Add Hackertours Admin (hta) (#182)

The two images are built in https://git.hamburg.ccc.de/CCCHH/hackertours-admin Reviewed-on: #182 Reviewed-by: chris <c6ristian+git-ccchh@christian.moe>
2026-11-02 18:51:09 +01:00 · 2026-11-02 18:51:09 +01:00 · 6a87ba0562
commit 6a87ba0562
parent 04f2b1d25c
5 changed files with 651 additions and 281 deletions
--- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
+++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
@ -286,6 +286,7 @@ cpuccc                              IN  CNAME           public-reverse-proxy
 did                                 IN  CNAME           public-reverse-proxy
 infra-docs                          IN  CNAME           public-reverse-proxy
 staging.infra-docs                  IN  CNAME           public-reverse-proxy
+hta                                 IN  CNAME           public-reverse-proxy


 auth.acmedns                        IN  NS              acmedns.hosts.hamburg.ccc.de.
@ -513,6 +514,7 @@ forgejo-actions-runner.hosts        IN  AAAA            2a00:14b0:42:102::18
 forgejo-runner.hosts                IN  AAAA            2a00:14b0:42:102::19
 forgejo-runner-external.hosts       IN  AAAA            2a00:14b0:42:102::1a
 matrix-sync.hosts                   IN  AAAA            2a00:14b0:42:102::1b
+hta.hosts                           IN  AAAA            2a00:14b0:42:102::1c

 ; acme-challenges
 _acme-challenge.sunders                 CNAME           a5ee8a99-3cdf-4212-972e-c0b6fda1242f.auth.acmedns
--- a/resources/chaosknoten/hta/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/hta/docker_compose/compose.yaml.j2
@ -0,0 +1,86 @@
+---
+# Hackertours Admin, see https://git.hamburg.ccc.de/CCCHH/hackertours-admin/src/branch/main/compose.yaml
+
+services:
+  database:
+    image: docker.io/library/postgres:18-alpine
+    environment:
+      POSTGRES_USER: hackertours
+      POSTGRES_PASSWORD: {{ secret__hta_db_password | to_json }}
+      POSTGRES_DB: hackertours
+    volumes:
+      - database:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U hackertours"]
+      interval: 5s
+      retries: 10
+    networks:
+      backend:
+    restart: unless-stopped
+
+  app:
+    image: git.hamburg.ccc.de/ccchh/hackertours-admin:main
+    environment:
+      DATABASE_URL: {{ ('postgres://hackertours:' ~ secret__hta_db_password ~ '@database:5432/hackertours') | to_json }}
+      GUNICORN_CMD_ARGS: "--timeout 60"
+      DJANGO_SECRET_KEY: {{ secret__hta_django_secret_key | to_json }}
+      DJANGO_ALLOWED_HOSTS: hta.hamburg.ccc.de
+      DJANGO_CSRF_TRUSTED_ORIGINS: https://hta.hamburg.ccc.de
+      DJANGO_BEHIND_PROXY: "1"
+      GOTENBERG_URL: http://gotenberg:3000
+      MOTIS_URL: http://motis:8080
+      HUGO_REPO_URL: ssh://forgejo@git.hamburg.ccc.de/CCCHH/hackertours.git
+      HUGO_REPO_SSH_KEY: {{ secret__hta_hugo_repo_ssh_key | to_json }}
+      # Output of `ssh-keyscan git.hamburg.ccc.de`, newlines written as \n
+      HUGO_REPO_KNOWN_HOSTS: 'git.hamburg.ccc.de ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC91Cgx/Ow3oRm1GdB5mkGbUEIKsWfggsVrvHy2EwLfTKPeDdFDzEwQaN6gzUxiLHhk6zNK4ygCOhMjEQFPw2mRAgsSk0vRnGxnnd+AhPfCMK+nZ4mAJ2EIeGiOMpYoJ49XytL+H0hwJcFlawxzkuOMFve65mOmJnA5zhDX8EsBbi8ulnuOfiXV/iq8VSRWONNCX/rgUJDBcryGAii7LY4zfTg7taWFmBZpFq/qcMaqXLwp6L63c7POmjUsrN8WphRUTYNoeZh7gmUZNanqGpGotsKisU+sQThuMpMEm7imSAtqL1qYfjPTxjlcreL1asqfvjp5K1apt+NSQdEbeRbcAU1xLjKzW3pzYh1bWvC1FJfgFHptEfqgkK3ebCBoS9xVUXtnyvUbbi569QM1Qly+W5r6N8a4aZHnVD4RFAzHNNDFYaks1E6uKfdgLQcwzLhXcB+fRMy8+b4RLz46vS/dYcrxKVMLtBiVZis9pd4GZ4IVLUXu9Z3ixFPBdf/YtW/WrKJKyEydEh0nMP0o49sWTI25yhxKPL2JXLlaQozVD6sxUP1wDU2MW1OvNlf4JsomyYiQ9gjsacP63RL5G8193Hw4A+r77pILQbv3PzVze1wqU/fyOBt/IImxxQ6fOy1sjohRuaXAPn4NaFTbykecyvr4GUaFvK5evG8Ao5Ql3w==\ngit.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrfbiDq3l25G7FUvbAGEdbBvIlbm+Od+P33OgIup2IR'
+      PRETIX_URL: https://tickets.hamburg.ccc.de
+      PRETIX_TOKEN: {{ secret__hta_pretix_token | to_json }}
+    volumes:
+      - data:/data
+    ports:
+      - "127.0.0.1:8000:8000"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/healthz')"]
+      interval: 30s
+      retries: 3
+    depends_on:
+      database:
+        condition: service_healthy
+    networks:
+      backend:
+      frontend:
+    restart: unless-stopped
+
+  # Renders the PDF handouts (HTML to PDF with Chromium); needs internet access for the map tiles.
+  gotenberg:
+    image: docker.io/gotenberg/gotenberg:8.38.1
+    command: ["gotenberg", "--api-timeout=60s", "--libreoffice-disable-routes"]
+    networks:
+      frontend:
+    restart: unless-stopped
+
+  # Public transport routing with the HVV timetable. On each start it fetches the newest timetable
+  # and OpenStreetMap data (about 1 GB) and imports them; it exits after MOTIS_REFRESH_HOURS to
+  # restart with fresh data.
+  motis:
+    image: git.hamburg.ccc.de/ccchh/hackertours-motis:main
+    environment:
+      MOTIS_REFRESH_HOURS: "24"
+      # Lift status from DB FaSta
+      DB_FASTA_CLIENT_ID: 9771ff8a0dd67637801e95fde5a5999f
+      DB_FASTA_API_KEY: {{ secret__hta_db_fasta_api_key | to_json }}
+    volumes:
+      - motis:/data
+    networks:
+      frontend:
+    restart: unless-stopped
+
+volumes:
+  database: {}
+  data: {}
+  motis: {}
+
+networks:
+  backend:
+    internal: true
+  frontend:
--- a/resources/chaosknoten/hta/nginx/hta.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/hta/nginx/hta.hamburg.ccc.de.conf
@ -0,0 +1,46 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+server {
+    # Listen on a custom port for the proxy protocol.
+    listen [::]:8443 ssl http2 proxy_protocol;
+    # Make use of the ngx_http_realip_module to set the $remote_addr and
+    # $remote_port to the client address and client port, when using proxy
+    # protocol.
+    # First set our proxy protocol proxy as trusted.
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
+    # Then tell the realip_module to get the addreses from the proxy protocol
+    # header.
+    real_ip_header proxy_protocol;
+
+    server_name hta.hamburg.ccc.de;
+
+    client_max_body_size 5g;
+
+    ssl_certificate /etc/letsencrypt/live/hta.hamburg.ccc.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/hta.hamburg.ccc.de/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/hta.hamburg.ccc.de/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Port 443;
+    # This is https in any case.
+    proxy_set_header X-Forwarded-Proto https;
+    # Hide the X-Forwarded header.
+    proxy_hide_header X-Forwarded;
+    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
+    # is transparent).
+    # Also provide "_hidden" for by, since it's not relevant.
+    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
+
+    location / {
+        proxy_pass http://127.0.0.1:8000/;
+        # gunicorn runs with --timeout 60, PDF rendering can take a while
+        proxy_read_timeout 90s;
+    }
+}
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@ -16,6 +16,7 @@ map $host $upstream_acme_challenge_host {
    hackertours.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
    staging.hackertours.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
    hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
+    hta.hamburg.ccc.de hta.hosts.hamburg.ccc.de:31820;
    id.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:31820;
    invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:31820;
    keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:31820;
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@ -44,6 +44,7 @@ stream {
        staging.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;
        spaceapi.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;
        tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:8443;
+        hta.hamburg.ccc.de hta.hosts.hamburg.ccc.de:8443;
        sunders.hamburg.ccc.de sunders.hosts.hamburg.ccc.de:8443;
        zammad.hamburg.ccc.de zammad.hosts.hamburg.ccc.de:8443;
        c3cat.de public-web-static.hosts.hamburg.ccc.de:8443;