PhilandClaude Opus 5.5
a08402f0ac
Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on bookmarks. and use the OpenAI key behind it. The server also had no automatic updates and three security updates waiting; the common role now installs unattended-upgrades with Debian's default security-only origins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 lines
442 B
Markdown
16 lines
442 B
Markdown
# Common Role
|
|
|
|
Base setup applied first by `site.yml` (tag `common`).
|
|
|
|
## What it does
|
|
- Installs `aptitude` and `jq`.
|
|
- Installs `unattended-upgrades` and turns on daily security updates
|
|
(Debian security archive only, no automatic reboots).
|
|
- Makes sure UFW is enabled with default deny. The SSH rule comes from the
|
|
bootstrap role, and container rules from `ufw-docker` in the docker role.
|
|
|
|
## Usage
|
|
```bash
|
|
bin/deploy --tags common
|
|
```
|