aboutsummaryrefslogtreecommitdiffstats
path: root/kubernetes/namespaces (unfollow)
Commit message (Collapse)AuthorLines
2024-05-04Perform fail2ban bans directly via nftablesGravatar Johannes Christ-0/+2
See upstream at https://github.com/fail2ban/fail2ban/commit/d0d07285234871bad3dc0c359d0ec03365b6dddc, this will be incorporated into Debian at the next release.
2024-05-04Skip tasks requiring all hosts when running with limitGravatar Johannes Christ-0/+2
2024-05-04Configure default security limitsGravatar Johannes Christ-0/+15
The new limits allow each user to run a maximum of 100 processes by default, allowing to manually raise this number to 200. When a custom "pydis" group or similar is introduced, I plan to expand this to also specify other limits to prevent user error from causing problems on the system.
2024-05-04set backend to systemdGravatar shtlrs-0/+1
2024-05-04Set up Prometheus alerting on NetcupGravatar Johannes Christ-2/+18
2024-05-03Set up database group for database hostsGravatar Johannes Christ-3/+9
2024-05-03Remove old groups from Vagrant inventoryGravatar Johannes Christ-30/+0
These groups are no longer present in our proper inventory as we no longer plan on selfhosting Kubernetes on the netcup nodes.
2024-05-01Harden SSH security and prevent some misconfigurationsGravatar Johannes Christ-8/+45
Disable agent forwarding and X11 forwarding in the default configuration. Users can still forward this if they really want to by installing a custom forwarder and utilizing their shell access to spawn it, but with this, we're making it impossible for people to accidentally forward their agent or their X socket to the remote server. Additionally, change the SSH configuration such that only the Python Discord users are allowed to log in.
2024-05-01Depend on ansible-core instead of AnsibleGravatar Johannes Christ-22/+83
Allow for faster local installation by only installing what we need.
2024-05-01ignore pycharm's idea filesGravatar shtlrs-0/+1
2024-05-01update the readme file to be more user friendlyGravatar shtlrs-14/+51
2024-05-01Install dependencies using poetryGravatar shtlrs-8/+14
2024-05-01bump the debian version usedGravatar shtlrs-4/+3
This also explicitly specifies the sync type to rsync
2024-04-29Stop alerting for slow GitHub webhook filter endpoint calls (#235)Gravatar jchristgit-2/+2
These are directly forwarded to GitHub with no time-consuming processing done on the site. We would therefore be alerting for GitHub's slowness, which is rather useless.
2024-04-29Whitelist possible LKE addresses to PostgreSQL on lovelaceGravatar Johannes Christ-8/+26
This allows us to connect to PostgreSQL on lovelace from any possible LKE node location, whilst not opening up our PostgreSQL instances to the world. This has already been rolled out.