notplantsandClaude Fable 5.1 8f7f125fc0 cc-ci host: no tailscale; fail2ban; opencode UI public on 8443 with the LE wildcard ...

Operator 2026-09-07: the combined host stays off the tailnet. ssh is
key-only (password + keyboard-interactive auth off), the opencode UI is
served as oc.ci.commoninternet.net on 8443 — TLS from the CI server's
*.ci.commoninternet.net ACME cert (new orchestrator-host option
opencodeUiAcmeHost; nginx joins the acme group) behind the existing basic
auth — and fail2ban watches sshd plus nginx's 401s (nginx-http-auth jail).
tailscaled ordering dropped from the orchestrator units. README updated.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

2026-09-07 20:45:59 +00:00

..

configuration.nix

cc-ci host: no tailscale; fail2ban; opencode UI public on 8443 with the LE wildcard

2026-09-07 20:45:59 +00:00

hardware.nix

nix/hosts/cc-ci: real hardware + networking from the box; document the infect fixes

2026-09-07 20:15:16 +00:00

networking.nix

nix/hosts/cc-ci: real hardware + networking from the box; document the infect fixes

2026-09-07 20:15:16 +00:00

ssh-keys

nix: one Hetzner host for the CI server + the orchestrator (#cc-ci)

2026-09-07 19:58:33 +00:00