jack
5befd48a50
firewall.yml: - Allow 172.16.0.0/12 and 10.0.0.0/8 on ports 80/443 so act_runner job containers can reach git.csrx.ru (Forgejo via Traefik) - Without this, Cloudflare-only rules broke CI/CD pipeline unattended_upgrades.yml (new): - Install unattended-upgrades + apt-listchanges - Configure auto-apply of security patches only (not all updates) - Auto-clean every 7 days, remove unused deps - No auto-reboot (manual control over kernel reboots) base/tasks/main.yml: - Add unattended_upgrades.yml to task sequence Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| backup | ||
| base | ||
| docker | ||
| services | ||