From e668c442738927bfa5b8520f5db2333beb528bf9 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Sun, 16 Aug 2026 09:01:57 +0200 Subject: [PATCH 01/10] Enable list subscription management for intern@ --- resources/chaosknoten/lists/docker_compose/compose.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index b4372c05..2a7ffdd8 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -77,7 +77,7 @@ services: - KEYCLOAK_CLIENT_SECRET={{ secret__lists__keycloak_client_secret }} - KEYCLOAK_REALM=ccchh - KEYCLOAK_URL=https://id.hamburg.ccc.de - - LIST_ATTRIBUTES=chaos@lists.hamburg.ccc.de:mailinglist-chaos + - LIST_ATTRIBUTES=chaos@lists.hamburg.ccc.de:mailinglist-chaos,intern@lists.hamburg.ccc.de:mailinglist-intern - MAILMAN_API_PASSWORD={{ secret__lists__rest_password }} - MAILMAN_API_URL=http://mailman-core:8001/3.1 image: git.hamburg.ccc.de/ccchh/mailman-subscription-sync:latest From 53c1801eba9db670c93a407fe5fc09bfc7262f6b Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Sun, 16 Aug 2026 09:28:42 +0200 Subject: [PATCH 02/10] Change confirmation lifetime to 7d --- inventories/chaosknoten/host_vars/lists.yaml | 2 ++ resources/chaosknoten/lists/docker_compose/compose.yaml.j2 | 1 + .../chaosknoten/lists/docker_compose/mailman-extra.cfg | 6 ++++++ 3 files changed, 9 insertions(+) create mode 100644 resources/chaosknoten/lists/docker_compose/mailman-extra.cfg diff --git a/inventories/chaosknoten/host_vars/lists.yaml b/inventories/chaosknoten/host_vars/lists.yaml index e6680f4b..8070d501 100644 --- a/inventories/chaosknoten/host_vars/lists.yaml +++ b/inventories/chaosknoten/host_vars/lists.yaml @@ -1,5 +1,7 @@ docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/lists/docker_compose/compose.yaml.j2') }}" docker_compose__configuration_files: + - name: mailman-extra.cfg + content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/lists/docker_compose/mailman-extra.cfg') }}" - name: settings_local.py content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/lists/docker_compose/settings_local.py') }}" docker_compose__files: resources/chaosknoten/lists/docker_compose/files diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index 2a7ffdd8..be0303fe 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -37,6 +37,7 @@ services: - database:database volumes: - /opt/mailman/web:/opt/mailman-web-data + - ./configs/mailman-extra.cfg:/opt/mailman/core/mailman-extra.cfg - ./configs/settings_local.py:/opt/mailman-web/settings_local.py - ./files/templates:/opt/mailman-web/templates environment: diff --git a/resources/chaosknoten/lists/docker_compose/mailman-extra.cfg b/resources/chaosknoten/lists/docker_compose/mailman-extra.cfg new file mode 100644 index 00000000..1ca22f32 --- /dev/null +++ b/resources/chaosknoten/lists/docker_compose/mailman-extra.cfg @@ -0,0 +1,6 @@ +# Override Mailman configuration settings +# See https://github.com/maxking/docker-mailman#configuration +# and https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/config/docs/config.html + +[mailman] +pending_request_life: 7d From 548d761def5a32bf0a4136cd420fb0d8d85f1e68 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Mon, 17 Aug 2026 09:20:13 +0200 Subject: [PATCH 03/10] Migrate officemail away --- .../chaosknoten/auth-dns/zones/hh.ccc.de.zone | 48 ++----------------- 1 file changed, 5 insertions(+), 43 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone b/resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone index 41b7f26e..f603a3d1 100644 --- a/resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone +++ b/resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone @@ -1,15 +1,7 @@ $TTL 7200 -; es wird jetzt der hostname mail.hamburg.ccc.de nicht mehr -; verwendet, sondern statt dessen local-mail.hamburg.ccc.de -; die popeye fuehlt sich immer noch unter mail.hamburg.ccc.de -; angesprochen, und nimmt daher keine mails mit absender-adressen -; die sie nicht kennt an. -; ich hoffe diese aenderung arbeitet um diesen bug herum. -; - haegar 2001.11.14 - @ IN SOA auth-dns.hamburg.ccc.de. noc.hamburg.ccc.de. ( - 2024012601 + 2024012601 10800 3600 3600000 @@ -19,16 +11,18 @@ $TTL 7200 @ NS erfadns.ber.ccc.de. IN MX 5 nomail.ccc.de. -; IN MX 10 local-mail.hamburg.ccc.de. IN MX 23 nomail2.ccc.de. IN MX 42 nomail3.ccc.de. + ; public-reverse-proxy IN A 212.12.48.125 IN AAAA 2a00:14b0:4200:3000:125::1 -localhost IN A 127.0.0.1 +; Migration von großem C officemail zu Infra in Berlin, ggf. mit vollkorn/haegar klären +officemail IN CNAME officemail.office.ccc.de. +; Alter Kram, sollte nach der Netzwerkumstellung auf Chaosknoten überflüssig sein ; DMZ-Server: dmz-net IN A 212.12.50.208 @@ -39,35 +33,3 @@ LAN-212-12-51-128 IN A 212.12.51.128 gate IN A 212.12.51.129 END-212-12-51-143 IN A 212.12.51.143 - -; convience and email - -backup IN A 172.31.16.3 - IN AAAA 2001:6f8:126f:1:16:20:0:3 -; IN MX 5 nomail.ccc.de. - IN MX 10 local-mail.hamburg.ccc.de. - -officemail IN A 172.31.17.131 - IN MX 5 nomail.ccc.de. -; IN MX 10 local-mail.hamburg.ccc.de. - IN MX 23 nomail2.ccc.de. - IN MX 42 nomail3.ccc.de. - -orga IN CNAME orga.hamburg.ccc.de. - - -; Die alte World, aka popeye.crew-gmbh.de -; Legacy-Names, do not delete -world IN A 192.76.134.7 - IN MX 10 world -popeye IN A 192.76.134.7 - IN MX 10 world -uucp IN A 192.76.134.7 - -; ChaosVPN -hack IN NS cvpn-dns.hack -cvpn-dns.hack IN A 172.31.0.5 - - -; tmp test -merz.leck.eier IN TXT "kann er mal" From e9a5b711ae7c2cda16d0770ec4bed87a148c7d1b Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Mon, 17 Aug 2026 09:25:23 +0200 Subject: [PATCH 04/10] Start migrating config to Ansible The real file still lives in /opt/mailman on the host for now, need to migrate whole config into Ansible. --- .../lists/docker_compose/compose.yaml.j2 | 1 - .../lists/docker_compose/mailman-extra.cfg | 13 +++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index be0303fe..2a7ffdd8 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -37,7 +37,6 @@ services: - database:database volumes: - /opt/mailman/web:/opt/mailman-web-data - - ./configs/mailman-extra.cfg:/opt/mailman/core/mailman-extra.cfg - ./configs/settings_local.py:/opt/mailman-web/settings_local.py - ./files/templates:/opt/mailman-web/templates environment: diff --git a/resources/chaosknoten/lists/docker_compose/mailman-extra.cfg b/resources/chaosknoten/lists/docker_compose/mailman-extra.cfg index 1ca22f32..29bb00ce 100644 --- a/resources/chaosknoten/lists/docker_compose/mailman-extra.cfg +++ b/resources/chaosknoten/lists/docker_compose/mailman-extra.cfg @@ -4,3 +4,16 @@ [mailman] pending_request_life: 7d + +# This address is the "site owner" address. Certain messages which must be +# delivered to a human, but which can't be delivered to a list owner (e.g. a +# bounce from a list owner), will be sent to this address. It should point to +# a human. +site_owner: listops@hamburg.ccc.de + +[mta] +# remove any pre-existing DKIM headers from mails being forwarded through a +# list +remove_dkim_headers: yes + +# eof From a87c27b3d5a4521eab07e5aba868fdd2f6d492a2 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 17 Aug 2026 21:39:00 +0200 Subject: [PATCH 05/10] keycloak(host): allow right ipv4 of z9 router --- .../keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf index 1420e43d..bd819118 100644 --- a/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf +++ b/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf @@ -41,7 +41,7 @@ server { # Also provide "_hidden" for by, since it's not relevant. proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden"; - allow 185.161.129.132/32; # z9 + allow 185.161.129.134/32; # z9 allow 2a07:c480:0:100::/56; # z9 allow 2a07:c481:1::/48; # z9 new ipv6 allow 213.240.180.39/32; # stb home From 233131b6125aa612d8481e80c07870a75f41edcb Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Tue, 18 Aug 2026 19:27:54 +0200 Subject: [PATCH 06/10] Use correct hostname --- inventories/z9/hosts.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index ebbab18f..66519db7 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -15,7 +15,7 @@ all: ansible_host: waybackproxy.ccchh.net ansible_user: chaos yate: - ansible_host: yate.z9.ccchh.net + ansible_host: yate.ccchh.net ansible_user: chaos z9-router: ansible_host: z9-router.ccchh.net From 1ae6f362bd18525087de520eb261f6ac89b49004 Mon Sep 17 00:00:00 2001 From: chris Date: Wed, 19 Aug 2026 21:53:32 +0200 Subject: [PATCH 07/10] keycloak: update to 26.7.2 --- resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 index 75c94e04..e321b2f3 100644 --- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 @@ -22,7 +22,7 @@ services: keycloak: - image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.3 + image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.2 pull_policy: always restart: unless-stopped command: start --optimized From 5ae8a3b186f08ba134cf1313431c2a764d218a56 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Fri, 21 Aug 2026 23:28:21 +0200 Subject: [PATCH 08/10] Re-add IP for waybackproxy --- resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 1 + 1 file changed, 1 insertion(+) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index c501167f..2f0ccdd1 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -134,6 +134,7 @@ octopi A 10.89.212.31 ;cisco-slm248p A 10.89.208.27 +waybackproxy A 10.89.212.33 ; ; Public Club Services From a2eba1ac706fc62c770e077e787856ed336be6cc Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Fri, 21 Aug 2026 23:34:10 +0200 Subject: [PATCH 09/10] fixed IP for Retro Sun SparcStation 4 --- resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 3 +++ 1 file changed, 3 insertions(+) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index 2f0ccdd1..e5c1d251 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -136,6 +136,9 @@ octopi A 10.89.212.31 waybackproxy A 10.89.212.33 +alnair A 10.89.210.23 + TXT "Sun SparcStation 4 Retro" + ; ; Public Club Services ; From ae314ea9b37a6e35d439cd63f6687a58372a0689 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Mon, 24 Aug 2026 10:01:16 +0200 Subject: [PATCH 10/10] Configure manual subscriber lists --- resources/chaosknoten/lists/docker_compose/compose.yaml.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index 2a7ffdd8..7a109e8c 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -80,9 +80,12 @@ services: - LIST_ATTRIBUTES=chaos@lists.hamburg.ccc.de:mailinglist-chaos,intern@lists.hamburg.ccc.de:mailinglist-intern - MAILMAN_API_PASSWORD={{ secret__lists__rest_password }} - MAILMAN_API_URL=http://mailman-core:8001/3.1 + - MANUAL_SUBSCRIBER_LISTS=/manual-subscriber-lists image: git.hamburg.ccc.de/ccchh/mailman-subscription-sync:latest networks: mailman: + volumes: + - /home/chaos/mailman-manual-subscriber-lists:/manual-subscriber-lists networks: mailman: