From ad783e4a15d0d635ad69fc2bfd069506c1d4aff3 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Tue, 27 Jan 2026 16:21:18 +0100 Subject: [PATCH 1/3] now in production --- inventories/chaosknoten/host_vars/spaceapiccc.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/inventories/chaosknoten/host_vars/spaceapiccc.yaml b/inventories/chaosknoten/host_vars/spaceapiccc.yaml index 377b909..d8b0242 100644 --- a/inventories/chaosknoten/host_vars/spaceapiccc.yaml +++ b/inventories/chaosknoten/host_vars/spaceapiccc.yaml @@ -5,7 +5,7 @@ docker_compose__pull: never certbot__version_spec: "" certbot__acme_account_email_address: le-admin@hamburg.ccc.de certbot__certificate_domains: - # - "spaceapi.ccc.de" # after DNS has been adjusted + - "spaceapi.ccc.de" # after DNS has been adjusted - "spaceapiccc.hamburg.ccc.de" certbot__new_cert_commands: - "systemctl reload nginx.service" From 3bba747dab80851b120afe8855221de96f74371c Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Tue, 27 Jan 2026 16:30:00 +0100 Subject: [PATCH 2/3] Configure seperate server for spaceapi.ccc.de --- .../chaosknoten/host_vars/spaceapiccc.yaml | 2 +- .../nginx/spaceapiccc.hamburg.ccc.de.conf | 43 ++++++++++++++++++- 2 files changed, 43 insertions(+), 2 deletions(-) diff --git a/inventories/chaosknoten/host_vars/spaceapiccc.yaml b/inventories/chaosknoten/host_vars/spaceapiccc.yaml index d8b0242..baf5065 100644 --- a/inventories/chaosknoten/host_vars/spaceapiccc.yaml +++ b/inventories/chaosknoten/host_vars/spaceapiccc.yaml @@ -5,7 +5,7 @@ docker_compose__pull: never certbot__version_spec: "" certbot__acme_account_email_address: le-admin@hamburg.ccc.de certbot__certificate_domains: - - "spaceapi.ccc.de" # after DNS has been adjusted + - "spaceapi.ccc.de" - "spaceapiccc.hamburg.ccc.de" certbot__new_cert_commands: - "systemctl reload nginx.service" diff --git a/resources/chaosknoten/spaceapiccc/nginx/spaceapiccc.hamburg.ccc.de.conf b/resources/chaosknoten/spaceapiccc/nginx/spaceapiccc.hamburg.ccc.de.conf index f060996..9b74c0c 100644 --- a/resources/chaosknoten/spaceapiccc/nginx/spaceapiccc.hamburg.ccc.de.conf +++ b/resources/chaosknoten/spaceapiccc/nginx/spaceapiccc.hamburg.ccc.de.conf @@ -12,7 +12,7 @@ server { # header. real_ip_header proxy_protocol; - server_name spaceapi.ccc.de spaceapiccc.hamburg.ccc.de; + server_name spaceapi.ccc.de; ssl_certificate /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/privkey.pem; @@ -40,3 +40,44 @@ server { proxy_pass http://172.16.238.10/; } } + +server { + # Listen on a custom port for the proxy protocol. + listen [::]:8443 ssl http2 proxy_protocol; + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 2a00:14b0:4200:3000:125::1; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + server_name spaceapi.ccc.de; + + ssl_certificate /etc/letsencrypt/live/spaceapi.ccc.de/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/spaceapi.ccc.de/privkey.pem; + # verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/chain.pem; + + # HSTS (ngx_http_headers_module is required) (63072000 seconds) + add_header Strict-Transport-Security "max-age=63072000" always; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Port 443; + # This is https in any case. + proxy_set_header X-Forwarded-Proto https; + # Hide the X-Forwarded header. + proxy_hide_header X-Forwarded; + # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that + # is transparent). + # Also provide "_hidden" for by, since it's not relevant. + proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden"; + + location / { + proxy_pass http://172.16.238.10/; + } +} From c8d4bcde7d625065dba4fa63f4ca07f93c356dde Mon Sep 17 00:00:00 2001 From: Renovate Date: Tue, 27 Jan 2026 15:30:58 +0000 Subject: [PATCH 3/3] Update all stable non-major dependencies --- inventories/chaosknoten/host_vars/netbox.yaml | 2 +- resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 | 2 +- resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/inventories/chaosknoten/host_vars/netbox.yaml b/inventories/chaosknoten/host_vars/netbox.yaml index 2c68c17..c18efd5 100644 --- a/inventories/chaosknoten/host_vars/netbox.yaml +++ b/inventories/chaosknoten/host_vars/netbox.yaml @@ -1,5 +1,5 @@ # renovate: datasource=github-releases depName=netbox packageName=netbox-community/netbox -netbox__version: "v4.5.0" +netbox__version: "v4.5.1" netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}" netbox__custom_pipeline_oidc_group_and_role_mapping: true diff --git a/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 b/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 index 50df05d..6b5a8fc 100644 --- a/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 @@ -1,7 +1,7 @@ --- services: ntfy: - image: docker.io/binwiederhier/ntfy:v2.15.0 + image: docker.io/binwiederhier/ntfy:v2.16.0 container_name: ntfy command: - serve diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index 091d113..835ed50 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -33,7 +33,7 @@ services: - pretalx_net pretalx: - image: docker.io/pretalx/standalone:v2025.1.0 + image: docker.io/pretalx/standalone:v2025.2.2 entrypoint: gunicorn command: - "pretalx.wsgi" @@ -78,7 +78,7 @@ services: - pretalx_net celery: - image: docker.io/pretalx/standalone:v2025.1.0 + image: docker.io/pretalx/standalone:v2025.2.2 command: - taskworker restart: unless-stopped