12542ecb19
Pocket ID replaces Forgejo as the OIDC provider for Outline, Vaultwarden and NetBird; Forgejo logs in through it. Uptime Kuma sits behind tinyauth via Caddy forward_auth (group ops), the public status page stays public. offboarding/offboard.py switches one person off in every service with an API and prints what a human still has to do: the shared passwords they could read. Measured: SSO lock alone left 10 of 13 ways open for 45 minutes; the script leaves 1 of 14, the vault copy on their laptop. HARDENING.md: the ufw hairpin that broke Vaultwarden SSO and Kuma, the mesh route into the docker bridges, and a fail2ban exception for Pocket ID.
10 lines
158 B
Text
10 lines
158 B
Text
.env
|
|
runner-config.yml
|
|
backup/.restic-env
|
|
backup/dumps/
|
|
backup/backup.log
|
|
.playwright-mcp/
|
|
logs/
|
|
ops-readonly/token.env
|
|
offboarding/offboard.env
|
|
__pycache__/
|