Set up Keycloak to Mailman sync for chaos@

DRY_RUN=true, so no changes to Mailman are performed yet.

inventories/chaosknoten/host_vars/lists.sops.yaml

@@ -3,10 +3,10 @@ secret__lists__hyperkitty_api_key: ENC[AES256_GCM,data:byO7x/r3E9mwxOwiK0Is+Mp+d
 secret__lists__postgres_password: ENC[AES256_GCM,data:HcH4Lyw9uuuqXGrrXkUqzg==,iv:3adzec+Wnh37LjzwMp7zhWMf9jZzI6EyUmEGS9TUYBg=,tag:8/jZrUzkcM+U3nME6+DSSA==,type:str]
 secret__lists__rest_password: ENC[AES256_GCM,data:BMCNEikejiDET0Mdlrzfcg==,iv:U5hVjM/epfzz2m/wXKhYhwFI/3zKX7XS/UMlBqwTZNk=,tag:0n79+5mP7ocY7jVQmWm+WA==,type:str]
 secret__lists__web_secret_key: ENC[AES256_GCM,data:3DntszkNw5ciwRUJJdmHTGTpjm9ZMBf9wO3MHAeiXuw=,iv:GqqjRcg0zG193Y04UYIipB8BBk/JUtGvtTCVQ4HCjDw=,tag:aY4d+CPGxMvRz8t983p9sw==,type:str]
+secret__lists__keycloak_client_secret: ENC[AES256_GCM,data:9fJWkQegmwMe24LnXnPE5CfxDE5jSRDB77Hm1dzF06k=,iv:A5L21JQ3Nv5jDP6e72pp6qh1tytCwpTCyKbFdb2Pv9M=,tag:x8Ik/fRGfgoy96aHwif7kQ==,type:str]
 sops:
   age:
-    - recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
+    - enc: |
-      enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
         YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxNUtVWVp5Z0pseFNLMURE
         MFY0V0E1K05sVGRnQ2lsMEhOWncwQzd5bURJCjE4cGxmeFNlS2FQb1JSZVhuNjFJ
@@ -14,8 +14,9 @@ sops:
         VFdtcTIwdWNLalFHdlh2dkdLWUhldVEKYygAfgJakHHw4NPfO1C3hd5HtJXMY87/
         Jh3LJn0sq+YKOVupd3G4FWVKozR78DHFNHvRmKQSR8OLmqEfi7w6xg==
         -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-05-16T11:00:16Z"
+      recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
-  mac: ENC[AES256_GCM,data:vwQc2suUJ0KiSsYRcrvsYHNYF2c8SU58LxWoFpzTX5hSDNy8LOWJIa6Ouo8c7gk4gYB0mS/FbmgEo8LOCDvRKamfgrpZQ2wvxI7GdGRjR0LOsS8O2xZ8QZ3BK9DfEfnA5ESgzRzX6Iuc4ZBUGfAQoDDxXrnh2ogWUdYPC81T5qU=,iv:Vi74U97iZAqQ8DDW2p3ncg58l6+mxar4hC5f48AuPAQ=,tag:Jd09hXId+ogV4rB0AWS2NA==,type:str]
+  lastmodified: "2026-07-26T13:56:25Z"
+  mac: ENC[AES256_GCM,data:DuRHpgKU2l5R1vPYzc02qwOAWHeuzAJC7H2qeEW4L2pfsRfmKJz0LToxr+7Ap2sxUESUBMIEx0NktxYEvWoNhnNMtUwyWTPR8cOWVX/g7AayQj5aicS7nkrYW6B6Rnnl7tmzLbOCtmcgVyceFUGMm27O387zXUgrcMFb0hgRISg=,iv:6hD8HIfEKgcpdbOuY8HILrLbZT+/rXh6ZzJFBzD27uE=,tag:5No4EiP0zYuahGTYGcEY6w==,type:str]
   pgp:
     - created_at: "2026-05-20T02:08:46Z"
       enc: |-
@@ -188,4 +189,4 @@ sops:
         -----END PGP MESSAGE-----
       fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
   unencrypted_suffix: _unencrypted
-  version: 3.12.2
+  version: 3.13.2

resources/chaosknoten/lists/docker_compose/compose.yaml.j2

@@ -68,6 +68,22 @@ services:
     networks:
       mailman:
 
+  keycloaksync:
+    restart: unless-stopped
+    command: ["uv", "run", "main.py", "sync"]
+    environment:
+      - DRY_RUN=true
+      - KEYCLOAK_CLIENT_ID=mailman-sync
+      - KEYCLOAK_CLIENT_SECRET={{ secret__lists__keycloak_client_secret }}
+      - KEYCLOAK_REALM=ccchh
+      - KEYCLOAK_URL=https://id.hamburg.ccc.de
+      - LIST_ATTRIBUTES=chaos@lists.hamburg.ccc.de:mailinglist-chaos
+      - MAILMAN_API_PASSWORD={{ secret__lists__rest_password }}
+      - MAILMAN_API_URL=http://mailman-core:8001/3.1
+    image: git.hamburg.ccc.de/ccchh/mailman-subscription-sync:latest
+    networks:
+      mailman:
+
 networks:
   mailman:
     driver: bridge