From 11b13cd32657c598199cab47efaac296986573d6 Mon Sep 17 00:00:00 2001
From: bee <secretbumblebee@proton.me>
Date: Sun, 31 May 2026 09:35:54 +0200
Subject: [PATCH] fixes/security

---
 .vscode/tasks.json                            | 30 +++++++------------
 .../inspircd}/irc-post-hook.sh                |  0
 .../inspircd}/nginx-post-hook.sh              |  0
 playbooks/autodns/autodns.yml                 |  2 +-
 .../fail2ban-ingress/fail2ban-ingress.yml     |  2 +-
 playbooks/fail2ban/fail2ban.yml               |  1 +
 playbooks/fail2ban/jail.local.j2              |  2 +-
 playbooks/gitea/gitea.yml                     | 15 +++++-----
 playbooks/letsencrypt/letsencrypt.yml         | 12 --------
 playbooks/monitoring/docker-compose.yml.j2    |  2 +-
 playbooks/monitoring/monitoring.yml           |  4 +--
 .../sites-enabled/gallery.secretbee.buzz      |  2 ++
 .../nginx/sites-enabled/git.secretbee.buzz    |  2 +-
 .../sites-enabled/grafana.secretbee.buzz      |  2 +-
 .../nginx/sites-enabled/lounge.secretbee.buzz |  2 +-
 .../wireguard-ingress/wireguard-ingress.yml   |  1 +
 playbooks/wireguard/wireguard.yml             |  1 +
 17 files changed, 31 insertions(+), 49 deletions(-)
 rename {playbooks/letsencrypt => archive/inspircd}/irc-post-hook.sh (100%)
 rename {playbooks/letsencrypt => archive/inspircd}/nginx-post-hook.sh (100%)

diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index fa8920d..95b28ee 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -150,26 +150,16 @@
             "panel": "dedicated"
         }
     },
-    {
-        "label": "Build & Push: postfix",
-        "type": "shell",
-        "command": "make push-postfix",
-        "group": "build",
-        "presentation": {
-            "reveal": "always",
-            "panel": "dedicated"
-        }
-    },
-    {
-        "label": "Build & Push: opendkim",
-        "type": "shell",
-        "command": "make push-opendkim",
-        "group": "build",
-        "presentation": {
-            "reveal": "always",
-            "panel": "dedicated"
-        }
-    }
+    // {
+    //     "label": "Build & Push: <template>",
+    //     "type": "shell",
+    //     "command": "make push-<template>",
+    //     "group": "build",
+    //     "presentation": {
+    //         "reveal": "always",
+    //         "panel": "dedicated"
+    //     }
+    // }
 ],
   "inputs": [
     {
diff --git a/playbooks/letsencrypt/irc-post-hook.sh b/archive/inspircd/irc-post-hook.sh
similarity index 100%
rename from playbooks/letsencrypt/irc-post-hook.sh
rename to archive/inspircd/irc-post-hook.sh
diff --git a/playbooks/letsencrypt/nginx-post-hook.sh b/archive/inspircd/nginx-post-hook.sh
similarity index 100%
rename from playbooks/letsencrypt/nginx-post-hook.sh
rename to archive/inspircd/nginx-post-hook.sh
diff --git a/playbooks/autodns/autodns.yml b/playbooks/autodns/autodns.yml
index efed651..e5ff2d7 100644
--- a/playbooks/autodns/autodns.yml
+++ b/playbooks/autodns/autodns.yml
@@ -1,4 +1,4 @@
-- name: Inspircd
+- name: Autodns
   hosts: beepi
   become: true
   vars:
diff --git a/playbooks/fail2ban-ingress/fail2ban-ingress.yml b/playbooks/fail2ban-ingress/fail2ban-ingress.yml
index 206a444..be652e6 100644
--- a/playbooks/fail2ban-ingress/fail2ban-ingress.yml
+++ b/playbooks/fail2ban-ingress/fail2ban-ingress.yml
@@ -19,7 +19,7 @@
         owner: fail2forward
         group: fail2forward
         state: directory
-        mode: '0655'
+        mode: '0700'
 
     - name: Create authorized_keys
       ansible.builtin.copy:
diff --git a/playbooks/fail2ban/fail2ban.yml b/playbooks/fail2ban/fail2ban.yml
index 3e213be..c3d58a7 100644
--- a/playbooks/fail2ban/fail2ban.yml
+++ b/playbooks/fail2ban/fail2ban.yml
@@ -18,6 +18,7 @@
         name: fail2forward
         generate_ssh_key: true
         ssh_key_bits: 2048
+        ssh_key_type: ed25519
         ssh_key_file: .ssh/id_rsa
       register: ssh_public_key
 
diff --git a/playbooks/fail2ban/jail.local.j2 b/playbooks/fail2ban/jail.local.j2
index 2713306..6e87d96 100644
--- a/playbooks/fail2ban/jail.local.j2
+++ b/playbooks/fail2ban/jail.local.j2
@@ -5,7 +5,7 @@ maxretry = 5
 banaction = ufw
 bantime.increment = true
 bantime.multipliers = 1 5 30 60 300 720 1440 2880
-ignoreip = 81.217.198.106
+ignoreip = 81.217.198.106 # home ip
 
 action = %(action_)s
          forward
diff --git a/playbooks/gitea/gitea.yml b/playbooks/gitea/gitea.yml
index 3a113df..cc870cd 100644
--- a/playbooks/gitea/gitea.yml
+++ b/playbooks/gitea/gitea.yml
@@ -1,4 +1,4 @@
-- name: Inspircd
+- name: Gitea
   hosts: beepi
   become: true
   vars:
@@ -26,18 +26,19 @@
         state: directory
         mode: '0755'
 
+    - name: Compose down
+      changed_when: true
+      failed_when: false
+      ansible.builtin.command:
+        cmd: podman-compose down
+        chdir: /opt/beeserver/gitea
+
     - name: Copy compose
       ansible.builtin.template:
         src: docker-compose.yml.j2
         dest: /opt/beeserver/gitea/docker-compose.yml
         mode: '0644'
 
-    - name: Compose down
-      changed_when: true
-      ansible.builtin.command:
-        cmd: podman-compose down
-        chdir: /opt/beeserver/gitea
-
     - name: Compose up
       changed_when: true
       ansible.builtin.command:
diff --git a/playbooks/letsencrypt/letsencrypt.yml b/playbooks/letsencrypt/letsencrypt.yml
index b446add..af58e5e 100644
--- a/playbooks/letsencrypt/letsencrypt.yml
+++ b/playbooks/letsencrypt/letsencrypt.yml
@@ -18,18 +18,6 @@
         - matrix.secretbee.buzz
         - gallery.secretbee.buzz
 
-    - name: Add post hook script
-      ansible.builtin.copy:
-        src: irc-post-hook.sh
-        dest: /opt/beeserver/irc-post-hook.sh
-        owner: root
-        group: root
-        mode: '0755'
-
-    - name: Renew for post hook
-      changed_when: true
-      ansible.builtin.command: certbot renew --cert-name irc.secretbee.buzz --deploy-hook /opt/beeserver/irc-post-hook.sh --force-renewal
-
     - name: Change permission on live
       ansible.builtin.file:
         path: /etc/letsencrypt/live/
diff --git a/playbooks/monitoring/docker-compose.yml.j2 b/playbooks/monitoring/docker-compose.yml.j2
index 58010e9..7e857d1 100644
--- a/playbooks/monitoring/docker-compose.yml.j2
+++ b/playbooks/monitoring/docker-compose.yml.j2
@@ -20,7 +20,7 @@ services:
     container_name: grafana
     restart: always
     ports:
-      - '4000:4000'
+      - '127.0.0.1:4000:4000'
     volumes:
       - grafana-storage:/var/lib/grafana
     environment:
diff --git a/playbooks/monitoring/monitoring.yml b/playbooks/monitoring/monitoring.yml
index e3e76a7..3d1a8b3 100644
--- a/playbooks/monitoring/monitoring.yml
+++ b/playbooks/monitoring/monitoring.yml
@@ -48,6 +48,7 @@
 
     - name: Compose down
       changed_when: true
+      failed_when: false
       ansible.builtin.command:
         cmd: podman-compose down
         chdir: /opt/beeserver/monitoring
@@ -101,9 +102,6 @@
         username: "{{ geoip_username }}"
         password: "{{ geoip_license }}"
         mode: '0644'
-      tags:
-        - never
-        - geoip
 
     - name: Get geoip tar file
       ansible.builtin.find:
diff --git a/playbooks/nginx/sites-enabled/gallery.secretbee.buzz b/playbooks/nginx/sites-enabled/gallery.secretbee.buzz
index 7ad4b6c..9a51e85 100644
--- a/playbooks/nginx/sites-enabled/gallery.secretbee.buzz
+++ b/playbooks/nginx/sites-enabled/gallery.secretbee.buzz
@@ -11,6 +11,8 @@ server {
     listen         443 ssl;
     server_name gallery.secretbee.buzz;
 
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
     ssl_certificate     /etc/letsencrypt/live/gallery.secretbee.buzz/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/gallery.secretbee.buzz/privkey.pem;
     ssl_protocols       TLSv1.2 TLSv1.3;
diff --git a/playbooks/nginx/sites-enabled/git.secretbee.buzz b/playbooks/nginx/sites-enabled/git.secretbee.buzz
index 4e13453..41444a5 100644
--- a/playbooks/nginx/sites-enabled/git.secretbee.buzz
+++ b/playbooks/nginx/sites-enabled/git.secretbee.buzz
@@ -13,7 +13,7 @@ server {
 
   limit_req zone=mylimit burst=20;
 
-  add_header Strict-Transport-Security "max-age=31536000, includeSubDomains" always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
 
   ssl_certificate     /etc/letsencrypt/live/git.secretbee.buzz/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/git.secretbee.buzz/privkey.pem;
diff --git a/playbooks/nginx/sites-enabled/grafana.secretbee.buzz b/playbooks/nginx/sites-enabled/grafana.secretbee.buzz
index c456044..10447aa 100644
--- a/playbooks/nginx/sites-enabled/grafana.secretbee.buzz
+++ b/playbooks/nginx/sites-enabled/grafana.secretbee.buzz
@@ -22,7 +22,7 @@ server {
 
   limit_req zone=mylimit burst=20;
 
-  add_header Strict-Transport-Security "max-age=31536000, includeSubDomains" always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
 
   ssl_certificate     /etc/letsencrypt/live/grafana.secretbee.buzz/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/grafana.secretbee.buzz/privkey.pem;
diff --git a/playbooks/nginx/sites-enabled/lounge.secretbee.buzz b/playbooks/nginx/sites-enabled/lounge.secretbee.buzz
index 499c804..4b75436 100644
--- a/playbooks/nginx/sites-enabled/lounge.secretbee.buzz
+++ b/playbooks/nginx/sites-enabled/lounge.secretbee.buzz
@@ -13,7 +13,7 @@ server {
 
   limit_req zone=mylimit burst=20;
 
-  add_header Strict-Transport-Security "max-age=31536000, includeSubDomains" always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
 
   ssl_certificate     /etc/letsencrypt/live/lounge.secretbee.buzz/fullchain.pem;
   ssl_certificate_key /etc/letsencrypt/live/lounge.secretbee.buzz/privkey.pem;
diff --git a/playbooks/wireguard-ingress/wireguard-ingress.yml b/playbooks/wireguard-ingress/wireguard-ingress.yml
index 6e0b265..8e1e5b9 100644
--- a/playbooks/wireguard-ingress/wireguard-ingress.yml
+++ b/playbooks/wireguard-ingress/wireguard-ingress.yml
@@ -18,6 +18,7 @@
 
     - name: Down wg0
       changed_when: true
+      failed_when: false
       ansible.builtin.command: wg-quick down wg0
 
     - name: Copy wg0.conf
diff --git a/playbooks/wireguard/wireguard.yml b/playbooks/wireguard/wireguard.yml
index 2498f46..0a45dc0 100644
--- a/playbooks/wireguard/wireguard.yml
+++ b/playbooks/wireguard/wireguard.yml
@@ -18,6 +18,7 @@
 
     - name: Down wg0
       changed_when: true
+      failed_when: false
       ansible.builtin.command: wg-quick down wg0
 
     - name: Copy wg0.conf