Files

T

PhilandClaude Opus 5.5 0c14ee5b1d Bring the docs up to date with the running stack

The READMEs, CLAUDE.md and todo.md still described Authentik, services
removed long ago (Ghost, MMDL, Postiz, Pinchflat...) and two servers. Now
they list the 24 services actually deployed (checked against docker ps),
explain that netcup and docker-01 are one machine, document Gondulf,
StarPunk, Listmonk, Gokapi and dockcheck, and use bin/deploy throughout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-31 11:30:50 -06:00

tasks

initial commit

2024-08-13 20:18:11 -06:00

README.md

Bring the docs up to date with the running stack

2026-10-31 11:30:50 -06:00

README.md

Bootstrap Role

First-time setup for a fresh Debian/Ubuntu server. Run once, against the server's public IP (inventory group bootstrap, host netcup), before site.yml can reach it over Tailscale.

What it does

Installs aptitude, curl, vim, git and ufw.
Gives the sudo group passwordless sudo.
Creates the user created_username (set to phil in bootstrap.yml) in the sudo group, with your local ~/.ssh/id_ed25519.pub as its SSH key.
Sets PermitRootLogin prohibit-password (root can still log in with a key).
UFW: allows OpenSSH, enables the firewall with default deny.

bootstrap.yml then runs the artis3n.tailscale role to join the tailnet, using vault_infrastructure.tailscale_key from the vault.

Requirements

ansible-galaxy install -r requirements.yml (for artis3n.tailscale).
~/.ssh/id_ed25519.pub on the machine running Ansible.
Root (or another sudo user) SSH access to the new server.

Usage

.venv/bin/ansible-playbook bootstrap.yml -i hosts.yml --vault-password-file vault_pass

Once the server is on Tailscale, put its Tailscale IP in hosts.yml under docker and use bin/deploy from then on.