Ronni Baslund
3831c85285
Host provisioning for the single-server production target: SSH + firewall hardening (nftables allowlist), k3s node registration, bare-metal Stalwart install with systemd units and TLS cert-sync from the cluster secret, and Restic encrypted backup/restore (primary + DR) with timer units. Host-specific secrets live in config.env (gitignored); config.env.example is the template. Also gitignores MemPalace per-project files.
13 lines
304 B
SYSTEMD
13 lines
304 B
SYSTEMD
# Run cert-sync shortly after boot and every 12h thereafter. cert-manager
|
|
# renews well before expiry, so twice-daily comfortably picks up new certs.
|
|
[Unit]
|
|
Description=Periodic mail TLS cert sync for Stalwart
|
|
|
|
[Timer]
|
|
OnBootSec=3min
|
|
OnUnitActiveSec=12h
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|