home/max

Archived

No description

This repository has been archived on 2023-04-26. You can view files and clone it, but cannot push or open issues or pull requests.

Find a file

Pim Kunis b21fc40a38 traefik works		2023-04-12 16:24:01 +02:00
data	common + docker working	2023-04-12 15:43:59 +02:00
inventory	common + docker working	2023-04-12 15:43:59 +02:00
roles	traefik works	2023-04-12 16:24:01 +02:00
util	remove echo from vault password prompt	2023-02-25 18:12:17 +01:00
.gitignore	common + docker working	2023-04-12 15:43:59 +02:00
ansible.cfg	common + docker working	2023-04-12 15:43:59 +02:00
LICENSE	Create LICENSE	2022-11-13 14:52:43 +01:00
main.tf	common + docker working	2023-04-12 15:43:59 +02:00
max.yml	traefik works	2023-04-12 16:24:01 +02:00
README.md	Merge branch 'master' of ssh://git.pim.kunis.nl:56287/home/max	2023-04-11 22:41:27 +02:00

README.md

Max

This repository contains Ansible scripts to setup our main home server max. The common role executes some common OS tasks. The docker role installs Docker. The other roles are specifically for the various services we run.

Running services

All services below are running under Docker, except NSD and Borg.

Reverse proxy using Traefik
Git server using Forgejo (git.pizzapim.nl)
Static website using Jekyll (pizzapim.nl)
File sychronisation using Syncthing
Microblogging server using Mastodon (social.pizzapim.nl)
Calendar and contact synchronisation using Radicale (dav.pizzapim.nl)
KMS server using vlmcsd
Cloud file storage using Seafile
Inbucket disposable webmail, Mailinator alternative (https://inbucket.org)
Cyberchef (https://cyberchef.geokunis2.nl)
Jitsi Meet (https://meet.jit.si)
RSS feed reader using FreshRSS
Metrics using Prometheus

Virtualization

Currently this repository is ran as a physical server, but we intend to virtualize it. First, the whole server should be virtualized on a single virtual machine. After that, it will be split up into several virtual machines. The services on each virtual machine should have similar services/security properties.

Provisional split of services on virtual machines:

"public web" VM: Mastodon, static HTML server, cyberchef, jitsi meet, inbucket
"data" VM: seafile, radicale, syncthing, freshrss
"management" VM: reverse proxy, prometheus, kms
"git" VM: forgejo. Because forgejo is a somewhat single point of failure, it should have its own VM.

Possible future services

matrix
peertube?
Pixelfed?
Prometheus
Concourse CI?

TODO

Clear view of what services + which versions we are running. This way, we can track security updates better.
Host tobb website?
Move from Ubuntu to Debian
move Mastodon to pim.kunis.nl
Podman
Replace watchtower with Podman features

NSD

ZSK Rollover

Could make automatic key rollovers with cron or some other tool.

Idempotency

Currently I always resign zones. But for idempotency I should probably only do it if the zone has changed or the keys have changed.

Firewall

A little more difficult because of docker networking but probably doable.