Add custom error pages and Nginx configuration for proxy module

- Introduced custom HTML error pages for various HTTP status codes (400, 401, 403, 404, 408, 429, 500, 502, 503, 504) in the proxy module.
- Created a .gitignore file to exclude non-HTML files in the error resources directory.
- Updated Nginx configuration to serve custom error pages for upstream errors.
- Added new Nginx configuration templates for handling HTTP and stream protocols.
- Implemented Wireguard configuration templates and associated variables for secure connections.
- Established Kubernetes resources for Stunnel and Wireguard, including deployment, service accounts, and config maps.
- Defined variables for the Stunnel and Wireguard modules to facilitate configuration.
- Created a new Wol Proxy module with Kubernetes resources for deployment and service management.

ansible/host_vars/dev-01.lab.alexpires.me.yml

@@ -41,6 +41,7 @@ fw_allowed_ports:
   - { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network only)
   - { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop)
   - { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.2/32" } # Ollama (Contabo VPN)
+  - { rule: "allow", port: "9090", proto: "tcp", from: "10.5.5.2/32" } # Prometheus (Contabo VPN)
   - { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.2/32" } # HTTPS (Contabo VPN)
   - { rule: "allow", port: "53", proto: "udp", from: "10.19.4.0/24" } # DNS (local network)
   - { rule: "allow", port: "53", proto: "udp", from: "10.5.5.2/32" } # DNS (Contabo VPN)
@@ -52,6 +53,7 @@ ufw_outgoing_traffic:
   - 80 # HTTP
   - 123 # NTP
   - 443 # HTTPS
+  - 465 # SMTPS
   - 853 # DNS over TLS
   - 10250 # Kubelet
   - 8880 # Kokoro-FastAPI
@@ -60,7 +62,8 @@ ufw_outgoing_traffic:
   - 8188 # comfyui
   - 4443
   - 9443
-  - 995 # POP3S
+  - 993 # IMAPS
+  - 9090 # Prometheus
 
 ufw_default_forward_policy: "ACCEPT"
 
@@ -84,7 +87,10 @@ fail2ban_jails:
     bantime: 3600
 
 # aide
-install_aide: false
+install_aide: true
+aide_exclude:
+  - "!/var/lib/snapd"
+  - "!/srv"
 
 misc_modules_blocklist:
   - bluetooth

ansible/host_vars/prod-01.alexpires.me.yml

@@ -60,7 +60,7 @@ ufw_outgoing_traffic:
   - 16443 # Kube API Server
   - 4443
   - 9443
-  - 995 # POP3S
+  - 993 # IMAPS
 
 ufw_default_forward_policy: "ACCEPT"
 
@@ -96,7 +96,15 @@ fail2ban_jails:
     filter: "postfix-k8s"
     logpath: "/var/log/postfix/current"
     maxretry: 3
-    findtime: 18000
+    findtime: 600
+    bantime: -1
+  dovecot:
+    enabled: true
+    port: "imap,imaps,pop3,pop3s"
+    filter: "dovecot-k8s"
+    logpath: "/var/log/dovecot/info.log"
+    maxretry: 3
+    findtime: 600
     bantime: -1
 
 fail2ban_filters:
@@ -104,6 +112,10 @@ fail2ban_filters:
     Definition:
       failregex: "^.*?postfix/smtps/smtpd\\[\\d+\\]:.*\\[<HOST>\\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed.*$"
       ignoreregex: ""
+  dovecot-k8s:
+    Definition:
+      failregex: "(?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \\(auth failed|Aborted login \\(tried to use disabled|Disconnected \\(auth failed|Aborted login \\(\\d+ authentication attempts).*rip=`<HOST>"
+      ignoreregex: ""
 
 # aide
 install_aide: true

ansible/playbook_mail.yml

@@ -8,8 +8,11 @@
     - name: Set required facts
       ansible.builtin.set_fact:
         mail_home: "{{ persistent_data | default('/var/lib') }}/mail"
+        log_home: "/var/log"
         mail_user_id: 1000
         mail_group_id: 1000
+        dovecot_user_id: 100
+        dovecot_group_id: 101
         postfix_user_id: 100
         postfix_group_id: 101
       tags: always
@@ -59,3 +62,17 @@
       tags:
         - tasks
         - tasks::folders
+
+    - name: Create required dovecot log
+      become: true
+      ansible.builtin.file:
+        state: directory
+        path: "{{ item }}"
+        mode: "0700"
+        owner: "{{ dovecot_user_id }}"
+        group: "{{ dovecot_group_id }}"
+      loop:
+        - "{{ log_home }}/dovecot"
+      tags:
+        - tasks
+        - tasks::folders

ansible/playbook_monitoring.yml

@@ -1,16 +1,13 @@
 ---
-- name: Monitoring Playbook (K8s)
-  hosts: monitoring
+- name: Prometheus Playbook (K8s)
+  hosts: prometheus
   gather_facts: true
 
 # Specific tasks for this playbook
   tasks:
     - name: Set required facts
       ansible.builtin.set_fact:
-        monitoring_home: "/var/lib/monitoring"
-        influxdb_home: "/var/lib/monitoring/influxdb.data"
-        kapacitor_home: "/var/lib/monitoring/kapacitor.data"
-        cronograf_home: "{{ persistent_data | default('/var/lib') }}/chronograf.data"
+        monitoring_home: "{{ persistent_data | default('/var/lib') }}/monitoring"
         monitoring_user_id: 1000
         monitoring_group_id: 1000
       tags: always
@@ -25,9 +22,6 @@
         group: "{{ monitoring_group_id }}"
       with_items:
         - "{{ monitoring_home }}"
-        - "{{ influxdb_home }}"
-        - "{{ kapacitor_home }}"
-        - "{{ cronograf_home }}"
       tags:
         - tasks
         - tasks::folders