infra-ansible, branch HEAD

decrypt vault with split gpg

2024-09-04T19:33:31Z

commit 07d9da59d55827198be043696d97979d14cfc304 parent 78c2ec8e9c899eb57bf07d1b3e53efbb53d4e49a Author: Jul Date: Thu, 5 Sep 2024 03:33:31 +0800 decrypt vault with split gpg

move all files to main directory

2024-06-10T12:16:42Z

commit 78c2ec8e9c899eb57bf07d1b3e53efbb53d4e49a parent a4f7f2998e4382bada4b488e8fa2344881e2d841 Author: Jul Date: Mon, 10 Jun 2024 20:16:42 +0800 move all files to main directory

fix order of wireguard client rc scripts

2024-06-10T12:10:21Z

commit a4f7f2998e4382bada4b488e8fa2344881e2d841 parent e6fcd3c05687ba7cfee6d2fe4cec4f15c295885e Author: Jul Date: Mon, 10 Jun 2024 20:10:21 +0800 fix order of wireguard client rc scripts

group local tasks into ansible blocks

2024-06-01T09:30:59Z

commit e6fcd3c05687ba7cfee6d2fe4cec4f15c295885e parent 03cedf9e0c2f6a652d041a53b55201689b2ec4aa Author: Jul Date: Sat, 1 Jun 2024 17:30:59 +0800 group local tasks into ansible blocks

escalate privelege manually for local tasks

2024-06-01T09:25:16Z

commit 03cedf9e0c2f6a652d041a53b55201689b2ec4aa parent 73aa9dd75da5b1536ff8f982b365f2451a7d7658 Author: Jul Date: Sat, 1 Jun 2024 17:25:16 +0800 escalate privelege manually for local tasks

target python3 binary

2024-06-01T09:24:13Z

commit 73aa9dd75da5b1536ff8f982b365f2451a7d7658 parent aa2d65dfae2fb2c340a0157fc6f34e47e3a10f1d Author: Jul Date: Sat, 1 Jun 2024 17:24:13 +0800 target python3 binary

adjust tasks for alpine

2024-05-31T21:32:12Z

commit aa2d65dfae2fb2c340a0157fc6f34e47e3a10f1d parent 0e124ff8430f3a3aab3b2929fb417416efd9a4c2 Author: Jul Date: Sat, 1 Jun 2024 05:32:12 +0800 adjust tasks for alpine

build alpine as host os

2024-05-31T09:44:12Z

commit 0e124ff8430f3a3aab3b2929fb417416efd9a4c2 parent a01c4a9095e27adfe82a91b8fe5bc508ba1461cc Author: Jul Date: Fri, 31 May 2024 17:44:12 +0800 build alpine as host os

set up server01 local testing environment

2024-05-21T09:31:44Z

commit a01c4a9095e27adfe82a91b8fe5bc508ba1461cc parent 1734a0364217ee7b69ac0606ed5d3b6286dc9805 Author: Jul Date: Tue, 21 May 2024 17:31:44 +0800 set up server01 local testing environment

debug playbook - use 'ansible servers -m setup'

2024-05-17T15:49:34Z

commit 1734a0364217ee7b69ac0606ed5d3b6286dc9805 parent 9ca0948dfb5aa9be0f21c34d734b4c79ad48952b Author: Jul Date: Fri, 17 May 2024 23:49:34 +0800 debug playbook - use 'ansible servers -m setup'

refresh ansible facts after setup is over

2024-05-17T15:45:28Z

commit 9ca0948dfb5aa9be0f21c34d734b4c79ad48952b parent 9c5e9a193ad16b6ba2be3ef9f388c6076e27ced2 Author: Jul Date: Fri, 17 May 2024 23:45:28 +0800 refresh ansible facts after setup is over

remove k0s nftables

2024-05-17T15:42:40Z

commit 9c5e9a193ad16b6ba2be3ef9f388c6076e27ced2 parent a6e86913ac78c45a2a2e1c33c6d36a92ad55933f Author: Jul Date: Fri, 17 May 2024 23:42:40 +0800 remove k0s nftables

remove k0s

2024-05-17T15:23:15Z

commit a6e86913ac78c45a2a2e1c33c6d36a92ad55933f parent 2a1a278b2bec467140de4ba818e61f860abc6786 Author: Jul Date: Fri, 17 May 2024 23:23:15 +0800 remove k0s

move nftables to firewall role

2024-05-17T15:21:38Z

commit 2a1a278b2bec467140de4ba818e61f860abc6786 parent 11cc802885c262b983b706d9277e7949a83a9f19 Author: Jul Date: Fri, 17 May 2024 23:21:38 +0800 move nftables to firewall role

modify firewall to allow k0s/calico to work

2024-05-17T15:16:11Z

commit 11cc802885c262b983b706d9277e7949a83a9f19 parent e517423cc98a26adf8542fce064e29e1215a1edd Author: Jul Date: Fri, 17 May 2024 23:16:11 +0800 modify firewall to allow k0s/calico to work

use calico with k0s

2024-05-17T15:07:30Z

commit e517423cc98a26adf8542fce064e29e1215a1edd parent 3b88435a4655628d450090cfa4775ec6690f0d4c Author: Jul Date: Fri, 17 May 2024 23:07:30 +0800 use calico with k0s

fix client's kubeconfig server address

2024-05-17T15:05:11Z

commit 3b88435a4655628d450090cfa4775ec6690f0d4c parent 442a1ab6e0163b1b1a88b84ae0dffeae56b75541 Author: Jul Date: Fri, 17 May 2024 23:05:11 +0800 fix client's kubeconfig server address

change nameservers variable to a list

2024-05-17T15:01:51Z

commit 442a1ab6e0163b1b1a88b84ae0dffeae56b75541 parent 9a2d6b00a4ae9c63d75fe6dfa2c8fdd58883b8a3 Author: Jul Date: Fri, 17 May 2024 23:01:51 +0800 change nameservers variable to a list

reorganize site playbook for proper initialization

2024-05-17T14:59:52Z

commit 9a2d6b00a4ae9c63d75fe6dfa2c8fdd58883b8a3 parent c4ab5524094773ad7509dddf695e658e0bb28cd4 Author: Jul Date: Fri, 17 May 2024 22:59:52 +0800 reorganize site playbook for proper initialization

specify k0s storage as kine sqlite

2024-05-16T05:19:29Z

commit c4ab5524094773ad7509dddf695e658e0bb28cd4 parent 26c4d7b977e0a405a081948b3147f61538791312 Author: Jul Date: Thu, 16 May 2024 13:19:29 +0800 specify k0s storage as kine sqlite

downgrade k0s version to v1.29.4+k0s.0

2024-05-16T05:18:44Z

commit 26c4d7b977e0a405a081948b3147f61538791312 parent f4ee787cd03fdfea52af8079ed04acf5c55fcaa4 Author: Jul Date: Thu, 16 May 2024 13:18:44 +0800 downgrade k0s version to v1.29.4+k0s.0

Revert "install latest k0s stable version"

2024-05-15T19:07:44Z

commit f4ee787cd03fdfea52af8079ed04acf5c55fcaa4 parent 96fde2c3ed1b03a0fe4b79ae174e53555dd335a8 Author: Jul Date: Thu, 16 May 2024 03:07:44 +0800 Revert "install latest k0s stable version" This reverts commit 6188690605e089e06c41cd17cd2cbbd160abcb15.

change nftables table name to custom-filter

2024-05-15T19:07:04Z

commit 96fde2c3ed1b03a0fe4b79ae174e53555dd335a8 parent 15b82020df4f713e87d5708e63e3f98d62d02ee0 Author: Jul Date: Thu, 16 May 2024 03:07:04 +0800 change nftables table name to custom-filter

connect local wireguard with ip to avoid /etc/hosts

2024-05-15T13:30:37Z

commit 15b82020df4f713e87d5708e63e3f98d62d02ee0 parent b05191221bc4971c37d6d235c659968ec2be412b Author: Jul Date: Wed, 15 May 2024 21:30:37 +0800 connect local wireguard with ip to avoid /etc/hosts

remove k0s externalAddress cluster config

2024-05-15T07:35:12Z

commit b05191221bc4971c37d6d235c659968ec2be412b parent 0cc5d4e21c8d272818d23bf5bf4b94ed13f0264c Author: Jul Date: Wed, 15 May 2024 15:35:12 +0800 remove k0s externalAddress cluster config

persist /etc/hosts changes in qubes

2024-05-15T07:11:24Z

commit 0cc5d4e21c8d272818d23bf5bf4b94ed13f0264c parent 4bd7db45c385b736058065afad94c1b78ae7c6e2 Author: Jul Date: Wed, 15 May 2024 15:11:24 +0800 persist /etc/hosts changes in qubes

install latest k0s stable version

2024-05-15T06:43:24Z

commit 4bd7db45c385b736058065afad94c1b78ae7c6e2 parent 1a658b7c9d35f5aca492d333da1101c35f1fbb0a Author: Jul Date: Wed, 15 May 2024 14:43:24 +0800 install latest k0s stable version

fix and refactor k0s installation

2024-05-14T20:10:30Z

commit 1a658b7c9d35f5aca492d333da1101c35f1fbb0a parent edfd90ca32e61e1aa44a6b702649a664ffa71e5b Author: Jul Date: Wed, 15 May 2024 04:10:30 +0800 fix and refactor k0s installation

move host variables to host_vars directory

2024-05-14T16:21:25Z

commit edfd90ca32e61e1aa44a6b702649a664ffa71e5b parent 68af35b74213ef075ccebd1497f66d353e117c99 Author: Jul Date: Wed, 15 May 2024 00:21:25 +0800 move host variables to host_vars directory

move ssh user related tasks to user.yml

2024-05-14T16:04:55Z

commit 68af35b74213ef075ccebd1497f66d353e117c99 parent df4ddef72fcfac9eab353b0035ce258f2ff75f0c Author: Jul Date: Wed, 15 May 2024 00:04:55 +0800 move ssh user related tasks to user.yml

set openssh port to default 22

2024-05-14T16:03:35Z

commit df4ddef72fcfac9eab353b0035ce258f2ff75f0c parent 8271ad27ea60c4b7a9f3231f67cdc05a92e6803e Author: Jul Date: Wed, 15 May 2024 00:03:35 +0800 set openssh port to default 22

configure nftables to only allow wireguard

2024-05-14T15:53:15Z

commit 8271ad27ea60c4b7a9f3231f67cdc05a92e6803e parent a56c5ab5a720424eb46aaa6cfb148165582071e8 Author: Jul Date: Tue, 14 May 2024 23:53:15 +0800 configure nftables to only allow wireguard

remove iptables firewall

2024-05-14T08:55:34Z

commit a56c5ab5a720424eb46aaa6cfb148165582071e8 parent dcc097bab430845a58f61be57675e1729a52bb74 Author: Jul Date: Tue, 14 May 2024 16:55:34 +0800 remove iptables firewall

move user creation to openssh role

2024-05-14T08:53:56Z

commit dcc097bab430845a58f61be57675e1729a52bb74 parent 61cf3b19845267669901cf120b44d3861a4e643e Author: Jul Date: Tue, 14 May 2024 16:53:56 +0800 move user creation to openssh role

avoid ansible changes in wireguard client tasks

2024-05-14T08:41:07Z

commit 61cf3b19845267669901cf120b44d3861a4e643e parent 3e7c4cd4256bf13e5ff77b9df093f1d2ea25db2e Author: Jul Date: Tue, 14 May 2024 16:41:07 +0800 avoid ansible changes in wireguard client tasks

use wireguard systemd and set wg ip varirables

2024-05-14T08:14:03Z

commit 3e7c4cd4256bf13e5ff77b9df093f1d2ea25db2e parent bd994074ad65c8e8a073cd16d312fbc257d42532 Author: Jul Date: Tue, 14 May 2024 16:14:03 +0800 use wireguard systemd and set wg ip varirables

install wireguard on server

2024-05-13T21:15:40Z

commit bd994074ad65c8e8a073cd16d312fbc257d42532 parent bd9dad250283236058b4ad308d77d90cd88b0dc7 Author: Jul Date: Tue, 14 May 2024 05:15:40 +0800 install wireguard on server

fix errors

2024-05-13T14:07:41Z

commit bd9dad250283236058b4ad308d77d90cd88b0dc7 parent 24b90b0d472050ef82edc21f2f32901356c400a3 Author: Jul Date: Mon, 13 May 2024 22:07:41 +0800 fix errors

set servers group in inventory

2024-05-13T13:26:35Z

commit 24b90b0d472050ef82edc21f2f32901356c400a3 parent bf3efbf95a639105c4c501e07f14915f70e409d9 Author: Jul Date: Mon, 13 May 2024 21:26:35 +0800 set servers group in inventory

clean up readme instructions

2024-05-13T13:20:41Z

commit bf3efbf95a639105c4c501e07f14915f70e409d9 parent fa1641b8f166c8e214dab99772f3258cdde17bdb Author: Jul Date: Mon, 13 May 2024 21:20:41 +0800 clean up readme instructions

rename iptables role to firewall

2024-05-13T13:16:59Z

commit fa1641b8f166c8e214dab99772f3258cdde17bdb parent a26c13225a64c45287d11e32fcb6bcdd2f87ee90 Author: Jul Date: Mon, 13 May 2024 21:16:59 +0800 rename iptables role to firewall

remove fwknop

2024-05-13T13:11:08Z

commit a26c13225a64c45287d11e32fcb6bcdd2f87ee90 parent 4a671791716af395d21797a29c0209d1d447aa53 Author: Jul Date: Mon, 13 May 2024 21:11:08 +0800 remove fwknop

set apt upgrade and periodic, unattended upgrades

2024-05-13T12:23:05Z

commit 4a671791716af395d21797a29c0209d1d447aa53 parent abb509dee13ea7156e9aa04e5ea02bf6511d4df4 Author: Jul Date: Mon, 13 May 2024 20:23:05 +0800 set apt upgrade and periodic, unattended upgrades

refactor local ssh config to a file

2024-05-13T12:15:50Z

commit abb509dee13ea7156e9aa04e5ea02bf6511d4df4 parent d27b1a75ccdf502776dcaf6767df9c2e7ca50c47 Author: Jul Date: Mon, 13 May 2024 20:15:50 +0800 refactor local ssh config to a file

move user creation to setup role

2024-05-13T12:12:33Z

commit d27b1a75ccdf502776dcaf6767df9c2e7ca50c47 parent 23d1f53d8fd2402554b03843a945f98cf0f14641 Author: Jul Date: Mon, 13 May 2024 20:12:33 +0800 move user creation to setup role

set network interfaces

2024-05-13T12:10:13Z

commit 23d1f53d8fd2402554b03843a945f98cf0f14641 parent 8d0f4008e6c03146fddc8b3d10d656f8d0554dc7 Author: Jul Date: Mon, 13 May 2024 20:10:13 +0800 set network interfaces

always escalate privilege

2024-05-13T11:45:31Z

commit 8d0f4008e6c03146fddc8b3d10d656f8d0554dc7 parent af6c12824983080751ebfd3057ff86e79e1abc64 Author: Jul Date: Mon, 13 May 2024 19:45:31 +0800 always escalate privilege

temporarily set mtu in raw-setup role

2024-05-13T11:44:05Z

commit af6c12824983080751ebfd3057ff86e79e1abc64 parent 53a31dbad9e72493b56fbae20940e8dd4b9563f4 Author: Jul Date: Mon, 13 May 2024 19:44:05 +0800 temporarily set mtu in raw-setup role

change to inventory yaml

2024-05-13T11:12:54Z

commit 53a31dbad9e72493b56fbae20940e8dd4b9563f4 parent 61c50c932e051fe31340c44c9073925b888cc7b8 Author: Jul Date: Mon, 13 May 2024 19:12:54 +0800 change to inventory yaml

configure fwknop locally

2024-05-13T10:42:32Z

commit 61c50c932e051fe31340c44c9073925b888cc7b8 parent 2d9b6ec6a57d21b59a5219daac6096997455685d Author: Jul Date: Mon, 13 May 2024 18:42:32 +0800 configure fwknop locally

set local ssh config

2024-05-13T08:52:16Z

commit 2d9b6ec6a57d21b59a5219daac6096997455685d parent 524a33df52829afec92bf60dd975bb78042c1560 Author: Jul Date: Mon, 13 May 2024 16:52:16 +0800 set local ssh config

set mtu idempotently

2024-05-13T08:52:03Z

commit 524a33df52829afec92bf60dd975bb78042c1560 parent 7e290e3d3adea45b3456f9a7317e256b3e646086 Author: Jul Date: Mon, 13 May 2024 16:52:03 +0800 set mtu idempotently

readjust site playbook

2024-05-13T08:51:45Z

commit 7e290e3d3adea45b3456f9a7317e256b3e646086 parent b9d7012da19f2f0d4a33487f677a34babceba48e Author: Jul Date: Mon, 13 May 2024 16:51:45 +0800 readjust site playbook

remove local compose testing

2024-05-13T07:28:47Z

commit b9d7012da19f2f0d4a33487f677a34babceba48e parent f6ffa651f7fcec9119a8e2550d3f8dacef85e15d Author: Jul Date: Mon, 13 May 2024 15:28:47 +0800 remove local compose testing

set up server environment for ansible

2024-05-13T07:28:03Z

commit f6ffa651f7fcec9119a8e2550d3f8dacef85e15d parent c04aad42930d02e5dd31b83883645cf5aa40af3a Author: Jul Date: Mon, 13 May 2024 15:28:03 +0800 set up server environment for ansible

add docker compose for local testing

2024-05-13T05:22:38Z

commit c04aad42930d02e5dd31b83883645cf5aa40af3a parent 83c8e99de7ff9314fdbfe6dfd07a13a4fe6757ea Author: Jul Date: Mon, 13 May 2024 13:22:38 +0800 add docker compose for local testing

install k0s

2024-05-11T10:20:28Z

commit 83c8e99de7ff9314fdbfe6dfd07a13a4fe6757ea parent ade533c607f7ae9d53e1ecdc2e3749b154cbc6a8 Author: Jul Date: Sat, 11 May 2024 18:20:28 +0800 install k0s

add debug playbook

2024-05-11T07:41:27Z

commit ade533c607f7ae9d53e1ecdc2e3749b154cbc6a8 parent cc5e39b8c998f52ff0226a2f0b98e6ca7fb0be3b Author: Jul Date: Sat, 11 May 2024 15:41:27 +0800 add debug playbook

change the port for fwknop

2024-05-10T19:48:54Z

commit cc5e39b8c998f52ff0226a2f0b98e6ca7fb0be3b parent e6f1cef259c36cb4ef837c348f431b33e8315986 Author: Jul Date: Sat, 11 May 2024 03:48:54 +0800 change the port for fwknop

only allow openssh port from fwknop

2024-05-10T19:48:30Z

commit e6f1cef259c36cb4ef837c348f431b33e8315986 parent f83780984757720e7df8d359ef9c05a829c8b41f Author: Jul Date: Sat, 11 May 2024 03:48:30 +0800 only allow openssh port from fwknop

organize playbooks with iptables and fwknop

2024-05-10T17:58:45Z

commit f83780984757720e7df8d359ef9c05a829c8b41f parent ee6a3d048edc741367a1ebb220cf14fc42099fcb Author: Jul Date: Sat, 11 May 2024 01:58:45 +0800 organize playbooks with iptables and fwknop

set commonly used flags to config

2024-05-10T17:58:12Z

commit ee6a3d048edc741367a1ebb220cf14fc42099fcb parent 80327fb7140276127e3e7e41eb6cf24b2a8d2c6f Author: Jul Date: Sat, 11 May 2024 01:58:12 +0800 set commonly used flags to config

install openssh for completeness

2024-05-10T17:20:42Z

commit 80327fb7140276127e3e7e41eb6cf24b2a8d2c6f parent c97dd038001d6de51dfeb1685f2d0f17e49451a3 Author: Jul Date: Sat, 11 May 2024 01:20:42 +0800 install openssh for completeness

set vault password script in config file

2024-05-10T17:04:59Z

commit c97dd038001d6de51dfeb1685f2d0f17e49451a3 parent 894f021e58cf2fcf6616d1caf377e322de4d284d Author: Jul Date: Sat, 11 May 2024 01:04:59 +0800 set vault password script in config file

set owner for ~/.ssh directory

2024-05-10T09:51:32Z

commit 894f021e58cf2fcf6616d1caf377e322de4d284d parent 904ecbdbe70b6c69ad6b4be4cfee39187f88c66e Author: Jul Date: Fri, 10 May 2024 17:51:32 +0800 set owner for ~/.ssh directory

configure fwknop with symmetric key

2024-05-10T09:50:42Z

commit 904ecbdbe70b6c69ad6b4be4cfee39187f88c66e parent ce10fe601d88c4dda86544a5fffc96b6d51b2779 Author: Jul Date: Fri, 10 May 2024 17:50:42 +0800 configure fwknop with symmetric key

set host iptables

2024-05-10T05:40:14Z

commit ce10fe601d88c4dda86544a5fffc96b6d51b2779 parent b3d1d7f182450c3b9c4937c1fc59be6690dc3ed3 Author: Jul Date: Fri, 10 May 2024 13:40:14 +0800 set host iptables

change openssh port to 57123

2024-05-08T08:41:35Z

commit b3d1d7f182450c3b9c4937c1fc59be6690dc3ed3 parent e8c1691764b58c1bcab544c37bbdb47e7e2a9501 Author: Jul Date: Wed, 8 May 2024 16:41:35 +0800 change openssh port to 57123

hide openssh debian banner

2024-05-08T06:58:59Z

commit e8c1691764b58c1bcab544c37bbdb47e7e2a9501 parent 0c85b06976416c4bb8412b9434aadc47a01f8ebe Author: Jul Date: Wed, 8 May 2024 14:58:59 +0800 hide openssh debian banner

set hardened openssh server

2024-05-08T05:39:55Z

commit 0c85b06976416c4bb8412b9434aadc47a01f8ebe Author: Jul Date: Wed, 8 May 2024 13:39:55 +0800 set hardened openssh server