Update all stable non-major dependencies

so we remove it from all other configs as well

.forgejo/workflows/deploy-docs.yaml

@@ -11,7 +11,7 @@ jobs:
   build:
     runs-on: docker
     container:
-      image: docker.io/library/python:3.14-trixie
+      image: docker.io/library/python:3.15-trixie
     steps:
       - name: Pipeline info
         run: |

.forgejo/workflows/lint.yaml

@@ -24,7 +24,7 @@ jobs:
       # work in our environmnet.
       # Rather manually setup python (pip) before instead.
       - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@v26.6.0
+        uses: https://github.com/ansible/ansible-lint@v26.10.1
         with:
           setup_python: "false"
           requirements_file: "requirements.yml"

inventories/chaosknoten/host_vars/cloud.yaml

@@ -1,7 +1,7 @@
 # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud
 nextcloud__version: 34
 # renovate: datasource=docker depName=docker.io/library/postgres
-nextcloud__postgres_version: 15.18
+nextcloud__postgres_version: 15.19
 nextcloud__fqdn: cloud.hamburg.ccc.de
 nextcloud__data_dir: /data/nextcloud
 nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"

inventories/chaosknoten/host_vars/netbox.yaml

@@ -1,5 +1,5 @@
 # renovate: datasource=github-releases depName=netbox packageName=netbox-community/netbox
-netbox__version: "v4.6.4"
+netbox__version: "v4.7.3"
 netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}"
 netbox__custom_pipeline_oidc_group_and_role_mapping: true
 

inventories/chaosknoten/host_vars/pad.yaml

@@ -13,4 +13,4 @@ nginx__configurations:
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf') }}"
 
 # renovate: datasource=docker depName=quay.io/hedgedoc/hedgedoc
-host_pad__docker_compose__hedgedoc_version: 1.11.1
+host_pad__docker_compose__hedgedoc_version: 1.12.0

inventories/chaosknoten/host_vars/wiki.yaml

@@ -1,13 +1,10 @@
 nginx__version_spec: ""
 nginx__configurations:
-  - name: wiki.ccchh.net
-    content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf') }}"
   - name: wiki.hamburg.ccc.de
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf') }}"
 
 certbot__acme_account_email_address: j+letsencrypt-ccchh@jsts.xyz
 certbot__certificate_domains:
-  - "wiki.ccchh.net"
   - "wiki.hamburg.ccc.de"
 certbot__new_cert_commands:
   - "systemctl reload nginx.service"

resources/chaosknoten/draupnir/docker_compose/compose.yaml

@@ -3,7 +3,7 @@
 
 services:
   draupnir:
-    image: ghcr.io/the-draupnir-project/draupnir:v3.1.0
+    image: ghcr.io/the-draupnir-project/draupnir:v3.2.0
     command: [ "bot", "--draupnir-config", "/etc/draupnir/production.yaml" ]
     restart: unless-stopped
     volumes:

resources/chaosknoten/grafana/docker_compose/compose.yaml.j2

@@ -2,7 +2,7 @@
 services:
 
   prometheus:
-    image: docker.io/prom/prometheus:v3.13.1
+    image: docker.io/prom/prometheus:v3.15.1
     container_name: prometheus
     command:
       - '--config.file=/etc/prometheus/prometheus.yml'
@@ -19,7 +19,7 @@ services:
       - prom_data:/prometheus
 
   alertmanager:
-    image: docker.io/prom/alertmanager:v0.33.1
+    image: docker.io/prom/alertmanager:v0.34.1
     container_name: alertmanager
     command:
       - '--config.file=/etc/alertmanager/alertmanager.yaml'
@@ -32,7 +32,7 @@ services:
       - alertmanager_data:/alertmanager
 
   grafana:
-    image: docker.io/grafana/grafana:13.1.0
+    image: docker.io/grafana/grafana:13.2.4
     container_name: grafana
     ports:
       - 3000:3000
@@ -46,7 +46,7 @@ services:
       - graf_data:/var/lib/grafana
 
   pve-exporter:
-    image: docker.io/prompve/prometheus-pve-exporter:3.9.0
+    image: docker.io/prompve/prometheus-pve-exporter:3.10.1
     container_name: pve-exporter
     ports:
       - 9221:9221

resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2

@@ -1,7 +1,7 @@
 ---
 services:
   ntfy:
-    image: docker.io/binwiederhier/ntfy:v2.26.0
+    image: docker.io/binwiederhier/ntfy:v2.32.0
     container_name: ntfy
     command:
       - serve

resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2

@@ -15,7 +15,7 @@ services:
       - pretalx_net
 
   redis:
-    image: docker.io/library/redis:8.8.0
+    image: docker.io/library/redis:8.10.2
     restart: unless-stopped
     volumes:
       - redis:/data

resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf

@@ -27,7 +27,6 @@ map $host $upstream_acme_challenge_host {
     pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:31820;
     spaceapi.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
     staging.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
-    wiki.ccchh.net wiki.hosts.hamburg.ccc.de:31820;
     wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:31820;
     www.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
     tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:31820;

resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf

@@ -29,7 +29,6 @@ stream {
         invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         grafana.hamburg.ccc.de grafana.hosts.hamburg.ccc.de:8443;
-        wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443;
         wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443;
         onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:8443;
         hackertours.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;

resources/chaosknoten/tickets/docker_compose/compose.yaml.j2

@@ -13,7 +13,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: docker.io/library/redis:8.8.0
+    image: docker.io/library/redis:8.10.2
     ports:
       - "6379:6379"
     volumes:

resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf

@@ -1,26 +0,0 @@
-# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
-# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
-server {
-    # Listen on a custom port for the proxy protocol.
-    listen [::]:8443 ssl http2 proxy_protocol;
-    # Make use of the ngx_http_realip_module to set the $remote_addr and
-    # $remote_port to the client address and client port, when using proxy
-    # protocol.
-    # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 2a00:14b0:4200:3000:125::1;
-    # Then tell the realip_module to get the addreses from the proxy protocol
-    # header.
-    real_ip_header proxy_protocol;
-
-    server_name wiki.ccchh.net;
-
-    ssl_certificate /etc/letsencrypt/live/wiki.ccchh.net/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/wiki.ccchh.net/privkey.pem;
-    # verify chain of trust of OCSP response using Root CA and Intermediate certs
-    ssl_trusted_certificate /etc/letsencrypt/live/wiki.ccchh.net/chain.pem;
-
-    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    return 302 https://wiki.hamburg.ccc.de$request_uri;
-}

resources/external/status/docker_compose/compose.yaml.j2

@@ -4,7 +4,7 @@
 
 services:
   database:
-    image: docker.io/library/postgres:18.4
+    image: docker.io/library/postgres:18.6
     restart: always
     volumes:
       - ./database:/var/lib/postgresql
@@ -16,7 +16,7 @@ services:
       - gatus
 
   gatus:
-    image: ghcr.io/twin/gatus:v5.36.0
+    image: ghcr.io/twin/gatus:v5.37.0
     restart: always
     ports:
       - "8080:8080"

roles/dokuwiki/tasks/main.yml

@@ -12,6 +12,24 @@
       - git
   diff: false
 
+- name: Configure php.ini for php-fpm
+  become: true
+  block:
+    - name: Ensure `session.use_strict_mode` is enabled via php.ini
+      ansible.builtin.lineinfile:
+        path: /etc/php/8.4/fpm/php.ini
+        regexp: '^session\.use_strict_mode'
+        line: 'session.use_strict_mode = 1'
+        state: present
+
+    - name: Ensure `session.upload_progress.enabled` is disabled via php.ini
+      become: true
+      ansible.builtin.lineinfile:
+        path: /etc/php/8.4/fpm/php.ini
+        regexp: '^session\.upload_progress\.enabled'
+        line: 'session.upload_progress.enabled = Off'
+        state: present
+
 - name: Ensure `php-fpm` is enabled
   become: true
   ansible.builtin.systemd: