windyboy
7ec29627fb
新增独立 HTTPS forward proxy：Traefik 新 entrypoint proxyin(:6443) 终止 TLS， 后端 sing-box（HTTP inbound + users 认证 + direct 出站），与既有 :443 nghttpx/squid 链路并存。宿主机只新增 6443/tcp；容器不发布 host 端口。 新增 compose/sing-box/（镜像 digest 钉版）与两份 runbook： - proxy-health.md：:443/:6443 只读健康检查，含开放代理负向测试 - proxy-client-setup.md：curl / env / 浏览器扩展配置与三类失败排查 （407 无认证头、页面加载不全=CDN 域名漏配、urllib/wget 不支持 TLS-to-proxy） 同批根盘回收 91%→43%（约 14G）：rust/node/.go/podman 孤儿存储/apt/journal/ 未用镜像/容器日志；journald 加 SystemMaxUse=200M；nghttpx+squid+traefik 加 json-file 轮转 10m×3；删除 ~/.cargo 后修好 zshenv/bashrc/profile 的失效 source。 验证：:6443 LE 证书、匿名 407、CONNECT 与绝对 URI 均返回 185.201.226.122； us4-gate 401 / update 200 / trlm 302；8 容器全部 Up；validate-repo.sh PASS。
3.0 KiB
3.0 KiB
Runbook index
Entry point for all runbooks. Before operational work, read the repo entry
AGENTS.md and the spec RUNBOOKS.md. New
runbooks start from _template.md.
Route by intent
| Intent | Runbook | Type |
|---|---|---|
| mailcow health check | mailcow-health.md | read-only |
| mailcow update | mailcow-update.md | change (gated) |
| mailcow SMTP/IMAP client | mailcow-smtp-client.md | reference |
| Vaultwarden health check | vaultwarden-health.md | read-only |
| Vaultwarden SQLite→PG migrate | vaultwarden-sqlite-to-postgres.md | change (destructive) |
| PowerDNS health check | pdns-health.md | read-only |
| RustDesk health check | rustdesk-health.md | read-only |
| Gitea health check | gitea-health.md | read-only |
| Matrix health check | matrix-health.md | read-only |
| Plane health check | plane-health.md | read-only |
us4 forward proxy health check (:443 + :6443) |
proxy-health.md | read-only |
| us4 forward proxy client setup (curl / env / browser) | proxy-client-setup.md | reference |
| pgdb health check | pgdb-health.md | read-only |
| pgdb DB restore (pg_restore) | pgdb-restore.md | change (procedure) |
| pgdb image/compose update | pgdb-update.md | change (gated) |
| AdGuard Home health check | adguard-home-health.md | read-only |
| Host disk cleanup (logs/apt/docker) | host-disk-cleanup.md | change (gated) |
| Matter packet capture | matter-packet-capture.md | read-only |
| Home Assistant maintenance | home-assistant-maintenance.md | change (gated) |
| matrix_e2ee integration update | matrix-e2ee-update.md | change (gated) |
| Routine Ansible operations | ansible-operations.md | change (allowlisted) |
| Linear issue → mergeable change | issue-to-merge.md | delivery |
| Failing health/playbook run | fix-ci.md | change |
| Release a reviewed change to production | release.md | change (gated) |
| Roll back a change | rollback.md | change (gated) |
| Controlled network configuration | network-change.md | change (gated) |
| Network outage / service recovery | network-recovery.md | recovery |
Notes
fix-ci.md,release.md,rollback.md,network-change.md,network-recovery.mdare adapted from the upstream guide to this repo's VPS-ops context (execution layer is Ansible + SSH + Linear, not a software CI/CD pipeline).- Health runbooks are read-only; they stop (
STOP) when live state conflicts with the expected state instead of mutating production.