Sergei Poljanski
27ccdc4255
The roles had drifted far from production: Forgejo was pinned at 12 while 15.0.11 runs, its config lacked the mailer, packages and the real database path, and several services existed only on the hosts. Running a role would have rolled production back. Take the servers as the truth and make the repository match them. site.yaml now holds the desired state of both hosts: - base: unattended upgrades, fail2ban, Docker daemon config and the weekly image prune, as found on the hosts. New: a 500M journal cap, and the Docker systemd override is kept absent. That override once opened dockerd on tcp/2375 without authentication. - traefik: templates as deployed, version in a variable (v3.7.18). The Coraza WAF files are removed; no router ever used them. - forgejo: 15.0.11, app.ini generated from the live file with the secrets taken from the vault. - crawler_alert, sillytavern, minecraft, minecraft_fossils: added from the hosts. Forgejo's canonical name becomes git.asxp.io; git.czsk.it stays as an alias on the same router. docker_service restarts a stack when its config changes, no longer forces ownership on existing data directories, and hides template diffs because they carry secrets. Containers listed in service_graceful_stop are saved and stopped with a long timeout before compose recreates them: Docker's 10 s default is too short for a Minecraft world. Both game servers get stop_grace_period for the same reason. Removed: the full-deployment and runner playbooks with their prompts, the Forgejo backup and restore roles for the old bare-metal host, and inventory entries for services that were never deployed. SSH hardening stays a manual playbook, since a mistake there locks everyone out. New secrets (SMTP, RCON, CurseForge key) went into the vault. Assisted-by: Claude:fable-5-2
52 lines
1 KiB
Django/Jinja
52 lines
1 KiB
Django/Jinja
# Traefik Static Configuration
|
|
|
|
# API and Dashboard
|
|
api:
|
|
dashboard: true
|
|
insecure: true # Dashboard accessible on :8080 without auth (restricted by network)
|
|
|
|
# Entry Points
|
|
entryPoints:
|
|
web:
|
|
address: ":80"
|
|
http:
|
|
redirections:
|
|
entryPoint:
|
|
to: websecure
|
|
scheme: https
|
|
websecure:
|
|
address: ":443"
|
|
|
|
# Docker Provider
|
|
providers:
|
|
docker:
|
|
endpoint: "unix:///var/run/docker.sock"
|
|
exposedByDefault: false
|
|
network: {{ traefik_network }}
|
|
file:
|
|
directory: /config
|
|
watch: true
|
|
|
|
# Let's Encrypt Certificate Resolver
|
|
certificatesResolvers:
|
|
letsencrypt:
|
|
acme:
|
|
email: {{ letsencrypt_email | default('admin@asxp.io') }}
|
|
storage: /letsencrypt/acme.json
|
|
httpChallenge:
|
|
entryPoint: web
|
|
|
|
# Logging
|
|
log:
|
|
level: INFO
|
|
filePath: /var/log/traefik/traefik.log
|
|
|
|
accessLog:
|
|
filePath: /var/log/traefik/access.log
|
|
bufferingSize: 100
|
|
fields:
|
|
headers:
|
|
defaultMode: drop
|
|
names:
|
|
User-Agent: keep
|
|
Referer: keep
|