Commit Graph

78 Commits

Author SHA1 Message Date
Daniel Micay
e581aeafb5 use idle CPU scheduling mode for updatedb 2024-01-03 10:10:04 -05:00
Daniel Micay
dc4101f3de update systemd configuration files 2023-12-07 12:33:59 -05:00
Daniel Micay
15f1cbcd02 nginx: drop ExecStart override 2023-09-18 02:41:59 -04:00
Daniel Micay
90411f367c update OCSP cache path for certbot-renew.service 2023-09-02 15:07:28 -04:00
Daniel Micay
e1af23a478 add attestation service config for email 2023-08-18 23:57:44 -04:00
Daniel Micay
894f150a62 use CAKE no-split-gso for release servers 2023-08-06 23:18:53 -04:00
Daniel Micay
2f56bae4a5 use consistent naming for system drop-in configs 2023-08-04 14:45:15 -04:00
Daniel Micay
e56add4330 run fstrim daily instead of weekly 2023-08-04 14:38:41 -04:00
Daniel Micay
b67d037a5e add xfs_fsr service run before fstrim service 2023-08-03 16:35:53 -04:00
Daniel Micay
124897ccba update systemd/system.conf 2023-08-01 18:06:28 -04:00
Daniel Micay
7a95f6bfb4 update systemd/networkd.conf 2023-08-01 18:05:17 -04:00
Daniel Micay
53b46f6166 set correct subnet mask for BuyVM main IP 2023-07-28 00:12:05 -04:00
Daniel Micay
5e07ae005b use idle scheduling for fstrim.service 2023-07-26 13:21:24 -04:00
Daniel Micay
6595a2b05f rename eth0 to public
This resolves a warning from systemd-networkd about using one of the
names reserved by the kernel.
2023-07-15 00:33:35 -04:00
Daniel Micay
b245498612 disable unused DHCP IPv4 address for mail server 2023-07-13 21:39:12 -04:00
Daniel Micay
6736cdc36f use highest accuracy for sysstat-collect.timer 2023-07-13 18:51:39 -04:00
Daniel Micay
6567335b31 run sysstat-collect.service every minute 2023-07-13 18:51:28 -04:00
Daniel Micay
5f339efb2d update certbot-ocsp-fetcher 2023-07-09 18:16:59 -04:00
Daniel Micay
462bdc8599 add session ticket key management scripts 2023-07-09 18:04:17 -04:00
Daniel Micay
8ac489c9aa allow nginx master process to use CAP_CHOWN
This is required for it to create the /var directories it uses when the
master process is running as root. It would be possible to run the nginx
master process as non-root but it doesn't drop ambient capabilities when
it spawns the workers so running the master process as non-root will end
up giving the workers higher privileges due to them ending up getting
the CAP_NET_BIND_SERVICE capability passed through.
2023-07-06 05:30:35 -04:00
Daniel Micay
2cf694017b silence systemd-networkd address prefix warning
It does the right thing by default now but it still produces a warning,
so silence it.
2023-07-06 04:39:16 -04:00
Daniel Micay
5777fa38ae add network configuration for 1.grapheneos.network 2023-07-06 04:30:23 -04:00
Daniel Micay
2f4e9f67c4 set log retention time per server 2023-07-06 00:17:05 -04:00
Daniel Micay
5ea36399d1 rename 1.grapheneos.network to 2.grapheneos.network 2023-07-05 17:31:48 -04:00
Daniel Micay
a97e039314 rename 2.grapheneos.network to 3.grapheneos.network 2023-07-05 17:31:30 -04:00
Daniel Micay
37bf4935f1 drop mail server specific certbot configuration
The mail server is now using the webroot authentication method via nginx
due to moving the MTA-STS web service to the mail server.
2023-06-30 15:47:33 -04:00
Daniel Micay
8114047b9b add new website server instance 2023-06-30 15:45:09 -04:00
Daniel Micay
2641d41169 move staging.attestation.app to BuyVM 2023-06-29 13:14:50 -04:00
Daniel Micay
f9bee29ab8 move staging.grapheneos.org to BuyVM 2023-06-23 14:41:01 -04:00
Daniel Micay
2f4218fc77 move ns1.staging.grapheneos.org to BuyVM 2023-06-22 12:41:26 -04:00
Daniel Micay
254e628a79 move staging.ns1.grapheneos.org to ns1.staging.grapheneos.org 2023-06-22 00:27:08 -04:00
Daniel Micay
f1d9c0693e disable link-local addressing 2023-06-21 23:10:09 -04:00
Daniel Micay
384c29bd5e simplify route metric configuration 2023-06-21 22:56:50 -04:00
Daniel Micay
d0d72994e2 replace ns2.grapheneos.org network configuration 2023-06-16 20:30:29 -04:00
Daniel Micay
27aca7474c drop no-op RemoveIPC 2023-06-10 20:42:37 -04:00
Daniel Micay
ac23681718 update systemd/system.conf 2023-03-30 03:17:00 -04:00
Daniel Micay
7ffac9ab5a raise max journald files 2023-03-29 00:15:04 -04:00
Daniel Micay
c573091af4 use per-host journald SystemMaxUse 2023-03-25 07:04:46 -04:00
Daniel Micay
d550ccbc73 update sleep.conf 2023-02-17 17:51:41 -05:00
Daniel Micay
68a73e798a update system.conf 2023-02-17 17:51:24 -05:00
Daniel Micay
7fc42a25c4 remove Arch Linux nginx error_log configuration
error_log works the same way as add_header where defining it again on
the same level is additive and logs to both places, meaning that there
are duplicated logs when defining a proper syslog error_log output at
the top level.
2023-02-17 17:31:00 -05:00
Daniel Micay
3ea5a14b2f drop floating IPs for DNS servers 2022-11-30 19:23:18 -05:00
Daniel Micay
91e36044ca drop floating IPs for release servers 2022-11-29 02:26:51 -05:00
Daniel Micay
9f1ba5f2a5 drop floating IPs for website servers 2022-11-29 02:07:56 -05:00
Daniel Micay
3354bcb34d drop floating IPs for network servers 2022-11-29 02:07:05 -05:00
Daniel Micay
ace45c7d5c drop floating IP for attestation server 2022-11-29 01:39:15 -05:00
Daniel Micay
9929542f43 drop floating IP for forum server 2022-11-29 01:27:01 -05:00
Daniel Micay
38414a8313 drop floating IP for Matrix server 2022-11-29 01:26:31 -05:00
Daniel Micay
0aff07f884 add grapheneos.social network configuration 2022-11-27 01:41:42 -05:00
Daniel Micay
08da28f7b5 drop floating IPs for staging servers 2022-11-27 00:08:29 -05:00