mates
1af4127820
Firewall (UFW) neni pozadovan:
- smazana cela role roles/firewall/
- odstraneny reference z prepare-new-server.yml
- pridana poznamka v group_vars/all.yml.example
- doporuceni: firewall resit externe (Cloudflare Tunnel, security group)
Base packages - pridany chybejici utility:
+ btop (system monitor - lepsi nez htop)
+ mc (Midnight Commander - textovy file manager)
+ tree (struktura adresaru v terminalu)
Ponechany: curl, wget, git, vim, htop, ca-certificates, gnupg,
lsb-release, apt-transport-https, bash-completion,
software-properties-common, unzip, zip, rsync, net-tools
79 lines
2.0 KiB
Plaintext
79 lines
2.0 KiB
Plaintext
---
|
|
# Spolecne promenne pro vsechny playbooky
|
|
# Zkopiruj na group_vars/all.yml a dopln
|
|
|
|
# ============================================
|
|
# DEPLOY USER (UID 1000)
|
|
# ============================================
|
|
deploy_user: deploy
|
|
deploy_uid: 1000
|
|
deploy_groups:
|
|
- docker
|
|
- sudo
|
|
- adm
|
|
- systemd-journal
|
|
|
|
# Verejne SSH klice pro deploy uzivatele
|
|
# Pridej sve klice (verejnou cast z `cat ~/.ssh/id_ed25519.pub`)
|
|
deploy_ssh_public_keys:
|
|
- "ssh-ed25519 AAAAC3Nz... hermes@mac" # <-- nahrad svym klicem
|
|
|
|
# ============================================
|
|
# DOCKER
|
|
# ============================================
|
|
docker_compose_version: "v2.27.0"
|
|
docker_daemon_config:
|
|
log-driver: json-file
|
|
log-opts:
|
|
max-size: "10m"
|
|
max-file: "3"
|
|
storage-driver: overlay2
|
|
live-restore: true
|
|
userland-proxy: false
|
|
|
|
# Sluzby k nasazeni (seznam nazvu adresaru v docker-services/)
|
|
services_to_deploy:
|
|
- portainer
|
|
- nginx-proxy-manager
|
|
- vaultwarden
|
|
- gitea
|
|
- jotty
|
|
- nextcloud-aio
|
|
- rustdesk
|
|
- audiobookshelf
|
|
- calibre-web
|
|
- plex
|
|
- erugo
|
|
- jswiki
|
|
- speedtest
|
|
- watchtower
|
|
|
|
# ============================================
|
|
# NETWORK / FIREWALL
|
|
# ============================================
|
|
# POZNAMKA: firewall (UFW) se nenastavuje automaticky.
|
|
# Pokud chces firewall, nastav ho rucne (Cloudflare Tunnel,
|
|
# security group na VPS, docker-network oddeleni, ...).
|
|
# Tato promenna zustava pro pripadnou budouci konfiguraci.
|
|
ssh_port: 22
|
|
allowed_ports:
|
|
- { port: 22, proto: tcp, comment: "SSH" }
|
|
- { port: 80, proto: tcp, comment: "HTTP" }
|
|
- { port: 443, proto: tcp, comment: "HTTPS" }
|
|
|
|
# ============================================
|
|
# SECURITY (fail2ban)
|
|
# ============================================
|
|
fail2ban_maxretry: 5
|
|
fail2ban_bantime: 3600
|
|
|
|
# ============================================
|
|
# SLUZBY (credentials po prvnim spusteni)
|
|
# ============================================
|
|
npm_default_email: admin@example.com
|
|
npm_default_password: changeme
|
|
|
|
gitea_admin_user: admin
|
|
gitea_admin_password: changeme
|
|
gitea_admin_email: admin@example.com
|