2 Commits

Author	SHA1	Message	Date
Adyrem	30b2d42fcc	Enforce firewall=0 on vmbr2 VMs to prevent NAT breakage ... When a VM has firewall=1, Proxmox inserts a fwbr bridge and iptables POSTROUTING fires at the bridge step (OUT=fwbrNNNi0) rather than at vmbr0. The MASQUERADE rule (-o vmbr0) never matches, so the VM loses internet access. Adds an idempotent task to the proxmox_host role that strips firewall=1 from VM 105's net0 config whenever the playbook runs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-18 11:39:08 +02:00
Adyrem	7ba749c620	Add Proxmox host role, WireGuard VPN, and public Gitea via Traefik HTTPS ... Proxmox host role: - Admin user setup, SSH hardening (port 2222, no root login) - claude-code SFTP chroot user - Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token) - WireGuard VPN server (10.10.10.0/24) with Fedora client registered - Proxmox firewall management via pvesh API (idempotent Python script) Public Gitea exposure: - Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix middleware for /git subpath, HTTP→HTTPS redirect - Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/ - Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass SSH config fixes: - StrictHostKeyChecking no → accept-new across all hosts - Proxmox jump host: port 2222, user adyrem (root login disabled) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-16 04:06:56 +02:00