phil/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Close Karakeep signups and turn on unattended security updates

Browse Source 
Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on
bookmarks. and use the OpenAI key behind it. The server also had no
automatic updates and three security updates waiting; the common role now
installs unattended-upgrades with Debian's default security-only origins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Phil
2026-10-31 11:47:45 -06:00
co-authored by Claude Opus 5.5
parent 0c14ee5b1d
commit a08402f0ac
4 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/common/README.md
+2
View File
@@ -4,6 +4,8 @@ Base setup applied first by `site.yml` (tag `common`).
## What it does
- Installs `aptitude` and `jq`.
- Installs `unattended-upgrades` and turns on daily security updates
(Debian security archive only, no automatic reboots).
- Makes sure UFW is enabled with default deny. The SSH rule comes from the
bootstrap role, and container rules from `ufw-docker` in the docker role.