551 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
June	d514688574	systemd_networkd(role),router(host): support global config to fix forw. ... With the router upgrade to Debian 13 the systemd version got upgraded as well breaking the current configuration for IP forwarding. Add a variable for global systemd-networkd configuration and use that to enable IPv4 and IPv6 forwarding on the router. The systemd_networkd role could be a bit nicer, not deploying/deleting the global configuration, if the variable is empty and reloading/restarting systemd-networkd at appropriate times. But as is works for now.	2026-01-18 19:21:33 +01:00
June	d7b463ecb9	status(host): fix token not working by using a new one	2026-01-18 04:54:31 +01:00
Renovate	0b6847493c	Update actions/checkout action to v6	2026-01-18 03:30:42 +00:00
Renovate	744dc00ae5	Update https://github.com/ansible/ansible-lint action to v26	2026-01-18 03:01:35 +00:00
June	fe52127e82	status(host): configure external status page and uptime monitoring host	2026-01-18 01:26:52 +01:00
June	51bbdd42a2	dooris(host): make certbot work	2026-01-13 16:55:22 +01:00
June	428b5c70bc	pretalx(host): roll back to pretalx v2025.1.0 for celery as well	2026-01-13 14:19:57 +01:00
June	92601ab9ea	renovate: add package rule for pretalx reclassifying major updates ... So that v2025.1.0 to v2025.2.2 counts as a major, not a minor, update.	2026-01-13 03:48:34 +01:00
June	3e0fdfa8de	pretalx(host): roll back to pretalx v2025.1.0 as v2025.2.2 doesn't work	2026-01-13 03:43:28 +01:00
June	951ec7ebcd	netbox(role): fix oidc integration by no longer using is_staff ... is_staff got removed in 4.5.0. See: https://github.com/netbox-community/netbox/releases/tag/v4.5.0	2026-01-13 02:25:06 +01:00
June	a92e144cfc	base_config(role): ensure base set of admin tools is installed ... See: https://git.hamburg.ccc.de/CCCHH/nix-infra/src/branch/main/config/common/admin-environment.nix	2026-01-13 00:41:06 +01:00
Renovate	c638790819	Update all stable non-major dependencies	2026-01-12 02:30:47 +00:00
June	70461c98ba	first run ansible_pull for router, then for all other hosts ... Do this to avoid a restarting router affecting playbook runs on other hosts.	2026-01-12 03:29:06 +01:00
June	968e29ccb8	do v6-only for internal proxy protocol communication ... Since we want to do v6-only internally, only listen on v6 for proxy protocol. This is also needed as we only have set_real_ip_from pointing to a v6.	2026-01-12 03:02:09 +01:00
June	255327952e	ntfy(host): move to new network and hostname	2026-01-11 03:57:11 +01:00
June	1971598e71	pretalx(host): move to new network and hostname	2026-01-11 03:23:18 +01:00
June	372f264bcb	ccchoir(host): move to new network and hostname	2026-01-11 03:23:14 +01:00
June	2fbb37db18	grafana(host): move to new network and hostname	2026-01-11 03:23:01 +01:00
June	bb30e88404	router(host): allowlist only certain icmpv6 types	2026-01-11 00:29:16 +01:00
June	a41b07949c	zammad(host): move to new network and hostname	2026-01-11 00:22:37 +01:00
June	ff550cbd8a	tickets(host): move to new network and hostname	2026-01-11 00:00:18 +01:00
June	49e3ecb986	netbox(host): move to new network and hostname	2026-01-09 03:05:29 +01:00
June	a622f21b54	renovate(host): move to new network and hostname	2026-01-07 18:46:27 +01:00
June	40b67c6bc3	sunders(host): move to new network and hostname	2026-01-07 18:46:16 +01:00
June	fbd3ea5496	base_config: disable cloud-init ssh module to avoid hostkey regeneration ... It should run once on first boot anyway and since it apparently runs for every change in the Proxmox cloud init config, disable it, so it doesn't, since it's annoying to have "random" hostkey changes.	2026-01-07 18:09:48 +01:00
June	80ddb2efc9	router: enable a DHCP server for the v4-NAT network as well ... As the hosts don't really need a static v4, just do DHCP.	2026-01-07 17:25:27 +01:00
Stefan Bethke	a328e92971	Should be compatible with trixie/13	2026-01-03 14:03:26 +01:00
Stefan Bethke	25db54b8ad	Make sure pip is installed	2026-01-03 14:02:56 +01:00
June	944c8cde82	onlyoffice(host): move to new network and hostname	2025-12-17 03:34:39 +01:00
June	366456eff8	keycloak(host): move to new network and hostname ... Also just listen on port 8443 for keycloak-admin proxy protocol.	2025-12-16 21:50:40 +01:00
June	1ca71a053e	pad(host): move to new network and hostname	2025-12-16 21:12:21 +01:00
June	b9add5bda3	cloud(host): set correct new proxy protocol reverse proxy ip	2025-12-16 20:59:15 +01:00
June	570600fce3	eh22-wiki(host): move to new network and hostname	2025-12-16 20:58:05 +01:00
June	5a476f2103	cloud(host): move to new network and hostname	2025-12-16 20:47:44 +01:00
June	b72dee0d6d	wiki(host): actually have nginx listen on v6	2025-12-16 19:52:24 +01:00
June	8b94a49f5e	wiki(host): move to new network and internal hostname	2025-12-16 19:23:33 +01:00
June	5f98dca56c	router(host): expose public v6 networks ... Also prepare for exposing public v4 networks later.	2025-12-16 19:03:36 +01:00
jtbx	66ee44366b	public-reverse-proxy: New IP of wiki VM	2025-12-14 15:39:03 +01:00
June	183b91b9f2	router(host): add nftables config for basic router functionality	2025-12-13 22:07:38 +01:00
June	d0618e3820	nftables(role): introduce role for deploying nftables	2025-12-13 22:07:37 +01:00
June	a9e394da06	router(host): add systemd-networkd-based network config	2025-12-13 22:07:37 +01:00
June	d6ba70523c	systemd_networkd(role): introd. role for deploy. systemd-networkd config	2025-12-13 22:07:35 +01:00
jtbx	766aa125c4	router(host): introduce router	2025-12-13 22:07:07 +01:00
c6ristian	c39cb0e390	we dont need to set a specific alloy version	2025-12-06 22:11:53 +01:00
c6ristian	df3710f019	grafana: set alloy to version v1.11.3 ... 1.12.0 is buggy	2025-12-02 22:55:29 +01:00
Renovate	0eaaf9227c	Update all stable non-major dependencies	2025-11-19 13:30:39 +00:00
June	ddab157600	don't pin digests anymore ... The benefit of digest pinning isn't that great for this project really and it comes at the cost of more issues and additional renovate noise, so just don't anymore. Adjust renovate config accordingly as well.	2025-11-18 14:24:21 +01:00
c6ristian	80acd5fdc6	grafana: store date for up to 28 days	2025-11-11 23:03:59 +01:00
c6ristian	5f6000adca	ssh_config: also enable sntrup761x25519-sha512 for Debain 13 ... tldr: PQC algorithms are complex but sntrup still is not brocken	2025-11-11 22:47:42 +01:00
Stefan Bethke	6fea98ffd2	Redirect to 39c3 instead of eh22	2025-11-07 20:09:02 +01:00