From 59aa8a7bcfb649f943d57ec714eb0014e8246154 Mon Sep 17 00:00:00 2001
From: bee <secretbumblebee@proton.me>
Date: Sat, 4 Jul 2026 22:54:09 +0200
Subject: [PATCH] various fixed

---
 playbooks/fail2ban-ingress/fail2ban-ingress.yml | 15 +++++++++++++++
 playbooks/fail2ban-ingress/fail2forward.j2      |  4 ++--
 playbooks/fail2ban/forward.conf.j2              |  4 ++--
 playbooks/matrix/docker-compose.yml.j2          |  3 ++-
 playbooks/monitoring/docker-compose.yml.j2      |  7 ++++---
 playbooks/monitoring/monitoring.yml             |  2 +-
 playbooks/ott/production.toml.j2                |  2 +-
 7 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/playbooks/fail2ban-ingress/fail2ban-ingress.yml b/playbooks/fail2ban-ingress/fail2ban-ingress.yml
index be652e6..c3b66cc 100644
--- a/playbooks/fail2ban-ingress/fail2ban-ingress.yml
+++ b/playbooks/fail2ban-ingress/fail2ban-ingress.yml
@@ -8,6 +8,11 @@
         name: fail2ban
         state: present
 
+    - name: Install sudo
+      ansible.builtin.apt:
+        name: sudo
+        state: present
+
     - name: Create user
       ansible.builtin.user:
         name: fail2forward
@@ -38,6 +43,16 @@
         group: root
         mode: '0755'
 
+    - name: Allow fail2forward to run fail2ban-client
+      ansible.builtin.copy:
+        content: |
+          fail2forward ALL=(root) NOPASSWD: /usr/bin/fail2ban-client set sshd banip *, /usr/bin/fail2ban-client set sshd unbanip *
+        dest: /etc/sudoers.d/fail2forward
+        owner: root
+        group: root
+        mode: '0440'
+        validate: /usr/sbin/visudo -cf %s
+
     - name: Copy jail.local
       ansible.builtin.template:
         src: jail.local.j2
diff --git a/playbooks/fail2ban-ingress/fail2forward.j2 b/playbooks/fail2ban-ingress/fail2forward.j2
index eb17879..3d32850 100644
--- a/playbooks/fail2ban-ingress/fail2forward.j2
+++ b/playbooks/fail2ban-ingress/fail2forward.j2
@@ -4,12 +4,12 @@ case "$SSH_ORIGINAL_COMMAND" in
   "ban "*)
     ip="${SSH_ORIGINAL_COMMAND#ban }"
     [[ "$ip" =~ ^[0-9.]+$|^[0-9a-fA-F:]+$ ]] || { echo "bad ip"; exit 1; }
-    exec fail2ban-client set sshd banip "$ip"
+    exec sudo /usr/bin/fail2ban-client set sshd banip "$ip"
     ;;
   "unban "*)
     ip="${SSH_ORIGINAL_COMMAND#unban }"
     [[ "$ip" =~ ^[0-9.]+$|^[0-9a-fA-F:]+$ ]] || { echo "bad ip"; exit 1; }
-    exec fail2ban-client set sshd unbanip "$ip"
+    exec sudo /usr/bin/fail2ban-client set sshd unbanip "$ip"
     ;;
   *)
     echo "denied" >&2; exit 1
diff --git a/playbooks/fail2ban/forward.conf.j2 b/playbooks/fail2ban/forward.conf.j2
index 0a1157a..d56e62f 100644
--- a/playbooks/fail2ban/forward.conf.j2
+++ b/playbooks/fail2ban/forward.conf.j2
@@ -3,9 +3,9 @@ actionstart =
 actionstop =
 actioncheck =
 
-actionban = sudo -u fail2forward ssh -i ~fail2forward/.ssh/id_rsa -o BatchMode=yes -o ConnectTimeout=5 -o ServerAliveInterval=5 <forward_user>@<forward_host> ban <ip>
+actionban = sudo -u fail2forward ssh -i ~fail2forward/.ssh/id_rsa -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 -o ServerAliveInterval=5 <forward_user>@<forward_host> ban <ip>
 
-actionunban = sudo -u fail2forward ssh -i ~fail2forward/.ssh/id_rsa -o BatchMode=yes -o ConnectTimeout=5 -o ServerAliveInterval=5 <forward_user>@<forward_host> unban <ip>
+actionunban = sudo -u fail2forward ssh -i ~fail2forward/.ssh/id_rsa -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 -o ServerAliveInterval=5 <forward_user>@<forward_host> unban <ip>
 
 [Init]
 forward_host = animeistrash.org
diff --git a/playbooks/matrix/docker-compose.yml.j2 b/playbooks/matrix/docker-compose.yml.j2
index f6f22f9..d8b5665 100644
--- a/playbooks/matrix/docker-compose.yml.j2
+++ b/playbooks/matrix/docker-compose.yml.j2
@@ -1,6 +1,7 @@
 services:
     homeserver:
-        image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
+        image: "forgejo.ellis.link/continuwuation/continuwuity:v0.5.10"
+        pull_policy: always
         restart: always
         command: /sbin/conduwuit
         ports:
diff --git a/playbooks/monitoring/docker-compose.yml.j2 b/playbooks/monitoring/docker-compose.yml.j2
index 7e857d1..9d6b084 100644
--- a/playbooks/monitoring/docker-compose.yml.j2
+++ b/playbooks/monitoring/docker-compose.yml.j2
@@ -47,7 +47,8 @@ services:
       - monitoring
 
   alloy:
-    image: docker.io/grafana/alloy
+    image: docker.io/grafana/alloy:v1.17.1
+    pull_policy: always
     container_name: alloy
     ports:
       - '127.0.0.1:12345:12345'
@@ -70,10 +71,10 @@ services:
     restart: always
 
   podman-exporter:
-    image: quay.io/navidys/prometheus-podman-exporter
+    image: quay.io/navidys/prometheus-podman-exporter:1.21.2
     container_name: podman-exporter
+    pull_policy: always
     restart: always
-    privileged: true
     user: root
     ports:
       - '127.0.0.1:9882:9882'
diff --git a/playbooks/monitoring/monitoring.yml b/playbooks/monitoring/monitoring.yml
index 3d1a8b3..cadc6df 100644
--- a/playbooks/monitoring/monitoring.yml
+++ b/playbooks/monitoring/monitoring.yml
@@ -57,7 +57,7 @@
       ansible.builtin.template:
         src: docker-compose.yml.j2
         dest: /opt/beeserver/monitoring/docker-compose.yml
-        mode: '0644'
+        mode: '0600'
 
     - name: Copy prometheus config
       ansible.builtin.copy:
diff --git a/playbooks/ott/production.toml.j2 b/playbooks/ott/production.toml.j2
index 12ab5b4..6ede27e 100644
--- a/playbooks/ott/production.toml.j2
+++ b/playbooks/ott/production.toml.j2
@@ -3,7 +3,7 @@ hostname="localhost:8080"
 log = { level="info" }
 
 api_key="{{ ott_api_key }}"
-session_secret="{{ ott_api_key }}"
+session_secret="{{ ott_session_secret }}"
 
 [info_extractor.youtube]
 api_key="{{ google_api_key }}"