Sergei Poljanski
5e009c4a47
All checks were successful
deploy / ansible (push) Successful in 7m22s
The ejabberd certificate (asxp.io, conference., xmpp.) was issued by hand and expires 2027-01-28 with nothing renewing it. Traefik now obtains it alongside the sites' certificates, through a router that only exists to request it, and a systemd path unit on ops pushes it to services whenever acme.json changes, with a daily run as fallback. The push uses its own SSH key, accepted from ops' VPC address only and forced to xmpp-cert-install, which checks the certificate is valid for another day and matches its key before replacing server.pem and reloading ejabberd. Two alerts: the sync hasn't succeeded for two days, or ejabberd serves an older certificate than Traefik holds for six hours. The existing expiry alert already covers port 5223. Assisted-by: Claude:opus-5-5 |
||
|---|---|---|
| .. | ||
| acme_forward | ||
| base | ||
| crawler_alert | ||
| docker_service | ||
| forgejo | ||
| forgejo_runner | ||
| forgejo_runner_interop | ||
| minecraft | ||
| monitoring | ||
| monitoring_agent | ||
| restic_backup | ||
| s3_replicate | ||
| s3fs | ||
| sillytavern | ||
| ssh_hardening | ||
| swap | ||
| traefik | ||
| wireguard | ||
| xmpp | ||
| xmpp_cert_sync | ||
| xray | ||