sshd accepted passwords from the internet (about 12,000 failed logins a
day) and root logins with a key. Keys only now, no root, no X11 forwarding.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on
bookmarks. and use the OpenAI key behind it. The server also had no
automatic updates and three security updates waiting; the common role now
installs unattended-upgrades with Debian's default security-only origins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Update service count from 22+ to 25 across documentation
- Add vault.yml to gitignore for security
- Add notifications configuration for AppriseAPI integration
- Add jq package to common role dependencies
- Add hairpin networking fix for AppriseAPI chat subdomain access
- Remove diun service references from monitoring category
- Update project completion status in todo.md
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
philandClaude