phil/ansible
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden permissions, close exposed ports, and clean up tasks

Browse Source 
- Quote file modes. Unquoted 644/755 were read as decimal, so files
  landed as 1204. Templates holding secrets are now 0640 root:docker.
- Stop publishing Authentik 9000/9443 and Karakeep 3000 (Caddy reaches
  them over the docker network), bind dir2opds to the Tailscale IP, and
  drop Caddy's unused 8448.
- Atuin login uses no_log and only runs once; the installer only runs
  when Atuin is missing.
- Make chsh, ufw-docker install, the bat symlink and Atuin dotfiles
  idempotent.
- Back up the Paperless data volume (SQLite DB), stopping Paperless
  during the backup.
- Close public sign-up on kosync and ByteStash.
- Replace hardcoded IPs and domains with variables.
- Remove teardown tasks and templates for 9 retired services.
- Fix the dockcheck comment: it auto-updates labelled containers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Phil
2026-10-29 21:03:54 -06:00
co-authored by Claude Opus 5.5
parent dea3b29b6b
commit c0145dd5a2
65 changed files with 154 additions and 600 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dns.yml
+31 -31
View File
@@ -10,74 +10,74 @@
- name: thesatelliteoflove.com
dns_records:
- name: "home"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "git"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "social"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "auth"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "audio"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "books"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "paper"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "snippets"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: cal
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: loclog
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: watcher
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: models
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: bookmarks
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: gotify
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: gotify-assistant
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: pdg
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: opds
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: sync
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: gokapi
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: nerder.land
dns_records:
- name: "forms"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "listmonk"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "repaircafe"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "repair"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
# DNS records to remove for decommissioned services
removed_records:
- name: thesatelliteoflove.com
dns_records:
- name: "pin"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "code"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "phlog"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "tasks"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "post"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "files"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "kanboard"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
- name: "grocy"
ip: "152.53.36.98"
ip: "{{ network.netcup_ip }}"
tasks:
- name: Remove A records for decommissioned services