b2d2a5bb1c
## Context An audit of the mailserver stack raised the question: why is Fail2ban disabled in the docker-mailserver deployment? The setting `ENABLE_FAIL2BAN = "0"` lives in the env ConfigMap at `stacks/mailserver/modules/mailserver/main.tf:68` with no documented rationale, which made the decision look accidental rather than deliberate. The decision is deliberate: CrowdSec is the cluster-wide bouncer for SSH, HTTP, and SMTP/IMAP brute-force defence. It already tails `postfix` + `dovecot` logs via the installed collections and enforces decisions at the LB/firewall tier with real client IPs preserved by `externalTrafficPolicy: Local` on the dedicated MetalLB IP. Enabling Fail2ban in-pod would duplicate that response path — two systems racing to ban the same offender from different enforcement points, iptables churn inside the container, and a split audit trail across two decision stores. User decision 2026-04-18: keep disabled, document the decision so the next auditor doesn't have to re-derive it. ## This change Adds a new subsection "Fail2ban Disabled (CrowdSec is the Policy)" to the Security section of `docs/architecture/mailserver.md`, placed immediately after the existing CrowdSec Integration block. The paragraph cites `stacks/mailserver/modules/mailserver/main.tf:68` (where `ENABLE_FAIL2BAN = "0"` lives) and explains why duplicating the layer would make things worse, not better. Pure docs — no Terraform touched. ## Test Plan ### Automated None — docs-only change. No tests, lint, or type checks apply to markdown prose. ### Manual Verification 1. `less infra/docs/architecture/mailserver.md` — locate the Security section; confirm the new "Fail2ban Disabled (CrowdSec is the Policy)" subsection appears between "CrowdSec Integration" and "Rspamd". 2. Render on GitHub or via a markdown previewer; confirm the inline link to `main.tf` resolves and the paragraph reads cleanly. 3. `grep -n 'ENABLE_FAIL2BAN' infra/stacks/mailserver/modules/mailserver/main.tf` — confirm it still reports the value on line 68, matching the citation in the doc. Closes: code-zhn Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| architecture | ||
| plans | ||
| post-mortems | ||
| runbooks | ||
| README.md | ||
Infrastructure Documentation
This repository contains the configuration and documentation for a homelab Kubernetes cluster running on Proxmox. The infrastructure hosts 70+ services managed declaratively with Terraform and Terragrunt.
Quick Reference
Network Ranges
- Physical Network:
192.168.1.0/24- Physical devices and host network - Management VLAN 10:
10.0.10.0/24- Infrastructure VMs and management - Kubernetes VLAN 20:
10.0.20.0/24- Kubernetes cluster network
Key URLs
- Public:
viktorbarzin.me - Internal:
viktorbarzin.lan
Architecture Documentation
| Document | Description |
|---|---|
| Overview | Infrastructure overview, hardware specs, VM inventory, and service catalog |
| Networking | Network topology, VLANs, routing, and firewall rules |
| VPN | Headscale mesh VPN and Cloudflare Tunnel configuration |
| Storage | TrueNAS NFS, democratic-csi, and persistent volume management |
| Authentication | Authentik SSO, OIDC flows, and service integration |
| Security | CrowdSec IPS, Kyverno policies, and security controls |
| Monitoring | Prometheus, Grafana, Loki, and observability stack |
| Secrets Management | HashiCorp Vault integration and secret rotation |
| CI/CD | Woodpecker CI pipeline and deployment automation |
| Backup & DR | Backup strategy, disaster recovery, and restore procedures |
| Compute | Proxmox VMs, GPU passthrough, K8s resource management, and VPA |
| Databases | PostgreSQL, MySQL, Redis, and database operators |
| Multi-tenancy | Namespace isolation, tier system, and resource quotas |
Operations
- Runbooks - Step-by-step operational procedures
- Plans - Infrastructure change plans and rollout strategies
Getting Started
- Review the Overview for a high-level understanding
- Read the Networking doc to understand connectivity
- Check Compute for resource management patterns
- Explore individual architecture docs based on your area of interest