57_Wolve
8fbeb8f6b0
Restructure around a single entry point (automations.sh) with a Gum wizard and a self-extracting bundle for repo-less installs. Add scripts/oslib.sh so the provisioning scripts (setup-host, harden-ssh, harden-jumphost, sshuser) run on Alpine/Debian/Alma; seed root keys from globals/. - ntfy SSH-login alerts (user, source IP, key, region, jump target) via pam_exec - daily auto-updates: AUTO_REBOOT=idle reboots only when no SSH active; opt-in Alpine stable-branch upgrades (ALLOW_RELEASE_UPGRADE) - cloud-init: generic base/jumphost + per-deployment, which harden SSH by default on fresh VMs - pocket-id: optional WebFinger block (BASE_DOMAIN), tag v2.8.0 - headscale: fix oidc.expiry schema for 0.28 so the container starts - Gitea release workflow on tag (TOKEN_GITEA); repo URLs -> Gitea - README/LICENSE/.gitignore/.gitattributes (force LF)
webfinger
A single Caddy container that serves /.well-known/webfinger at an apex domain
(for OIDC issuer discovery — used by Tailscale and others) and 301-redirects
everything else to a target URL.
Required .env values
| Variable | Notes |
|---|---|
BASE_DOMAIN |
Apex domain to serve from (e.g. example.com). |
ISSUER_URL |
OIDC issuer for the WebFinger response (your pocket-id). |
REDIRECT_URL |
Where non-WebFinger traffic is redirected (path + query preserved). |
ACME_EMAIL |
Let's Encrypt registration email. |
See .env.example.
Deploy
./automations.sh # Deploy on this host → deploy: webfinger
Or build + run the self-contained artifact:
./build.sh
scp deploy.sh root@host:
ssh root@host 'bash deploy.sh'
# non-interactive:
# BASE_DOMAIN=example.com ISSUER_URL=https://auth.example.com \
# REDIRECT_URL=https://example.org ACME_EMAIL=me@example.com SKIP_PROMPTS=1 bash deploy.sh
Unattended provisioning: cloud-init.yml.
Notes
- Standalone: binds 80/443 itself, so don't co-locate with another stack that wants those ports.
- DNS for
BASE_DOMAINmust resolve to the host and 80/443 be reachable before deploy.