windyboy
7ec29627fb
新增独立 HTTPS forward proxy：Traefik 新 entrypoint proxyin(:6443) 终止 TLS， 后端 sing-box（HTTP inbound + users 认证 + direct 出站），与既有 :443 nghttpx/squid 链路并存。宿主机只新增 6443/tcp；容器不发布 host 端口。 新增 compose/sing-box/（镜像 digest 钉版）与两份 runbook： - proxy-health.md：:443/:6443 只读健康检查，含开放代理负向测试 - proxy-client-setup.md：curl / env / 浏览器扩展配置与三类失败排查 （407 无认证头、页面加载不全=CDN 域名漏配、urllib/wget 不支持 TLS-to-proxy） 同批根盘回收 91%→43%（约 14G）：rust/node/.go/podman 孤儿存储/apt/journal/ 未用镜像/容器日志；journald 加 SystemMaxUse=200M；nghttpx+squid+traefik 加 json-file 轮转 10m×3；删除 ~/.cargo 后修好 zshenv/bashrc/profile 的失效 source。 验证：:6443 LE 证书、匿名 407、CONNECT 与绝对 URI 均返回 185.201.226.122； us4-gate 401 / update 200 / trlm 302；8 容器全部 Up；validate-repo.sh PASS。
46 lines
3.0 KiB
Markdown
46 lines
3.0 KiB
Markdown
# Runbook index
|
|
|
|
Entry point for all runbooks. Before operational work, read the repo entry
|
|
[`AGENTS.md`](../AGENTS.md) and the spec [`RUNBOOKS.md`](../RUNBOOKS.md). New
|
|
runbooks start from [`_template.md`](_template.md).
|
|
|
|
## Route by intent
|
|
|
|
| Intent | Runbook | Type |
|
|
|---|---|---|
|
|
| mailcow health check | [mailcow-health.md](mailcow-health.md) | read-only |
|
|
| mailcow update | [mailcow-update.md](mailcow-update.md) | change (gated) |
|
|
| mailcow SMTP/IMAP client | [mailcow-smtp-client.md](mailcow-smtp-client.md) | reference |
|
|
| Vaultwarden health check | [vaultwarden-health.md](vaultwarden-health.md) | read-only |
|
|
| Vaultwarden SQLite→PG migrate | [vaultwarden-sqlite-to-postgres.md](vaultwarden-sqlite-to-postgres.md) | change (destructive) |
|
|
| PowerDNS health check | [pdns-health.md](pdns-health.md) | read-only |
|
|
| RustDesk health check | [rustdesk-health.md](rustdesk-health.md) | read-only |
|
|
| Gitea health check | [gitea-health.md](gitea-health.md) | read-only |
|
|
| Matrix health check | [matrix-health.md](matrix-health.md) | read-only |
|
|
| Plane health check | [plane-health.md](plane-health.md) | read-only |
|
|
| us4 forward proxy health check (`:443` + `:6443`) | [proxy-health.md](proxy-health.md) | read-only |
|
|
| us4 forward proxy client setup (curl / env / browser) | [proxy-client-setup.md](proxy-client-setup.md) | reference |
|
|
| pgdb health check | [pgdb-health.md](pgdb-health.md) | read-only |
|
|
| pgdb DB restore (pg_restore) | [pgdb-restore.md](pgdb-restore.md) | change (procedure) |
|
|
| pgdb image/compose update | [pgdb-update.md](pgdb-update.md) | change (gated) |
|
|
| AdGuard Home health check | [adguard-home-health.md](adguard-home-health.md) | read-only |
|
|
| Host disk cleanup (logs/apt/docker) | [host-disk-cleanup.md](host-disk-cleanup.md) | change (gated) |
|
|
| Matter packet capture | [matter-packet-capture.md](matter-packet-capture.md) | read-only |
|
|
| Home Assistant maintenance | [home-assistant-maintenance.md](home-assistant-maintenance.md) | change (gated) |
|
|
| matrix_e2ee integration update | [matrix-e2ee-update.md](matrix-e2ee-update.md) | change (gated) |
|
|
| Routine Ansible operations | [ansible-operations.md](ansible-operations.md) | change (allowlisted) |
|
|
| Linear issue → mergeable change | [issue-to-merge.md](issue-to-merge.md) | delivery |
|
|
| Failing health/playbook run | [fix-ci.md](fix-ci.md) | change |
|
|
| Release a reviewed change to production | [release.md](release.md) | change (gated) |
|
|
| Roll back a change | [rollback.md](rollback.md) | change (gated) |
|
|
| Controlled network configuration | [network-change.md](network-change.md) | change (gated) |
|
|
| Network outage / service recovery | [network-recovery.md](network-recovery.md) | recovery |
|
|
|
|
## Notes
|
|
|
|
- `fix-ci.md`, `release.md`, `rollback.md`, `network-change.md`, `network-recovery.md`
|
|
are adapted from the upstream guide to this repo's VPS-ops context (execution
|
|
layer is Ansible + SSH + Linear, not a software CI/CD pipeline).
|
|
- Health runbooks are read-only; they stop (`STOP`) when live state conflicts
|
|
with the expected state instead of mutating production.
|