Files

T

PhilandClaude Opus 5.5 a08402f0ac Close Karakeep signups and turn on unattended security updates

Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on
bookmarks. and use the OpenAI key behind it. The server also had no
automatic updates and three security updates waiting; the common role now
installs unattended-upgrades with Debian's default security-only origins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-31 11:47:45 -06:00

442 B

Raw Blame History

Common Role

Base setup applied first by site.yml (tag common).

What it does

Installs aptitude and jq.
Installs unattended-upgrades and turns on daily security updates (Debian security archive only, no automatic reboots).
Makes sure UFW is enabled with default deny. The SSH rule comes from the bootstrap role, and container rules from ufw-docker in the docker role.

Usage

bin/deploy --tags common

442 B Raw Blame History

Common Role

What it does

Usage

442 B

Raw Blame History