infra/roles/base/tasks/main.yml at fccbd1a45aa1ee497f8c457c1df673357838420d - jack/infra - Forgejo: Beyond coding. We Forge.

jack/infra

jack fccbd1a45a

CI/CD / syntax-check (push) Successful in 42s

Details

CI/CD / deploy (push) Failing after 52s

Details

feat: Cloudflare DNS-01 ACME + Docker hardening + sysctl

Cloudflare DNS-01 ACME:
- Switch Traefik cert resolver from httpChallenge to dnsChallenge
  using Cloudflare provider (resolvers: 1.1.1.1, 1.0.0.1)
- Add CLOUDFLARE_DNS_API_TOKEN env to Traefik container
- Add CF_ZONE_ID + cloudflare_dns_api_token to all/main.yml
- Store API token in Ansible Vault

Docker daemon hardening:
- Add log-driver: json-file with max-size 10m / max-file 3
  (prevents disk fill from unbounded container logs)
- Add live-restore: true (containers survive Docker daemon restart)

Kernel hardening (sysctl):
- New roles/base/tasks/sysctl.yml via ansible.posix.sysctl
- IP spoofing protection (rp_filter)
- Disable ICMP redirects and broadcast pings
- SYN flood protection (syncookies, backlog)
- Disable IPv6 (not used)
- Restrict kernel pointers and dmesg to root
- Disable SysRq, suid core dumps

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-22 04:06:46 +07:00

7 lines

165 B

YAML

Raw Blame History

 ---
 - import_tasks: packages.yml
 - import_tasks: swap.yml
 - import_tasks: sysctl.yml
 - import_tasks: users.yml
 - import_tasks: sshd.yml
 - import_tasks: firewall.yml