timothykim
fcc720ee7b
fix cert handler deleting nginx conf file
2026-03-28 17:48:09 -04:00
timothykim
123af3a269
remove ssl stapling
Deploy nginx / deploy (push) Successful in 4s
Deploy nginx / test (push) Failing after 7s
2026-03-28 17:15:12 -04:00
timothykim
cf26235d70
add hcsuzuki.music
Deploy hcsuzuki.music / deploy (push) Successful in 28s
Deploy nginx / deploy (push) Failing after 4s
Deploy nginx / test (push) Has been skipped
2026-03-28 13:37:49 -04:00
timothykim
111969fa9c
e2e test
2026-03-27 16:19:21 -04:00
timothykim
c87f76a78a
rename new-service.sh to service.sh with subcommands
2026-03-27 12:28:32 -04:00
timothykim
313fb4655f
updated workflow
Deploy beszel / deploy (push) Successful in 4s
2026-03-26 20:02:09 -04:00
timothykim
81151f90aa
update the deploy and new service
2026-03-26 20:01:06 -04:00
timothykim
78773110fc
update beszel compose
2026-03-26 23:49:41 +00:00
timothykim
8762339713
add beszel
2026-03-26 19:45:19 -04:00
timothykim
697de3e199
add uptimerobot monitor subcommand to app.sh
2026-03-26 13:13:41 -04:00
timothykim
43fc8c2e7b
remove new-app.sh, update docs to reference app.sh directly
2026-03-20 20:14:16 -04:00
timothykim
787e747fa4
fix deploy re-exec not forwarding command argument
2026-03-20 20:10:32 -04:00
timothykim
7b1a888db0
add workflow_dispatch and self-trigger paths to all workflows
Deploy haanmind.net / deploy (push) Failing after 1s
Deploy hantim.net / deploy (push) Failing after 1s
Deploy hcsuzuki.net / deploy (push) Failing after 1s
Deploy nginx / deploy (push) Failing after 1s
Deploy nginx / test (push) Has been skipped
Deploy thekims.family / deploy (push) Failing after 1s
Deploy timothykim.net / deploy (push) Failing after 1s
Provision server / provision (push) Successful in 11s
Deploy garage / deploy (push) Successful in 5s
2026-03-20 20:03:11 -04:00
timothykim
a37872489c
add certbot email, pin git pull to origin main
2026-03-20 19:57:45 -04:00
timothykim
de1d60b1db
remove standalone certbot fallback, fail on missing certs
2026-03-20 19:50:44 -04:00
timothykim
c8c79a542a
re-exec deploy.sh after git pull to pick up changes
Deploy nginx / deploy (push) Successful in 3s
Deploy nginx / test (push) Successful in 7s
2026-03-20 17:01:36 -04:00
timothykim
b2bb8fa5eb
clarify default server block comment
Deploy nginx / deploy (push) Successful in 4s
Deploy nginx / test (push) Successful in 8s
2026-03-20 16:57:08 -04:00
timothykim
729eadee33
use *.*.conf glob to match only domain conf files for cert issuance
2026-03-20 16:55:52 -04:00
timothykim
4b39eaaf06
skip default server block in cert issuance, remove ssh debug lines
2026-03-20 16:53:47 -04:00
timothykim
085b0bdd1b
clean up trailing newline in nginx.conf
Deploy nginx / deploy (push) Failing after 4s
Deploy nginx / test (push) Has been skipped
2026-03-20 16:51:09 -04:00
timothykim
020e7b2950
retrigger nginx deploy for host key test
Deploy nginx / deploy (push) Failing after 5s
Deploy nginx / test (push) Has been skipped
2026-03-20 16:43:54 -04:00
timothykim
9a9df25742
retrigger nginx deploy for host key debug
Deploy nginx / deploy (push) Failing after 0s
Deploy nginx / test (push) Has been skipped
2026-03-20 16:41:27 -04:00
timothykim
6e2ec87ccf
debug host key pinning in nginx workflow
2026-03-20 16:40:37 -04:00
timothykim
77e08f34cf
retrigger nginx deploy for host key test
Deploy nginx / deploy (push) Failing after 0s
Deploy nginx / test (push) Has been skipped
2026-03-20 16:38:40 -04:00
timothykim
061213bf7e
retrigger nginx deploy for host key test
Deploy nginx / deploy (push) Failing after 0s
Deploy nginx / test (push) Has been skipped
2026-03-20 16:35:34 -04:00
timothykim
03e45dc6f2
trigger nginx deploy to test host key pinning
Deploy nginx / deploy (push) Failing after 0s
Deploy nginx / test (push) Has been skipped
2026-03-20 16:33:15 -04:00
timothykim
16ea39811d
document deploy host key variable in readme
2026-03-20 16:31:54 -04:00
timothykim
7daf7a267b
pin ssh host key in all workflows
2026-03-20 16:31:03 -04:00
timothykim
5abfca19b3
restrict envsubst to expected variables only
Deploy garage / deploy (push) Failing after 2s
2026-03-20 16:25:23 -04:00
timothykim
9e3996a72b
remove security.md from repo, add to gitignore
2026-03-20 16:17:23 -04:00
timothykim
163aefddee
add default server block to drop unknown host headers
2026-03-20 16:12:06 -04:00
timothykim
3a1ef3a167
fix tls tests to load system ca certificates
2026-03-20 16:07:32 -04:00
timothykim
cce9b5c4c4
add ssl/tls hardening to nginx
2026-03-20 16:05:41 -04:00
timothykim
2bcf67dcc4
fetch secrets by uuid instead of listing all
2026-03-20 15:51:43 -04:00
timothykim
b19e194c0b
remove deploy user from docker group
2026-03-20 15:38:11 -04:00
timothykim
1a7f823a87
restrict garage admin api to home ip
2026-03-20 15:33:36 -04:00
timothykim
0ca8394f8a
add testing section to readme
2026-03-20 15:22:58 -04:00
timothykim
e767ab3235
test -> tests
2026-03-20 15:20:29 -04:00
timothykim
50ab425e8f
fix test directory path in deploy-nginx workflow
2026-03-20 15:19:41 -04:00
timothykim
b7439b23e3
fix nginx security headers not being applied to https responses
...
nginx add_header inheritance meant X-Content-Type-Options and X-Frame-Options
were silently dropped from all https server blocks. moved all security headers
into a shared snippet (security-headers.inc) included per server block. added
pytest-based header verification that auto-discovers sites from conf files.
2026-03-20 15:11:56 -04:00
timothykim
3b41653c04
refactor new-app into app.sh with subcommands
2026-03-20 14:43:47 -04:00
timothykim
eecdf7b002
restructure docs: eliminate duplication across md files
2026-03-20 11:42:06 -04:00
timothykim
be1ad6b456
audit fixes: error handling, docs consistency, bucket idempotency
Provision server / provision (push) Successful in 12s
2026-03-20 11:28:36 -04:00
timothykim
6b1e78350f
document media hosting in readme and usecases
2026-03-19 22:34:47 -04:00
timothykim
4516ed7bab
add media setup instructions to new-app.sh output
2026-03-19 22:31:02 -04:00
timothykim
f9788ff178
fix s3 proxy: forward host header for signature validation
Deploy nginx / deploy (push) Successful in 3s
2026-03-19 21:55:37 -04:00
timothykim
da99d102e9
add s3.hantim.net proxy, fix dns ttl to 3600
Deploy nginx / deploy (push) Successful in 13s
2026-03-19 18:23:39 -04:00
timothykim
a421ecc837
add garage admin api with token, expose via garage.hantim.net
Deploy garage / deploy (push) Successful in 5s
Deploy nginx / deploy (push) Successful in 13s
2026-03-19 17:19:03 -04:00
timothykim
a64f81f503
upgrade garage to v2.2.0, add /media/ proxy to nginx
Deploy garage / deploy (push) Successful in 7s
Deploy nginx / deploy (push) Successful in 3s
2026-03-19 16:45:22 -04:00
timothykim
df179546ae
update docs, fix deploy to not restart unchanged services
...
- deploy.sh: use compose up instead of down+up, fetch secrets individually
- configure.sh: delegate all service deployment to deploy.sh
- docs: add garage cluster init, .env.keys mechanism, update configure.sh description
- remove 2>/dev/null from bws calls
2026-03-19 12:39:55 -04:00
timothykim