fix(crowdsec): update whitelist.yaml to prevent false positive from nextcloud chunk

ansible/inventory/group_vars/all.yaml

@@ -66,7 +66,7 @@ services:
   grafana:
     domain: "grafana"
     ports:
-      http: "3000" # Infra server: Internal ports
+      http: "3000"
     subuid: "100471"
   caddy:
     ports:
@@ -97,7 +97,7 @@ services:
       public: "gitea"
       internal: "gitea.app"
     ports:
-      http: "3000" # App server: Public ports
+      http: "3000"
     subuid: "100999"
   immich:
     domain:
@@ -111,8 +111,8 @@ services:
       http: "3003"
   actualbudget:
     domain:
-      public: "actualbudget"
+      public: "budget"
-      internal: "actualbudget.app"
+      internal: "budget.app"
     ports:
       http: "5006"
     subuid: "101000"
@@ -156,28 +156,6 @@ services:
       http: "8002"
       redis: "6382"
     subuid: "100032"
-  collabora:
-    domain:
-      public: "collabora"
-      internal: "collabora.app"
-    ports:
-      http: "9980"
-    subuid: "101000"
-  ezbookkeeping:
-    domain:
-      public: "budget"
-      internal: "budget.app"
-    ports:
-      http: "8003"
-    subuid: "100999"
-  sure:
-    domain:
-      public: "sure"
-      internal: "sure.app"
-    ports:
-      http: "3001"
-      redis: "6383"
-    subuid: "100999"
 
 version:
   packages:
@@ -185,17 +163,17 @@ version:
     step: "0.30.2"
     kopia: "0.22.3"
     blocky: "0.29.0"
-    alloy: "1.16.1"
+    alloy: "1.13.0"
   containers:
     # common
     caddy: "2.11.2"
     # infra
     step: "0.30.2"
-    ldap: "v0.6.3"
+    ldap: "v0.6.2"
-    x509-exporter: "4.1.0"
+    x509-exporter: "3.21.0"
-    prometheus: "v3.11.3"
+    prometheus: "v3.9.1"
-    loki: "3.7.1"
+    loki: "3.6.5"
-    grafana: "13.0.1"
+    grafana: "12.3.3"
     ## Postgresql
     postgresql: "18.2"
     # For immich - https://github.com/immich-app/base-images/blob/main/postgres/versions.yaml
@@ -215,6 +193,3 @@ version:
     manticore: "25.0.0"
     affine: "0.26.3"
     nextcloud: "33.0.3"
-    collabora: "25.04.9.4.1"
-    ezbookkeeping: "1.4.0"
-    sure: "0.7.0-hotfix.2"

ansible/playbooks/app/site.yaml

@@ -233,29 +233,6 @@
           tags: ["site", "nextcloud"]
       tags: ["site", "nextcloud"]
 
-    - name: Set collabora
-      ansible.builtin.include_role:
-        name: "app"
-        tasks_from: "services/set_collabora"
-        apply:
-          tags: ["site", "collabora"]
-      tags: ["site", "collabora"]
-
-    - name: Set ezbookkeeping
-      ansible.builtin.include_role:
-        name: "app"
-        tasks_from: "services/set_ezbookkeeping"
-        apply:
-          tags: ["site", "ezbookkeeping"]
-      tags: ["site", "ezbookkeeping"]
-
-    - name: Set sure
-      ansible.builtin.include_role:
-        name: "app"
-        tasks_from: "services/set_sure"
-        apply:
-          tags: ["site", "sure"]
-      tags: ["site", "sure"]
 
     - name: Flush handlers right now
       ansible.builtin.meta: "flush_handlers"

ansible/playbooks/console/site.yaml

@@ -122,11 +122,3 @@
         apply:
           tags: ["init", "site", "tools"]
       tags: ["init", "site", "tools"]
-
-    - name: Set kopia
-      ansible.builtin.include_role:
-        name: "common"
-        tasks_from: "services/set_kopia"
-        apply:
-          tags: ["init", "site", "kopia"]
-      tags: ["init", "site", "kopia"]

ansible/roles/app/handlers/main.yaml

@@ -111,39 +111,3 @@
   changed_when: false
   listen: "notification_restart_nextcloud"
   ignore_errors: true # noqa: ignore-errors
-
-- name: Restart collabora
-  ansible.builtin.systemd:
-    name: "collabora.service"
-    state: "restarted"
-    enabled: true
-    scope: "user"
-    daemon_reload: true
-  changed_when: false
-  listen: "notification_restart_collabora"
-  ignore_errors: true # noqa: ignore-errors
-
-- name: Restart ezbookkeeping
-  ansible.builtin.systemd:
-    name: "ezbookkeeping.service"
-    state: "restarted"
-    enabled: true
-    scope: "user"
-    daemon_reload: true
-  changed_when: false
-  listen: "notification_restart_ezbookkeeping"
-  ignore_errors: true # noqa: ignore-errors
-
-- name: Restart sure
-  ansible.builtin.systemd:
-    name: "{{ item }}"
-    state: "restarted"
-    enabled: true
-    scope: "user"
-    daemon_reload: true
-  loop:
-    - "sure-web.service"
-    - "sure-worker.service"
-  changed_when: false
-  listen: "notification_restart_sure"
-  ignore_errors: true # noqa: ignore-errors

ansible/roles/app/tasks/node/set_raid.yaml

@@ -68,23 +68,3 @@
     group: "svadmins"
     mode: "0770"
   become: true
-
-- name: Deploy btrfs scrub service and timer
-  ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/app/btrfs/{{ item }}.j2"
-    dest: "/etc/systemd/system/{{ item }}"
-    owner: "root"
-    group: "root"
-    mode: "0644"
-  loop:
-    - "btrfs-scrub.service"
-    - "btrfs-scrub.timer"
-  become: true
-
-- name: Enable auto btrfs scrub
-  ansible.builtin.systemd:
-    name: "btrfs-scrub.timer"
-    state: "started"
-    enabled: true
-    daemon_reload: true
-  become: true

ansible/roles/app/tasks/services/set_collabora.yaml

@@ -1,17 +0,0 @@
----
-- name: Deploy container file
-  ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/collabora/collabora.container.j2"
-    dest: "{{ node['home_path'] }}/.config/containers/systemd/collabora.container"
-    owner: "{{ ansible_user }}"
-    group: "svadmins"
-    mode: "0644"
-  notify: "notification_restart_collabora"
-
-- name: Enable collabora.service
-  ansible.builtin.systemd:
-    name: "collabora.service"
-    state: "started"
-    enabled: true
-    daemon_reload: true
-    scope: "user"

ansible/roles/app/tasks/services/set_ezbookkeeping.yaml

@@ -1,58 +0,0 @@
----
-- name: Create ezbookkeeping directory
-  ansible.builtin.file:
-    path: "{{ node['home_path'] }}/{{ item }}"
-    state: "directory"
-    owner: "{{ services['ezbookkeeping']['subuid'] }}"
-    group: "svadmins"
-    mode: "0770"
-  loop:
-    - "data/containers/ezbookkeeping"
-    - "data/containers/ezbookkeeping/data"
-    - "containers/ezbookkeeping"
-    - "containers/ezbookkeeping/ssl"
-  become: true
-
-
-- name: Deploy root certificate
-  ansible.builtin.copy:
-    content: |
-      {{ hostvars['console']['ca']['root']['crt'] }}
-    dest: "{{ node['home_path'] }}/containers/ezbookkeeping/ssl/{{ root_cert_filename }}"
-    owner: "{{ services['ezbookkeeping']['subuid'] }}"
-    group: "svadmins"
-    mode: "0440"
-  become: true
-  notify: "notification_restart_ezbookkeeping"
-  no_log: true
-
-- name: Register secret value to podman secret
-  containers.podman.podman_secret:
-    name: "{{ item.name }}"
-    data: "{{ item.value }}"
-    state: "present"
-    force: true
-  loop:
-    - name: "EBK_AUTH_OAUTH2_CLIENT_SECRET"
-      value: "{{ hostvars['console']['ezbookkeeping']['oidc']['secret'] }}"
-    - name: "EBK_DATABASE_PASSWD"
-      value: "{{ hostvars['console']['postgresql']['password']['ezbookkeeping'] }}"
-  notify: "notification_restart_ezbookkeeping"
-  no_log: true
-
-- name: Deploy ezbookkeeping.container file
-  ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/ezbookkeeping/ezbookkeeping.container.j2"
-    dest: "{{ node['home_path'] }}/.config/containers/systemd/ezbookkeeping.container"
-    owner: "{{ ansible_user }}"
-    group: "svadmins"
-    mode: "0644"
-  notify: "notification_restart_ezbookkeeping"
-
-- name: Enable ezbookkeeping.service
-  ansible.builtin.systemd:
-    name: "ezbookkeeping.service"
-    state: "started"
-    enabled: true
-    daemon_reload: true
-    scope: "user"

ansible/roles/app/tasks/services/set_sure.yaml

@@ -1,110 +0,0 @@
----
-- name: Set redis service name
-  ansible.builtin.set_fact:
-    redis_service: "sure"
-
-- name: Create redis_sure directory
-  ansible.builtin.file:
-    path: "{{ node['home_path'] }}/{{ item }}"
-    state: "directory"
-    owner: "{{ services['redis']['subuid'] }}"
-    group: "svadmins"
-    mode: "0770"
-  loop:
-    - "containers/redis"
-    - "containers/redis/{{ redis_service }}"
-    - "containers/redis/{{ redis_service }}/data"
-  become: true
-
-- name: Deploy redis config file
-  ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.conf.j2"
-    dest: "{{ node['home_path'] }}/containers/redis/{{ redis_service }}/redis.conf"
-    owner: "{{ ansible_user }}"
-    group: "svadmins"
-    mode: "0644"
-  register: "is_redis_conf"
-
-- name: Deploy redis container file
-  ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/redis/redis.container.j2"
-    dest: "{{ node['home_path'] }}/.config/containers/systemd/redis_{{ redis_service }}.container"
-    owner: "{{ ansible_user }}"
-    group: "svadmins"
-    mode: "0644"
-  register: "is_redis_containerfile"
-
-- name: Enable (Restart) redis service
-  ansible.builtin.systemd:
-    name: "redis_{{ redis_service }}.service"
-    state: "restarted"
-    enabled: true
-    daemon_reload: true
-    scope: "user"
-  when: is_redis_conf.changed or is_redis_containerfile.changed # noqa: no-handler
-
-- name: Create sure directory
-  ansible.builtin.file:
-    path: "{{ node['home_path'] }}/{{ item }}"
-    state: "directory"
-    owner: "{{ services['sure']['subuid'] }}"
-    group: "svadmins"
-    mode: "0770"
-  loop:
-    - "data/containers/sure"
-    - "data/containers/sure/storage"
-    - "containers/sure"
-    - "containers/sure/ssl"
-  become: true
-
-
-- name: Deploy root certificate
-  ansible.builtin.copy:
-    content: |
-      {{ hostvars['console']['ca']['root']['crt'] }}
-    dest: "{{ node['home_path'] }}/containers/sure/ssl/{{ root_cert_filename }}"
-    owner: "{{ services['paperless']['subuid'] }}"
-    group: "svadmins"
-    mode: "0440"
-  become: true
-  notify: "notification_restart_sure"
-  no_log: true
-
-- name: Register secret value to podman secret
-  containers.podman.podman_secret:
-    name: "{{ item.name }}"
-    data: "{{ item.value }}"
-    state: "present"
-    force: true
-  loop:
-    - name: "SURE_SECRET_KEY_BASE"
-      value: "{{ hostvars['console']['sure']['session_secret'] }}"
-    - name: "SURE_POSTGRES_PASSWORD"
-      value: "{{ hostvars['console']['postgresql']['password']['sure'] }}"
-    - name: "SURE_OIDC_CLIENT_SECRET"
-      value: "{{ hostvars['console']['sure']['oidc']['secret'] }}"
-  notify: "notification_restart_sure"
-  no_log: true
-
-- name: Deploy sure.container file
-  ansible.builtin.template:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/app/sure/{{ item }}.j2"
-    dest: "{{ node['home_path'] }}/.config/containers/systemd/{{ item }}"
-    owner: "{{ ansible_user }}"
-    group: "svadmins"
-    mode: "0644"
-  loop:
-    - "sure-web.container"
-    - "sure-worker.container"
-  notify: "notification_restart_sure"
-
-- name: Enable paperless.service
-  ansible.builtin.systemd:
-    name: "{{ item }}"
-    state: "started"
-    enabled: true
-    daemon_reload: true
-    scope: "user"
-  loop:
-    - "sure-web.service"
-    - "sure-worker.service"

ansible/roles/common/tasks/services/set_alloy.yaml

@@ -5,10 +5,9 @@
       - hardware
   become: true
 
-- name: Download alloy deb file (x86_64)
+- name: Deploy alloy deb file (x86_64)
-  ansible.builtin.get_url:
+  ansible.builtin.copy:
-    url: "https://github.com/grafana/alloy/releases/download/v{{ version['packages']['alloy'] }}/\
+    src: "{{ hostvars['console']['node']['data_path'] }}/bin/alloy-{{ version['packages']['alloy'] }}-amd64.deb"
-      alloy-{{ version['packages']['alloy'] }}-1.amd64.deb"
     dest: "/var/cache/apt/archives/alloy-{{ version['packages']['alloy'] }}.deb"
     owner: "root"
     group: "root"
@@ -16,10 +15,9 @@
   become: true
   when: ansible_facts['architecture'] == "x86_64"
 
-- name: Download alloy deb file (aarch64)
+- name: Deploy alloy deb file (aarch64)
-  ansible.builtin.get_url:
+  ansible.builtin.copy:
-    url: "https://github.com/grafana/alloy/releases/download/v{{ version['packages']['alloy'] }}/\
+    src: "{{ hostvars['console']['node']['data_path'] }}/bin/alloy-{{ version['packages']['alloy'] }}-arm64.deb"
-      alloy-{{ version['packages']['alloy'] }}-1.arm64.deb"
     dest: "/var/cache/apt/archives/alloy-{{ version['packages']['alloy'] }}.deb"
     owner: "root"
     group: "root"
@@ -32,7 +30,6 @@
     deb: "/var/cache/apt/archives/alloy-{{ version['packages']['alloy'] }}.deb"
     state: "present"
   become: true
-  notify: "notification_restart_alloy"
 
 - name: Deploy alloy config
   ansible.builtin.template:

ansible/roles/common/tasks/services/set_crowdsec.yaml

@@ -36,15 +36,10 @@
   ansible.builtin.set_fact:
     acquisd_list:
       fw:
-        collection:
+        collection: "crowdsecurity/suricata"
-          - "crowdsecurity/suricata"
-        parser: []
         config: "suricata.yaml"
       auth:
-        collection:
+        collection: "crowdsecurity/caddy"
-          - "crowdsecurity/caddy"
-        parser:
-          - "crowdsecurity/nextcloud-whitelist"
         config: "caddy.yaml"
 
 - name: Deploy crowdsec-update service files
@@ -186,8 +181,7 @@
   block:
     - name: Install crowdsec collection
       ansible.builtin.command:
-        cmd: "cscli collections install {{ item }}"
+        cmd: "cscli collections install {{ acquisd_list[node['name']]['collection'] }}"
-      loop: "{{ acquisd_list[node['name']]['collection'] }}"
       become: true
       changed_when: "'overwrite' not in is_collection_installed.stderr"
       failed_when:
@@ -195,17 +189,6 @@
         - "'already installed' not in is_collection_installed.stderr"
       register: "is_collection_installed"
 
-    - name: Install crowdsec parser
-      ansible.builtin.command:
-        cmd: "cscli parsers install {{ item }}"
-      loop: "{{ acquisd_list[node['name']]['parser'] }}"
-      become: true
-      changed_when: "'overwrite' not in is_parser_installed.stderr"
-      failed_when:
-        - is_parser_installed.rc != 0
-        - "'already installed' not in is_parser_installed.stderr"
-      register: "is_parser_installed"
-
     - name: Create crowdsec acquis.d directory
       ansible.builtin.file:
         path: "/etc/crowdsec/acquis.d"

ansible/roles/common/tasks/services/set_kopia.yaml

@@ -5,36 +5,34 @@
       - hardware
   become: true
 
+- name: Check kopia installation
+  ansible.builtin.shell: |
+    command -v kopia
+  changed_when: false
+  failed_when: false
+  register: "is_kopia_installed"
+  ignore_errors: true
+
 - name: Set console kopia
   when: node['name'] == 'console'
   block:
-    - name: Download kopia
+    - name: Apply cli tools (x86_64)
-      ansible.builtin.get_url:
-        url: "https://github.com/kopia/kopia/releases/download/v{{ version['packages']['kopia'] }}/\
-          kopia_{{ version['packages']['kopia'] }}_linux_{{ item }}.deb"
-        dest: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-{{ item }}.deb"
-        owner: "{{ ansible_user }}"
-        group: "svadmins"
-        mode: "0600"
-      loop:
-        - "amd64"
-        - "arm64"
-
-    - name: Install kopia (x86_64)
       ansible.builtin.apt:
         deb: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-amd64.deb"
         state: "present"
       become: true
-      when: ansible_facts['architecture'] == "x86_64"
+      when:
-
+        - ansible_facts['architecture'] == "x86_64"
-    - name: Install kopia (aarch64)
+        - is_kopia_installed.rc != 0
+    - name: Apply cli tools (aarch64)
       ansible.builtin.apt:
         deb: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-arm64.deb"
         state: "present"
       become: true
-      when: ansible_facts['architecture'] == "aarch64"
+      when:
-
+        - ansible_facts['architecture'] == "aarch64"
-    - name: Connect console kopia server
+        - is_kopia_installed.rc != 0
+    - name: Connect kopia server
       environment:
         KOPIA_PASSWORD: "{{ hostvars['console']['kopia']['user']['console'] }}"
       ansible.builtin.shell: |
@@ -53,36 +51,30 @@
     - name: Set kopia uid
       ansible.builtin.set_fact:
         kopia_uid: 951
-
+    - name: Deploy kopia deb file (x86_64)
-    - name: Download kopia deb file (x86_64)
+      ansible.builtin.copy:
-      ansible.builtin.get_url:
+        src: "{{ hostvars['console']['node']['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-amd64.deb"
-        url: "https://github.com/kopia/kopia/releases/download/v{{ version['packages']['kopia'] }}/\
-          kopia_{{ version['packages']['kopia'] }}_linux_amd64.deb"
         dest: "/var/cache/apt/archives/kopia-{{ version['packages']['kopia'] }}.deb"
         owner: "root"
         group: "root"
         mode: "0644"
       become: true
       when: ansible_facts['architecture'] == "x86_64"
-
+    - name: Deploy kopia deb file (aarch64)
-    - name: Download kopia deb file (aarch64)
+      ansible.builtin.copy:
-      ansible.builtin.get_url:
+        src: "{{ hostvars['console']['node']['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-arm64.deb"
-        url: "https://github.com/kopia/kopia/releases/download/v{{ version['packages']['kopia'] }}/\
-          kopia_{{ version['packages']['kopia'] }}_linux_arm64.deb"
         dest: "/var/cache/apt/archives/kopia-{{ version['packages']['kopia'] }}.deb"
         owner: "root"
         group: "root"
         mode: "0644"
       become: true
       when: ansible_facts['architecture'] == "aarch64"
-
     - name: Create kopia group
       ansible.builtin.group:
         name: "kopia"
         gid: "{{ kopia_uid }}"
         state: "present"
       become: true
-
     - name: Create kopia user
       ansible.builtin.user:
         name: "kopia"
@@ -93,7 +85,6 @@
         comment: "Kopia backup User"
         state: "present"
       become: true
-
     - name: Create kopia directory
       ansible.builtin.file:
         path: "{{ item.name }}"
@@ -110,13 +101,12 @@
           mode: "0700"
       become: true
       no_log: true
-
     - name: Install kopia
       ansible.builtin.apt:
         deb: "/var/cache/apt/archives/kopia-{{ version['packages']['kopia'] }}.deb"
         state: "present"
       become: true
-
+      when: is_kopia_installed.rc != 0
     - name: Deploy kopia env
       ansible.builtin.template:
         src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/common/kopia/kopia.env.j2"
@@ -126,7 +116,6 @@
         mode: "0400"
       become: true
       no_log: true
-
     - name: Deploy kopia service files
       ansible.builtin.template:
         src: "{{ hostvars['console']['node']['config_path'] }}/services/systemd/common/kopia/{{ item }}.j2"
@@ -139,7 +128,6 @@
         - "kopia-backup.service"
         - "kopia-backup.timer"
       become: true
-
     - name: Enable auto kopia rules update
       ansible.builtin.systemd:
         name: "kopia-backup.timer"

ansible/roles/console/tasks/services/set_cli_tools.yaml

@@ -49,6 +49,42 @@
     - "amd64"
     - "arm64"
 
+- name: Download kopia
+  ansible.builtin.get_url:
+    url: "https://github.com/kopia/kopia/releases/download/v{{ version['packages']['kopia'] }}/\
+      kopia_{{ version['packages']['kopia'] }}_linux_{{ item }}.deb"
+    dest: "{{ node['data_path'] }}/bin/kopia-{{ version['packages']['kopia'] }}-{{ item }}.deb"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0600"
+  loop:
+    - "amd64"
+    - "arm64"
+
+- name: Download blocky
+  ansible.builtin.get_url:
+    url: "https://github.com/0xERR0R/blocky/releases/download/v{{ version['packages']['blocky'] }}/\
+      blocky_v{{ version['packages']['blocky'] }}_Linux_{{ item }}.tar.gz"
+    dest: "{{ node['data_path'] }}/bin/blocky-{{ version['packages']['blocky'] }}-{{ item }}.tar.gz"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0600"
+  loop:
+    - "x86_64"
+    - "arm64"
+
+- name: Download alloy
+  ansible.builtin.get_url:
+    url: "https://github.com/grafana/alloy/releases/download/v{{ version['packages']['alloy'] }}/\
+      alloy-{{ version['packages']['alloy'] }}-1.{{ item }}.deb"
+    dest: "{{ node['data_path'] }}/bin/alloy-{{ version['packages']['alloy'] }}-{{ item }}.deb"
+    owner: "{{ ansible_user }}"
+    group: "svadmins"
+    mode: "0600"
+  loop:
+    - "amd64"
+    - "arm64"
+
 - name: Apply cli tools (x86_64)
   ansible.builtin.apt:
     deb: "{{ node['data_path'] }}/bin/{{ item }}"
@@ -56,6 +92,7 @@
   loop:
     - "sops-{{ version['packages']['sops'] }}-amd64.deb"
     - "step-{{ version['packages']['step'] }}-amd64.deb"
+    - "kopia-{{ version['packages']['kopia'] }}-amd64.deb"
   become: true
   when: ansible_facts['architecture'] == "x86_64"
 
@@ -66,5 +103,6 @@
   loop:
     - "sops-{{ version['packages']['sops'] }}-arm64.deb"
     - "step-{{ version['packages']['step'] }}-arm64.deb"
+    - "kopia-{{ version['packages']['kopia'] }}-arm64.deb"
   become: true
   when: ansible_facts['architecture'] == "aarch64"

ansible/roles/fw/tasks/services/set_blocky.yaml

@@ -23,7 +23,7 @@
     state: "present"
   become: true
 
-- name: Create blocky directory
+- name: Create blocky etc directory
   ansible.builtin.file:
     path: "{{ item }}"
     owner: "blocky"
@@ -31,38 +31,13 @@
     mode: "0750"
     state: "directory"
   loop:
-    - "/home/blocky"
-    - "/home/blocky/bin"
     - "/etc/blocky"
     - "/etc/blocky/ssl"
   become: true
 
-- name: Download blocky (x86_64)
-  ansible.builtin.get_url:
-    url: "https://github.com/0xERR0R/blocky/releases/download/v{{ version['packages']['blocky'] }}/\
-      blocky_v{{ version['packages']['blocky'] }}_Linux_x86_64.tar.gz"
-    dest: "/home/blocky/bin/blocky-{{ version['packages']['blocky'] }}-x86_64.tar.gz"
-    owner: "blocky"
-    group: "blocky"
-    mode: "0600"
-  become: true
-  when: ansible_facts['architecture'] == "x86_64"
-
-- name: Download blocky (aarch64)
-  ansible.builtin.get_url:
-    url: "https://github.com/0xERR0R/blocky/releases/download/v{{ version['packages']['blocky'] }}/\
-      blocky_v{{ version['packages']['blocky'] }}_Linux_arm64.tar.gz"
-    dest: "/home/blocky/bin/blocky-{{ version['packages']['blocky'] }}-arm64.tar.gz"
-    owner: "blocky"
-    group: "blocky"
-    mode: "0600"
-  become: true
-  when: ansible_facts['architecture'] == "aarch64"
-
 - name: Deploy blocky binary file (x86_64)
   ansible.builtin.unarchive:
-    src: "/home/blocky/bin/blocky-{{ version['packages']['blocky'] }}-x86_64.tar.gz"
+    src: "{{ hostvars['console']['node']['data_path'] }}/bin/blocky-{{ version['packages']['blocky'] }}-x86_64.tar.gz"
-    remote_src: true
     dest: "/usr/local/bin/"
     owner: "root"
     group: "root"
@@ -77,8 +52,7 @@
 
 - name: Deploy blocky binary file (aarch64)
   ansible.builtin.unarchive:
-    src: "/home/blocky/bin/blocky-{{ version['packages']['blocky'] }}-arm64.tar.gz"
+    src: "{{ hostvars['console']['node']['data_path'] }}/bin/blocky-{{ version['packages']['blocky'] }}-arm64.tar.gz"
-    remote_src: true
     dest: "/usr/local/bin/"
     owner: "root"
     group: "root"

ansible/roles/infra/tasks/services/set_postgresql.yaml

@@ -12,8 +12,6 @@
       - "vikunja"
       - "affine"
       - "nextcloud"
-      - "ezbookkeeping"
-      - "sure"
 
 - name: Create postgresql directory
   ansible.builtin.file:

ansible/roles/infra/tasks/services/set_x509-exporter.yaml

@@ -8,20 +8,9 @@
     mode: "0770"
   loop:
     - "x509-exporter"
-    - "x509-exporter/config"
     - "x509-exporter/certs"
   become: true
 
-- name: Deploy config.yaml
-  ansible.builtin.copy:
-    src: "{{ hostvars['console']['node']['config_path'] }}/services/containers/infra/x509-exporter/config/config.yaml"
-    dest: "{{ node['home_path'] }}/containers/x509-exporter/config/config.yaml"
-    owner: "{{ services['x509-exporter']['subuid'] }}"
-    group: "svadmins"
-    mode: "0440"
-  become: true
-  no_log: true
-
 - name: Deploy certificates
   ansible.builtin.copy:
     content: |

config/node/fw/nftables.conf.j2

@@ -82,8 +82,6 @@ table inet filter {
         chain global {
                 # invalid packets
                 ct state invalid drop comment "deny invalid connection"
-                # VPN connection exception handling
-                udp dport $PORTS_VPN return comment "return vpn connection to input and forward chain"
                 # crowdsec
                 ip saddr @crowdsec-blacklists counter drop comment "deny all crowdsec blacklist"
                 ip6 saddr @crowdsec6-blacklists counter drop comment "deny all ipv6 crowdsec blacklist"

config/secrets/secrets.yaml

@@ -120,8 +120,6 @@ postgresql:
         vikunja: ENC[AES256_GCM,data:/+wQdoFPTBG2elI9kZbAVWrHZ0DhMaYr4dc+2z9QNdb3TcDS2PEia0JuSAg=,iv:MViZTyUD8YqMmxSTWCQpJ30f/KQdQGOzPlRHHsQ8lAw=,tag:zov3POno139dkMxFDpj2gg==,type:str]
         affine: ENC[AES256_GCM,data:XPXrcszsV06YqCJZ7CDqc4rCwqqNlbtLCFYfLAQ8jamLtft8L2UVrMA4WZo=,iv:vrWdBeckxB9tmEE628j4jhU+hSpE6TXYMGt0hh1Cg84=,tag:hlWwWUGht8NqWTZREMsa1Q==,type:str]
         nextcloud: ENC[AES256_GCM,data:ROsximNuWYMTZktmLJPx7W1Qol/uT+APgwoCtFO/6ZYYc3KxKvlk344eqEc=,iv:4d+MrfIHjJKAcwhvZ3g4go66uZcieuL7lngKErJd+fg=,tag:QbWOtxeCbiu62GyrE2atXg==,type:str]
-        ezbookkeeping: ENC[AES256_GCM,data:CYYQ5DVr8Na46QduvUNF6d0XBVSXTml34q3/PhIYIvUNviOVgCjqXA4wN7g=,iv:qRljohJ+wI50XxSgMElKp65HyV3mKRTqDGjw9C1S0d0=,tag:PClp7PRmC0+PV0SzZpJqqQ==,type:str]
-        sure: ENC[AES256_GCM,data:FULJ2gjJ2gZC3s324itW+CjGRBHIP9RnOqw5TT1UaiUhb7UHAPm1na+LsZk=,iv:c0GnVZkxprJUzPPq3TCQaZvAes9QQuvDXqgVLLaiQIg=,tag:uDxy/Lkd2hNK4AWwMNMslw==,type:str]
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
@@ -268,23 +266,6 @@ nextcloud:
 #ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
 #
 #
-#ENC[AES256_GCM,data:tMahvC9OLW4+AGLyx68SNsOPBezApw==,iv:WHx8ruuQ33J/8XtwyhvDy2cKqE7lAWvj/r5AUhdyssU=,tag:uRwheXUxqNSIhcPqGeMNog==,type:comment]
-ezbookkeeping:
-    oidc:
-        secret: ENC[AES256_GCM,data:ZMIfRwXDT1ujGKoc7DGvc8/O+ciB+kajo9yOwVsMsbEjl6D8gl6I0Lbsta8=,iv:++p1TTW6gDUEvh56SjMgldrpob/VWNtiYGo6wNS8cz0=,tag:LQaW333UskiN4mtIjUAguA==,type:str]
-        hash: ENC[AES256_GCM,data:XyB1N3MUzBHWHAumat7/ASy/Aja/gLKmeTriOqLnMgZ9lBE1birYtFW+R0wZ+vyx79tHKVnRxzrWsxoD5jitCmHyMVrJmJKl5c4SYMhytKfBPgrNe3twcc06U+wONmgAuVpaEQlnnyzAz42SpOHbT55GegHjYzT5hXax8eRvdM6xJSY=,iv:R4+EdQuKo2JumY3cu8KPpeFezcLhlehXBxr2wVG5wHk=,tag:hpDX1x9NCCutUsnDKEf1Sg==,type:str]
-#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
-#
-#
-#ENC[AES256_GCM,data:Fsqc2JDp9dvfgiCjdQ==,iv:3DALKKEXaP8hzXRvxD4CgfFpOiPPsOa16OB94n8WKp8=,tag:K+FF3zGrc0YLXWK/R2L3Ow==,type:comment]
-sure:
-    session_secret: ENC[AES256_GCM,data:InHsz/jld8E9TwI8MWpxk9x2I7dxlIsY9R6jtDK2pBA=,iv:HY5yXEC2Dce26e9/vXTIWELvVd9ZjhcCwFD0jhz5pPw=,tag:LLSJovZ0RH3CUK+se7R4Ag==,type:str]
-    oidc:
-        secret: ENC[AES256_GCM,data:9BSvpcU9BJctSN9bkPIAsRxg8JNHTWvOKdpJFhm//CUDm/Xc7oC/ANHf5no=,iv:JVQLl/rp65kZSK/4SpVXxtiac3Z35XNkxWm2+lEdq/c=,tag:WgfaORiNlrO+wHSdnl4CWQ==,type:str]
-        hash: ENC[AES256_GCM,data:EjJ+1fP7/9wG2jG0Jv2hxMLtErqxjHBstRjru79dd5ZXhqwT7S+jpLfl9WpZU9qi20ps9YP4qe7G08p6NJNXjYhQj852GQxEORRh/9StAZsPt3p8w+ePZSVbivPQH+FpPKWYxoH0VR7y3TnL66R0tKRLh1fNTc5jRy5rU5r1bfs1jZ0=,iv:0y9FxW4QdD7qHz3bPRWlwHFpvOsvlYhVrOItB6BzaE8=,tag:Wc7MZhP3QRYmvZcjpoEWtQ==,type:str]
-#ENC[AES256_GCM,data:ODXFUxxxdQ==,iv:s9zJVx6wo6x517tbNvC+FZ0dFzqbjqeLI6rXBq72hQA=,tag:bXoV2I3LbpmQyddJrtS3Qg==,type:comment]
-#
-#
 #ENC[AES256_GCM,data:T4Wtn49AAxPd2QUFTR+q,iv:bH5goGWBDqumAat9dUv2OwfCUJUpuVqncTMqMBZUXhI=,tag:G+W6hHA+yftQ+4RJpXrxHg==,type:comment]
 switch:
     password: ENC[AES256_GCM,data:qu0f9L7A0eFq/UCpaRs=,iv:W8LLOp3MSfd/+EfNEZNf91K8GgI5eUfVPoWTRES2C0Y=,tag:Q5FlAOfwqwJwPvd7k6i+0g==,type:str]
@@ -314,7 +295,7 @@ sops:
             UmliaFNxVTBqRkI1QWJpWGpTRWxETW8KEY/8AfU73UOzCGhny1cNnd5dCNv7bHXt
             k+uyWPPi+enFkVaceSwMFrA66uaWWrwAj11sXEB7yzvGFPrnAGezjQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-06T07:38:04Z"
+    lastmodified: "2026-05-02T04:55:25Z"
-    mac: ENC[AES256_GCM,data:5Q9oN/oun7x1q7L4HWWM52V0YDPyoADBZICdgDwLPWqgpXabz5Z49xvKt+NLXwsC+5q3VK27Y9NS2ZWOXJJGE2uQ7XWYh08r4yA9wHXpq0LcBdhPeV3R1aVG8zVtsyV760ctqJnmfThM18lVgnVahJAQDmg6VPYMd/UV5cFbtAw=,iv:99S9Qt7BdvDCKLgEdUqcWI2M2dxzpN5koxe6W9asrpg=,tag:cEOceyMhocPKS1Wyhhoe4A==,type:str]
+    mac: ENC[AES256_GCM,data:4U/SGYS9eNRgRvUEvZh9E0JSctkZzSpdoUYEAbnOVyU+5u8NcG9lbMUAB4kFXb9kHVGBUI5wMwnzg102g96q1IYw5m/k4lrpePceGVNAxxKpWTnkLROhJlL3Z/Bylgq2mj7PVDcGCGEB0xPDgN+ffa7ldCxIikYmSKktISguwYU=,iv:zqS9iJ54FIaNQhnfOl4YY9QcaZLbPekTxlY1AEp3m/s=,tag:TckIRAKRVyxf/UD+jejNng==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.12.1

config/services/containers/app/collabora/collabora.container.j2

@@ -1,25 +0,0 @@
-[Quadlet]
-DefaultDependencies=false
-
-[Unit]
-Description=Collabora Online
-
-[Container]
-Image=docker.io/collabora/code:{{ version['containers']['collabora'] }}
-ContainerName=collabora
-HostName=collabora
-
-PublishPort={{ services['collabora']['ports']['http'] }}:9980/tcp
-
-Environment="TZ=Asia/Seoul"
-Environment="aliasgroup1=https://{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}"
-# Environment="aliasgroup2=other_server_FQDN"
-Environment="extra_params=--o:ssl.enable=false --o:ssl.termination=true --o:server_name={{ services['collabora']['domain']['public'] }}.{{ domain['public'] }} --o:admin_console.enable=false"
-
-[Service]
-Restart=always
-RestartSec=10s
-TimeoutStopSec=120
-
-[Install]
-WantedBy=default.target

config/services/containers/app/ezbookkeeping/ezbookkeeping.container.j2

@@ -1,61 +0,0 @@
-[Quadlet]
-DefaultDependencies=false
-
-[Unit]
-Description=ezBookkeeping
-
-After=network-online.target
-Wants=network-online.target
-
-[Container]
-Image=docker.io/mayswind/ezbookkeeping:{{ version['containers']['ezbookkeeping'] }}
-ContainerName=ezbookkeeping
-HostName=ezbookkeeping
-
-PublishPort={{ services['ezbookkeeping']['ports']['http'] }}:8080/tcp
-
-Volume=%h/data/containers/ezbookkeeping/data:/data:rw
-Volume=%h/containers/ezbookkeeping/ssl:/etc/ssl/ezbookkeeping:ro
-
-# General
-Environment="TZ=Asia/Seoul"
-Environment="EBK_SERVER_DOMAIN={{ services['ezbookkeeping']['domain']['public'] }}.{{ domain['public'] }}"
-Environment="EBK_SERVER_ROOT_URL=https://{{ services['ezbookkeeping']['domain']['public'] }}.{{ domain['public'] }}/"
-Environment="EBK_LOG_MODE=console"
-
-# Database
-Environment="EBK_DATABASE_TYPE=postgres"
-Environment="EBK_DATABASE_HOST={{ services['postgresql']['domain'] }}.{{ domain['internal'] }}:{{ services['postgresql']['ports']['tcp'] }}"
-Environment="EBK_DATABASE_NAME=ezbookkeeping_db"
-Environment="EBK_DATABASE_USER=ezbookkeeping"
-Secret=EBK_DATABASE_PASSWD,type=env
-Environment="EBK_DATABASE_SSL_MODE=verify-full"
-Environment="PGSSLROOTCERT=/etc/ssl/ezbookkeeping/{{ root_cert_filename }}"
-
-# OIDC
-Environment="EBK_AUTH_ENABLE_OAUTH2_AUTH=true"
-Environment="EBK_AUTH_OAUTH2_PROVIDER=oidc"
-Environment="EBK_AUTH_OAUTH2_CLIENT_ID=ezbookkeeping"
-Secret=EBK_AUTH_OAUTH2_CLIENT_SECRET,type=env
-Environment="EBK_AUTH_OAUTH2_USE_PKCE=true"
-Environment="EBK_AUTH_OIDC_PROVIDER_BASE_URL=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}"
-Environment="EBK_AUTH_ENABLE_OIDC_DISPLAY_NAME=true"
-Environment="EBK_AUTH_OIDC_CUSTOM_DISPLAY_NAME=Authelia"
-
-# Registration / auth policy
-Environment="EBK_AUTH_ENABLE_INTERNAL_AUTH=false"
-Environment="EBK_USER_ENABLE_REGISTER=true"
-Environment="EBK_AUTH_OAUTH2_AUTO_REGISTER=true"
-
-# AI / MCP disabled by default
-Environment="EBK_MCP_ENABLE_MCP=false"
-Environment="EBK_LLM_TRANSACTION_FROM_AI_IMAGE_RECOGNITION=false"
-
-[Service]
-ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
-Restart=always
-RestartSec=10s
-TimeoutStopSec=120
-
-[Install]
-WantedBy=default.target

config/services/containers/app/nextcloud/config/background.config.php.j2

@@ -1,5 +1,4 @@
 <?php
 $CONFIG = [
-    // Background jobs mode is auto-detected as 'cron' when nextcloud-cron.timer runs cron.php via CLI. No explicit config required.
     'maintenance_window_start' => 18,
 ];

config/services/containers/app/sure/sure-web.container.j2

@@ -1,67 +0,0 @@
-[Quadlet]
-DefaultDependencies=false
-
-[Unit]
-Description=Sure Web
-
-After=network-online.target redis_sure.service
-Wants=network-online.target redis_sure.service
-
-[Container]
-Image=ghcr.io/we-promise/sure:{{ version['containers']['sure'] }}
-ContainerName=sure-web
-HostName=sure-web
-
-PublishPort={{ services['sure']['ports']['http'] }}:3000/tcp
-
-Volume=%h/data/containers/sure/storage:/rails/storage:rw
-Volume=%h/containers/sure/ssl:/etc/ssl/sure:ro
-
-# General
-Environment="TZ=Asia/Seoul"
-Environment="SELF_HOSTED=true"
-Environment="ONBOARDING_STATE=closed"
-Environment="RAILS_FORCE_SSL=false"
-Environment="RAILS_ASSUME_SSL=true"
-Environment="APP_DOMAIN={{ services['sure']['domain']['public'] }}.{{ domain['public'] }}"
-Secret=SURE_SECRET_KEY_BASE,type=env,target=SECRET_KEY_BASE
-
-# PostgreSQL
-Environment="POSTGRES_USER=sure"
-Environment="POSTGRES_DB=sure_db"
-Environment="DB_HOST={{ services['postgresql']['domain'] }}.{{ domain['internal'] }}"
-Environment="DB_PORT={{ services['postgresql']['ports']['tcp'] }}"
-Environment="PGSSLMODE=verify-full"
-Environment="PGSSLROOTCERT=/etc/ssl/sure/{{ root_cert_filename }}"
-Secret=SURE_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD
-
-# Redis
-Environment="REDIS_URL=redis://host.containers.internal:{{ services['sure']['ports']['redis'] }}/1"
-
-# OIDC - Authelia
-Environment="OIDC_CLIENT_ID=sure"
-Environment="OIDC_ISSUER=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}"
-Environment="OIDC_REDIRECT_URI=https://{{ services['sure']['domain']['public'] }}.{{ domain['public'] }}/auth/openid_connect/callback"
-Secret=SURE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
-Environment="OIDC_BUTTON_LABEL=Sign in with Authelia"
-Environment="AUTH_JIT_MODE=create_and_link"
-# email's domain, e.g. ilnmors.internal then only user@ilnmors.internal is allowed to sign-up
-Environment="ALLOWED_OIDC_DOMAINS="
-
-# WebAuthn / Passkey
-Environment="WEBAUTHN_RP_ID={{ domain['public'] }}"
-Environment="WEBAUTHN_ALLOWED_ORIGINS=https://{{ services['sure']['domain']['public'] }}.{{ domain['public'] }}"
-
-# Provider
-## Currency
-Environment="EXCHANGE_RATE_PROVIDER=yahoo_finance"
-Environment="SECURITIES_PROVIDER=yahoo_finance"
-
-[Service]
-ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
-Restart=always
-RestartSec=10s
-TimeoutStopSec=120
-
-[Install]
-WantedBy=default.target

config/services/containers/app/sure/sure-worker.container.j2

@@ -1,67 +0,0 @@
-[Quadlet]
-DefaultDependencies=false
-
-[Unit]
-Description=Sure Worker
-
-After=network-online.target redis_sure.service
-Wants=network-online.target redis_sure.service
-
-[Container]
-Image=ghcr.io/we-promise/sure:{{ version['containers']['sure'] }}
-ContainerName=sure-worker
-HostName=sure-worker
-
-Volume=%h/data/containers/sure/storage:/rails/storage:rw
-Volume=%h/containers/sure/ssl:/etc/ssl/sure:ro
-
-Exec=bundle exec sidekiq
-
-# General
-Environment="TZ=Asia/Seoul"
-Environment="SELF_HOSTED=true"
-Environment="ONBOARDING_STATE=closed"
-Environment="RAILS_FORCE_SSL=false"
-Environment="RAILS_ASSUME_SSL=true"
-Environment="APP_DOMAIN={{ services['sure']['domain']['public'] }}.{{ domain['public'] }}"
-Secret=SURE_SECRET_KEY_BASE,type=env,target=SECRET_KEY_BASE
-
-# PostgreSQL
-Environment="POSTGRES_USER=sure"
-Environment="POSTGRES_DB=sure_db"
-Environment="DB_HOST={{ services['postgresql']['domain'] }}.{{ domain['internal'] }}"
-Environment="DB_PORT={{ services['postgresql']['ports']['tcp'] }}"
-Environment="PGSSLMODE=verify-full"
-Environment="PGSSLROOTCERT=/etc/ssl/sure/{{ root_cert_filename }}"
-Secret=SURE_POSTGRES_PASSWORD,type=env,target=POSTGRES_PASSWORD
-
-# Redis
-Environment="REDIS_URL=redis://host.containers.internal:{{ services['sure']['ports']['redis'] }}/1"
-
-# OIDC - Authelia
-Environment="OIDC_CLIENT_ID=sure"
-Environment="OIDC_ISSUER=https://{{ services['authelia']['domain'] }}.{{ domain['public'] }}"
-Environment="OIDC_REDIRECT_URI=https://{{ services['sure']['domain']['public'] }}.{{ domain['public'] }}/auth/openid_connect/callback"
-Secret=SURE_OIDC_CLIENT_SECRET,type=env,target=OIDC_CLIENT_SECRET
-Environment="OIDC_BUTTON_LABEL=Sign in with Authelia"
-Environment="AUTH_JIT_MODE=create_and_link"
-# email's domain, e.g. ilnmors.internal then only user@ilnmors.internal is allowed to sign-up
-Environment="ALLOWED_OIDC_DOMAINS="
-
-# WebAuthn / Passkey
-Environment="WEBAUTHN_RP_ID={{ domain['public'] }}"
-Environment="WEBAUTHN_ALLOWED_ORIGINS=https://{{ services['sure']['domain']['public'] }}.{{ domain['public'] }}"
-
-# Provider
-## Currency
-Environment="EXCHANGE_RATE_PROVIDER=yahoo_finance"
-Environment="SECURITIES_PROVIDER=yahoo_finance"
-
-[Service]
-ExecStartPre=/usr/bin/nc -zv {{ services['postgresql']['domain'] }}.{{ domain['internal'] }} {{ services['postgresql']['ports']['tcp'] }}
-Restart=always
-RestartSec=10s
-TimeoutStopSec=120
-
-[Install]
-WantedBy=default.target

config/services/containers/auth/authelia/config/authelia.yaml.j2

@@ -387,46 +387,3 @@ identity_providers:
         access_token_signed_response_alg: 'none'
         userinfo_signed_response_alg: 'none'
         token_endpoint_auth_method: 'client_secret_post'
-      # https://www.authelia.com/integration/openid-connect/clients/ezbookkeeping/
-      - client_id: 'ezbookkeeping'
-        client_name: 'ezBookkeeping'
-        client_secret: '{{ hostvars['console']['ezbookkeeping']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: true
-        pkce_challenge_method: 'S256'
-        redirect_uris:
-          - 'https://budget.ilnmors.com/oauth2/callback'
-        scopes:
-          - 'openid'
-          - 'profile'
-          - 'email'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_basic'
-      # https://www.authelia.com/integration/openid-connect/clients/sure/
-      - client_id: 'sure'
-        client_name: 'Sure'
-        client_secret: '{{ hostvars['console']['sure']['oidc']['hash'] }}'
-        public: false
-        authorization_policy: 'one_factor'
-        require_pkce: true
-        pkce_challenge_method: 'S256'
-        redirect_uris:
-          - 'https://sure.ilnmors.com/auth/openid_connect/callback'
-        scopes:
-          - 'openid'
-          - 'email'
-          - 'profile'
-          - 'groups'
-        response_types:
-          - 'code'
-        grant_types:
-          - 'authorization_code'
-        access_token_signed_response_alg: 'none'
-        userinfo_signed_response_alg: 'none'
-        token_endpoint_auth_method: 'client_secret_basic'

config/services/containers/common/caddy/etc/app/Caddyfile.j2

@@ -83,21 +83,3 @@
                 header_up Host {http.request.header.X-Forwarded-Host}
         }
 }
-{{ services['collabora']['domain']['internal'] }}.{{ domain['internal'] }} {
-        import private_tls
-        reverse_proxy host.containers.internal:{{ services['collabora']['ports']['http'] }} {
-                header_up Host {http.request.header.X-Forwarded-Host}
-        }
-}
-{{ services['ezbookkeeping']['domain']['internal'] }}.{{ domain['internal'] }} {
-        import private_tls
-        reverse_proxy host.containers.internal:{{ services['ezbookkeeping']['ports']['http'] }} {
-                header_up Host {http.request.header.X-Forwarded-Host}
-        }
-}
-{{ services['sure']['domain']['internal'] }}.{{ domain['internal'] }} {
-        import private_tls
-        reverse_proxy host.containers.internal:{{ services['sure']['ports']['http'] }} {
-                header_up Host {http.request.header.X-Forwarded-Host}
-        }
-}

config/services/containers/common/caddy/etc/auth/Caddyfile.j2

@@ -145,33 +145,6 @@
                 }
         }
 }
-{{ services['collabora']['domain']['public'] }}.{{ domain['public'] }} {
-        import crowdsec_log
-        route {
-                crowdsec
-                reverse_proxy https://{{services['collabora']['domain']['internal'] }}.{{ domain['internal'] }} {
-                        header_up Host {http.reverse_proxy.upstream.host}
-                }
-        }
-}
-{{ services['ezbookkeeping']['domain']['public'] }}.{{ domain['public'] }} {
-        import crowdsec_log
-        route {
-                crowdsec
-                reverse_proxy https://{{services['ezbookkeeping']['domain']['internal'] }}.{{ domain['internal'] }} {
-                        header_up Host {http.reverse_proxy.upstream.host}
-                }
-        }
-}
-{{ services['sure']['domain']['public'] }}.{{ domain['public'] }} {
-        import crowdsec_log
-        route {
-                crowdsec
-                reverse_proxy https://{{services['sure']['domain']['internal'] }}.{{ domain['internal'] }} {
-                        header_up Host {http.reverse_proxy.upstream.host}
-                }
-        }
-}
 
 # Internal domain
 {{ node['name'] }}.{{ domain['internal'] }} {

config/services/containers/infra/x509-exporter/config/config.yaml

@@ -1,11 +0,0 @@
-server:
-  listen: :9793
-
-sources:
-  - kind: file
-    name: homelab-certs
-    paths:
-      - /certs/*.crt
-      - /certs/*.pem
-      - /certs/*.cer
-    refreshInterval: 1m

config/services/containers/infra/x509-exporter/x509-exporter.container.j2

@@ -11,12 +11,11 @@ Image=docker.io/enix/x509-certificate-exporter:{{ version['containers']['x509-ex
 ContainerName=x509-exporter
 HostName=X509-exporter
 
-Volume=%h/containers/x509-exporter/config/config.yaml:/etc/config.yaml:ro
 Volume=%h/containers/x509-exporter/certs:/certs:ro
 
 PublishPort={{ services['x509-exporter']['ports']['http'] }}:9793
 
-Exec=--config /etc/config.yaml
+Exec=--listen-address :9793 --watch-dir=/certs
 
 [Service]
 Restart=always

config/services/systemd/app/btrfs/btrfs-scrub.service.j2

@@ -1,10 +0,0 @@
-[Unit]
-Description=BTRFS auto scrub
-ConditionPathIsMountPoint={{ storage['btrfs']['mount_point'] }}
-RequiresMountsFor={{ storage['btrfs']['mount_point'] }}
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/btrfs scrub start -Bd {{ storage['btrfs']['mount_point'] }}
-Nice=19
-IOSchedulingClass=idle

config/services/systemd/app/btrfs/btrfs-scrub.timer.j2

@@ -1,10 +0,0 @@
-[Unit]
-Description=Monthly BTRFS auto scrub 
-
-[Timer]
-OnCalendar=*-*-01 04:00:00
-Persistent=true
-RandomizedDelaySec=300
-
-[Install]
-WantedBy=timers.target

config/services/systemd/common/crowdsec/bouncers/whitelists.yaml.j2

@@ -13,11 +13,11 @@ whitelist:
 {% if node['name'] == 'auth' %}
     expression:
         # budget local-first sql scrap rule
-        - "evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/data/migrations/'"
+        - "evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/data/migrations/'"
         # immich thumbnail request 404 error false positive
-        - "evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'"
+        - "evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'"
         # opencloud chunk request false positive
-        - "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/js/chunks/'"
+        - "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'"
-        # nextcloud thumbnail/preview request error false positive
+        # nextcloud chunk request false positive
-        - "evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' &&  evt.Meta.http_path startsWith '/index.php/core/preview?'"
+        - evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/apps/viewer/js/'
 {% endif %}

config/services/systemd/common/kopia/kopia-backup.service.j2

@@ -21,9 +21,9 @@ ProtectHome=tmpfs
 InaccessiblePaths=/boot /root
 
 {% if node['name'] == 'infra' %}
-BindReadOnlyPaths={{ node['home_path'] }}/containers/postgresql/backups
+BindReadOnlyPaths=%h/containers/postgresql/backups
 {% elif node['name'] == 'app' %}
-BindReadOnlyPaths={{ node['home_path'] }}/data
+BindReadOnlyPaths=%h/data
 {% endif %}
 # In root namescope, %u always bring 0
 BindPaths=/etc/kopia
@@ -38,10 +38,10 @@ ExecStartPre=/usr/bin/kopia repository connect server \
 
 {% if node['name'] == 'infra' %}
 ExecStart=/usr/bin/kopia snapshot create \
-    {{ node['home_path'] }}/containers/postgresql/backups
+    /home/infra/containers/postgresql/backups
 {% elif node['name'] == 'app' %}
 ExecStart=/usr/bin/kopia snapshot create \
-    {{ node['home_path'] }}/data
+    /home/app/data
 {% endif %}
 
 

docs/adr/007-backup.md

@@ -6,10 +6,7 @@
     - First documentation
 
 - Feb/27/2026
-    - Status changed from Deferred to Accepted
+    - Status changed from Deffered to Accepted
-
-- May/06/2026
-    - Add backup checking rules
     
 ## Status
 
@@ -33,12 +30,6 @@
     - Backing up the `/var/lib/postgresql` directory directly while the DB is running can lead to severe data corruption and inconsistency.
     - Logical dumps (`pg_dump`) are much safer, database-agnostic, and easier to restore in a homelab environment.
 
-### Silent failure problem
-
-- May/06/2026, the fact that backups haven't run since commit '9f236b6fa5' because of '%h' in system service unit.
-    - Operator couldn't realize backup doesn't run because the system service was failed silently.
-    - Therefore, set the checking rule.
-
 
 ## Decisions
 
@@ -63,14 +54,7 @@
         - From kopia server to console:$HOMELAB_PATH/data/volume/infra/postgresql/\{cluster,data\}
     - APP data files
         - From kopia server to APP vm after initiating before deploy services
-- Automatic backup does not guarantee integrity of data system, so before reset the system conduct manual backup after making sure all services are shutdown.
+- Automative backup does not guarantee integrity of data system, so before reset the system conduct manual backup after making sure all services are shutdown.
-- Check the repository once a week (Every monday)
-    - Check the snapshot in repository with `kopia snapshot list --all`
-    - Mount the snapshot respectively with `kopia mount $SNAPSHOT_ID $DESTINATION`
-    - Copy random file from snapshot and check the values.
-    - If there's some failure, check the backup service and conduct backup immediately.
-    - Repeat the check flow.
-    - When everything is done, umount the kopia mount with `ctrl+c`
 
 ## Consequences
 

docs/issues/crowdsec/260321_actual_budget.md

@@ -21,14 +21,13 @@
 ## Timeline
 - 2026-03-21: Release actual budget
 - 2026-03-21: Find the false positive case, and add whitelist
-- 2026-05-07: Optimize whitelist expression
 
 ## Solution
 - Access to fw
   - Check the ban list with `sudo cscli alerts list`
   - Read the ban case with `sudo cscli alerts inspect $NUMBER`
-- Add expressions on whitelist
+- Add regex on whitelist
-  - evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/data/migrations/'
+  - evt.Meta.target_fqdn == '{{ services['actualbudget']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/data/migrations/'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
   - Delete false positive decision with `sudo cscli decision delete --id $ID`

docs/issues/crowdsec/260321_immich.md

@@ -20,14 +20,13 @@
 ## Timeline
 - 2026-03-21: Release Immich
 - 2026-03-21: Find the false positive case, and add whitelist
-- 2026-05-07: Optimize whitelist expression
 
 ## Solution
 - Access to fw
   - Check the ban list with `sudo cscli alerts list`
   - Read the ban case with `sudo cscli alerts inspect $NUMBER`
-- Add expressions on whitelist
+- Add regex on whitelist
-  - evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'
+  - evt.Meta.target_fqdn == 'Immich.ilnmors.com' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
   - Delete false positive decision with `sudo cscli decision delete --id $ID`

docs/issues/crowdsec/260404_opencloud.md

@@ -20,14 +20,13 @@
 ## Timeline
 - 2026-04-04: Release OpenCloud
 - 2026-04-04: Find the false positive case, and add whitelist
-- 2026-05-07: Optimize whitelist expression
 
 ## Solution
 - Access to fw
   - Check the ban list with `sudo cscli alerts list`
   - Read the ban case with `sudo cscli alerts inspect $NUMBER`
-- Add expressions on whitelist
+- Add regex on whitelist
-  - evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/js/chunks/'
+  - evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
   - Delete false positive decision with `sudo cscli decision delete --id $ID`

docs/issues/crowdsec/260502_nextcloud.md

@@ -14,29 +14,20 @@
   - fw ban users' IP address.
 
 ## Reason
-- Nextcloud has a lot of workflows which can be caught from crowdsec
+- Nextcloud uses chunks when clients uploads or download files to it.
+- LAPI decides a ban when a lot of chunks file is uploaded or downloaded from external devices.
+    - `crowdsecurity/http-crawl-non_statics`
 
 ## Timeline
-- 2026-05-02: Release nextcloud
+- 2026-05-02: Release OpenCloud
 - 2026-05-02: Find the false positive case, and add whitelist
-- 2026-05-03: Install crowdsecurity/nextcloud-whitelist parser
-- 2026-05-03: Make previous expressions annotation
-- 2026-05-07: Find the false positive case, which is not on `crowdsecurity/nextcloud-whitelist`
-- 2026-05-07: Set whitelist expression
 
 ## Solution
-- Install crowdsecurity/nextcloud-whitelist on auth node
-- Add expression on whitelist
-  - evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' &&  evt.Meta.http_path startsWith '/index.php/core/preview?'
-
-### Deprecated solution
 - Access to fw
   - Check the ban list with `sudo cscli alerts list`
   - Read the ban case with `sudo cscli alerts inspect $NUMBER`
-- Add expressions on whitelist
+- Add regex on whitelist
-  - evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/apps/viewer/js/'
+  - evt.Meta.target_fcqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/apps/viewer/js/'
-  - evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/dist/'
-  - evt.Meta.target_fqdn == '{{ services['nextcloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/remote.php/dav/files/'
 - Delete false positive decision
   - Check false positive decision with `sudo cscli decision list`
   - Delete false positive decision with `sudo cscli decision delete --id $ID`

docs/services/app/collabora.md

@@ -1,28 +0,0 @@
-# Collabora office
-
-## Prerequisite
-
-- Nothing
-
-## Configuration
-
-- Admin page is disabled by Environment options
-    - `admin_console.enable=false`
-
-### Link to nextcloud
-
-- https://nextcloud.ilnmors.com
-    - login with admin account
-
-- Profile: Apps: Nextcloud Office 
-    - Check installation and enable
-
-- Profile: Administration Settings: Nextcloud Office: Your own server
-    - http://host.containers.internal:9980 (collabora container port)
-    - Public FQDN is set automatically
-    - save
-
-- Files
-    - Verify document opening (verified)
-    - The basic font `Noto Sans KR` exists
-        - Korean is presented very well

docs/services/app/ezbookkeeping.md

@@ -1,35 +0,0 @@
-# ezBookkeeping
-
-## Prerequisite
-
-### Create database
-
-- Create the password with `openssl rand -base64 32`
-  - Save this value in secrets.yaml in `postgresql.password.ezbookkeeping`
-  - Access infra server to create paperless_db with `podman exec -it postgresql psql -U postgres`
-
-```SQL
-CREATE USER ezbookkeeping WITH PASSWORD 'postgresql.password.ezbookkeeping';
-CREATE DATABASE ezbookkeeping_db;
-ALTER DATABASE ezbookkeeping_db OWNER TO ezbookkeeping;
-```
-
-### Create oidc secret and hash
-
-- Create the secret with `openssl rand -base64 32`
-- access to auth vm
-  - `podman exec -it authelia sh`
-  - `authelia crypto hash generate pbkdf2 --password 'ezbookkeeping.oidc.secret'`
-- Save this value in secrets.yaml in `ezbookkeeping.oidc.secret` and `ezbookkeeping.oidc.hash`
-
-### Add postgresql dump backup list
-
-- [set_postgresql.yaml](../../../ansible/roles/infra/tasks/services/set_postgresql.yaml)
-
-```yaml
-- name: Set connected services list
-  ansible.builtin.set_fact:
-    connected_services:
-      - ...
-      - "ezbookkeeping"
-```

docs/services/app/nextcloud.md

@@ -61,7 +61,7 @@ ALTER DATABASE nextcloud_db OWNER TO nextcloud;
   - Mail
   - Nextcloud Office
 
-### OIDC and DB Configuration
+### Configuration
 
 ```bash
 podman exec -u www-data nextcloud php occ user_oidc:provider Authelia \
@@ -86,21 +86,3 @@ podman exec -u www-data nextcloud php occ db:add-missing-primary-keys
 
 - Profile: Accounts:
   - allocate admin group for admin users
-
-#### Disable System addressbook expose
-
-- Profile: Administration Settings: Groupware: System Address Book
-  - Disable `Enable system address book` option
-
-## Security warning in Nextcloud (ignored)
-
-### trusted_proxies option
-- Nextcloud wants admin to set `trusted_proxies` via forwarded ip header.
-  - In current system, app vm explicitly prevents access the nextcloud container outside of vm.
-  - trusted_proxy ip address will be definitely 169.254.1.2 (caddy's APIPA address which is used in PASTA network), so it is not distinguished from other containers.
-  - Therefore, it doesn't need to be set.
-
-### HSTS option
-- This system is already main - sidecar reverse proxy system, and main proxy automatically changes http requests to https request (Caddyfile listens https).
-  - main - sidecar communication is also on https via internal certificate.
-  - Therefore, it doesn't need to be set.

docs/services/app/sure.md

@@ -1,67 +0,0 @@
-# sure
-
-## Prerequisite
-
-### Create database
-
-- Create the password with `openssl rand -base64 32`
-  - Save this value in secrets.yaml in `postgresql.password.sure`
-  - Access infra server to create sure_db with `podman exec -it postgresql psql -U postgres`
-
-```SQL
-CREATE USER sure WITH PASSWORD 'postgresql.password.sure';
-CREATE DATABASE sure_db;
-ALTER DATABASE sure_db OWNER TO sure;
-```
-
-### Create oidc secret and hash
-
-- Create the secret with `openssl rand -base64 32`
-- access to auth vm
-  - `podman exec -it authelia sh`
-  - `authelia crypto hash generate pbkdf2 --password 'sure.oidc.secret'`
-- Save this value in secrets.yaml in `sure.oidc.secret` and `sure.oidc.hash`
-
-### Create session secret value
-
-- Create the secret with `LC_ALL=C tr -dc 'A-Za-z0-9!#%&()*+,-./:;<=>?@[\]^_{|}~' </dev/urandom | head -c 32`
-  - Save this value in secrets.yaml in `sure.session_secret`
-
-### Add postgresql dump backup list
-
-- [set_postgresql.yaml](../../../ansible/roles/infra/tasks/services/set_postgresql.yaml)
-
-```yaml
-- name: Set connected services list
-  ansible.builtin.set_fact:
-    connected_services:
-      - ...
-      - "sure"
-```
-
-## Configuration
-
-### Access to sure
-
-- https://sure.ilnmors.com
-  - Sign in with Authelia
-  - Create account
-
-### Account configuration
-
-- Setup: 
-  - First name and last name
-  - Will be using sure with
-    - [x] Family members
-  - Country: South Korea
-- Preference: 
-  - South Korean Won (KRW)
-  - date: YYYY-MM-DD
-- Goals:
-  - Next
-
-### Group and user configuration
-
-- Profile: Settings: Profile info:
-  - Household: Set name
-  - Invite member: input email of member

docs/services/common/crowdsec.md

@@ -234,9 +234,9 @@ fw@fw:~$ sudo cscli alerts inspect 230 -d
 
 - check the log and analyze and make expression
   - e.g. immich
-    - "evt.Meta.target_fqdn == '{{ services['immich']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'"
+    - evt.Meta.target_fqdn == 'immich.ilnmors.com' && evt.Meta.http_path contains '/api/assets/' && evt.Meta.http_path contains '/thumbnail'
   - e.g. opencloud
-    - "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_status in ['200', '304'] && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/js/chunks/'"
+    - "evt.Meta.target_fqdn == '{{ services['opencloud']['domain']['public'] }}.{{ domain['public'] }}' && evt.Meta.http_path contains '/js/chunks/'"
 - free false positive decision
 
 fw@fw:~$ sudo cscli decision list

docs/specifications/environments.md

@@ -119,21 +119,14 @@
         - [x] Immich
         - [x] Actual budget
         - [x] Paperless-ngx
-        - [x] vikunja (Comparing to Nextcloud deck)
+        - [x] vikunja
-        - [x] OpenCloud (Comparing to Nextcloud)
+        - [x] OpenCloud
         - [x] affine \(Notion substitution\)
         - [x] Nextcloud \(Use nextcloud as CalDAV and CardDav, kanban and todo\)
-        - [x] Collabora office \(Link to Nextcloud, it works well\)
+        - [ ] Collabora office
-        - [x] ezBookkeeping 
-            - use budget.ilnmors.com for ezBookkeeping, actual budget domain is changed as actualbudget.ilnmors.com
-        - [x] sure
-            - comparing sure, ezBookkeeping, and actualbudget
-            - ezbookkeeping has no function to share the account and budget to the other users.
-            - actual budget's YNAB way is hard to adjust
-            - sure is heavy, but it is not YNAB and it allows to share account the other users
         - WriteFreely
-        - MediaCMS or PeerTube
+        - MediaCMS
-        - Funkwhale or Navidrome or Jellyfin
+        - Funkwhale
         - Kavita
         - Audiobookshelf
         - Miniflux