Files

T

PhilandClaude Opus 5.5 750d4dacad Record the Debian 13 upgrade and turn off the VSOCK SSH generator

The server now runs Debian 13.7. systemd 257's ssh generator logs a
harmless AF_VSOCK error on netcup VMs, so the common role masks it.
The plan file now records how the upgrade went and what's left.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-31 19:07:31 -06:00

handlers

Turn off SSH password and root login

2026-10-31 12:17:45 -06:00

tasks

Record the Debian 13 upgrade and turn off the VSOCK SSH generator

2026-10-31 19:07:31 -06:00

README.md

Turn off SSH password and root login

2026-10-31 12:17:45 -06:00

README.md

Common Role

Base setup applied first by site.yml (tag common).

What it does

Installs aptitude and jq.
Installs unattended-upgrades and turns on daily security updates (Debian security archive only, no automatic reboots).
SSH: keys only, no root login, no X11 forwarding (/etc/ssh/sshd_config.d/10-hardening.conf, reloads ssh when changed).
Makes sure UFW is enabled with default deny. The SSH rule comes from the bootstrap role, and container rules from ufw-docker in the docker role.

Usage

bin/deploy --tags common