Damien
5c6bee3335
Gitea returns HTTP 200 on a failed web login (the page is simply re-rendered with an error), so the existing traefik-auth jail, which matches on DownstreamStatus, is structurally blind to brute force on the login form. Adds a dedicated gitea-auth jail reading the forwarded application log (routed by the new 50-gitea.conf on top of #20's generic receiver), plus a Traefik-side rate limit on /user/login, /user/sign_up and /user/forgot_password as a second layer. [DEFAULT] ignoreip in jail.local guards every jail (not just gitea-auth) so a misconfigured X-Forwarded-For chain can't ban the tailnet itself — this must be in place before the jail, since the whole point is to make that failure mode structurally impossible rather than caught after the fact. conf.d/gitea.yml gains a highest-priority router that denies public access to /metrics (ipAllowList limited to loopback) while leaving it reachable on the tailnet, where Gitea's own tailscale serve answers directly. The backend also moves to https://gitea.taila5ad8.ts.net (443, no port) — the result of #19's tailscale serve --https=443 — which is NOT compatible with the previous :3000 backend of the old community-scripts deployment; only apply once the data migration has actually happened. Verified with real fail2ban/rsyslog/Traefik v3 in disposable containers: the gitea filter matches real failure log lines and misses the normal login-page line; 5 failed logins from an external IP bans it while 5 from the Tailscale CGNAT range never do (ignoreip in effect); a forwarded "gitea"-tagged message lands in /var/log/gitea/gitea.log; Traefik loads all three routers, both middlewares, and the stated priorities without error. Closes #21
infra-scripts
Public infrastructure deployment scripts designed to be executed directly via curl | bash.
Philosophy
These scripts automate the deployment of personal infrastructure components. They are:
- Self-contained: No external dependencies beyond standard Debian packages
- Idempotent-ish: Safe to re-run (where possible)
- Curl-friendly: Designed for one-liner deployment from a fresh server
- Multi-OS: Supports Debian and Alpine-based deployments, chosen per-script based on that service's requirements
- Loopback by default: Services bind to
127.0.0.1; Tailscale handles the reverse proxy and TLS termination - Log hygiene: Every long-running service ships with a
logrotateconfig (no unbounded log files) - Console auto-login: Proxmox LXCs are configured for root auto-login on
tty1(fastpct enterand Web UI shell access) - Keep it simple: One script per service, plain bash, no frameworks — readability over cleverness
Available Scripts
| Script | Description | Usage |
|---|---|---|
proxy/install.sh |
Reverse proxy with Tailscale + Nginx Proxy Manager | curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/proxy/install.sh | bash |
netlab/install.sh |
Network lab with ContainerLab | curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/netlab/install.sh | bash |
gitea-runner/install.sh |
Gitea Act Runner on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea-runner/install.sh)" |
openbao/install.sh |
OpenBao secrets manager on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/openbao/install.sh)" |
komodo/install.sh |
Komodo (Docker + MongoDB) on Alpine VM | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/komodo/install.sh)" |
Requirements
- Fresh Debian 12/13 installation (proxy, netlab) or Proxmox VE host (gitea-runner, openbao) or Alpine VM (komodo)
- User with sudo privileges (do not run as root) — except gitea-runner, openbao, and komodo which run as root
- Internet access