jack fccbd1a45a feat: Cloudflare DNS-01 ACME + Docker hardening + sysctl ... Cloudflare DNS-01 ACME: - Switch Traefik cert resolver from httpChallenge to dnsChallenge using Cloudflare provider (resolvers: 1.1.1.1, 1.0.0.1) - Add CLOUDFLARE_DNS_API_TOKEN env to Traefik container - Add CF_ZONE_ID + cloudflare_dns_api_token to all/main.yml - Store API token in Ansible Vault Docker daemon hardening: - Add log-driver: json-file with max-size 10m / max-file 3 (prevents disk fill from unbounded container logs) - Add live-restore: true (containers survive Docker daemon restart) Kernel hardening (sysctl): - New roles/base/tasks/sysctl.yml via ansible.posix.sysctl - IP spoofing protection (rp_filter) - Disable ICMP redirects and broadcast pings - SYN flood protection (syncookies, backlog) - Disable IPv6 (not used) - Restrict kernel pointers and dmesg to root - Disable SysRq, suid core dumps Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-03-22 04:06:46 +07:00
..
firewall.yml	feat: Cloudflare integration — real IP forwarding + firewall lockdown	2026-03-22 04:02:06 +07:00
main.yml	feat: Cloudflare DNS-01 ACME + Docker hardening + sysctl	2026-03-22 04:06:46 +07:00
packages.yml	Initial commit	2026-03-20 19:39:26 +07:00
sshd.yml	Initial commit	2026-03-20 19:39:26 +07:00
swap.yml	feat: major infrastructure improvements	2026-03-22 03:28:16 +07:00
sysctl.yml	feat: Cloudflare DNS-01 ACME + Docker hardening + sysctl	2026-03-22 04:06:46 +07:00
users.yml	Add Forgejo Actions CI/CD with act_runner	2026-03-21 21:28:15 +07:00