Runbooks

Step-by-step procedures for building and rebuilding vinhedo hosts. Where a step is already scripted in this repo, the runbook points at the script instead of repeating it, so the two can’t drift apart.

  1. Fleet Baseline — the common build every host gets: swap, SSH hardening, UFW, Fail2Ban, NGINX with /health, Certbot, the Projects Monitor collector, unattended upgrades, weekly maintenance.
  2. vinhedo1 Build — what is specific to vinhedo1 on top of the baseline: PiVPN / WireGuard for the GitHub Actions → MariaDB tunnel, and the Grimoire API reverse proxy.

Scripted parts of the baseline live in baseline/ (deploy-swap.sh), alongside projects-monitor-access-to-OCI/ and weekly-maintenance/.

Table of contents

This site uses Just the Docs, a documentation theme for Jekyll.