jack 5befd48a50 fix: allow Docker bridge networks through UFW for runner + add unattended-upgrades ... firewall.yml: - Allow 172.16.0.0/12 and 10.0.0.0/8 on ports 80/443 so act_runner job containers can reach git.csrx.ru (Forgejo via Traefik) - Without this, Cloudflare-only rules broke CI/CD pipeline unattended_upgrades.yml (new): - Install unattended-upgrades + apt-listchanges - Configure auto-apply of security patches only (not all updates) - Auto-clean every 7 days, remove unused deps - No auto-reboot (manual control over kernel reboots) base/tasks/main.yml: - Add unattended_upgrades.yml to task sequence Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-03-22 04:11:39 +07:00
..
firewall.yml	fix: allow Docker bridge networks through UFW for runner + add unattended-upgrades	2026-03-22 04:11:39 +07:00
main.yml	fix: allow Docker bridge networks through UFW for runner + add unattended-upgrades	2026-03-22 04:11:39 +07:00
packages.yml	Initial commit	2026-03-20 19:39:26 +07:00
sshd.yml	Initial commit	2026-03-20 19:39:26 +07:00
swap.yml	feat: major infrastructure improvements	2026-03-22 03:28:16 +07:00
sysctl.yml	feat: Cloudflare DNS-01 ACME + Docker hardening + sysctl	2026-03-22 04:06:46 +07:00
unattended_upgrades.yml	fix: allow Docker bridge networks through UFW for runner + add unattended-upgrades	2026-03-22 04:11:39 +07:00
users.yml	Add Forgejo Actions CI/CD with act_runner	2026-03-21 21:28:15 +07:00