Merge remote-tracking branch 'origin/main' into matrix-sync
This commit is contained in:
commit
9860117a06
36 changed files with 791 additions and 51 deletions
|
|
@ -1,4 +1,7 @@
|
|||
ansible_pull__age_private_key: ENC[AES256_GCM,data:8PCkZx76R5aWPITn5MCZCMckXvaLfVvnDgO70XmF/eeH5xLVOVx+EC3DZjmHxEoW7Kn4LAJTR4mWl/xP+p++elRvTMcHltV+vBQ=,iv:jKq07NLM84MSGU4CCyUS9ODmwiUMhlDONkKJ7P9P2DM=,tag:95yBZlwYdSNeX2O4t/h9kw==,type:str]
|
||||
jitsi__jicofo_auth_password: ENC[AES256_GCM,data:a7y36RJUR4OBtVNzgmqlGEsg1hNRGgsuwG2YFJrDlMI=,iv:mnGlKOXtNltNe3wY34BnVCJ9CtLQ7aksr4xXbrTOnJg=,tag:j1N7MUTJG8K0JW/a6YESFg==,type:str]
|
||||
jitsi__jvb_auth_password: ENC[AES256_GCM,data:xUFiIXAzY4pEpwgL/5LPBlhkx73RX6VFT3QJlG5QbFo=,iv:/XqENztrrpj1h3lBhEtJJo78lCrxrMWxRszNjSwx+KQ=,tag:+LRYmv9Tvt0muR47QTd6HA==,type:str]
|
||||
jitsi__turn_secret: ENC[AES256_GCM,data:UPev9ND9Mf2gGK28huQuuxRyUZvPPCmFL9rU1f0zndSPPBMspSsnlgtMy0+VY/CsGEIEcWsy3eYDPcAW/EKFtA==,iv:ew0MKP5zdQvqfla2y7xkcXLm3qSMlf5sucn8Qu3G3Zs=,tag:dqe239LD+wPVqLQFF+nz2A==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
|
|
@ -30,8 +33,8 @@ sops:
|
|||
QzBBdJ6TiDwJ1rwwM211smfIbcYhWX6C/EfitI5XoIW8aS4ln1g1Ww==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age187zdk64205lx7r83a4m26pfa8hq6khc8sf83k266jasngeq08v3sfqswfg
|
||||
lastmodified: "2026-07-29T20:26:44Z"
|
||||
mac: ENC[AES256_GCM,data:dHiB768SBppBrjNoSpgDvriCgrSNzIkpSYzm9REx4otbnvNjHYPhP9OdsZ6zTcoFoX+41/zE13r4EoAz4F++jdJidv1+7DMFvVUKMuFNzp2VjDfB1ZNzzyM+px7l83L5eNhgNPp26mweOVMEz92NgB916KMY+5e3uUeSR+iIdho=,iv:7k8rugBXULjPSOZukQiufNn9Vs5uWVhcvFKIhD1o7so=,tag:IE+2uhzGS2xJJgFHuc94CA==,type:str]
|
||||
lastmodified: "2026-10-08T07:56:43Z"
|
||||
mac: ENC[AES256_GCM,data:CgD19xHN5nEg9TMQq/c4Xpv1LH0LfcXrkfBMUcbJiIn4FsSzQetLYxueeDXUVOujOb9ZSEin1nR+OZwa/nuwN9mTg37c0XZ6HV0UvNNEIrN/o4doUCQa2jLmbX8etxeNhF7oWJ84OgQIhPLvLwp3Z0A/+kPKbmtz3znQNgKoHQY=,iv:6Dt7z55az2SJovJ7ozG35Q99a08kOrKl/uQCUVcbq8c=,tag:M6p0ZJzoFnWgspnGknq7SQ==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-09-24T19:54:13Z"
|
||||
enc: |-
|
||||
|
|
|
|||
33
inventories/chaosknoten/host_vars/jitsi.yaml
Normal file
33
inventories/chaosknoten/host_vars/jitsi.yaml
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
nftables__config: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/jitsi/nftables/nftables.conf') }}"
|
||||
|
||||
# renovate: datasource=github-releases depName=jitsi/docker-jitsi-meet versioning=regex:^stable-(?<major>\d+)$
|
||||
jitsi__version: stable-11248
|
||||
jitsi__domain: jitsi.hamburg.ccc.de
|
||||
jitsi__letsencrypt_email: le-admin@hamburg.ccc.de
|
||||
jitsi__jvb_advertise_ips:
|
||||
- 212.12.51.139
|
||||
- 2a00:14b0:f000:23:51:139:0:1
|
||||
jitsi__whiteboard: true
|
||||
jitsi__turn: true
|
||||
jitsi__prometheus_exporter: true
|
||||
# jitsi__jicofo_auth_password, jitsi__jvb_auth_password and jitsi__turn_secret are defined in jitsi.sops.yaml.
|
||||
|
||||
# Branding
|
||||
jitsi__env:
|
||||
DYNAMIC_BRANDING_URL: https://jitsi.hamburg.ccc.de/static/ccchh-branding.json
|
||||
jitsi__custom_interface_config_js: |
|
||||
// Replace the footer with app store links with our own in welcomePageAdditionalContent.html.
|
||||
interfaceConfig.DISPLAY_WELCOME_FOOTER = false;
|
||||
interfaceConfig.DISPLAY_WELCOME_PAGE_CONTENT = true;
|
||||
interfaceConfig.JITSI_WATERMARK_LINK = 'https://hamburg.ccc.de/';
|
||||
jitsi__web_files:
|
||||
- path: images/watermark.svg
|
||||
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/jitsi/web/ccchh-logo.svg') }}"
|
||||
- path: images/favicon.svg
|
||||
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/jitsi/web/round-logo.svg') }}"
|
||||
- path: images/ccchh-background.svg
|
||||
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/jitsi/web/background.svg') }}"
|
||||
- path: static/ccchh-branding.json
|
||||
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/jitsi/web/branding.json') }}"
|
||||
- path: static/welcomePageAdditionalContent.html
|
||||
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/jitsi/web/welcomePageAdditionalContent.html') }}"
|
||||
|
|
@ -1,13 +1,10 @@
|
|||
nginx__version_spec: ""
|
||||
nginx__configurations:
|
||||
- name: wiki.ccchh.net
|
||||
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf') }}"
|
||||
- name: wiki.hamburg.ccc.de
|
||||
content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf') }}"
|
||||
|
||||
certbot__acme_account_email_address: j+letsencrypt-ccchh@jsts.xyz
|
||||
certbot__certificate_domains:
|
||||
- "wiki.ccchh.net"
|
||||
- "wiki.hamburg.ccc.de"
|
||||
certbot__new_cert_commands:
|
||||
- "systemctl reload nginx.service"
|
||||
|
|
|
|||
|
|
@ -146,6 +146,7 @@ systemd_networkd_hosts:
|
|||
router:
|
||||
nftables_hosts:
|
||||
hosts:
|
||||
jitsi:
|
||||
router:
|
||||
docker_compose_hosts:
|
||||
hosts:
|
||||
|
|
@ -265,6 +266,9 @@ wiki_hosts:
|
|||
netbox_hosts:
|
||||
hosts:
|
||||
netbox:
|
||||
jitsi_hosts:
|
||||
hosts:
|
||||
jitsi:
|
||||
proxmox_vm_template_hosts:
|
||||
hosts:
|
||||
chaosknoten:
|
||||
|
|
|
|||
|
|
@ -110,6 +110,13 @@
|
|||
tags:
|
||||
- docker_compose
|
||||
|
||||
- name: Ensure Jitsi deployment on jitsi_hosts
|
||||
hosts: jitsi_hosts
|
||||
roles:
|
||||
- jitsi
|
||||
tags:
|
||||
- jitsi
|
||||
|
||||
- name: Ensure NGINX deployment on nginx_hosts
|
||||
hosts: nginx_hosts:!public_reverse_proxy_hosts
|
||||
roles:
|
||||
|
|
|
|||
|
|
@ -79,7 +79,7 @@ hp-color A 10.89.209.28
|
|||
|
||||
club-assistant A 10.89.213.22
|
||||
AAAA 2a07:c481:1:36::32
|
||||
_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de
|
||||
_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de.
|
||||
|
||||
|
||||
esphome A 10.89.212.210
|
||||
|
|
@ -139,6 +139,7 @@ waybackproxy A 10.89.212.33
|
|||
alnair A 10.89.210.23
|
||||
TXT "Sun SparcStation 4 Retro"
|
||||
|
||||
ptouch-print-server A 10.89.208.14
|
||||
;
|
||||
; Public Club Services
|
||||
;
|
||||
|
|
|
|||
|
|
@ -59,7 +59,7 @@ services:
|
|||
- /dev/null:/etc/prometheus/pve.yml
|
||||
|
||||
loki:
|
||||
image: docker.io/grafana/loki:3.7.8
|
||||
image: docker.io/grafana/loki:3.7.9
|
||||
container_name: loki
|
||||
ports:
|
||||
- 13100:3100
|
||||
|
|
|
|||
|
|
@ -44,15 +44,6 @@ scrape_configs:
|
|||
- mumble.hamburg.ccc.de:443
|
||||
labels:
|
||||
org: ccchh
|
||||
- job_name: opnsense-ccchh
|
||||
honor_timestamps: true
|
||||
metrics_path: /metrics
|
||||
scheme: http
|
||||
static_configs:
|
||||
- targets:
|
||||
- 185.161.129.132:9100
|
||||
labels:
|
||||
org: ccchh
|
||||
- job_name: jitsi
|
||||
honor_timestamps: true
|
||||
scrape_interval: 5s
|
||||
|
|
|
|||
65
resources/chaosknoten/jitsi/nftables/nftables.conf
Normal file
65
resources/chaosknoten/jitsi/nftables/nftables.conf
Normal file
|
|
@ -0,0 +1,65 @@
|
|||
#!/usr/sbin/nft -f
|
||||
|
||||
# Docker manages its own tables (via iptables-nft), so don't use "flush ruleset" here,
|
||||
# but only replace our own table. This also means that a reload is fine, but stopping
|
||||
# or restarting nftables.service (which flushes the whole ruleset) requires restarting
|
||||
# Docker afterwards.
|
||||
# Traffic to ports published by Docker containers (web, JVB, exporter) gets DNATed in
|
||||
# prerouting and therefore passes the forward hook instead of the input hook.
|
||||
|
||||
## Variables
|
||||
|
||||
define if_wan = "ens18"
|
||||
|
||||
# Prometheus on grafana (IPv4 via the NAT of router)
|
||||
define prometheus_v4 = { 212.12.48.123 }
|
||||
define prometheus_v6 = { 2a00:14b0:42:102::e }
|
||||
|
||||
## Rules
|
||||
|
||||
table inet host_filter
|
||||
delete table inet host_filter
|
||||
|
||||
table inet host_filter {
|
||||
# Runs before Docker's DNAT, so this also applies to ports published by containers.
|
||||
chain prerouting {
|
||||
type filter hook prerouting priority dstnat - 10; policy accept;
|
||||
|
||||
iifname $if_wan tcp dport 9888 ip saddr $prometheus_v4 accept comment "jitsi exporter (container)"
|
||||
iifname $if_wan tcp dport 9888 ip6 saddr $prometheus_v6 accept comment "jitsi exporter (container)"
|
||||
iifname $if_wan tcp dport 9888 drop
|
||||
}
|
||||
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
|
||||
iifname "lo" accept
|
||||
ct state invalid drop
|
||||
ct state established,related accept
|
||||
|
||||
# ICMPv6 is needed for neighbour discovery etc.
|
||||
meta l4proto ipv6-icmp accept
|
||||
meta l4proto icmp accept
|
||||
|
||||
# Docker networks
|
||||
iifname { "docker0", "br-*" } accept
|
||||
|
||||
tcp dport 22 accept comment "ssh"
|
||||
|
||||
# Ports published by containers normally get DNATed and never reach the input
|
||||
# hook, but they do when handled by docker-proxy (e.g. for IPv6 without IPv6
|
||||
# enabled on the Docker network).
|
||||
tcp dport { 80, 443 } accept comment "jitsi web (container)"
|
||||
udp dport 10000 accept comment "jitsi jvb (container)"
|
||||
|
||||
# coturn (runs in the host network namespace)
|
||||
udp dport 3478 accept comment "turn"
|
||||
tcp dport 3478 accept comment "turn"
|
||||
tcp dport 5349 accept comment "turns"
|
||||
udp dport 5349 accept comment "turns (dtls)"
|
||||
udp dport 49152-65535 accept comment "turn relay ports"
|
||||
|
||||
tcp dport { 9100, 9888 } ip saddr $prometheus_v4 accept comment "node exporter, jitsi exporter (container)"
|
||||
tcp dport { 9100, 9888 } ip6 saddr $prometheus_v6 accept comment "node exporter, jitsi exporter (container)"
|
||||
}
|
||||
}
|
||||
18
resources/chaosknoten/jitsi/web/background.svg
Normal file
18
resources/chaosknoten/jitsi/web/background.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 6.8 KiB |
5
resources/chaosknoten/jitsi/web/branding.json
Normal file
5
resources/chaosknoten/jitsi/web/branding.json
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"logoImageUrl": "https://jitsi.hamburg.ccc.de/images/watermark.svg",
|
||||
"logoClickUrl": "https://hamburg.ccc.de/",
|
||||
"backgroundImageUrl": "https://jitsi.hamburg.ccc.de/images/ccchh-background.svg"
|
||||
}
|
||||
5
resources/chaosknoten/jitsi/web/ccchh-logo.svg
Normal file
5
resources/chaosknoten/jitsi/web/ccchh-logo.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 84 KiB |
7
resources/chaosknoten/jitsi/web/round-logo.svg
Normal file
7
resources/chaosknoten/jitsi/web/round-logo.svg
Normal file
File diff suppressed because one or more lines are too long
|
After Width: | Height: | Size: 6.3 KiB |
|
|
@ -0,0 +1,13 @@
|
|||
<template id = "welcome-page-additional-content-template">
|
||||
<footer class = "welcome-footer">
|
||||
<div class = "welcome-footer-centered">
|
||||
<div class = "welcome-footer-padded">
|
||||
<div class = "welcome-footer-row-block welcome-footer--row-1" style = "flex-wrap: wrap; gap: 16px;">
|
||||
<a href = "https://wiki.hamburg.ccc.de/infrastructure:services:jitsi" style = "color: #fff;">Technical Information for CCCHH Jitsi</a>
|
||||
<a href = "https://hamburg.ccc.de/imprint/" style = "color: #fff;">Imprint and Contact</a>
|
||||
<a href = "https://hamburg.ccc.de/privacy-notice/" style = "color: #fff;">Privacy Policy</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
</template>
|
||||
|
|
@ -4,7 +4,7 @@
|
|||
|
||||
services:
|
||||
onlyoffice:
|
||||
image: docker.io/onlyoffice/documentserver:9.4.0
|
||||
image: docker.io/onlyoffice/documentserver:10.0.0
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- "./onlyoffice/DocumentServer/logs:/var/log/onlyoffice"
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ services:
|
|||
- pretalx_net
|
||||
|
||||
static:
|
||||
image: docker.io/library/nginx:1.31.6
|
||||
image: docker.io/library/nginx:1.31.8
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- public:/usr/share/nginx/html
|
||||
|
|
|
|||
|
|
@ -27,7 +27,6 @@ map $host $upstream_acme_challenge_host {
|
|||
pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:31820;
|
||||
spaceapi.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
|
||||
staging.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
|
||||
wiki.ccchh.net wiki.hosts.hamburg.ccc.de:31820;
|
||||
wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:31820;
|
||||
www.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
|
||||
tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:31820;
|
||||
|
|
|
|||
|
|
@ -29,7 +29,6 @@ stream {
|
|||
invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
|
||||
keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
|
||||
grafana.hamburg.ccc.de grafana.hosts.hamburg.ccc.de:8443;
|
||||
wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443;
|
||||
wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443;
|
||||
onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:8443;
|
||||
hackertours.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;
|
||||
|
|
|
|||
|
|
@ -1,26 +0,0 @@
|
|||
# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
|
||||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl http2 proxy_protocol;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 2a00:14b0:4200:3000:125::1;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
|
||||
server_name wiki.ccchh.net;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/wiki.ccchh.net/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/wiki.ccchh.net/privkey.pem;
|
||||
# verify chain of trust of OCSP response using Root CA and Intermediate certs
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/wiki.ccchh.net/chain.pem;
|
||||
|
||||
# HSTS (ngx_http_headers_module is required) (63072000 seconds)
|
||||
add_header Strict-Transport-Security "max-age=63072000" always;
|
||||
|
||||
return 302 https://wiki.hamburg.ccc.de$request_uri;
|
||||
}
|
||||
|
|
@ -262,7 +262,7 @@ endpoints:
|
|||
conditions:
|
||||
- "[STATUS] == 200"
|
||||
- "[CERTIFICATE_EXPIRATION] > 48h"
|
||||
- "[BODY] == pat(*ONLYOFFICE Docs Community Edition installed*)"
|
||||
- "[BODY] == pat(*ONLYOFFICE Docs installed successfully*)"
|
||||
|
||||
- name: Pad
|
||||
url: "https://pad.hamburg.ccc.de/"
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue