PhilandClaude Opus 5.5
a08402f0ac
Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on bookmarks. and use the OpenAI key behind it. The server also had no automatic updates and three security updates waiting; the common role now installs unattended-upgrades with Debian's default security-only origins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
28 lines
711 B
YAML
28 lines
711 B
YAML
- name: Install common packages
|
|
apt:
|
|
name:
|
|
- aptitude
|
|
- jq
|
|
state: latest
|
|
update_cache: true
|
|
|
|
- name: UFW - Enable and deny by default
|
|
community.general.ufw:
|
|
state: enabled
|
|
default: deny
|
|
# Security updates install themselves each day (Debian's default origins:
|
|
# the -security archive only). No automatic reboots.
|
|
- name: Install unattended-upgrades
|
|
ansible.builtin.apt:
|
|
name: unattended-upgrades
|
|
state: present
|
|
|
|
- name: Turn on daily unattended upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
owner: root
|
|
mode: '0644'
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|