Sergei Poljanski
5e009c4a47
All checks were successful
deploy / ansible (push) Successful in 7m22s
The ejabberd certificate (asxp.io, conference., xmpp.) was issued by hand and expires 2027-01-28 with nothing renewing it. Traefik now obtains it alongside the sites' certificates, through a router that only exists to request it, and a systemd path unit on ops pushes it to services whenever acme.json changes, with a daily run as fallback. The push uses its own SSH key, accepted from ops' VPC address only and forced to xmpp-cert-install, which checks the certificate is valid for another day and matches its key before replacing server.pem and reloading ejabberd. Two alerts: the sync hasn't succeeded for two days, or ejabberd serves an older certificate than Traefik holds for six hours. The existing expiry alert already covers port 5223. Assisted-by: Claude:opus-5-5 |
||
|---|---|---|
| .. | ||
| alert-rules.yaml.j2 | ||
| alerting.yaml.j2 | ||
| blackbox.yml.j2 | ||
| dashboards.yaml.j2 | ||
| datasources.yaml.j2 | ||
| docker-compose.yml.j2 | ||
| grafana.env.j2 | ||
| loki.env.j2 | ||
| loki.yml.j2 | ||
| prometheus.yml.j2 | ||