| Age | Commit message (Collapse) | Author |
|---|
|
adduser --disabled-password sets password field to '!' in /etc/shadow,
which OpenSSH 10.0 treats as a locked account, rejecting all logins
including pubkey auth. Setting password to '*' via usermod marks the
account as "no password login" without locking it, allowing SSH
key authentication to work.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
OpenSSH rejects login for users whose shell is not listed
in /etc/shells. Without this, SSH key auth fails with
"Permission denied" even with a valid key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
RSA keys are rejected by OpenSSH 10.0 in debian:latest
due to dropped SHA-1 signature support. Ed25519 is the
recommended key type.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
- Remove hardcoded password for git user (chpasswd line)
- Fix comment: ubuntu -> debian
- Fix volume path: /var/git -> /var/git/repos to match host layout
- Remove deprecated compose version field
- start.sh: check for .pub files directly instead of any file in keys/
- start.sh: always set repos ownership/permissions, not only when
directory is non-empty (fixes fresh start with empty repos dir)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Documents project structure, services, networking, startup order,
conventions and TODOs for Claude Code context retention.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Step-by-step instructions to build the bastion server from a fresh
Debian install: Docker, Portainer, Git Server, Ghost, Jenkins,
Nginx with SSL. Includes network architecture, startup order,
and ports summary.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Shows how to use different Docker images per stage
in a Jenkins pipeline with Docker-out-of-Docker setup.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
- Add jenkins_network to nginx compose (for reaching Jenkins container)
- Add jenkins.swave.lol server block in nginx.conf (subdomain access)
- Add /jenkins location on swave.lol (path-based access)
- Add jenkins.swave.lol to certbot certificate request
Jenkins is accessible via both https://jenkins.swave.lol
and https://swave.lol/jenkins
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
- Dockerfile extends jenkins:lts with Docker CLI and docker-workflow plugin
so Jenkins can spawn sibling build containers via host's docker.sock
- docker-compose.yaml mounts docker.sock, persists jenkins_home,
uses --prefix=/jenkins for path-based access
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
The SSL cert now covers both swave.lol and blog.swave.lol
to match the updated nginx server_name configuration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
- Fix server_name from swave.com to swave.lol on SSL block
- Add blog.swave.lol as additional server_name
- Update SSL protocols to TLSv1.2 and TLSv1.3 only (remove deprecated TLSv1/1.1)
- Use modern cipher suite
- Add reverse proxy location block to forward requests to Ghost (ghost:2368)
- Add proper proxy headers (Host, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Nginx needs access to ghost_network to reverse proxy
requests to the Ghost service.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Add Docker configurations for Ghost, Git server, and Nginx services
with documentation and architecture diagrams.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
