jack/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
infra/roles/base/tasks
History
jack e935c897c6
Some checks failed
CI/CD / syntax-check (push) Successful in 58s
Details
CI/CD / deploy (push) Failing after 43s
Details
feat: Cloudflare integration — real IP forwarding + firewall lockdown 
Traefik traefik.yml.j2:
- Add forwardedHeaders.trustedIPs with all Cloudflare CIDR ranges
  on both web and websecure entrypoints so rate limiting and
  CrowdSec see real visitor IPs, not Cloudflare proxy IPs

firewall.yml:
- Replace open HTTP/HTTPS rules with per-CIDR allow rules
  scoped to Cloudflare IP ranges only
- Direct access to ports 80/443 bypassing Cloudflare is now blocked

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-22 04:02:06 +07:00
..
firewall.yml feat: Cloudflare integration — real IP forwarding + firewall lockdown 2026-03-22 04:02:06 +07:00
main.yml feat: major infrastructure improvements 2026-03-22 03:28:16 +07:00
packages.yml Initial commit 2026-03-20 19:39:26 +07:00
sshd.yml Initial commit 2026-03-20 19:39:26 +07:00
swap.yml feat: major infrastructure improvements 2026-03-22 03:28:16 +07:00
users.yml Add Forgejo Actions CI/CD with act_runner 2026-03-21 21:28:15 +07:00