mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2025-01-18 08:06:16 +01:00
27553ab31a
With the support for network.wireguard.* credentials[1] in systemd v256[2], we can now easily avoid storing the credentials centrally in our ansible vault, which is preferable as it makes the private keys less exposed. It may also make fine-grained access easier in the future[3] as there is no longer a vault file for each server. All the keys have been rotated and the new private keys are only stored on the servers. [1] https://github.com/systemd/systemd/pull/30826 [2] https://github.com/systemd/systemd/releases/tag/v256 [3] https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/64
16 lines
400 B
YAML
16 lines
400 B
YAML
filesystem: btrfs
|
|
fetchmail_user: "donate@archlinux.org"
|
|
fetchmail_delivery_cmd: "/usr/local/bin/donor_import_wrapper.sh"
|
|
|
|
ipv4_address: "95.217.163.246"
|
|
ipv6_address: "2a01:4f9:c010:6b1f::1"
|
|
|
|
fail2ban_jails:
|
|
sshd: true
|
|
postfix: false
|
|
dovecot: false
|
|
nginx_limit_req: true
|
|
wireguard_address: 10.0.0.1
|
|
wireguard_public_key: 2Mk9WPdkf+1Q6Kk6g5eeX5xSHfCisiGJAdmSjRyefBo=
|
|
nginx_enable_http3: true
|