Add custom error pages and Nginx configuration for proxy module

- Introduced custom HTML error pages for various HTTP status codes (400, 401, 403, 404, 408, 429, 500, 502, 503, 504) in the proxy module.
- Created a .gitignore file to exclude non-HTML files in the error resources directory.
- Updated Nginx configuration to serve custom error pages for upstream errors.
- Added new Nginx configuration templates for handling HTTP and stream protocols.
- Implemented Wireguard configuration templates and associated variables for secure connections.
- Established Kubernetes resources for Stunnel and Wireguard, including deployment, service accounts, and config maps.
- Defined variables for the Stunnel and Wireguard modules to facilitate configuration.
- Created a new Wol Proxy module with Kubernetes resources for deployment and service management.

ansible/host_vars/dev-01.lab.alexpires.me.yml

@@ -41,6 +41,7 @@ fw_allowed_ports:
   - { rule: "allow", port: "11434", proto: "tcp", from: "10.19.4.0/24" } # Ollama (local network only)
   - { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.5/32" } # Ollama (Laptop)
   - { rule: "allow", port: "11434", proto: "tcp", from: "10.5.5.2/32" } # Ollama (Contabo VPN)
+  - { rule: "allow", port: "9090", proto: "tcp", from: "10.5.5.2/32" } # Prometheus (Contabo VPN)
   - { rule: "allow", port: "443", proto: "tcp", from: "10.5.5.2/32" } # HTTPS (Contabo VPN)
   - { rule: "allow", port: "53", proto: "udp", from: "10.19.4.0/24" } # DNS (local network)
   - { rule: "allow", port: "53", proto: "udp", from: "10.5.5.2/32" } # DNS (Contabo VPN)
@@ -52,6 +53,7 @@ ufw_outgoing_traffic:
   - 80 # HTTP
   - 123 # NTP
   - 443 # HTTPS
+  - 465 # SMTPS
   - 853 # DNS over TLS
   - 10250 # Kubelet
   - 8880 # Kokoro-FastAPI
@@ -60,7 +62,8 @@ ufw_outgoing_traffic:
   - 8188 # comfyui
   - 4443
   - 9443
-  - 995 # POP3S
+  - 993 # IMAPS
+  - 9090 # Prometheus
 
 ufw_default_forward_policy: "ACCEPT"
 
@@ -84,7 +87,10 @@ fail2ban_jails:
     bantime: 3600
 
 # aide
-install_aide: false
+install_aide: true
+aide_exclude:
+  - "!/var/lib/snapd"
+  - "!/srv"
 
 misc_modules_blocklist:
   - bluetooth

ansible/host_vars/prod-01.alexpires.me.yml

@@ -60,7 +60,7 @@ ufw_outgoing_traffic:
   - 16443 # Kube API Server
   - 4443
   - 9443
-  - 995 # POP3S
+  - 993 # IMAPS
 
 ufw_default_forward_policy: "ACCEPT"
 
@@ -96,7 +96,15 @@ fail2ban_jails:
     filter: "postfix-k8s"
     logpath: "/var/log/postfix/current"
     maxretry: 3
-    findtime: 18000
+    findtime: 600
+    bantime: -1
+  dovecot:
+    enabled: true
+    port: "imap,imaps,pop3,pop3s"
+    filter: "dovecot-k8s"
+    logpath: "/var/log/dovecot/info.log"
+    maxretry: 3
+    findtime: 600
     bantime: -1
 
 fail2ban_filters:
@@ -104,6 +112,10 @@ fail2ban_filters:
     Definition:
       failregex: "^.*?postfix/smtps/smtpd\\[\\d+\\]:.*\\[<HOST>\\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed.*$"
       ignoreregex: ""
+  dovecot-k8s:
+    Definition:
+      failregex: "(?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \\(auth failed|Aborted login \\(tried to use disabled|Disconnected \\(auth failed|Aborted login \\(\\d+ authentication attempts).*rip=`<HOST>"
+      ignoreregex: ""
 
 # aide
 install_aide: true