Bastian de Byl
f11391b28f
Caddy was rotating on implicit defaults (100MiB/keep 10/90d) that were not holding -- 20 rotated files per stream and a 190-day-old .gz, 1.3 GB across 16 log streams. Made explicit at 10MiB/keep 3/7d. Note roll_size et al are subdirectives of `output file`, NOT of `log`. Getting that wrong does not degrade gracefully: Caddy refuses to start on a bad config, so every site went down until it was corrected. Worth a `caddy validate` gate before reload. journald had no SystemMaxUse and had reached 4 GB, drifting toward its 10%-of-filesystem default (~190 GB on this root). Capped at 500M. Both are safe to keep short because fluent-bit ships the journal and every Caddy access log into Graylog -- though note its GELF output has been erroring for days, which weakens that premise and wants investigating. The larger find was unrelated to logs: 896 images totalling 59.6 GB with 75% unused (94 tags of greg-time-bot, 73 of fulfillr -- one per deploy) and 5.4 GB of dangling volumes, mostly 804 MB Nextcloud /var/www/html trees orphaned by container recreations. Pruned to 22 images / 15.4 GB, and added a weekly timer keeping 30 days so a rollback still needs no rebuild. Also dropped the decommissioned 6379/tcp redis rule (nothing listening; Immich's redis is on the shared podman network) and the orphaned nosql, s3 and searxng volume dirs. Backup log exclusions turned out to be unnecessary: Gitea logs to console so its log dirs are empty, Nextcloud already excludes its own, BookStack mounts only uploads, and Caddy is not backed up. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
73 lines
1.4 KiB
YAML
73 lines
1.4 KiB
YAML
---
|
|
- name: set required podman firewall rules
|
|
become: true
|
|
ansible.posix.firewalld:
|
|
port: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: enabled
|
|
loop:
|
|
- "{{ syslog_udp_default }}/udp"
|
|
- "{{ syslog_udp_error }}/udp"
|
|
- "{{ syslog_udp_unifi }}/udp"
|
|
# web server (Caddy)
|
|
- 80/tcp
|
|
- 443/tcp
|
|
# Gitea Skudak SSH
|
|
- 2222/tcp
|
|
# BookStack (wiki.skudak.com) -- container publishes 6875:8080
|
|
- 6875/tcp
|
|
# Satisfactory
|
|
- 7777/tcp
|
|
- 7777/udp
|
|
- 15000/udp
|
|
- 15000/tcp
|
|
- 15777/udp
|
|
- 15777/tcp
|
|
# Factorio
|
|
- 27015/tcp
|
|
- 34197/udp
|
|
# Zomboid
|
|
- 16261/udp
|
|
- 16262/udp
|
|
# crafty
|
|
- 8443/tcp
|
|
# minecraft
|
|
- 25565/tcp
|
|
- 25565/udp
|
|
notify: restart firewalld
|
|
tags: firewall
|
|
|
|
- name: unset non-required podman firewall rules
|
|
become: true
|
|
ansible.posix.firewalld:
|
|
port: "{{ item }}"
|
|
permanent: true
|
|
immediate: true
|
|
state: disabled
|
|
loop:
|
|
- 1153/tcp
|
|
- 1153/udp
|
|
- 2000/udp
|
|
- 2456/udp
|
|
- 2457/udp
|
|
- 9093/tcp
|
|
- 9092/tcp
|
|
- 9091/tcp
|
|
- 9091/udp
|
|
- 9092/udp
|
|
# cam2ip
|
|
- 56000/tcp
|
|
- 56000/udp
|
|
# Palworld
|
|
- 8211/udp
|
|
- 25575/udp
|
|
# bunkerweb waf test ports
|
|
- 1080/tcp
|
|
- 1443/tcp
|
|
- 7000/tcp
|
|
# gelf-proxy (removed - now using GELF HTTP via Caddy)
|
|
- 12201/udp
|
|
notify: restart firewalld
|
|
tags: firewall
|