Clément Désiles 120615c38f fix(fail2ban): start under ProtectSystem=strict hardening ...

- log to journald via fail2ban.local (logtarget is a fail2ban.conf option,
  not jail.local) so the server can start without /var/log write access
- create the socket dir via RuntimeDirectory=fail2ban instead of a
  non-creating ReadWritePaths entry
- add ufw write paths so bans persist under the read-only namespace
- manage override.conf unconditionally and restart on change

2026-09-05 16:21:49 +02:00

..

archlinux

security: always restore sudoers after makepkg, drop dead paru block

2026-08-18 21:52:49 +02:00

backup

feat(backup): add restic backup role with encrypted incremental snapshots

2026-09-01 22:20:27 +02:00

dhcpd

fix: restart dhcpd on nas restart

2026-05-29 21:29:14 +02:00

disks

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

docker

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

fail2ban

fix(fail2ban): start under ProtectSystem=strict hardening

2026-09-05 16:21:49 +02:00

fdroid

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

gitea

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

immich

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

matrix/templates

fix(podman): use Type=notify + service-container so systemd sees pod crashes

2026-05-29 21:49:13 +02:00

metabase

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

monitoring/tasks

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

net_config

feat(net_config): support IPForward and IPMasquerade in network config

2026-06-19 23:55:02 +02:00

net_persist

fix: secure pg + fix old way of sharing podman network

2026-05-29 21:31:07 +02:00

networking

fix: secure pg + fix old way of sharing podman network

2026-05-29 21:31:07 +02:00

nfs_server

refactor: hoist OS-specific package names to role defaults

2026-05-30 21:57:20 +02:00

nginx

fix(nginx): prevent cert leak on IPv6 / unknown SNI

2026-05-30 17:06:10 +02:00

ntfy

feat(backup): add restic backup role with encrypted incremental snapshots

2026-09-01 22:20:27 +02:00

ntp_chrony

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

nut

feat(nut): report outage duration and battery % in ntfy

2026-06-29 23:50:48 +02:00

nut_exporter

Add support for NUT (EATON inverter)

2026-06-13 09:37:49 +02:00

podman

fix(podman): restore newuidmap/newgidmap file caps for rootless namespaces

2026-08-23 22:03:31 +02:00

postgres

fix: secure pg + fix old way of sharing podman network

2026-05-29 21:31:07 +02:00

qfieldcloud/templates

fix(podman): use Type=notify + service-container so systemd sees pod crashes

2026-05-29 21:49:13 +02:00

samba_server

feat(samba_server): new role for SMB/CIFS shares

2026-05-30 21:57:13 +02:00

sshd

fix(sshd): move login banner to zsh .zprofile

2026-08-25 22:58:03 +02:00

static_web

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

syncthing

feat: add syncthing support

2026-06-03 23:28:26 +02:00

sys_autoupdate

feat: sys autoupdate

2026-05-08 23:47:21 +02:00

systemd

feat: introduce systemd config

2025-11-15 00:18:35 +01:00

tooling

fix: add unzip to tooling role

2026-08-26 00:16:33 +02:00

unbound

feat: BREAKING unbound configuration

2026-03-17 23:08:44 +01:00

unifi

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

uptime_kuma

feat(backup): add restic backup role with encrypted incremental snapshots

2026-09-01 22:20:27 +02:00

valkey

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

wireguard

fix(wireguard): reload tunnel via syncconf on config change

2026-08-27 10:14:23 +02:00

zfs

security: always restore sudoers after makepkg, drop dead paru block

2026-08-18 21:52:49 +02:00

zsh

doc: minor alias to help me switch to podman

2026-08-26 00:16:09 +02:00