CCCHH/ansible-infra
CCCHH/ansible-infra
Watch
3
2
Fork
You've already forked ansible-infra
 1
Code Issues 19 Pull requests 18 Wiki Activity Actions

Merge remote-tracking branch 'origin/main' into keycloak-browser-flow
All checks were successful
/ build (pull_request) Successful in 29s
Details
/ Ansible Lint (pull_request) Successful in 5m49s
Details
/ Ansible Lint (push) Successful in 6m36s
Details

Browse source
This commit is contained in:
Stefan Bethke 2026-10-08 11:06:11 +02:00
commit f49fb34587
70 changed files with 5488 additions and 5092 deletions
Download patch file Download diff file Expand all files Collapse all files

2
resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2
View file

@ -2,7 +2,7 @@
services:
oauth2-proxy:
container_name: oauth2-proxy
image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3
image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5
command: --config /oauth2-proxy.cfg
hostname: oauth2-proxy
volumes:

10
resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
View file

@ -228,10 +228,7 @@ rproxy-intern IN A 172.31.17.180
IN AAAA 2a00:14b0:f000:23::80
IN MX 10 cow.hamburg.ccc.de.
bildungsurlaub IN CNAME rproxy
doku IN CNAME rproxy
test IN CNAME rproxy
www.test IN CNAME rproxy
bildungsurlaub IN CNAME public-reverse-proxy
eh2003 IN CNAME public-reverse-proxy
www.eh2003 IN CNAME public-reverse-proxy
easterhegg2003 IN CNAME public-reverse-proxy
@ -499,7 +496,8 @@ keycloak.hosts IN AAAA 2a00:14b0:42:102::6
onlyoffice.hosts IN AAAA 2a00:14b0:42:102::7
renovate.hosts IN AAAA 2a00:14b0:42:102::8
sunders.hosts IN AAAA 2a00:14b0:42:102::9
mjolnir.hosts IN AAAA 2a00:14b0:42:102::a
draupnir.hosts IN AAAA 2a00:14b0:42:102::a
mjolnir.hosts IN CNAME draupnir.hosts
netbox.hosts IN AAAA 2a00:14b0:42:102::b
tickets.hosts IN AAAA 2a00:14b0:42:102::c
zammad.hosts IN AAAA 2a00:14b0:42:102::d
@ -509,8 +507,6 @@ pretalx.hosts IN AAAA 2a00:14b0:42:102::10
ntfy.hosts IN AAAA 2a00:14b0:42:102::11
spaceapiccc.hosts IN AAAA 2a00:14b0:42:102::12
acmedns.hosts IN AAAA 2a00:14b0:42:102::13
www2.hosts IN AAAA 2a00:14b0:42:102::14
www3.hosts IN AAAA 2a00:14b0:42:102::15
diday-staging-runner.hosts IN AAAA 2a00:14b0:42:102::16
public-web-static.hosts IN AAAA 2a00:14b0:42:102::17
forgejo-actions-runner.hosts IN AAAA 2a00:14b0:42:102::18

11
resources/chaosknoten/draupnir/docker_compose/compose.yaml Normal file
View file

@ -0,0 +1,11 @@
# Links & Resources
# https://github.com/matrix-org/mjolnir/blob/main/docs/setup_docker.md
services:
draupnir:
image: ghcr.io/the-draupnir-project/draupnir:v3.1.0
command: [ "bot", "--draupnir-config", "/etc/draupnir/production.yaml" ]
restart: unless-stopped
volumes:
- ./draupnir_data:/data
- ./configs/config.yaml:/etc/draupnir/production.yaml:ro

25
resources/chaosknoten/draupnir/docker_compose/config.yaml.j2 Normal file
View file

@ -0,0 +1,25 @@
# https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml
homeserverUrl: "https://matrix.hamburg.ccc.de"
rawHomeserverUrl: "https://matrix.hamburg.ccc.de"
accessToken: "{{ secret__draupnir_matrix_user_token }}"
dataPath: "/data/storage"
logLevel: "INFO"
recordIgnoredInvites: true
managementRoom: "#moderation-management:hamburg.ccc.de"
experimentalRustCrypto: true
automaticallyRedactForReasons:
- "spam"
- "advertising"
- "porn"
- "harassmet"
# set to low value to have Draupnir chain consecutive backgrounded operations faster
backgroundDelayMS: 10
# currently not working because /_synapse is not routed via reverse proxy
pollReports: false
# this knob can turn of moderation action temporarily
noop: false

10
resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
View file

@ -59,7 +59,7 @@ services:
- /dev/null:/etc/prometheus/pve.yml
loki:
image: docker.io/grafana/loki:3.7.3
image: docker.io/grafana/loki:3.7.8
container_name: loki
ports:
- 13100:3100
@ -70,7 +70,7 @@ services:
- loki_data:/var/loki
ntfy-alertmanager-ccchh-critical:
image: docker.io/xenrox/ntfy-alertmanager:1.0.0
image: docker.io/xenrox/ntfy-alertmanager:1.0.1
container_name: ntfy-alertmanager-ccchh-critical
volumes:
- ./configs/ntfy-alertmanager-ccchh-critical:/etc/ntfy-alertmanager/config
@ -79,7 +79,7 @@ services:
restart: unless-stopped
ntfy-alertmanager-fux-critical:
image: docker.io/xenrox/ntfy-alertmanager:1.0.0
image: docker.io/xenrox/ntfy-alertmanager:1.0.1
container_name: ntfy-alertmanager-fux-critical
volumes:
- ./configs/ntfy-alertmanager-fux-critical:/etc/ntfy-alertmanager/config
@ -88,7 +88,7 @@ services:
restart: unless-stopped
ntfy-alertmanager-ccchh:
image: docker.io/xenrox/ntfy-alertmanager:1.0.0
image: docker.io/xenrox/ntfy-alertmanager:1.0.1
container_name: ntfy-alertmanager-ccchh
volumes:
- ./configs/ntfy-alertmanager-ccchh:/etc/ntfy-alertmanager/config
@ -97,7 +97,7 @@ services:
restart: unless-stopped
ntfy-alertmanager-fux:
image: docker.io/xenrox/ntfy-alertmanager:1.0.0
image: docker.io/xenrox/ntfy-alertmanager:1.0.1
container_name: ntfy-alertmanager-fux
volumes:
- ./configs/ntfy-alertmanager-fux:/etc/ntfy-alertmanager/config

2
resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
View file

@ -22,7 +22,7 @@
services:
keycloak:
image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.2
image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.5
pull_policy: always
restart: unless-stopped
command: start --optimized

10
resources/chaosknoten/mjolnir/docker_compose/compose.yaml
View file

@ -1,10 +0,0 @@
# Links & Resources
# https://github.com/matrix-org/mjolnir/blob/main/docs/setup_docker.md
services:
mjolnir:
image: docker.io/matrixdotorg/mjolnir:v1.12.1
restart: unless-stopped
volumes:
- ./mjolnir_data:/data
- ./configs/config.yaml:/data/config/production.yaml:ro

23
resources/chaosknoten/mjolnir/docker_compose/config.yaml.j2
View file

@ -1,23 +0,0 @@
# https://github.com/matrix-org/mjolnir/blob/main/config/default.yaml
homeserverUrl: "https://matrix.hamburg.ccc.de"
rawHomeserverUrl: "https://matrix.hamburg.ccc.de"
# Mjolnir should be able to retrieve an access token itself
encryption:
use: true
username: "moderation"
password: {{ secret__mjolnir_matrix_user_password }}
dataPath: "/data/storage"
autojoinOnlyIfManager: true
recordIgnoredInvites: true
# The native encryption backend doesn't seem to support v12 rooms yet.
# https://github.com/matrix-org/mjolnir/issues/641
managementRoom: "#moderation-management-v11:hamburg.ccc.de"
forwardMentionsToManagementRoom: false
verboseLogging: false
logLevel: "INFO"
syncOnStartup: true
verifyPermissionsOnStartup: true
noop: false
fasterMembershipChecks: false
protectAllJoinedRooms: true

2
resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf
View file

@ -14,6 +14,8 @@ server {
server_name pad.hamburg.ccc.de;
client_max_body_size 100m;
ssl_certificate /etc/letsencrypt/live/pad.hamburg.ccc.de/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/pad.hamburg.ccc.de/privkey.pem;
# verify chain of trust of OCSP response using Root CA and Intermediate certs

2
resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
View file

@ -23,7 +23,7 @@ services:
- pretalx_net
static:
image: docker.io/library/nginx:1.31.2
image: docker.io/library/nginx:1.31.6
restart: unless-stopped
volumes:
- public:/usr/share/nginx/html

2
resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
View file

@ -89,9 +89,11 @@ map $host $upstream_acme_challenge_host {
staging.infra-docs.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
didays.de public-web-static.hosts.hamburg.ccc.de:31820;
staging.didays.de public-web-static.hosts.hamburg.ccc.de:31820;
www.didays.de public-web-static.hosts.hamburg.ccc.de:31820;
ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820;
überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820;
xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:31820;
bildungsurlaub.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
default "";
}

3
resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
View file

@ -3,6 +3,7 @@
user nginx;
worker_processes auto;
worker_rlimit_nofile 2050; # should be worker_connections*2 at least
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
@ -112,9 +113,11 @@ stream {
staging.infra-docs.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;
didays.de public-web-static.hosts.hamburg.ccc.de:8443;
staging.didays.de public-web-static.hosts.hamburg.ccc.de:8443;
www.didays.de public-web-static.hosts.hamburg.ccc.de:8443;
ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443;
überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443;
xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:8443;
bildungsurlaub.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;
}
server {

2
resources/chaosknoten/sunders/docker_compose/compose.yaml.j2
View file

@ -3,7 +3,7 @@
services:
db:
image: mariadb:12.3.2
image: mariadb:12.3.3
command: --max_allowed_packet=3250585600
environment:
MYSQL_ROOT_PASSWORD: "{{ secret__sunders_db_root_password }}"

7
resources/chaosknoten/tickets/docker_compose/pretix.cfg.j2
View file

@ -15,7 +15,12 @@ host=database
[mail]
from=tickets@hamburg.ccc.de
host=cow-intern.hamburg.ccc.de
host=cow.hamburg.ccc.de
port=587
tls=on
user=tickets@hamburg.ccc.de
password={{ secret__pretix_mail_password }}
[redis]
location=redis://redis/0