 Adyrem
|
7ba749c620
|
Add Proxmox host role, WireGuard VPN, and public Gitea via Traefik HTTPS
Ansible Lint / lint (push) Successful in 4s
Proxmox host role:
- Admin user setup, SSH hardening (port 2222, no root login)
- claude-code SFTP chroot user
- Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token)
- WireGuard VPN server (10.10.10.0/24) with Fedora client registered
- Proxmox firewall management via pvesh API (idempotent Python script)
Public Gitea exposure:
- Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix
middleware for /git subpath, HTTP→HTTPS redirect
- Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/
- Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass
SSH config fixes:
- StrictHostKeyChecking no → accept-new across all hosts
- Proxmox jump host: port 2222, user adyrem (root login disabled)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-16 04:06:56 +02:00 |
|
|
Adyrem
|
62e5027d24
|
Add Proxmox firewall configs and Grafana dashboards
- proxmox/firewall/host.fw: host firewall rules (SSH/Proxmox UI/SPICE
from LAN, DNS from internal subnets, ICMP)
- proxmox/firewall/cluster.fw: cluster firewall with network aliases
- files/grafana-dashboards/node-exporter-full.json: Node Exporter Full
(grafana.com/dashboards/1860)
- files/grafana-dashboards/loki-logs.json: Logs/App dashboard for Loki
(grafana.com/dashboards/13639)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-05-15 18:35:36 +02:00 |
|