immich pgvector Q&A.
 2026-05-29 22:24:16 +02:00
Clément Désiles 36d6baaecb fix: missing task in wg 2026-05-29 21:54:25 +02:00
Clément Désiles 5f2c82d296 fix: use ansible_facts['getent_passwd'] to silence INJECT_FACTS_AS_VARS deprecation 2026-05-29 21:54:03 +02:00
Clément Désiles dbc7ca203a fix: minor taks name typo 2026-05-29 21:50:39 +02:00
Clément Désiles a8545fc501 fix(podman): use Type=notify + service-container so systemd sees pod crashes 
The previous Type=oneshot + RemainAfterExit=true pattern made systemd
freeze pod units in 'active (exited)' as soon as 'podman play kube'
returned, so crash-looping containers were invisible to
'systemctl --user --failed' and Restart=on-failure never fired.

For every podman-pod role (immich, fdroid, ntfy, gitea, qfieldcloud,
unifi, matrix, uptime_kuma):

- switch units to Type=notify + NotifyAccess=all
- run 'podman kube play --service-container=true' so the unit's main
  PID stays alive as long as the pod
- use 'podman kube down' for ExecStop
- add TimeoutStartSec=180 to cover slow first-boot image pulls

Pod manifests: flip every container's restartPolicy from Always to
Never. systemd is now the single owner of the restart loop: container
exits -> pod dies -> service container dies -> unit fails ->
Restart=on-failure restarts everything cleanly. With Always, podman
retried internally and hid the failure from systemd.

CLAUDE.md updated to document the new canonical template and the
'restartPolicy: Never' requirement.
 2026-05-29 21:49:13 +02:00
Clément Désiles 29d9f27052 fix: ntfy probe without curl available 2026-05-29 21:41:04 +02:00
Clément Désiles b04939d3d0 fix: use ansible_facts['kernel'] to avoid deprecation warning 2026-05-29 21:35:54 +02:00
Clément Désiles ff3133f8e7 feat: wireguard role allow multiple endpoints 2026-05-29 21:32:08 +02:00
Clément Désiles 4ae7721070 fix: secure pg + fix old way of sharing podman network 2026-05-29 21:31:07 +02:00
Clément Désiles ffeff6556b fix: restart dhcpd on nas restart 2026-05-29 21:29:14 +02:00
Clément Désiles 436fba0d39 Merge branch 'main' of github.com:cdesiles/ansible-playbooks 2026-05-29 21:28:41 +02:00
Clément Désiles 92deb854d2 fix: enhance tooling 2026-05-29 21:27:25 +02:00
Clément Désiles 05e7ee3956 fix: tls for static web 2026-05-29 21:27:00 +02:00
Clément Désiles aea450dc9d feat: nginx certbot 2026-05-29 21:26:17 +02:00
Clément Désiles 1d00432061 fix: podman integration 2026-05-29 21:24:58 +02:00
Clément Désiles 7904275754 nfs: minor tweak 2026-05-22 00:07:24 +02:00
Clément Désiles 305b8324db feat: sys autoupdate 2026-05-08 23:47:21 +02:00
Clément Désiles ea0771a5ac fix: update wireguard example 2026-05-05 22:59:46 +02:00
Clément Désiles 48e87f7cb1 zsh: enhance configuration with alacritty 2026-05-05 22:58:56 +02:00
Clément Désiles 4ac40b9898 fix: nginx defaults override on archlinux 2026-05-05 22:56:08 +02:00
Clément Désiles 488be1280c fix: dhcpd startup dependency 2026-05-05 22:54:56 +02:00
Clément Désiles de165f5e1c fix: review archlinux install details 2026-04-11 22:55:03 +02:00
Clément Désiles f9397ad38c feat: allow sshd to bind on multiple networks 2026-04-11 22:54:35 +02:00
Clément Désiles ac40c23d06 feat: more base tools 2026-04-11 22:53:19 +02:00
Clément Désiles 6fc7879648 fix: uptime-kuma reverse proxy config 2026-04-11 22:53:06 +02:00
Clément Désiles c4136ba5d2 fix: ntfy 2026-04-11 22:52:29 +02:00
Clément Désiles 4d60c6ea34 fix: zshrc to take p10k theme 2026-04-11 22:51:28 +02:00
Clément Désiles ae33184aa0 fix: zsh role add fzf support and p10k settings tweaks 2026-04-11 22:41:10 +02:00
Clément Désiles 61c88045f7 feat: add more tooling 2026-03-17 23:13:02 +01:00
Clément Désiles 525868caaf fix: wireguard on archlinux 2026-03-17 23:10:08 +01:00
Clément Désiles 235881aba7 fix: commit bootstrap playbook 2026-03-17 23:09:47 +01:00
Clément Désiles a6878c0b7d fix: dhcpd ipv4 service 2026-03-17 23:09:29 +01:00
Clément Désiles e209a93a78 feat: BREAKING unbound configuration 2026-03-17 23:08:44 +01:00
Clément Désiles 869727d364 fix: add bootstrap for new hosts 2026-03-17 23:06:42 +01:00
Clément Désiles 6393ff6ed3 fix: force images pull and change default ports 2026-02-14 21:02:51 +01:00
Clément Désiles 23c7da84bb fix: minor doc 2026-02-03 22:11:35 +01:00
Clément Désiles 34da95f8be fix: ntfy timezone 2026-02-03 22:08:48 +01:00
Clément Désiles 321a14a108 fix: increase unbound ttl&cache 2026-02-03 22:08:20 +01:00
Clément Désiles 1f758deb82 feat: add dhcpd server role 2026-02-03 22:07:40 +01:00
Clément Désiles 5fb027c446 fix: open wg port only in server mode 2026-01-22 07:31:45 +01:00
Clément Désiles 94dfe36c46 fix: add dig to test our dns setup 2026-01-18 13:46:37 +01:00
Clément Désiles 5a880d5d5a fix: unbound idempotency 2026-01-18 13:46:16 +01:00
Clément Désiles 8d3db69172 fix: wireguard config failfast 2026-01-18 13:21:37 +01:00
Clément Désiles aa5de65d30 fix: unbound ipv6 localhost 2026-01-18 13:21:15 +01:00
Clément Désiles c79c445a23 chore: ansible-lint review (almost done) 2026-01-04 11:21:15 +01:00
Clément Désiles 3e469fa25e fix: unbound interface naming 2025-12-24 17:09:22 +01:00
Clément Désiles 08364cf2c8 fix: unbound boot ordering 2025-12-24 16:47:38 +01:00
Clément Désiles f385efca84 doc: lint & enhancements 2025-12-23 09:11:16 +01:00
Clément Désiles 229f9f6b5d fix: user systemd 2025-12-23 09:08:43 +01:00
Clément Désiles 1cdad04a93 fix: cleanup 2025-12-21 23:04:09 +01:00
Clément Désiles 1349ce9c19 fix: defaulting to nginx vars 2025-12-21 22:26:24 +01:00
Clément Désiles 10f4eb5817 fix: podman connect 2025-12-21 22:25:57 +01:00
Clément Désiles c197f28013 fix: using a bridge to link podman pods to host s services 2025-12-21 22:25:11 +01:00
Clément Désiles b2a3ae6783 feat: add gitea support 2025-12-21 22:24:22 +01:00
Clément Désiles 10e58eb990 fix: podman user called by systemd 2025-12-20 23:14:26 +01:00
Clément Désiles ba94509bca feat: fix systemd user and add static-web role 2025-12-20 23:14:00 +01:00
Clément Désiles 787c171f65 feat: new services and fixes 2025-12-20 20:52:24 +01:00
Clément Désiles d8eb53f096 feat: add ntfy notification system 2025-12-15 23:09:47 +01:00
Clément Désiles 150a032988 fix: python interpreter relates to inventory 2025-12-15 22:15:34 +01:00
Clément Désiles ebeb6d5c6b feat: forward tcp traffic easily 2025-12-15 22:14:46 +01:00
Clément Désiles bd2e806aa1 fix: warning on unbound runs 2025-12-15 22:13:01 +01:00
Clément Désiles b35fbe63ee fix: unbound ad filtering 2025-12-14 00:41:32 +01:00
Clément Désiles e003f30889 doc: deploy key 2025-12-13 23:51:53 +01:00
Clément Désiles 80093037a6 chore: replace ntpd by chrony 2025-12-13 23:49:39 +01:00
Clément Désiles 93fa850f8e fix: add some tools 2025-12-09 00:31:13 +01:00
Clément Désiles 60694e0d6f fix: missing template 2025-12-09 00:30:59 +01:00
Clément Désiles 13b9723d7b fix: handlers 2025-12-09 00:30:51 +01:00
Clément Désiles dede0052e9 fix: wireguard dns resolver config 2025-12-09 00:29:42 +01:00
Clément Désiles 9b08cf95eb fix: retry to apply fw rules 2025-12-09 00:28:16 +01:00
Clément Désiles 1e7f05a29e fix: nginx log rotation 2025-11-15 00:18:49 +01:00
Clément Désiles bd4dc157b8 feat: introduce systemd config 2025-11-15 00:18:35 +01:00
Clément Désiles 667bca796e feat: rework logging and rotation rules 2025-11-15 00:18:01 +01:00
Clément Désiles 1d3af8dc45 fix: leaner readmes 2025-11-15 00:17:22 +01:00
Clément Désiles 9c10116dcb fix: apparmor config typo 2025-11-15 00:17:04 +01:00
Clément Désiles 3ab48b93a6 feat: introduce immich 2025-11-14 00:23:03 +01:00
Clément Désiles 96abbbefa2 feat: new logo 2025-11-14 00:21:56 +01:00
Clément Désiles 8b40b4d676 fix: rely on logical ansible_user instead of this whoami hack 2025-11-14 00:09:51 +01:00
Clément Désiles 26dc670949 fix: set default inventory and remote tmp 2025-11-14 00:07:57 +01:00
Clément Désiles 796fcb8b07 fix: new requirements for podman 2025-11-14 00:07:20 +01:00
Clément Désiles edf8574091 fix: zfs chown recursion high bug 2025-11-14 00:05:58 +01:00
Clément Désiles 9f3e920d7d fix: review postgres on multiple iface 2025-11-11 11:11:47 +01:00
Clément Désiles e692d4df98 feat: add valkey/redis 2025-11-11 00:02:42 +01:00
Clément Désiles e7dbe470da feat: pg with extensions and open to podmans containers 2025-11-11 00:02:15 +01:00
Clément Désiles ba37edd498 doc: add more ufw comments 2025-11-10 23:57:34 +01:00
Clément Désiles cab15e590e doc: add ufw description 2025-11-10 18:25:55 +01:00
Clément Désiles 83b6a38999 feat: add postgres support 2025-11-10 18:24:43 +01:00
Clément Désiles 2c8f49191c feat: enhance podman configuration with advances networking 2025-11-10 18:23:44 +01:00
Clément Désiles 2c421611ae chore: ansible-lint 2025-11-02 21:18:15 +01:00
Clément Désiles 2c6da106b2 fix: ssh authorized_keys fallback 2025-08-26 01:13:19 +02:00
Clément Désiles e1a1518cb8 feat: enhance sshd fallback over missing $HOME 2025-08-26 01:02:53 +02:00
Clément Désiles 117978fe52 feat: add metric support and fix net-persist issues with multiple NICs 2025-08-26 00:31:24 +02:00
Clément Désiles b5886e1a7b doc: small adjustment 2025-08-25 22:13:54 +02:00
Clément Désiles c612cc7839 chore: first commit 2025-07-25 20:23:54 +02:00
Clément Désiles 5c4016357f Initial commit 2025-07-25 20:11:17 +02:00