ansible(base): aide exclusions for shithub's write-heavy paths
- SHA
5372ec0032c1bf5f0abfeed85597ea90dc041fc4- Parents
-
cf737e7 - Tree
05b6b3c
tenseleyflow/shithub
/
5372ec0
Browse files
1 changed file
| Status | File | + | - |
|---|---|---|---|
| A |
deploy/ansible/roles/base/files/aide-shithub.conf
|
43 | 0 |
deploy/ansible/roles/base/files/aide-shithub.confadded@@ -0,0 +1,43 @@ | ||
| 1 | +# SPDX-License-Identifier: AGPL-3.0-or-later | |
| 2 | +# | |
| 3 | +# shithub-specific exclusions. Drops into /etc/aide/aide.conf.d/. | |
| 4 | +# Everything here uses AIDE's "!" prefix to UN-watch paths that | |
| 5 | +# the upstream Debian config would otherwise track. | |
| 6 | +# | |
| 7 | +# We exclude paths whose churn is by-design — keeping them in the | |
| 8 | +# baseline would generate so much noise that real intrusion signals | |
| 9 | +# would drown. The stuff we DO want flagged: /etc, /usr/local/bin, | |
| 10 | +# /usr/lib/systemd/system, /root/.ssh, package-managed binaries, | |
| 11 | +# sshd_config — all of which the upstream config already covers. | |
| 12 | + | |
| 13 | +# ── Application data (repos, by design write-heavy) | |
| 14 | +!/data | |
| 15 | +!/var/lib/shithub | |
| 16 | +!/var/lib/shithub-ssh | |
| 17 | + | |
| 18 | +# ── Database files + WAL (Postgres rewrites these constantly) | |
| 19 | +!/var/lib/postgresql | |
| 20 | + | |
| 21 | +# ── Source checkout (fetch+reset on every deploy) | |
| 22 | +!/root/src/shithub | |
| 23 | + | |
| 24 | +# ── Caddy state (cert renewals, access log) | |
| 25 | +!/var/lib/caddy | |
| 26 | +!/var/log/caddy | |
| 27 | + | |
| 28 | +# ── shithub-specific log dir | |
| 29 | +!/var/log/shithub | |
| 30 | + | |
| 31 | +# ── AIDE's own metadata (don't recurse into our own DB) | |
| 32 | +!/var/lib/aide | |
| 33 | + | |
| 34 | +# ── Restore-drill scratch (mktemp paths under /tmp already excluded | |
| 35 | +# by upstream, but the share dir holds the live script + sql) | |
| 36 | +!/usr/local/share/shithub | |
| 37 | + | |
| 38 | +# ── Backup workdir (nightly pg_dump lands here before rclone copy; | |
| 39 | +# file count + content change every night by design) | |
| 40 | +!/var/backups/shithub | |
| 41 | + | |
| 42 | +# ── shithub-deploy artifacts on the app droplet | |
| 43 | +!/tmp/shithubd-new | |