Forgot the rules to only run when needed.

If the clock drift is too big (I've seen a month) then certificate
validation fails and fetching updates fails.

Fix the SpamAssassin error: `HELO does not match SPF record`.

It breaks the Let's Encrypt renewal workflow.

My SSH config uses port 443 which is great for breaking out from
restricted networks, but not so great when restarting HAProxy and the
SSH connection breaks during an Ansible run.

Remove services that have been decomissioned.

Use the HTTPS port so I can break out from restricted networks.

HAProxy is used to inspect the SNI and route to the correct backend
without needing the SSL certificates and keys. Because it opens a new
TCP connection, the source IP at the other side is always the router's
internal IP so we can't filter there based on the source IP.

Maybe this will help with finding other users.

It's not part of the listen directive anymore, it's now a separate
directive.

This is a dump of the config from a new router (Linksys MR8300) running
a new version of OpenWRT (23.05).

After migrating all Docker Compose services to a managed (not the
default) network, the IP address has changed.

The first time unbound-anchor is run the exit code is 1.

This reverts commit 49549b66.

It's complaining about missing modules but they exist. Also, it doesn't
find the requirements.yml file inside the Ansible directory.

It's been created by Ansible now since it's been used by multiple
project, all complaining that the labels are wrong.

This reverts commit a3ea3389.

I was the impression that soft updates improve reliability but in fact
they reduce it (had a couple of power outages and it would only boot in
single user mode and all of the partitions required an fsck).

Per https://zonemaster.net/en/result/472d8d42df31e2d8, implement _some_
of the recommendations:
- Limit AXFR availability.
- Raise some of the SOA values.

The Am I Live checks routinely fail because of it.

It's been decomissioned.

It overrides /etc/resolv.conf and I don't need it (I run my own DNS
resolver).