diff --git a/.forgejo/workflows/deploy-docs.yaml b/.forgejo/workflows/deploy-docs.yaml index 537d983..6e0acd6 100644 --- a/.forgejo/workflows/deploy-docs.yaml +++ b/.forgejo/workflows/deploy-docs.yaml @@ -23,7 +23,7 @@ jobs: apt -y install nodejs git rsync openssh-client pip install --upgrade pip - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Install Python packages run: | diff --git a/.forgejo/workflows/lint.yaml b/.forgejo/workflows/lint.yaml index bdd53f5..2007d24 100644 --- a/.forgejo/workflows/lint.yaml +++ b/.forgejo/workflows/lint.yaml @@ -10,7 +10,7 @@ jobs: name: Ansible Lint runs-on: docker steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Install pip run: | apt update diff --git a/docs/concepts-and-configurations/documentation-structure.md b/docs/concepts-and-configurations/documentation-structure.md index 0ca89d3..f5f4a21 100644 --- a/docs/concepts-and-configurations/documentation-structure.md +++ b/docs/concepts-and-configurations/documentation-structure.md @@ -5,12 +5,103 @@ summary: >- How our documentation is organized and what we do to balance ease of writing and understanding. --- -!!! info "ToDo" +!!! info "Info" - This section needs updating + If you're looking for a hands-on approach on how documentation is to be written you can find a [guide](../guides/writing-documentation.md) explaining the process. If you're unsure how to start you can find [templates](../guides/writing-documentation.md#3-addedit-your-markdown-file) there aswell. -- Docs should be english -- Guides are for step-by-step things - - Guides always have a "Goal" explicitly formulated -- Concepts and Configuration aim to make readers understand something in detail +## General Rules +These rules are general formatting and writing decisions that apply to every document. Their goal is to provide a concise style across the whole documentation to keep the text easy to follow. +- All documents written in this project should be written in **english** to maximize the compatability across readers. +- The documentation structure is intended to be followed, while not being **enforced** to keep a low entry barier for documentation authors. +- Use features like _Admonitions_ given by markdown and the theme whenever they can help by increasing the readability and outlining important parts. For instructions on how to use these theme specific features please refer down to the [MkDocs shadcn](https://asiffer.github.io/mkdocs-shadcn/) documentation. + +## Defining a Document Scope +The scope for a document should be set to define responsibility and set boundaries to where that document applies. Especially lining out which services are affected by it. It **does not** need to be defined explicitly in the text, but should be kept in mind while writing. + +!!! note "Example" + + The scope for this document is aiming to convey the base concepts on how to structure concepts and configurations in this documentation. To provide high readability and a project wide concise structure that authors and readers can rely on. + +We generally distinguish between concepts, configurations and guides in this documentation. Their separation should be clarified with folowing list: + +- **Concept:** A concept includes an abstract definition about a specific structure while not going into implementation details. It is a document intending to further abstract the understanding of structure. It can also go into detail about _why_ we do things a certain way. +- **Configuration:** A configuration can be a follow up of a concept, explaining the specific implementation in a given environment. +- **Guide:** A guide is a step-by-step hands-on instruction for the reader to follow along. It can reference concepts and configurations. The important difference to the other two document types is that guides are goal oriented. Understanding how things work is secondary to achieving a specific thing. + + +## Structuring Concepts + +!!! note "Goal" + + The goal for a concept is to provide the reader with a structured detailed explanation about an abstract concept, conveying why this concept was choosen and how it is intended to be used. + +### Describing the Concept +This section is a summary to give the reader a quick overview about the concept answering following questions: + +- What is this concept about? +- Why is this concept needed? +- What does this concept do? + +### Explaining the Concept +This section should be an in depth explanation about the concept, explaining the concept as detailed as needed for the reader to be able to transfer it into an implementation. The usage of graphs and diagrams is advised when they can help the reader understand the concept better. + +### Referencing additional Sources +This section should include sources to other documentations, concepts and hand-on guides which the reader can look up to futher explore the defined concept. + + +## Structuring Configurations + +!!! note "Goal" + + A configuration document is intended to provide the reader with examples and best practices for configuring a specific item. It focuses on the technical implementation rather than an abstract concept. + +### Describing the Configuration +This section should give the reader a quick overview which configuration files are being described. + +### Providing the Configuration +Here the author should provide configuration sections or full templates. The configurations don't have to be fully complete, they're rather a more structured view on which options are important and what to watch out for. + +### Discussing Authors Thoughts +A discussion why the author choose which configuration options and what to watch out for. Best practices should be taught here. This section can also link to outside sources. + +### Referencing Documentation +Here the author should provide upstream documentation which includes configuration options and further explanations why and how they are used. + + +## Structuring Guides + +!!! note "Goal" + + A guide intends to provide a hands-on approach to the reader which they can follow step-by-step to archive the guides defined goal. A good example for a guide can be found at [Writing Documentation](../guides/writing-documentation.md). + +### Defining the Goal +A guide should always have a goal defined in the beginning, using the _Admonition_ for a success box is highly advised. An example for a goal box is shown below: + +/// tab | Source + +```markdown +!!! success "Goal" + How to setup, write its baseline documentation in ansible, and deploy a service. +``` + +/// + +/// tab | Rendered + +!!! success "Goal" + How to setup, write its baseline documentation in ansible, and deploy a service. + +/// + +### Instructing the Reader +A guide should always have numbered instruction steps which are easy to follow. Important notices and information should written in _Admonitions_ as direct notices from the author to the reader. Dangerous steps or options should use a `danger` Admonition. + +### Closing Up +While this section is optional, a guide should be finished with steps and facts that can be checked by the reader to ensure that the guide worked as intended and all steps are completed correctly. + +## References +Here you can find useful documentation regarding writing documentation: + +- [MkDocs](https://www.mkdocs.org/user-guide/): This is the official mkdocs documentation, although it mostly explains configuring the mkdocs instance rather than explaining the usage. +- [MkDocs shadcn](https://asiffer.github.io/mkdocs-shadcn/): This is our theme for MkDocs which has its own syntax and quircks which can help writing more readable documentation diff --git a/docs/guides/writing-documentation.md b/docs/guides/writing-documentation.md index fd2681f..15fe254 100644 --- a/docs/guides/writing-documentation.md +++ b/docs/guides/writing-documentation.md @@ -38,7 +38,7 @@ Once you have cloned the repository, you can just edit a file in the [`docs/`](h ```shell uv venv uv pip install -r docs_requirements.txt - mkdocs serve + uv run mkdocs serve ``` When adding new content, you can use one of the templates below to get started: diff --git a/inventories/chaosknoten/host_vars/auth-dns.yaml b/inventories/chaosknoten/host_vars/auth-dns.yaml index c94a9e7..7d220bc 100644 --- a/inventories/chaosknoten/host_vars/auth-dns.yaml +++ b/inventories/chaosknoten/host_vars/auth-dns.yaml @@ -5,43 +5,46 @@ alloy_config_additional: "{{ lookup('ansible.builtin.template', 'resources/chaos knot__dnssec_key_id: "auth-dns.hamburg.ccc.de-1" knot__remotes: - - id: ns-intern.hamburg.ccc.de - address: [ "2a00:14b0:f000:23::53", "172.31.17.53" ] + - id: erfadns.ber.ccc.de + address: [ "2a02:8000:1000:101::196", "185.106.84.196" ] - id: ns.vie.ccc.de address: [ "2a02:1b8:10:31::228", "146.255.57.228" ] - - id: ns2.vie.ccc.de - address: [ "2a02:8000:1000:102::188", "185.106.84.188" ] knot__catalog_zones: - domain: "hamburg.ccc.de.catalog." - notify_targets: [ "ns.vie.ccc.de" ] + notify_targets: [ "erfadns.ber.ccc.de" ] knot__zones: - domain: "hh.ccc.de." catalog_member: "hamburg.ccc.de.catalog." - notify_targets: [ "ns-intern.hamburg.ccc.de", "ns.vie.ccc.de", "ns2.vie.ccc.de" ] + notify_targets: [ "erfadns.ber.ccc.de" ] content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone') }}" - domain: "ccchh.net." catalog_member: "hamburg.ccc.de.catalog." - notify_targets: [ "ns-intern.hamburg.ccc.de", "ns.vie.ccc.de", "ns2.vie.ccc.de" ] + notify_targets: [ "erfadns.ber.ccc.de", "ns.vie.ccc.de" ] content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/ccchh.net.zone') }}" - domain: "hamburg.ccc.de." catalog_member: "hamburg.ccc.de.catalog." - notify_targets: [ "ns-intern.hamburg.ccc.de", "ns.vie.ccc.de", "ns2.vie.ccc.de" ] + notify_targets: [ "erfadns.ber.ccc.de" ] content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone') }}" - domain: "eh20.easterhegg.eu." catalog_member: "hamburg.ccc.de.catalog." - notify_targets: [ "ns-intern.hamburg.ccc.de", "ns.vie.ccc.de", "ns2.vie.ccc.de" ] + notify_targets: [ "erfadns.ber.ccc.de", "ns.vie.ccc.de" ] content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/eh20.easterhegg.eu.zone') }}" - domain: "eh22.easterhegg.eu." catalog_member: "hamburg.ccc.de.catalog." - notify_targets: [ "ns-intern.hamburg.ccc.de", "ns.vie.ccc.de", "ns2.vie.ccc.de" ] + notify_targets: [ "erfadns.ber.ccc.de", "ns.vie.ccc.de" ] content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/eh22.easterhegg.eu.zone') }}" + - domain: "diday.org." + catalog_member: "hamburg.ccc.de.catalog." + notify_targets: [ "erfadns.ber.ccc.de", "ns.vie.ccc.de" ] + content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/diday.org.zone') }}" + - domain: "3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa." - notify_targets: [ "ns-intern.hamburg.ccc.de", "ns.vie.ccc.de", "ns2.vie.ccc.de" ] + notify_targets: [ "erfadns.ber.ccc.de" ] content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa.zone') }}" diff --git a/inventories/chaosknoten/host_vars/www2.yaml b/inventories/chaosknoten/host_vars/www2.yaml deleted file mode 100644 index 0a8071a..0000000 --- a/inventories/chaosknoten/host_vars/www2.yaml +++ /dev/null @@ -1,4 +0,0 @@ -nginx__version_spec: "" -nginx__configurations: - - name: diday.org - content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/www2/nginx/diday.org.conf') }}" diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 1c3f84e..4e968c2 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -90,14 +90,6 @@ all: ansible_host: acmedns.hosts.hamburg.ccc.de ansible_user: chaos ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de - www2: - ansible_host: www2.hosts.hamburg.ccc.de - ansible_user: chaos - ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de - www3: - ansible_host: www3.hosts.hamburg.ccc.de - ansible_user: chaos - ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de auth-dns: ansible_host: auth-dns.hamburg.ccc.de ansible_user: chaos @@ -129,8 +121,6 @@ base_config_hosts: renovate: spaceapiccc: mjolnir: - www2: - www3: auth-dns: systemd_networkd_hosts: hosts: @@ -178,8 +168,6 @@ nginx_hosts: ntfy: sunders: spaceapiccc: - www2: - www3: public_reverse_proxy_hosts: hosts: public-reverse-proxy: @@ -222,8 +210,6 @@ alloy_hosts: router: sunders: spaceapiccc: - www2: - www3: auth-dns: infrastructure_authorized_keys_hosts: hosts: @@ -246,8 +232,6 @@ infrastructure_authorized_keys_hosts: renovate: spaceapiccc: mjolnir: - www2: - www3: auth-dns: lists: wiki_hosts: @@ -283,8 +267,6 @@ ansible_pull_hosts: ntfy: spaceapiccc: mjolnir: - # www2: - # www3: auth-dns: msmtp_hosts: hosts: diff --git a/inventories/z9/host_vars/opensourcetorrents.sops.yaml b/inventories/z9/host_vars/opensourcetorrents.sops.yaml new file mode 100644 index 0000000..1be8403 --- /dev/null +++ b/inventories/z9/host_vars/opensourcetorrents.sops.yaml @@ -0,0 +1,180 @@ +ansible_pull__age_private_key: ENC[AES256_GCM,data:QB0xpxP8pLfE2ExpCRD4joQzoEcbQZTiVEJbX3t9GyFEseZUtnUCO0ysFUc6hRs2BC9hoPXz6k/dZ0vNkniBmqcN5zTofZ8bg94=,iv:3NVVsae+pgbriTNzgT6rGCEzJjw368WgAKfQCi2qsmQ=,tag:AQSIxJCZOZ8dtlvcu4WMuw==,type:str] +sops: + lastmodified: "2026-06-01T19:05:50Z" + mac: ENC[AES256_GCM,data:ms4yaDEY/2DxC56rxagBRgfkHuy2/AGhZ0om3+gTVfG8/1p7v+qWXuWrNlDjefjhLKVCaf5yl749JZIjs8PP6rTKyTcteqVfoKwx+CFaEA9OmPOaENBV8Kpy2Rrkw8J4UBBKSoTKGFDAGtyysmqbS8eqDuEpb/TbfbbybJUNfe4=,iv:g4IHNmQELptweaqRE7P3LlBTwV+7jt6AfrPowzuziv4=,tag:YkBnOJA5IN1xDhI+umYSow==,type:str] + pgp: + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxK/JaB2/SdtAQ//RL0kbXLXSfPux7TjkM/BzqbuQa/XMmPhMPLSawLjLMHa + +lAA6aSpHfX/seNQiLrS0mpXZFzvnPKgxacPx+vLAYGe46u+OXpthrKTStm2URNs + njTkuzCH8yQskaSyQKV3wPjOYTFWGOBAv7bFHenep9DIy5uwGDgYqR//fSP0nQwX + oCdegmWcymct/xhXzK+jcIbvgjD4Xfoc0Gt+IYUYF/FEZisZCRHhK5okt7uhxjcl + 39qCVipK1ofWRt3vXkNaL4ySUEB0i03yotB7eX82wuGt7/ZdpZ9NLRLfrL+DwR4j + QrO0uGBrqya9d46Ftx2wz0eF5aZOLZwe6oBVBRSq4jQ2WPF/NLzEIuFl2cRrk941 + 4L7ZWf8RfYtbicDXhRThef5D43ZF/kYZRzX/oTpAzUInD+VYPo5j0b9mjQLf50jg + jGc/jDl8PpfG8Rrx1XZJLiplSZ508ZzuRb0yr5ZEt5oB7sYW+WzI4q8HulY2lLrp + S5TIeKtyhJGbZAJSgQFJXxSI2K7ZJJcqCvMccOgTNpbWvLlChgtRnSaDkgNhV6Ox + 22C2IVg/8/90j4oDkTN6EWJcyBB3cSyfgyeDIIFiJdglX7J5w2IieMquWBUvitmg + ThIboVjDbKaDrJTRR9AxW7pDgtwJ9QtQmUcCUQS7jVRAdKpcYswuGaBuOvsAuYzU + aAEJAhBb1CFfTj/ZXcRYbr8b7viH1k/Rr0gOH1iWz6lGIJsLysEz/eieCdUzwXWF + zBW5zC5DiycUXGpD3uuEG8aF8w4alZR1ojrI8+J+Oq18j0tvjL3yRANSw/ADuDg5 + n2kmm+LeZkP2 + =GTgt + -----END PGP MESSAGE----- + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQEMA1QflAioE8i3AQf/XGTsK3l2dEjTmsBP/+F8Y21l0cIJNEUhsFeoAdbciWcC + LFeCeCnwVdMog6ZcJvhAZKghTYzm2/wfuolMLdSsci4yYM7G+cqZLxtBGrczUgvo + HRd4YbL/PY28SM9S37RhlT6KS8rbE9IzYiZDWHXvIDb4CCrmNrfZDUBthj+nbKI0 + vxy5N1ZtrKKalAx1C4pL3zdxJD+2gV/4bzbl9gIs/tfNxj9zdlHORiWh+VT9YGwS + 9S4atPuwVtGNjALj3ynGqTNAsjSTW/LNpITQO3NQP7TapdoJYfXyzQlq9e9eKn+F + eTer+RwxbkQVFhAf2ta6LARaIZuxbb2TXAs56Pot79JeAeGhN+rRrgzuSsPLzvsA + ffppf7aUTSyZhTR/w2XC0kJoq9a3RzxhvgxGH9ChoWi0Rww8CYNqOjs6wRNHoZEq + nIcKELugMRe+HOvxauhlKUS7PbkIyzWA8OUxp+KGdQ== + =bbYE + -----END PGP MESSAGE----- + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAz5uSgHG2iMJARAAl+rfH2BzDc/DaciHospFYIGG1ZKIIXcLks/owL5gyTpE + xDJB+tC/GIrSPTqFZbpjtz1PmBEvJAwqdb5hTz0oux8X4xEHHwenmF1meBuyffX/ + UrkNtog0hVhyV07XNpY0iVCbhKhskLf70jteZx5PZEobtE4aggp3MKRM5SSLmAsF + WL1bIucY/NBFsmNK8zc3GF7i9EqD2WtSKjGjaxLReJSUZB5+qdTe8vFo6bL+AHuh + yW2F3M6k5BMA8oJd6l2az29kbXAhjZS1eQX9WoVCYB2I8BHLSeM5XNkPShgCBcLK + DnNtUhSgKb6kcqJe63K3GwzNyzOVzzVrLP6TLk7kOoQgTocG+QlCJE5fVtynOCx6 + sqiJfRpHWbNgWyfrlKtXmPgGP9vYTRUm/DhJKhuPNJi1zcEizVSXpApjaBvdFyzC + /e5+RZdv/CM4hN10ZYB559zuhM1eQCCI9jrd8QJYfr4cZpNG8SrRpLSBoXzisULc + 1OKFpsaC/wCAHz6YKORmHDR1DC6ZvOtUL+bZ1cvU9kT5y8MlAyzWhz0jI8dk5CgV + 4r4w3yC0sF4cwIR/fWkHfS2bBecdcAuy0mxS9LxxR8JZgXOyemprHw5qenyCEn3+ + orTBbz0Y9CkIe+zfwmReqjBhKiwKKxcuEVXpUS6pEOoRyJj3VgRPohNX1bnem7DS + XgHliClcpKnUTIqt/XSQgfMyRSZkMEjNFQ8MFKBc+jM5L9/ePqOmNfli7tM8bbxt + y01x1AzFpQoMTrH6XtWHou2l8g9xqKwMnDjfFv3wXxaoabaZO0ZCP+KJjIzFWNA= + =0dtX + -----END PGP MESSAGE----- + fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DsZXvxFXTXoQSAQdAePJugVBFUtTJdt/Wm9/fEKLNhviCY8Hs2vrMfGk0UlYw + l6MV4EgwcL2G3kiUAkpFgyRQKFRTIdTMxqNy/zwjPQy1OZ+GvNGTCYO3Ig9bQcdq + 0l4BjFXvf7siDLCF4B6+eaPRh6vCe1CL5Iz1+W9aaQtE+g8lsBMpSrHPrFPJIxgm + HM3Vla/58ncOAwKo15jCPW9fzR++wd4rs66dcQK6dclyfFfufSjmt2h5BPAUgHJZ + =hMBT + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAfG8vQNNlmvwPwvfgF1RQeLVakfatgGmCqo5sYgajky8w + VZoBn11zJgV8eeQHDdyKd61CPgNiWKbRSklpV3M8DUUSARFkjqAQSAnHv1gFxw+C + 0l4BPThpjiQfWRH4CONZ3gg+d2iBpnpsw5pRZecK7usf3NvIEnn6fjkYTxQ6NpwV + Gijvov5TpDIg+6WexebxAV1BOXC37mBUjLWh65ii3f8Y75poOgnFstf9Q/czh2Qm + =dQPL + -----END PGP MESSAGE----- + fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxjNhCKPP69fAQ//bBlTr4MlEDG/ebgtlD/ZMwLLLqshKwPj1Xrxww/oiDdd + TtyhJwxpXIarDjqFCAk7XRww+tdzOJsqDoL6QWeAT/hZSj9UpSmIKCYT2lZfuOfc + r1V1hyGJ+mj+8k3kDwrOIH2g2VhUQBQHzf7yDWdQYGO2+6lvjznWdYhqCir7mCCv + RAQYyM/TvQ8uQCEnzfge0+7iqXDlGLVG+gUg5gRkhl3sXYGgEZk48fQz+yIjoUXh + e+awrgatGxCGEuLUKqV/d+Yo7HDF8fmR0R3SfHzOU7X5MNa/5XLK8ebKe7c+zoJH + 0GBFecnH7AJS69ZpO7+Lw7IpwLTnK0wEeytFTLwV4EGxIM4LC9wDPlSAsPD4eUzH + TyFnPV148n5EsK7DktJzKYal/AUVrHMNKmUk9S/dD5pjm3/FAyHUKwi8BJnOyLyn + q98RJwY5mBlaQk8MVrbm/S+bSk0isK2gOj8nlU7PN2H5b9c5PP6gEMcRSTeKoWhr + uGtSJR/9tQ6BXMIZ6LXgy7Kc1rqwaINe0fMjozjAtAHGF/ir8D9YHpvjktG3K6tP + 11SX4TUQmEudWFG6faGPZB6YN8vuCPIFvYJ5atm3eimq6AL84YPxJcUmN3om+rS+ + oOQy+578A8wFqo6gsxMKnnAYgm876AM95dTZ61uaT3zRce4DxWjd/ZwsVhjpUWTS + XgFPsrLiDnvTQh/Pl4/92vVAZSgnZX/iK92BtBYOgxJRKudO1v5BEjYLZ79pptsB + WxWDwCXxVsVuSn+WRaKZG1YGIMWXgxuh8xeXY+Jonr04XJjI5xvSwc7QleqJyWs= + =0Zep + -----END PGP MESSAGE----- + fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA46L6MuPqfJqAQ/+M1k47rFaIxpZSyQTNTZFtYiAhFrd7wNd9scG9jv7VGZr + s2/ZTkKeYfUloSt9ADOvWL13odQA0UCtDHfbPlmbwNZi4sSuzFO7GAhXn8zeAnzl + QY3FbgOlARJBZgpJc3kWdWfsFBfrtUcrGeUOo7H4rp6LsALi6ZFSvfrtTgbqxsG8 + j6K8VtPODXFrHoZ6d8rPWYbccw8DU/yu8k5l+TX8p1LB0ZX3/Vuic6eq3BvaJwQ9 + WWIC52lq6WF5vTSsRlKsF8Wx0MT6cwE40QejlXvshBk2q4WxRE6EAWb/QRKG2zO6 + 0qYYKyBMf3wvG+xRibOxj9wjcKFZM9TK9GMd0nBENCdEbmd61EmSkKZ20GoyAHzb + YvDYmZaApO2KmR69XPBRMdfUYuVcIx6IRr1NbHOxRK8tDp+cmaTjFMpjJ5dQooAG + bICV9sBF0FsNPFtAUpQJt/DBEsYh+TzMDiXcYhJqXCXZfT5PKQJuKXUoFmuPXjlf + Xamndl7hzTBWV78MntslcxvoFLmaVcnqxJ4sMHFWw4uUxLfiJr9tsBuG5mDDobbV + Ut9elfKRN8kZDhPERjbsLOBLy96q6lZHw5p/LLWzhzGpusSUpbjym1TZHRuGgw2A + hvRYvxMddjVFnUYzZQ1nfiiPpfAboCi+izcDX/Z9lHizPwo1pgiJN3BozXqw3sHS + XgHIo9t0UErZXJBY4XgIYj1ZSxEcW68fWqvvWkzfapMXaD1bGqGYB5E0aYfnSEON + 1knp9pUxz4J+Ji4iSj/xIdEu/P2PA4zC01mR+NzIP/BOvKXh+Jv+aIjQPKEa3DE= + =kAEV + -----END PGP MESSAGE----- + fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DQrf1tCqiJxoSAQdAEwmCynNMa+f2381le1p/R0Y+xFNicd+FuZIKQFuBHXAw + g8sG+4zBlfpTvC1nGrmISCh9pLU0GBGdkBj7H4tzTaOCFzUlGJ0/8YE+z59vMqGb + 0l4B33k2zuTEv4o72mU3oUDbSR+GIIRrwkZP56OLYWD6cyxams0bYtPJPXIPLRgr + GqsaD7maL48YU0buIXgAqM/qLcGe4nASGbKDw/kfYYItpLY1qDtfa/HVa5UKN2gn + =r4IJ + -----END PGP MESSAGE----- + fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdAN+NvSDt9JdoluBcood/rBQqjrFc2+SYdAfaUW2qo0GAw + +fWK4SOysY4vCvbv3o0IgLaSOoFFL4+une9pN9LT8LAu8TWB1BcrAgEXY4k0CWsN + 0lgBKY5bpmJG/UYXX3fAnxVsJly22j8Twv9DqmWKNZZjC7A0Nr2hUZe/ju0wZMIH + /DrztZaEiL8wopwFuwYH8BDWqxy1fBNROYwfWpN+JATUQ15xMFxywFG6 + =e2Sg + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+AQ/+KopAvH5xiQB82eguBeCcenEkKMay/nOFaJjBQEkDJsaT + 1Bsw0Oj2raq1Z89MoOpzyxT1DiP8EaaBQAVn/A43oz8Fh5qQZ4dQSR4JhbiCdyEb + QNxE7WwcpCfcfE41SptrUscf1eMBSyu0nti4CwtZCcd06Sp9w31xwGhX4IqyMqgd + cTlxk7PDDnn5m3tuFTVJ6xfwY0JcdDQk0qIY+91hrJobfMPAtI3IooZFRV2rNAAr + BU5xECQ6xWniOzoU94tP2CiyCum6pdAvJNdyHJJfuBi/0wlJqJvG45uzp2FAxtuI + 6DhQDk4YQcB7cVetiA4DgO7cychJHlmt/AqNLRCuPwmQUb8cRcFyfKkzUs4ECPwj + PalACOTDJYy2j8/cYnj0g15ec7JJRBEeMT5MNoh+TzQPyTibMlKqWwvjxQpBXwbH + qhoHrwAQZazZgobHtxAgaV5mbeOXZ5Ex099fsIGKNE4lBgWSSIy+nhBCCKE2Rk5U + soNZger/FKyp1wm8yjSBR1kRUZJ1vZlH+CwRZabiRznkUOZqp7oSDu9rJDz7qj4K + z9TTxdGvWktY6D5NjbqhwydKxOi5V4anaDGpUU7UN4zZFoMDq2SPOQ1lMnGsivnL + bsOv6Aw9N4T/BbkNklov4Re78in5gLW2F8tZuWDivzFrRYbBUhoc4FePu9I9omjU + aAEJAhCzKn6cD31zTqUO9EF4CYQ6c1JI9Rpc6BMbOUw7/yk1Za8LXwsMAVZ5W5S6 + XAb2m30YyZTz5qTKDdPfp0g085PUIDd5i3FNOF+7KAOsHo6VYGwEEElDk+hqCxRW + X08L3B92wiCV + =09xQ + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-06-01T19:05:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdAhQVLiF0+IM+jl18Og/DVWRLd2FuGmFZE1XrT5hNFRVEw + 59z7hX9diyHbK6KGx2ef6By09bICq7EenpqSf9WOUBwnMWWNyDjFRxI7SCmYpGAO + 1GgBCQIQDb/vnYH+8CLl2NsFUndXX6QnUaXpyb8RqC7fBFd1bj79VmYGAz2F/A+i + KV5FPdekeH/HIe9Mhwdu2vUUmKXgDJ+cuEyrmlMd5xCZp0jIE7ImBSgxVMmd4stc + eDcrp4EFzYXnBA== + =/qaN + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 + unencrypted_suffix: _unencrypted + version: 3.12.2 diff --git a/inventories/z9/host_vars/opensourcetorrents.yaml b/inventories/z9/host_vars/opensourcetorrents.yaml new file mode 100644 index 0000000..6bcc86d --- /dev/null +++ b/inventories/z9/host_vars/opensourcetorrents.yaml @@ -0,0 +1 @@ +# add /etc/transmission-remote/settings.json here diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index a0251e1..237a8cc 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -6,6 +6,9 @@ all: light: ansible_host: light.ccchh.net ansible_user: chaos + opensourcetorrents: + ansible_host: opensourcetorrents.ccchh.net + ansible_user: chaos thinkcccore0: ansible_host: thinkcccore0.ccchh.net waybackproxy: diff --git a/mkdocs.yml b/mkdocs.yml index 0ae452d..8158c75 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -9,6 +9,7 @@ markdown_extensions: - attr_list - codehilite - pymdownx.blocks.details + - pymdownx.blocks.tab - pymdownx.superfences: css_class: codehilite diff --git a/resources/chaosknoten/auth-dns/zones/3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa.zone b/resources/chaosknoten/auth-dns/zones/3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa.zone index e06c4a2..9db7051 100644 --- a/resources/chaosknoten/auth-dns/zones/3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa.zone +++ b/resources/chaosknoten/auth-dns/zones/3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa.zone @@ -7,8 +7,8 @@ $TTL 7200 3600000 86400 ) - IN NS auth-dns.hamburg.ccc.de. - IN NS ns.vie.ccc.de. +@ NS auth-dns.hamburg.ccc.de. +@ NS erfadns.ber.ccc.de. ; ccchh firewall / tunnelendpunkte: 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0 IN PTR fwhh.hamburg.ccc.de. diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index e4b91d6..9151920 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -8,7 +8,7 @@ $TTL 60 ; 1 minutes ) @ NS auth-dns.hamburg.ccc.de. -@ NS ns.vie.ccc.de. +@ NS erfadns.ber.ccc.de. ; @@ -138,3 +138,11 @@ octopi A 10.89.212.31 ;zigbee2mqtt A 185.161.129.132 ; Old entry probably deprecadet + +; +; Public Club Services +; + +opensourcetorrents A 185.161.130.67 + AAAA 2a07:c481:1:35::42 + diff --git a/resources/chaosknoten/auth-dns/zones/diday.org.zone b/resources/chaosknoten/auth-dns/zones/diday.org.zone new file mode 100644 index 0000000..bf93208 --- /dev/null +++ b/resources/chaosknoten/auth-dns/zones/diday.org.zone @@ -0,0 +1,44 @@ +$TTL 3600 +@ SOA auth-dns.hamburg.ccc.de. noc.hamburg.ccc.de. ( + 1 ; serial (overwritten by knot automatically) + 10800 ; refresh + 3600 ; retry + 3600000 ; expire + 86400 ; minimum/negative ttl + ) + +@ NS auth-dns.hamburg.ccc.de. +@ NS erfadns.ber.ccc.de. + + + +; +; Main Site +; +*.diday.org. A 212.12.48.125 +*.diday.org. AAAA 2a00:14b0:4200:3000:125::1 +diday.org. A 212.12.48.125 +diday.org. AAAA 2a00:14b0:4200:3000:125::1 +diday.org. TXT "google-site-verification=pJq0LANnNJlkIflKgwbBOOt8GLuU5ywlW6RXhtPwdmE" + +; +; Mail Setup +; +diday.org. MX 10 cow.hamburg.ccc.de. +diday.org. TXT "v=spf1 mx ip4:212.12.51.133 ip6:2a00:14b0:f000:23:51:133:0:1 ip4:212.12.48.122 ip6:2a00:14b0:4200:3000:122::1 -all" +_dmarc.diday.org. TXT "v=DMARC1; p=none" +dkim._domainkey.diday.org. TXT "v=DKIM1;k=rsa;t=s;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv2YlBjR5oNm7eDeMXmQF6Izx1A17+vBHNapHlV2Rlj3N4Cjo9kSn0y8rlrqkASUKszDgToGrh1vkHhtYN6EE5QS5iVVSnXcWPiHnBzrxK4OmhVZZtrgGsM17pq9udAEEapc371dQQsL3WhXOvilGGSIQ9u5VDlc+y/ApXi79J6DHSf66t0JUU1e8vLn8ZI8hcXe3nsHXqbW4ot24rk8EvaugsK40jbhqxZ+BrJTBq/iP8w5RsF6KdYjTaqPfr/D4dbvUU6fc8jLyy3OWZgSkkOmv7m0UdbOm2Kk6c+1hNjQJZVEhQrpGrpAcjE37/v8ZNbQMgaasiugH6ElnKb13ZQIDAQAB" + +events.diday.org. A 91.98.167.209 +events.diday.org. AAAA 2a01:4f8:c2c:44b::1 +termine.diday.org. CNAME events.diday.org. + + +; +; Local Delegation or sub-sites +; +darmstadt.diday.org. DS 60883 14 2 351d5314bd499060db6de802dc06104cc9ef54ce91c783def8d20e2e9cd99b99 +darmstadt.diday.org. DS 60883 14 4 4dc93f94c226ecdbb0adbae32064c5ff9a52e9be80973a2ff99218e7bc5af19ab50d9f13f552f1a7900f781fbd7e8205 +darmstadt.diday.org. NS jerry.hax404.de. +darmstadt.diday.org. NS summer.hax404.de. + diff --git a/resources/chaosknoten/auth-dns/zones/eh20.easterhegg.eu.zone b/resources/chaosknoten/auth-dns/zones/eh20.easterhegg.eu.zone index 2820b68..5879c18 100644 --- a/resources/chaosknoten/auth-dns/zones/eh20.easterhegg.eu.zone +++ b/resources/chaosknoten/auth-dns/zones/eh20.easterhegg.eu.zone @@ -7,8 +7,8 @@ $TTL 7200 3600000 86400 ) - IN NS auth-dns.hamburg.ccc.de. - IN NS ns.vie.ccc.de. +@ NS auth-dns.hamburg.ccc.de. +@ NS erfadns.ber.ccc.de. IN MX 5 nomail.ccc.de. ;IN MX 10 local-mail.hamburg.ccc.de. diff --git a/resources/chaosknoten/auth-dns/zones/eh22.easterhegg.eu.zone b/resources/chaosknoten/auth-dns/zones/eh22.easterhegg.eu.zone index 32d9d04..a34c183 100644 --- a/resources/chaosknoten/auth-dns/zones/eh22.easterhegg.eu.zone +++ b/resources/chaosknoten/auth-dns/zones/eh22.easterhegg.eu.zone @@ -7,8 +7,8 @@ $TTL 600 3600000 86400 ) - IN NS auth-dns.hamburg.ccc.de. - IN NS ns.vie.ccc.de. +@ NS auth-dns.hamburg.ccc.de. +@ NS erfadns.ber.ccc.de. IN A 212.12.48.125 IN AAAA 2a00:14b0:4200:3000:125::1 diff --git a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone index 8c30fb4..33f8a31 100644 --- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone +++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone @@ -14,8 +14,8 @@ $TTL 7200 3600000 86400 ) - IN NS ns.hamburg.ccc.de. - IN NS ns.vie.ccc.de. +@ NS auth-dns.hamburg.ccc.de. +@ NS erfadns.ber.ccc.de. $TTL 60 IN MX 10 cow.hamburg.ccc.de. diff --git a/resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone b/resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone index 35794ba..41b7f26 100644 --- a/resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone +++ b/resources/chaosknoten/auth-dns/zones/hh.ccc.de.zone @@ -15,8 +15,8 @@ $TTL 7200 3600000 86400 ) - IN NS ns.hamburg.ccc.de. - IN NS ns.vie.ccc.de. +@ NS auth-dns.hamburg.ccc.de. +@ NS erfadns.ber.ccc.de. IN MX 5 nomail.ccc.de. ; IN MX 10 local-mail.hamburg.ccc.de. diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 index d239bb4..8db3526 100644 --- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 @@ -22,7 +22,7 @@ services: keycloak: - image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.5.7 + image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.0 pull_policy: always restart: unless-stopped command: start --optimized diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf index 304072b..6e309a2 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf @@ -87,6 +87,9 @@ map $host $upstream_acme_challenge_host { staging.docs.c3voc.de public-web-static.hosts.hamburg.ccc.de:31820; infra-docs.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820; staging.infra-docs.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820; + ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820; + überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820; + xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:31820; default ""; } diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf index 5e89aa9..5c57f0d 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf @@ -110,6 +110,9 @@ stream { staging.docs.c3voc.de public-web-static.hosts.hamburg.ccc.de:8443; infra-docs.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443; staging.infra-docs.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443; + ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443; + überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443; + xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:8443; } server { diff --git a/resources/chaosknoten/www2/nginx/diday.org.conf b/resources/chaosknoten/www2/nginx/diday.org.conf deleted file mode 100644 index 0d4253f..0000000 --- a/resources/chaosknoten/www2/nginx/diday.org.conf +++ /dev/null @@ -1,80 +0,0 @@ -server { - listen 443 ssl; - listen [::]:443 ssl; - http2 on; - - server_name diday.org; - - # use our router as resolver - #resolver 10.31.208.1; # is this needed??? - - # configure the ngx_http_realip_module to set $remote_addr and $remote_port to the - # information passed through from public-reverse-proxy.hamburg.ccc.de via proxy-protocol - set_real_ip_from 2a00:14b0:4200:3000:125::1; - real_ip_header proxy_protocol; - - # configure tls trustchain - ssl_certificate /dev/null; - ssl_certificate_key /dev/null; - ssl_trusted_certificate /dev/null; - - # - # configure site - # - root /var/www/diday.org; - error_page 404 /404.html; - index index.html; - add_header Referrer-Policy "strict-origin-when-cross-origin" always; - - # return a redirect based on the map loaded from the webroot - if ($did_redirect_target ~ ^301:(.*)$) { - return 301 $1; - } - if ($did_redirect_target ~ ^302:(.*)$) { - return 302 $1; - } - - # deny access to the redirects config file - location = /nginx-redirects.conf { - deny all; - return 404; - } - - # dynamically redirect the user to the language they prefer - location = / { - set $lang "de"; - if ($http_accept_language ~* "^en") { - set $lang "en"; - } - return 302 /$lang/; - } - - # configure decap-cms content-type and caching rules - location = /admin/cms.js { - expires -1; - add_header Cache-Control "no-store"; - } - location = /admin/config.yml { - expires -1; - add_header Cache-Control "no-store"; - types { } - default_type text/yaml; - } - - # configure asset caching - location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2?)$ { - expires 1y; - add_header Cache-Control "public, immutable"; - } - - # we are using the Astro Image Pipeline, therefore DecapCMS can't access image previews - location /admin/src/ { - log_not_found off; - return 404; - } - - location / { - try_files $uri $uri/ =404; - } -} - diff --git a/resources/external/status/docker_compose/config/services-chaosknoten.yaml b/resources/external/status/docker_compose/config/services-chaosknoten.yaml index ab426bc..aea633a 100644 --- a/resources/external/status/docker_compose/config/services-chaosknoten.yaml +++ b/resources/external/status/docker_compose/config/services-chaosknoten.yaml @@ -75,11 +75,11 @@ endpoints: conditions: - "[DNS_RCODE] == NOERROR" - - name: auth-dns (club-assistant.ccchh.net) + - name: auth-dns (pve01.ccchh.net) url: "auth-dns.hamburg.ccc.de" <<: *services_chaosknoten_defaults dns: - query-name: "club-assistant.ccchh.net" + query-name: "pve01.ccchh.net" query-type: "AAAA" conditions: - "[DNS_RCODE] == NOERROR" diff --git a/resources/external/status/docker_compose/config/websites.yaml b/resources/external/status/docker_compose/config/websites.yaml index 7ac34a2..867a23d 100644 --- a/resources/external/status/docker_compose/config/websites.yaml +++ b/resources/external/status/docker_compose/config/websites.yaml @@ -124,7 +124,7 @@ endpoints: conditions: - "[STATUS] == 200" - "[CERTIFICATE_EXPIRATION] > 48h" - - "[BODY] == pat(*Wir sind der Chaos Computer Club der Hansestadt Hamburg.*)" + - "[BODY] == pat(*STATUS_CANARY_HAMBURG_CCC_DE_DO_NOT_TOUCH*)" - name: spaceapi.ccc.de url: "https://spaceapi.ccc.de" @@ -238,4 +238,4 @@ endpoints: conditions: - "[STATUS] == 200" - "[CERTIFICATE_EXPIRATION] > 48h" - - "[BODY] == pat(*Wir sind der Chaos Computer Club der Hansestadt Hamburg.*)" + - "[BODY] == pat(*STATUS_CANARY_HAMBURG_CCC_DE_DO_NOT_TOUCH*)" diff --git a/roles/knot/tasks/02-configure.yaml b/roles/knot/tasks/02-configure.yaml index a2a8e55..e79143f 100644 --- a/roles/knot/tasks/02-configure.yaml +++ b/roles/knot/tasks/02-configure.yaml @@ -33,6 +33,7 @@ owner: knot group: knot mode: u=rw,g=r + validate: "kzonecheck -v -o '{{ item.domain }}' %s" # this seems weird but hear me out: # if we don't disable SLAAC, the node automatically gets an address based on IPv6 Router-Advertisements diff --git a/roles/knot/templates/netplan-disable-ra.yaml b/roles/knot/templates/netplan-disable-ra.yaml index 505fba2..bad31a5 100644 --- a/roles/knot/templates/netplan-disable-ra.yaml +++ b/roles/knot/templates/netplan-disable-ra.yaml @@ -1,7 +1,7 @@ # {{ ansible_managed }} network: ethernets: - {%- for i_iface_name in ansible_interfaces -%} + {%- for i_iface_name in ansible_facts["interfaces"] -%} {%- if i_iface_name != "lo" -%} {%- set i_iface = ansible_facts[i_iface_name] %} @@ -11,4 +11,3 @@ network: accept-ra: false {% endif %} {% endfor %} -