Clément Désiles 40cc0efcf8 fix(fail2ban): use ProtectSystem=full so ufw can create its lock file ...

strict makes /run read-only, which blocks ufw's /run/ufw.lock and
cannot be whitelisted via ReadWritePaths (the file does not exist).
full still protects /usr and /etc while leaving /run and /var writable,
so only /etc/ufw needs an explicit write path.

2026-09-05 16:28:55 +02:00

..

archlinux

security: always restore sudoers after makepkg, drop dead paru block

2026-08-18 21:52:49 +02:00

backup

feat(backup): add restic backup role with encrypted incremental snapshots

2026-09-01 22:20:27 +02:00

dhcpd

fix: restart dhcpd on nas restart

2026-05-29 21:29:14 +02:00

disks

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

docker

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

fail2ban

fix(fail2ban): use ProtectSystem=full so ufw can create its lock file

2026-09-05 16:28:55 +02:00

fdroid

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

gitea

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

immich

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

matrix/templates

fix(podman): use Type=notify + service-container so systemd sees pod crashes

2026-05-29 21:49:13 +02:00

metabase

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

monitoring/tasks

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

net_config

feat(net_config): support IPForward and IPMasquerade in network config

2026-06-19 23:55:02 +02:00

net_persist

fix: secure pg + fix old way of sharing podman network

2026-05-29 21:31:07 +02:00

networking

fix: secure pg + fix old way of sharing podman network

2026-05-29 21:31:07 +02:00

nfs_server

refactor: hoist OS-specific package names to role defaults

2026-05-30 21:57:20 +02:00

nginx

fix(nginx): prevent cert leak on IPv6 / unknown SNI

2026-05-30 17:06:10 +02:00

ntfy

feat(backup): add restic backup role with encrypted incremental snapshots

2026-09-01 22:20:27 +02:00

ntp_chrony

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

nut

feat(nut): report outage duration and battery % in ntfy

2026-06-29 23:50:48 +02:00

nut_exporter

Add support for NUT (EATON inverter)

2026-06-13 09:37:49 +02:00

podman

fix(podman): restore newuidmap/newgidmap file caps for rootless namespaces

2026-08-23 22:03:31 +02:00

postgres

fix: secure pg + fix old way of sharing podman network

2026-05-29 21:31:07 +02:00

qfieldcloud/templates

fix(podman): use Type=notify + service-container so systemd sees pod crashes

2026-05-29 21:49:13 +02:00

samba_server

feat(samba_server): new role for SMB/CIFS shares

2026-05-30 21:57:13 +02:00

sshd

fix(sshd): move login banner to zsh .zprofile

2026-08-25 22:58:03 +02:00

static_web

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

syncthing

feat: add syncthing support

2026-06-03 23:28:26 +02:00

sys_autoupdate

feat: sys autoupdate

2026-05-08 23:47:21 +02:00

systemd

feat: introduce systemd config

2025-11-15 00:18:35 +01:00

tooling

fix: add unzip to tooling role

2026-08-26 00:16:33 +02:00

unbound

feat: BREAKING unbound configuration

2026-03-17 23:08:44 +01:00

unifi

refactor: drop shared-service meta dependencies from service roles

2026-07-04 00:15:50 +02:00

uptime_kuma

feat(backup): add restic backup role with encrypted incremental snapshots

2026-09-01 22:20:27 +02:00

valkey

chore: ansible-lint review (almost done)

2026-01-04 11:21:15 +01:00

wireguard

fix(wireguard): reload tunnel via syncconf on config change

2026-08-27 10:14:23 +02:00

zfs

security: always restore sudoers after makepkg, drop dead paru block

2026-08-18 21:52:49 +02:00

zsh

doc: minor alias to help me switch to podman

2026-08-26 00:16:09 +02:00