fripost-ansible - Fripost ansible scripts

	Commit message (Collapse)	Author	Age	Files
*	Roundcube: improve serving of static resources.	Guilhem Moulin	2018-12-06	1
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	We only serve whitelisted extensions (css, js, png, etc.), and only for some selected sub-directories. Access to everything else (incl. log files and config files) is denied with a 404. This is unlike upstream's .htaccess file, which blacklists restricted locations and happily serves the rest: https://github.com/roundcube/roundcubemail/blob/master/.htaccess#L8 To find out which extensions exist on the file system, run find -L /var/lib/roundcube/{plugins,program/js,program/resources,skins} -type f \ \| sed -n 's/.*\.//p' \| sort \| uniq -c
*	Remove trailing spaces.	Guilhem Moulin	2018-12-05	3
\|
*	DKIM: also include the "d=" tag in key filenames, not only the "s=" tag.	Guilhem Moulin	2018-12-05	7
\| \| \| \| \|	While the combination of "s=" tag (selector) & "d=" tag signing domain maps to a unique key, the selector alone doesn't necessarily.
*	Upgrade DKIM keys to rsa2048, and allow for multiple keys.	Guilhem Moulin	2018-12-04	7
\|
*	Don't include hostname in ansible headers.	Guilhem Moulin	2018-12-03	1
\|
*	gencerts: Also show the algorithm for SSH host keys.	Guilhem Moulin	2018-12-03	1
\|
*	Install unbound on metal hosts.	Guilhem Moulin	2018-12-03	4
\| \| \| \|	(A validating, recursive, caching DNS resolver.)
*	Define new host "calima" serving Nextcloud.	Guilhem Moulin	2018-12-03	19
\|
*	Upgrade wiki baseline to Debian Stretch.	Guilhem Moulin	2018-12-03	4
\|
*	Upgrade MX baseline to Debian Stretch.	Guilhem Moulin	2018-12-03	2
\|
*	Upgrade webmail baseline to Debian Stretch.	Guilhem Moulin	2018-12-03	7
\|
*	ssh_known_hosts: also list ed25519 host (pub)keys.	Guilhem Moulin	2018-12-03	1
\|
*	Upgrade syntax to Ansible 2.7 (apt module).	Guilhem Moulin	2018-12-03	25
\|
*	certs/gencerts.sh: wibble	Guilhem Moulin	2018-12-03	1
\|
*	Postfix: replace cdb & btree tables with lmdb ones.	Guilhem Moulin	2018-12-03	15
\| \| \| \|	Cf. lmdb_table(5).
*	IPsec: allow ISAKMP over IPv6.	Guilhem Moulin	2018-12-03	2
\|
*	Upgrade baseline to Debian Stretch.	Guilhem Moulin	2018-12-03	23
\|
*	Skip samhain installation.	Guilhem Moulin	2018-12-03	4
\| \| \| \|	It's become too verbose (too many false-positive)…
*	Harden anti spam on the MX:es.	Guilhem Moulin	2018-06-09	6
\|
*	More logcheck-database tweaks.	Guilhem Moulin	2018-04-04	3
\|
*	lacme: explicitely bind to [::]:80.	Guilhem Moulin	2018-04-04	1
\|
*	Postfix: replace 'fifo' types with 'unix', as it's the new default.	Guilhem Moulin	2018-04-04	1
\|
*	sympa: wibble	Guilhem Moulin	2018-04-04	2
\|
*	Firewall: Allow DNS queries over TCP.	Guilhem Moulin	2018-04-04	1
\|
*	APT: use deb.debian.org as archive source.	Guilhem Moulin	2018-04-04	1
\|
*	Postscreen: improve DNSBL sites and scores.	Guilhem Moulin	2018-04-04	1
\|
*	Amavis: bind server to INADDR_LOOPBACK	Guilhem Moulin	2018-04-04	1
\|
*	Perform recipient address verification on the MSA itself.	Guilhem Moulin	2018-04-04	4
\|
*	LDAP: Expose part of the database to Nextcloud.	Guilhem Moulin	2018-04-04	2
\|
*	Upgrade syntax to Ansible 2.5.	Guilhem Moulin	2018-04-04	5
\|
*	Upgrade syntax to Ansible 2.4.	Guilhem Moulin	2017-11-23	7
\|
*	More logcheck-database tweaks.	Guilhem Moulin	2017-09-14	3
\|
*	Fix detection of KVM guests.	Guilhem Moulin	2017-07-29	3
\|
*	rkhunter: Disable remote updates to fix CVE-2017-7480.	Guilhem Moulin	2017-07-29	1
\|
*	Use MariaDB as default MySQL flavor.	Guilhem Moulin	2017-07-29	6
\|
*	Don't install debsecan anymore by default.	Guilhem Moulin	2017-06-26	2
\| \| \| \|	https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=789196
*	MySQL: Use a single InnoDB file per table.	Guilhem Moulin	2017-06-15	1
\|
*	Webmail: don't allow outgoing TCP/993 connections.	Guilhem Moulin	2017-06-15	1
\| \| \| \|	We're going through IPsec to communicate with the IMAP server.
*	postfix-sender-login: strip extension before lookup.	Guilhem Moulin	2017-06-13	1
\| \| \| \| \| \|	Users can add an extension (following postconf(5)'s $recipient_delimiter) to the local part of any envelope sender address already allowed.
*	More logcheck-database tweaks.	Guilhem Moulin	2017-06-07	1
\|
*	postfix-msa: anonymize SASL-authenticated senders using IPv6.	Guilhem Moulin	2017-06-06	1
\|
*	dovecot-auth-proxy: Fix synopsis line.	Guilhem Moulin	2017-06-05	1
\|
*	postscreen: lower zen.spamhaus.org DNSBL score from 3 to 2 on the MX:es.	Guilhem Moulin	2017-06-05	1
\| \| \| \| \|	So being listed on that BL doesn't yield a flat reject if the IP isn't also listed to other lists.
*	postfix-sender-login: wibble	Guilhem Moulin	2017-06-05	2
\|
*	dovecot: enable user iteration and add a cronjob for `doveadm purge -A`	Guilhem Moulin	2017-06-05	9
\|
*	move postfix-sender-login.{service,socket} to files/.	Guilhem Moulin	2017-06-02	2
\|
*	postfix: enable XFORWARD command from our internal relays.	Guilhem Moulin	2017-06-02	1
\|
*	postfix: don't rate-limit our IPsec subnet.	Guilhem Moulin	2017-06-02	3
\|
*	postfix-sender-login: terminate the worker after 32*$nProc connections to ↵	Guilhem Moulin	2017-06-01	1
\| \| \| \|	release ressources.
*	postfix-sender-login: handle EINTR in read(2) and write(2) calls.	Guilhem Moulin	2017-06-01	1
\|