jack
aa9706bbc4
Traefik: - Enable access logs → /var/log/traefik/access.log (needed for CrowdSec) - Add global security headers middleware: HSTS, X-Frame-Options, CSP, nosniff, XSS filter, referrer policy, permissions policy - Add rate limiting: default 100/s, API 30/s, admin 10/s (strict) - Add Authelia ForwardAuth middleware for SSO integration CrowdSec (new service): - Analyzes Traefik access logs + auth.log in real time - Community IP reputation blocklist (crowdsecurity/traefik + http-cve) - Firewall bouncer: bans malicious IPs at kernel level (iptables) Authelia (new service, auth.csrx.ru): - 2FA/SSO portal with TOTP (Google Authenticator) - Protects: traefik.csrx.ru, sync.csrx.ru, /god-mode/ in Plane - Session: 12h expiry, 30m inactivity, Redis backend - argon2id password hashing Container security: - Add security_opt: no-new-privileges to traefik, vaultwarden, forgejo, grafana, authelia CI/CD security: - Remove hardcoded server IP 87.249.49.32 from workflow - Use SSH_KNOWN_HOSTS secret instead of ssh-keyscan (prevents MITM) - Added SSH_KNOWN_HOSTS secret to Forgejo Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
52 lines
1.5 KiB
YAML
52 lines
1.5 KiB
YAML
name: CI/CD
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
branches: [master]
|
|
|
|
jobs:
|
|
syntax-check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install ansible
|
|
run: pip3 install ansible --quiet --break-system-packages
|
|
|
|
- name: Write vault password
|
|
run: |
|
|
echo "${{ secrets.VAULT_PASSWORD }}" > ~/.vault-password-file
|
|
chmod 600 ~/.vault-password-file
|
|
|
|
- name: Syntax check
|
|
run: ansible-playbook playbooks/deploy.yml --syntax-check -i inventory/
|
|
|
|
deploy:
|
|
needs: syntax-check
|
|
if: github.ref == 'refs/heads/master' && github.event_name == 'push'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
pip3 install ansible --quiet --break-system-packages
|
|
ansible-galaxy collection install ansible.posix community.general community.docker
|
|
|
|
- name: Configure SSH
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
printf '%s' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
printf '%s' "${{ secrets.SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts
|
|
chmod 600 ~/.ssh/known_hosts
|
|
|
|
- name: Write vault password
|
|
run: |
|
|
echo "${{ secrets.VAULT_PASSWORD }}" > ~/.vault-password-file
|
|
chmod 600 ~/.vault-password-file
|
|
|
|
- name: Deploy
|
|
run: ansible-playbook playbooks/deploy.yml -i inventory/
|