Test2

.github/workflows/enforce-rebase.yml

@@ -0,0 +1,24 @@
+# This workflow will fail if the branch contains a merge commit or if
+# it isn't based on master.
+#
+# Caveat: It runs at push time, so if master moves after the branch is
+# push, this will still pass.  A merge queue is likely needed to solve
+# this.
+# https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/merging-a-pull-request-with-a-merge-queue
+# Another workaround is that mergers could re-run just this workflow.
+name: Enforce Rebasing
+
+on: [push]
+
+jobs:
+  rebase_job:
+    runs-on: ubuntu-latest
+    name: Enforce rebasing
+
+    steps:
+    - name: Check out code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Is Rebased on master?
+      uses: rspier/enforce-rebase@master

bootstrap/selfconfig-root

@@ -68,13 +68,13 @@ my @required_debs = qw(
  libexpat1-dev
  libgetopt-long-descriptive-perl
  libpath-tiny-perl
+ libsasl2-modules
  libssl-dev
  nginx
  python3-certbot-nginx
+ ufw
  unzip
  zlib1g-dev
- libsasl2-modules
- ufw
 );
 
 run_cmd(qw(apt-get -o DPkg::Lock::Timeout=60 install -y), @required_debs);

doc/install-prod.md

@@ -66,6 +66,17 @@ Install node exporter.
 apt -y install prometheus-node-exporter
 ```
 
+### General
+
+You probably want to enable some non-default collectors.  In
+`/etc/default/prometheus-node-exporter`:
+
+```
+ARGS="--collector.systemd"
+```
+
+### nginx
+
 Consider
 [nginx-prometheus-exporter](https://github.com/nginxinc/nginx-prometheus-exporter).
 
@@ -95,13 +106,29 @@ server {
 
 ## Additional Configuration
 
+### Fail2ban
+
 Default fail2ban bantime is very short. Make it longer:
 
 ```
 fail2ban-client start sshd
 fail2ban-client set sshd bantime 86400
 ```
 
+Make sure that fail2ban is reading logs.  Run `fail2ban-client status
+sshd`.  If it's not failing any IPs, that's a sign it's not working.
+The default backend of `auto` normally works, but may get confused if
+`/var/log/auth.log` exists.  If deleting `/var/log/auth.log` doesn't
+work, or you want to force it to always read the journal... in
+`/etc/fail2ban/jail.conf`:
+
+```
+[DEFAULT]
+backend = systemd
+```
+
+### Package upgrades
+
 Automatic security upgrades are a good idea, and probably outweigh
 the risks.