Ronni Baslund
3831c85285
Host provisioning for the single-server production target: SSH + firewall hardening (nftables allowlist), k3s node registration, bare-metal Stalwart install with systemd units and TLS cert-sync from the cluster secret, and Restic encrypted backup/restore (primary + DR) with timer units. Host-specific secrets live in config.env (gitignored); config.env.example is the template. Also gitignores MemPalace per-project files.
11 lines
306 B
Desktop File
11 lines
306 B
Desktop File
# Oneshot: sync the mail TLS cert from the cluster to Stalwart.
|
|
# Triggered by stalwart-cert-sync.timer.
|
|
[Unit]
|
|
Description=Sync mail.dezky.eu TLS cert from cluster to Stalwart
|
|
After=network-online.target k3s.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/opt/stalwart/cert-sync.sh
|