Fix #392

This is meant as a internal authenticated and encrypted network which we
can use for internal services, we don't want to expose to the internet
or when encryption is desired but not easily implementable.

We no longer mirror arch32 on our servers and this role is currently
broken.

Kristian Klausen authored Feb 26, 2021 and Jelle van der Waa committed Apr 08, 2021

Fix #263

Kristian Klausen authored Mar 07, 2021 and Jelle van der Waa committed Apr 07, 2021

unbound is only used if dns_servers is explicit set to 127.0.0.1, which
isn't the case for any of these systems.

Fix #234

For all hosts we want to have a working fail2ban for sshd brute force
attempts through a group_vars/all. For some hosts an override is
required to enable postfix or dovecot jails.

We switched for monitoring to prometheus so zabbix-agent is unwanted and
we don't want to accidently deploy it again.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>