various fixed

playbooks/fail2ban-ingress/fail2ban-ingress.yml

@@ -8,6 +8,11 @@
         name: fail2ban
         state: present
 
+    - name: Install sudo
+      ansible.builtin.apt:
+        name: sudo
+        state: present
+
     - name: Create user
       ansible.builtin.user:
         name: fail2forward
@@ -38,6 +43,16 @@
         group: root
         mode: '0755'
 
+    - name: Allow fail2forward to run fail2ban-client
+      ansible.builtin.copy:
+        content: |
+          fail2forward ALL=(root) NOPASSWD: /usr/bin/fail2ban-client set sshd banip *, /usr/bin/fail2ban-client set sshd unbanip *
+        dest: /etc/sudoers.d/fail2forward
+        owner: root
+        group: root
+        mode: '0440'
+        validate: /usr/sbin/visudo -cf %s
+
     - name: Copy jail.local
       ansible.builtin.template:
         src: jail.local.j2

playbooks/fail2ban-ingress/fail2forward.j2

@@ -4,12 +4,12 @@ case "$SSH_ORIGINAL_COMMAND" in
   "ban "*)
     ip="${SSH_ORIGINAL_COMMAND#ban }"
     [[ "$ip" =~ ^[0-9.]+$|^[0-9a-fA-F:]+$ ]] || { echo "bad ip"; exit 1; }
-    exec fail2ban-client set sshd banip "$ip"
+    exec sudo /usr/bin/fail2ban-client set sshd banip "$ip"
     ;;
   "unban "*)
     ip="${SSH_ORIGINAL_COMMAND#unban }"
     [[ "$ip" =~ ^[0-9.]+$|^[0-9a-fA-F:]+$ ]] || { echo "bad ip"; exit 1; }
-    exec fail2ban-client set sshd unbanip "$ip"
+    exec sudo /usr/bin/fail2ban-client set sshd unbanip "$ip"
     ;;
   *)
     echo "denied" >&2; exit 1

playbooks/fail2ban/forward.conf.j2

@@ -3,9 +3,9 @@ actionstart =
 actionstop =
 actioncheck =
 
-actionban = sudo -u fail2forward ssh -i ~fail2forward/.ssh/id_rsa -o BatchMode=yes -o ConnectTimeout=5 -o ServerAliveInterval=5 <forward_user>@<forward_host> ban <ip>
+actionban = sudo -u fail2forward ssh -i ~fail2forward/.ssh/id_rsa -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 -o ServerAliveInterval=5 <forward_user>@<forward_host> ban <ip>
 
-actionunban = sudo -u fail2forward ssh -i ~fail2forward/.ssh/id_rsa -o BatchMode=yes -o ConnectTimeout=5 -o ServerAliveInterval=5 <forward_user>@<forward_host> unban <ip>
+actionunban = sudo -u fail2forward ssh -i ~fail2forward/.ssh/id_rsa -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 -o ServerAliveInterval=5 <forward_user>@<forward_host> unban <ip>
 
 [Init]
 forward_host = animeistrash.org

playbooks/matrix/docker-compose.yml.j2

@@ -1,6 +1,7 @@
 services:
     homeserver:
-        image: "forgejo.ellis.link/continuwuation/continuwuity:latest"
+        image: "forgejo.ellis.link/continuwuation/continuwuity:v0.5.10"
+        pull_policy: always
         restart: always
         command: /sbin/conduwuit
         ports:

playbooks/monitoring/docker-compose.yml.j2

@@ -47,7 +47,8 @@ services:
       - monitoring
 
   alloy:
-    image: docker.io/grafana/alloy
+    image: docker.io/grafana/alloy:v1.17.1
+    pull_policy: always
     container_name: alloy
     ports:
       - '127.0.0.1:12345:12345'
@@ -70,10 +71,10 @@ services:
     restart: always
 
   podman-exporter:
-    image: quay.io/navidys/prometheus-podman-exporter
+    image: quay.io/navidys/prometheus-podman-exporter:1.21.2
     container_name: podman-exporter
+    pull_policy: always
     restart: always
-    privileged: true
     user: root
     ports:
       - '127.0.0.1:9882:9882'

playbooks/monitoring/monitoring.yml

@@ -57,7 +57,7 @@
       ansible.builtin.template:
         src: docker-compose.yml.j2
         dest: /opt/beeserver/monitoring/docker-compose.yml
-        mode: '0644'
+        mode: '0600'
 
     - name: Copy prometheus config
       ansible.builtin.copy:

playbooks/ott/production.toml.j2

@@ -3,7 +3,7 @@ hostname="localhost:8080"
 log = { level="info" }
 
 api_key="{{ ott_api_key }}"
-session_secret="{{ ott_api_key }}"
+session_secret="{{ ott_session_secret }}"
 
 [info_extractor.youtube]
 api_key="{{ google_api_key }}"