Adyrem
7ba749c620
Ansible Lint / lint (push) Successful in 4s
Proxmox host role: - Admin user setup, SSH hardening (port 2222, no root login) - claude-code SFTP chroot user - Unattended upgrades, DuckDNS dynamic DNS updater (vault-encrypted token) - WireGuard VPN server (10.10.10.0/24) with Fedora client registered - Proxmox firewall management via pvesh API (idempotent Python script) Public Gitea exposure: - Traefik: add HTTPS entrypoint, Let's Encrypt ACME (HTTP-01), StripPrefix middleware for /git subpath, HTTP→HTTPS redirect - Gitea ROOT_URL updated to https://adyrem.duckdns.org/git/ - Pi-hole split DNS: adyrem.duckdns.org → 10.10.1.3 for internal hairpin bypass SSH config fixes: - StrictHostKeyChecking no → accept-new across all hosts - Proxmox jump host: port 2222, user adyrem (root login disabled) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
16 lines
555 B
Django/Jinja
16 lines
555 B
Django/Jinja
# Managed by Ansible — do not edit manually
|
|
[Interface]
|
|
Address = 10.10.10.1/24
|
|
ListenPort = {{ wireguard_port }}
|
|
PrivateKey = {{ wg_server_private_key }}
|
|
PostUp = iptables -I FORWARD -i %i -j ACCEPT; iptables -I FORWARD -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
{% for peer in wireguard_peers %}
|
|
[Peer]
|
|
# {{ peer.name }}
|
|
PublicKey = {{ peer.public_key }}
|
|
AllowedIPs = {{ peer.allowed_ips }}
|
|
|
|
{% endfor %}
|