From 8d708b8087e7bec7eeb39551c793d9df8485d140 Mon Sep 17 00:00:00 2001
From: Renovate <no-reply@git.hamburg.ccc.de>
Date: Tue, 18 Nov 2025 20:30:38 +0000
Subject: [PATCH 01/24] Update docker.io/library/redis Docker tag to v8

---
 resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
index 6509a99..6acbd2b 100644
--- a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
@@ -13,7 +13,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: docker.io/library/redis:7.4.6
+    image: docker.io/library/redis:8.4.0
     ports:
       - "6379:6379"
     volumes:

From 0eaaf9227c730d0c0efe9f60381ecd38fee1d0ef Mon Sep 17 00:00:00 2001
From: Renovate <no-reply@git.hamburg.ccc.de>
Date: Wed, 19 Nov 2025 13:30:39 +0000
Subject: [PATCH 02/24] Update all stable non-major dependencies

---
 .forgejo/workflows/lint.yaml                              | 2 +-
 inventories/chaosknoten/host_vars/cloud.yaml              | 2 +-
 inventories/chaosknoten/host_vars/netbox.yaml             | 2 +-
 .../chaosknoten/grafana/docker_compose/compose.yaml.j2    | 8 ++++----
 .../chaosknoten/keycloak/docker_compose/compose.yaml.j2   | 2 +-
 resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 | 2 +-
 .../chaosknoten/pretalx/docker_compose/compose.yaml.j2    | 2 +-
 .../chaosknoten/tickets/docker_compose/compose.yaml.j2    | 2 +-
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/.forgejo/workflows/lint.yaml b/.forgejo/workflows/lint.yaml
index 23bf6d2..d29fb6e 100644
--- a/.forgejo/workflows/lint.yaml
+++ b/.forgejo/workflows/lint.yaml
@@ -24,7 +24,7 @@ jobs:
       # work in our environmnet.
       # Rather manually setup python (pip) before instead.
       - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@v25.9.2
+        uses: https://github.com/ansible/ansible-lint@v25.11.0
         with:
           setup_python: "false"
           requirements_file: "requirements.yml"
diff --git a/inventories/chaosknoten/host_vars/cloud.yaml b/inventories/chaosknoten/host_vars/cloud.yaml
index 0cbcd4d..fc4e23c 100644
--- a/inventories/chaosknoten/host_vars/cloud.yaml
+++ b/inventories/chaosknoten/host_vars/cloud.yaml
@@ -1,7 +1,7 @@
 # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud
 nextcloud__version: 32
 # renovate: datasource=docker depName=docker.io/library/postgres
-nextcloud__postgres_version: 15.14
+nextcloud__postgres_version: 15.15
 nextcloud__fqdn: cloud.hamburg.ccc.de
 nextcloud__data_dir: /data/nextcloud
 nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"
diff --git a/inventories/chaosknoten/host_vars/netbox.yaml b/inventories/chaosknoten/host_vars/netbox.yaml
index 60dd94a..3be8bdd 100644
--- a/inventories/chaosknoten/host_vars/netbox.yaml
+++ b/inventories/chaosknoten/host_vars/netbox.yaml
@@ -1,5 +1,5 @@
 # renovate: datasource=github-releases depName=netbox packageName=netbox-community/netbox
-netbox__version: "v4.4.5"
+netbox__version: "v4.4.6"
 netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}"
 netbox__custom_pipeline_oidc_group_and_role_mapping: true
 
diff --git a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
index 74d7916..2d598f9 100644
--- a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
@@ -2,7 +2,7 @@
 services:
 
   prometheus:
-    image: docker.io/prom/prometheus:v3.7.2
+    image: docker.io/prom/prometheus:v3.7.3
     container_name: prometheus
     command:
       - '--config.file=/etc/prometheus/prometheus.yml'
@@ -19,7 +19,7 @@ services:
       - prom_data:/prometheus
 
   alertmanager:
-    image: docker.io/prom/alertmanager:v0.28.1
+    image: docker.io/prom/alertmanager:v0.29.0
     container_name: alertmanager
     command:
       - '--config.file=/etc/alertmanager/alertmanager.yaml'
@@ -32,7 +32,7 @@ services:
       - alertmanager_data:/alertmanager
 
   grafana:
-    image: docker.io/grafana/grafana:12.2.1
+    image: docker.io/grafana/grafana:12.3.0
     container_name: grafana
     ports:
       - 3000:3000
@@ -59,7 +59,7 @@ services:
       - /dev/null:/etc/prometheus/pve.yml
 
   loki:
-    image: docker.io/grafana/loki:3.5.7
+    image: docker.io/grafana/loki:3.6.0
     container_name: loki
     ports:
       - 13100:3100
diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
index 9fde708..a260ab1 100644
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@@ -46,7 +46,7 @@ services:
       - "8080:8080"
 
   db:
-    image: docker.io/library/postgres:15.14
+    image: docker.io/library/postgres:15.15
     restart: unless-stopped
     networks:
       - keycloak
diff --git a/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 b/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2
index 9fe2a7a..50df05d 100644
--- a/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2
@@ -1,7 +1,7 @@
 ---
 services:
   ntfy:
-    image: docker.io/binwiederhier/ntfy:v2.14.0
+    image: docker.io/binwiederhier/ntfy:v2.15.0
     container_name: ntfy
     command:
       - serve
diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
index 3de7eac..dda67bb 100644
--- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
@@ -15,7 +15,7 @@ services:
       - pretalx_net
 
   redis:
-    image: docker.io/library/redis:8.2.2
+    image: docker.io/library/redis:8.4.0
     restart: unless-stopped
     volumes:
       - redis:/data
diff --git a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
index 6509a99..938883b 100644
--- a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
@@ -13,7 +13,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: docker.io/library/redis:7.4.6
+    image: docker.io/library/redis:7.4.7
     ports:
       - "6379:6379"
     volumes:

From df3710f0196206bbfae0996dcbc1ed7b9d8f09bf Mon Sep 17 00:00:00 2001
From: c6ristian <c6ristian@christian.moe>
Date: Tue, 2 Dec 2025 22:55:29 +0100
Subject: [PATCH 03/24] grafana: set alloy to version v1.11.3

1.12.0 is buggy
---
 inventories/chaosknoten/host_vars/grafana.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inventories/chaosknoten/host_vars/grafana.yaml b/inventories/chaosknoten/host_vars/grafana.yaml
index 2e3672e..0037fcc 100644
--- a/inventories/chaosknoten/host_vars/grafana.yaml
+++ b/inventories/chaosknoten/host_vars/grafana.yaml
@@ -53,7 +53,7 @@ nginx__configurations:
   - name: metrics.hamburg.ccc.de
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/grafana/nginx/metrics.hamburg.ccc.de.conf') }}"
 
-
+alloy_version: "1.11.3"
 alloy_config: |
   prometheus.remote_write "default" {
     endpoint {

From c39cb0e3909ca53df08e6389603cfbb77e32da2b Mon Sep 17 00:00:00 2001
From: c6ristian <c6ristian@christian.moe>
Date: Sat, 6 Dec 2025 22:11:53 +0100
Subject: [PATCH 04/24] we dont need to set a specific alloy version

---
 inventories/chaosknoten/host_vars/grafana.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/inventories/chaosknoten/host_vars/grafana.yaml b/inventories/chaosknoten/host_vars/grafana.yaml
index 0037fcc..ecc942c 100644
--- a/inventories/chaosknoten/host_vars/grafana.yaml
+++ b/inventories/chaosknoten/host_vars/grafana.yaml
@@ -53,7 +53,6 @@ nginx__configurations:
   - name: metrics.hamburg.ccc.de
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/grafana/nginx/metrics.hamburg.ccc.de.conf') }}"
 
-alloy_version: "1.11.3"
 alloy_config: |
   prometheus.remote_write "default" {
     endpoint {

From 766aa125c4da85009ae7d3023be55dbc37c47d65 Mon Sep 17 00:00:00 2001
From: jtbx <ccc@jtbx.de>
Date: Sun, 23 Feb 2025 18:49:19 +0100
Subject: [PATCH 05/24] router(host): introduce router

---
 inventories/chaosknoten/hosts.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index b9e6358..e668d49 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -51,6 +51,9 @@ all:
     public-reverse-proxy:
       ansible_host: public-reverse-proxy.hamburg.ccc.de
       ansible_user: chaos
+    router:
+      ansible_host: router.hamburg.ccc.de
+      ansible_user: chaos
     wiki:
       ansible_host: wiki-intern.hamburg.ccc.de
       ansible_user: chaos
@@ -88,6 +91,7 @@ base_config_hosts:
     pad:
     pretalx:
     public-reverse-proxy:
+    router:
     tickets:
     wiki:
     zammad:
@@ -173,6 +177,7 @@ infrastructure_authorized_keys_hosts:
     pad:
     pretalx:
     public-reverse-proxy:
+    router:
     wiki:
     zammad:
     ntfy:

From d6ba70523cd45b95845acb49741bbaa699703994 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 20:05:02 +0200
Subject: [PATCH 06/24] systemd_networkd(role): introd. role for deploy.
 systemd-networkd config

---
 inventories/chaosknoten/hosts.yaml              |  2 ++
 playbooks/deploy.yaml                           |  5 +++++
 roles/systemd_networkd/README.md                | 11 +++++++++++
 roles/systemd_networkd/meta/argument_specs.yaml |  6 ++++++
 roles/systemd_networkd/tasks/main.yaml          | 14 ++++++++++++++
 5 files changed, 38 insertions(+)
 create mode 100644 roles/systemd_networkd/README.md
 create mode 100644 roles/systemd_networkd/meta/argument_specs.yaml
 create mode 100644 roles/systemd_networkd/tasks/main.yaml

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index e668d49..51d2b56 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -98,6 +98,8 @@ base_config_hosts:
     ntfy:
     sunders:
     renovate:
+systemd_networkd_hosts:
+  hosts:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index d7bacac..ec7db50 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -4,6 +4,11 @@
   roles:
     - base_config
 
+- name: Ensure systemd-networkd config deployment on systemd_networkd_hosts
+  hosts: systemd_networkd_hosts
+  roles:
+    - systemd_networkd
+
 - name: Ensure deployment of infrastructure authorized keys
   hosts: infrastructure_authorized_keys_hosts
   roles:
diff --git a/roles/systemd_networkd/README.md b/roles/systemd_networkd/README.md
new file mode 100644
index 0000000..3297c47
--- /dev/null
+++ b/roles/systemd_networkd/README.md
@@ -0,0 +1,11 @@
+# Role `systemd_networkd`
+
+Deploys the given systemd-networkd configuration files.
+
+## Support Distributions
+
+Should work on Debian-based distributions.
+
+## Required Arguments
+
+- `systemd_networkd__config_dir`: Directory with systemd-networkd configs to deploy.
diff --git a/roles/systemd_networkd/meta/argument_specs.yaml b/roles/systemd_networkd/meta/argument_specs.yaml
new file mode 100644
index 0000000..81b046a
--- /dev/null
+++ b/roles/systemd_networkd/meta/argument_specs.yaml
@@ -0,0 +1,6 @@
+argument_specs:
+  main:
+    options:
+      systemd_networkd__config_dir:
+        type: path
+        required: true
diff --git a/roles/systemd_networkd/tasks/main.yaml b/roles/systemd_networkd/tasks/main.yaml
new file mode 100644
index 0000000..f88ed14
--- /dev/null
+++ b/roles/systemd_networkd/tasks/main.yaml
@@ -0,0 +1,14 @@
+- name: ensure rsync is installed
+  ansible.builtin.apt:
+    name: rsync
+    state: present
+  become: true
+
+- name: synchronize systemd-networkd configs
+  ansible.posix.synchronize:
+    src: "{{ systemd_networkd__config_dir }}"
+    dest: "/etc/systemd/network"
+    archive: false
+    recursive: true
+    delete: true
+  become: true

From a9e394da063211b91f6c120dfa5a30f52aac64ad Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 20:03:30 +0200
Subject: [PATCH 07/24] router(host): add systemd-networkd-based network config

---
 inventories/chaosknoten/host_vars/router.yaml |  1 +
 inventories/chaosknoten/hosts.yaml            |  1 +
 .../router/systemd_networkd/00-net0.link      |  6 ++++
 .../router/systemd_networkd/00-net1.link      |  6 ++++
 .../router/systemd_networkd/00-net2.link      |  6 ++++
 .../systemd_networkd/10-net0.2-v4_nat.netdev  |  7 +++++
 .../10-net0.3-ci_runner.netdev                |  7 +++++
 .../router/systemd_networkd/20-net0.network   | 12 ++++++++
 .../router/systemd_networkd/20-net1.network   | 14 +++++++++
 .../router/systemd_networkd/20-net2.network   | 14 +++++++++
 .../systemd_networkd/21-net0.2-v4_nat.network | 23 +++++++++++++++
 .../21-net0.3-ci_runners.network              | 29 +++++++++++++++++++
 12 files changed, 126 insertions(+)
 create mode 100644 inventories/chaosknoten/host_vars/router.yaml
 create mode 100644 resources/chaosknoten/router/systemd_networkd/00-net0.link
 create mode 100644 resources/chaosknoten/router/systemd_networkd/00-net1.link
 create mode 100644 resources/chaosknoten/router/systemd_networkd/00-net2.link
 create mode 100644 resources/chaosknoten/router/systemd_networkd/10-net0.2-v4_nat.netdev
 create mode 100644 resources/chaosknoten/router/systemd_networkd/10-net0.3-ci_runner.netdev
 create mode 100644 resources/chaosknoten/router/systemd_networkd/20-net0.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/20-net1.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/20-net2.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
 create mode 100644 resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network

diff --git a/inventories/chaosknoten/host_vars/router.yaml b/inventories/chaosknoten/host_vars/router.yaml
new file mode 100644
index 0000000..b181c0a
--- /dev/null
+++ b/inventories/chaosknoten/host_vars/router.yaml
@@ -0,0 +1 @@
+systemd_networkd__config_dir: 'resources/chaosknoten/router/systemd_networkd/'
diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 51d2b56..d3217ab 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -100,6 +100,7 @@ base_config_hosts:
     renovate:
 systemd_networkd_hosts:
   hosts:
+    router:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/resources/chaosknoten/router/systemd_networkd/00-net0.link b/resources/chaosknoten/router/systemd_networkd/00-net0.link
new file mode 100644
index 0000000..0c55d13
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/00-net0.link
@@ -0,0 +1,6 @@
+[Match]
+MACAddress=BC:24:11:54:11:15
+Type=ether
+
+[Link]
+Name=net0
diff --git a/resources/chaosknoten/router/systemd_networkd/00-net1.link b/resources/chaosknoten/router/systemd_networkd/00-net1.link
new file mode 100644
index 0000000..ef04d04
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/00-net1.link
@@ -0,0 +1,6 @@
+[Match]
+MACAddress=BC:24:11:9A:FB:34
+Type=ether
+
+[Link]
+Name=net1
diff --git a/resources/chaosknoten/router/systemd_networkd/00-net2.link b/resources/chaosknoten/router/systemd_networkd/00-net2.link
new file mode 100644
index 0000000..2a56f72
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/00-net2.link
@@ -0,0 +1,6 @@
+[Match]
+MACAddress=BC:24:11:AE:C7:04
+Type=ether
+
+[Link]
+Name=net2
diff --git a/resources/chaosknoten/router/systemd_networkd/10-net0.2-v4_nat.netdev b/resources/chaosknoten/router/systemd_networkd/10-net0.2-v4_nat.netdev
new file mode 100644
index 0000000..a46afb4
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/10-net0.2-v4_nat.netdev
@@ -0,0 +1,7 @@
+[NetDev]
+Name=net0.2
+Kind=vlan
+
+[VLAN]
+Id=2
+
diff --git a/resources/chaosknoten/router/systemd_networkd/10-net0.3-ci_runner.netdev b/resources/chaosknoten/router/systemd_networkd/10-net0.3-ci_runner.netdev
new file mode 100644
index 0000000..0cd60db
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/10-net0.3-ci_runner.netdev
@@ -0,0 +1,7 @@
+[NetDev]
+Name=net0.3
+Kind=vlan
+
+[VLAN]
+Id=3
+
diff --git a/resources/chaosknoten/router/systemd_networkd/20-net0.network b/resources/chaosknoten/router/systemd_networkd/20-net0.network
new file mode 100644
index 0000000..a32d75e
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/20-net0.network
@@ -0,0 +1,12 @@
+[Match]
+Name=net0
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+VLAN=net0.2
+VLAN=net0.3
+
+LinkLocalAddressing=no
+
diff --git a/resources/chaosknoten/router/systemd_networkd/20-net1.network b/resources/chaosknoten/router/systemd_networkd/20-net1.network
new file mode 100644
index 0000000..c8bffc1
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/20-net1.network
@@ -0,0 +1,14 @@
+[Match]
+Name=net1
+
+[Network]
+DNS=212.12.50.158
+IPForward=ipv4
+IPv6AcceptRA=no
+
+[Address]
+Address=212.12.48.123/24
+
+[Route]
+Gateway=212.12.48.55
+
diff --git a/resources/chaosknoten/router/systemd_networkd/20-net2.network b/resources/chaosknoten/router/systemd_networkd/20-net2.network
new file mode 100644
index 0000000..b3f497d
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/20-net2.network
@@ -0,0 +1,14 @@
+[Match]
+Name=net2
+
+[Network]
+#DNS=212.12.50.158
+IPForward=ipv6
+IPv6AcceptRA=no
+
+[Address]
+Address=2a00:14b0:4200:3500::130:2/112
+
+[Route]
+Gateway=2a00:14b0:4200:3500::130:1
+
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
new file mode 100644
index 0000000..880dd1d
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
@@ -0,0 +1,23 @@
+[Match]
+Name=net0.2
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=v4-NAT
+
+IPMasquerade=ipv4
+IPv6SendRA=yes
+
+[Address]
+Address=10.32.2.1/24
+
+[IPv6SendRA]
+UplinkInterface=net2
+
+[IPv6Prefix]
+Prefix=2a00:14b0:42:102::/64
+Assign=true
+Token=static:::1
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network b/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
new file mode 100644
index 0000000..6f73beb
--- /dev/null
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
@@ -0,0 +1,29 @@
+[Match]
+Name=net0.3
+Type=vlan
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Description=ci-runners
+
+IPMasquerade=ipv4
+IPv6SendRA=yes
+
+DHCPServer=true
+
+[DHCPServer]
+PoolOffset=100
+PoolSize=150
+
+[Address]
+Address=10.32.3.1/24
+
+[IPv6SendRA]
+UplinkInterface=net2
+
+[IPv6Prefix]
+Prefix=2a00:14b0:42:103::/64
+Assign=true
+Token=static:::1

From d0618e382050aeabb4d50942df03d89bfb16f91a Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 21:38:39 +0200
Subject: [PATCH 08/24] nftables(role): introduce role for deploying nftables

---
 inventories/chaosknoten/hosts.yaml      |  2 ++
 playbooks/deploy.yaml                   |  5 +++++
 roles/nftables/README.md                | 11 +++++++++++
 roles/nftables/handlers/main.yaml       |  5 +++++
 roles/nftables/meta/argument_specs.yaml |  6 ++++++
 roles/nftables/tasks/main.yaml          | 15 +++++++++++++++
 6 files changed, 44 insertions(+)
 create mode 100644 roles/nftables/README.md
 create mode 100644 roles/nftables/handlers/main.yaml
 create mode 100644 roles/nftables/meta/argument_specs.yaml
 create mode 100644 roles/nftables/tasks/main.yaml

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index d3217ab..55ab696 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -101,6 +101,8 @@ base_config_hosts:
 systemd_networkd_hosts:
   hosts:
     router:
+nftables_hosts:
+  hosts:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml
index ec7db50..f416b91 100644
--- a/playbooks/deploy.yaml
+++ b/playbooks/deploy.yaml
@@ -9,6 +9,11 @@
   roles:
     - systemd_networkd
 
+- name: Ensure nftables deployment on nftables_hosts
+  hosts: nftables_hosts
+  roles:
+    - nftables
+
 - name: Ensure deployment of infrastructure authorized keys
   hosts: infrastructure_authorized_keys_hosts
   roles:
diff --git a/roles/nftables/README.md b/roles/nftables/README.md
new file mode 100644
index 0000000..81d8871
--- /dev/null
+++ b/roles/nftables/README.md
@@ -0,0 +1,11 @@
+# Role `nftables`
+
+Deploys nftables.
+
+## Support Distributions
+
+Should work on Debian-based distributions.
+
+## Required Arguments
+
+- `nftables__config`: nftables configuration to deploy.
diff --git a/roles/nftables/handlers/main.yaml b/roles/nftables/handlers/main.yaml
new file mode 100644
index 0000000..3b72c54
--- /dev/null
+++ b/roles/nftables/handlers/main.yaml
@@ -0,0 +1,5 @@
+- name: Restart nftables service
+  ansible.builtin.systemd_service:
+    name: nftables
+    state: restarted
+  become: true
diff --git a/roles/nftables/meta/argument_specs.yaml b/roles/nftables/meta/argument_specs.yaml
new file mode 100644
index 0000000..aa56223
--- /dev/null
+++ b/roles/nftables/meta/argument_specs.yaml
@@ -0,0 +1,6 @@
+argument_specs:
+  main:
+    options:
+      nftables__config:
+        type: str
+        required: true
diff --git a/roles/nftables/tasks/main.yaml b/roles/nftables/tasks/main.yaml
new file mode 100644
index 0000000..46ea18d
--- /dev/null
+++ b/roles/nftables/tasks/main.yaml
@@ -0,0 +1,15 @@
+- name: ensure nftables is installed
+  ansible.builtin.apt:
+    name: nftables
+    state: present
+  become: true
+
+- name: deploy nftables configuration
+  ansible.builtin.copy:
+    content: "{{ nftables__config }}"
+    dest: "/etc/nftables.conf"
+    mode: "0644"
+    owner: root
+    group: root
+  become: true
+  notify: Restart nftables service

From 183b91b9f2d289fcbde59687f476632cef024250 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sat, 20 Sep 2025 23:34:17 +0200
Subject: [PATCH 09/24] router(host): add nftables config for basic router
 functionality

---
 inventories/chaosknoten/host_vars/router.yaml |  1 +
 inventories/chaosknoten/hosts.yaml            |  1 +
 .../chaosknoten/router/nftables/nftables.conf | 73 +++++++++++++++++++
 .../systemd_networkd/21-net0.2-v4_nat.network |  2 +-
 .../21-net0.3-ci_runners.network              |  2 +-
 5 files changed, 77 insertions(+), 2 deletions(-)
 create mode 100644 resources/chaosknoten/router/nftables/nftables.conf

diff --git a/inventories/chaosknoten/host_vars/router.yaml b/inventories/chaosknoten/host_vars/router.yaml
index b181c0a..134d29f 100644
--- a/inventories/chaosknoten/host_vars/router.yaml
+++ b/inventories/chaosknoten/host_vars/router.yaml
@@ -1 +1,2 @@
 systemd_networkd__config_dir: 'resources/chaosknoten/router/systemd_networkd/'
+nftables__config: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/router/nftables/nftables.conf') }}"
diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 55ab696..e592d23 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -103,6 +103,7 @@ systemd_networkd_hosts:
     router:
 nftables_hosts:
   hosts:
+    router:
 docker_compose_hosts:
   hosts:
     ccchoir:
diff --git a/resources/chaosknoten/router/nftables/nftables.conf b/resources/chaosknoten/router/nftables/nftables.conf
new file mode 100644
index 0000000..6bc6cbe
--- /dev/null
+++ b/resources/chaosknoten/router/nftables/nftables.conf
@@ -0,0 +1,73 @@
+#!/usr/sbin/nft -f
+
+## Variables
+
+# Interfaces
+define if_net1_v4_wan = "net1"
+define if_net2_v6_wan = "net2"
+define if_net0_2_v4_nat = "net0.2"
+define if_net0_3_ci_runner = "net0.3"
+
+# Interface Groups
+define wan_ifs = { $if_net1_v4_wan,
+                   $if_net2_v6_wan }
+define lan_ifs = { $if_net0_2_v4_nat,
+                   $if_net0_3_ci_runner }
+
+
+## Rules
+
+table inet reverse-path-forwarding {
+    chain rpf-filter {
+        type filter hook prerouting priority mangle + 10; policy drop;
+
+        # Only allow packets if their source address is routed via their incoming interface.
+        # https://github.com/NixOS/nixpkgs/blob/d9d87c51960050e89c79e4025082ed965e770d68/nixos/modules/services/networking/firewall-nftables.nix#L100
+        fib saddr . mark . iif oif exists accept
+    }
+}
+
+table inet host {
+    chain input {
+        type filter hook input priority filter; policy drop;
+
+        iifname "lo" accept comment "allow loopback"
+
+        ct state invalid drop
+        ct state established,related accept
+
+		ip protocol icmp accept
+		ip6 nexthdr icmpv6 accept
+
+        # Allow SSH access.
+        tcp dport 22 accept comment "allow ssh access"
+
+        # Allow DHCP server access.
+		iifname $if_net0_3_ci_runner udp dport 67 accept comment "allow dhcp server access"
+    }
+}
+
+table ip v4nat {
+    chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+    }
+
+    chain postrouting {
+        type nat hook postrouting priority srcnat; policy accept;
+
+        oifname $if_net1_v4_wan masquerade
+    }
+}
+
+table inet forward {
+    chain forward {
+        type filter hook forward priority filter; policy drop;
+
+        ct state invalid drop
+        ct state established,related accept
+
+        # Allow internet access.
+		meta nfproto ipv6 iifname $lan_ifs oifname $if_net2_v6_wan accept comment "allow v6 internet access"
+		meta nfproto ipv4 iifname $lan_ifs oifname $if_net1_v4_wan accept comment "allow v4 internet access"
+    }
+}
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
index 880dd1d..c7fd9a7 100644
--- a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
@@ -8,7 +8,7 @@ RequiredForOnline=no
 [Network]
 Description=v4-NAT
 
-IPMasquerade=ipv4
+# Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
 
 [Address]
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network b/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
index 6f73beb..9caca86 100644
--- a/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.3-ci_runners.network
@@ -8,7 +8,7 @@ RequiredForOnline=no
 [Network]
 Description=ci-runners
 
-IPMasquerade=ipv4
+# Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
 
 DHCPServer=true

From 66ee44366b5e08b2368b82a25c1b1b4cd0882ff5 Mon Sep 17 00:00:00 2001
From: jtbx <ccc@jtbx.de>
Date: Sun, 14 Dec 2025 15:39:03 +0100
Subject: [PATCH 10/24] public-reverse-proxy: New IP of wiki VM

---
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index 4a449f5..de8ebdd 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -27,8 +27,8 @@ stream {
         invite.hamburg.ccc.de 172.31.17.144:8443;
         keycloak-admin.hamburg.ccc.de 172.31.17.144:8444;
         grafana.hamburg.ccc.de 172.31.17.145:8443;
-        wiki.ccchh.net 172.31.17.146:8443;
-        wiki.hamburg.ccc.de 172.31.17.146:8443;
+        wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443;
+        wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443;
         onlyoffice.hamburg.ccc.de 172.31.17.147:8443;
         hackertours.hamburg.ccc.de 172.31.17.151:8443;
         staging.hackertours.hamburg.ccc.de 172.31.17.151:8443;

From 5f98dca56c258b10c58c7efced616867f56de551 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Tue, 16 Dec 2025 19:03:36 +0100
Subject: [PATCH 11/24] router(host): expose public v6 networks

Also prepare for exposing public v4 networks later.
---
 resources/chaosknoten/router/nftables/nftables.conf | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/resources/chaosknoten/router/nftables/nftables.conf b/resources/chaosknoten/router/nftables/nftables.conf
index 6bc6cbe..6d04a4c 100644
--- a/resources/chaosknoten/router/nftables/nftables.conf
+++ b/resources/chaosknoten/router/nftables/nftables.conf
@@ -13,6 +13,8 @@ define wan_ifs = { $if_net1_v4_wan,
                    $if_net2_v6_wan }
 define lan_ifs = { $if_net0_2_v4_nat,
                    $if_net0_3_ci_runner }
+# define v4_exposed_ifs = { }
+define v6_exposed_ifs = { $if_net0_2_v4_nat }
 
 
 ## Rules
@@ -69,5 +71,9 @@ table inet forward {
         # Allow internet access.
 		meta nfproto ipv6 iifname $lan_ifs oifname $if_net2_v6_wan accept comment "allow v6 internet access"
 		meta nfproto ipv4 iifname $lan_ifs oifname $if_net1_v4_wan accept comment "allow v4 internet access"
+
+        # Allow access to exposed networks from internet.
+        # meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
+        meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access"
     }
 }

From 8b94a49f5e3255377f349087b1e224903696329a Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Tue, 16 Dec 2025 19:23:33 +0100
Subject: [PATCH 12/24] wiki(host): move to new network and internal hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 4 ++--
 resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf          | 4 ++--
 resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf     | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index e592d23..a43e940 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -55,9 +55,9 @@ all:
       ansible_host: router.hamburg.ccc.de
       ansible_user: chaos
     wiki:
-      ansible_host: wiki-intern.hamburg.ccc.de
+      ansible_host: wiki.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     zammad:
       ansible_host: zammad-intern.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 165e166..dabf4aa 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -25,8 +25,8 @@ map $host $upstream_acme_challenge_host {
     pretalx.hamburg.ccc.de 172.31.17.157:31820;
     spaceapi.hamburg.ccc.de 172.31.17.151:31820;
     staging.hamburg.ccc.de 172.31.17.151:31820;
-    wiki.ccchh.net 172.31.17.146:31820;
-    wiki.hamburg.ccc.de 172.31.17.146:31820;
+    wiki.ccchh.net wiki.hosts.hamburg.ccc.de:31820;
+    wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:31820;
     www.hamburg.ccc.de 172.31.17.151:31820;
     tickets.hamburg.ccc.de 172.31.17.148:31820;
     sunders.hamburg.ccc.de 172.31.17.170:31820;
diff --git a/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf b/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
index a564fc2..c393dd1 100644
--- a/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
+++ b/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
@@ -7,7 +7,7 @@ server {
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
@@ -21,6 +21,6 @@ server {
 
     # HSTS (ngx_http_headers_module is required) (63072000 seconds)
     add_header Strict-Transport-Security "max-age=63072000" always;
-    
+
     return 302 https://wiki.hamburg.ccc.de$request_uri;
 }
diff --git a/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf b/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
index ccdd224..255dc0a 100644
--- a/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
@@ -7,7 +7,7 @@ server {
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;

From b72dee0d6d9e0cfe9c3aea5143fe8c8cfe463604 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Tue, 16 Dec 2025 19:52:24 +0100
Subject: [PATCH 13/24] wiki(host): actually have nginx listen on v6

---
 resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf      | 1 +
 resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf | 1 +
 2 files changed, 2 insertions(+)

diff --git a/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf b/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
index c393dd1..472236a 100644
--- a/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
+++ b/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
@@ -3,6 +3,7 @@
 server {
     # Listen on a custom port for the proxy protocol.
     listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
diff --git a/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf b/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
index 255dc0a..b4eab7f 100644
--- a/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
@@ -3,6 +3,7 @@
 server {
     # Listen on a custom port for the proxy protocol.
     listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.

From 5a476f21034dd48c3a6b17758be92d3dfe9f62f0 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Tue, 16 Dec 2025 20:47:44 +0100
Subject: [PATCH 14/24] cloud(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 2 +-
 roles/nextcloud/templates/nginx_nextcloud.conf.j2             | 1 +
 4 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index a43e940..5aa1363 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -7,9 +7,9 @@ all:
     chaosknoten:
       ansible_host: chaosknoten.hamburg.ccc.de
     cloud:
-      ansible_host: cloud-intern.hamburg.ccc.de
+      ansible_host: cloud.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     eh22-wiki:
       ansible_host: eh22-wiki-intern.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index dabf4aa..9fdf0fc 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -6,7 +6,7 @@ map $host $upstream_acme_challenge_host {
     staging.c3cat.de 172.31.17.151:31820;
     ccchoir.de ccchoir-intern.hamburg.ccc.de:31820;
     www.ccchoir.de ccchoir-intern.hamburg.ccc.de:31820;
-    cloud.hamburg.ccc.de 172.31.17.143:31820;
+    cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:31820;
     element.hamburg.ccc.de 172.31.17.151:31820;
     git.hamburg.ccc.de 172.31.17.154:31820;
     grafana.hamburg.ccc.de 172.31.17.145:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index de8ebdd..84c1187 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -20,7 +20,7 @@ stream {
     map $ssl_preread_server_name $address {
         ccchoir.de ccchoir-intern.hamburg.ccc.de:8443;
         www.ccchoir.de ccchoir-intern.hamburg.ccc.de:8443;
-        cloud.hamburg.ccc.de cloud-intern.hamburg.ccc.de:8443;
+        cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:8443;
         pad.hamburg.ccc.de pad-intern.hamburg.ccc.de:8443;
         pretalx.hamburg.ccc.de pretalx-intern.hamburg.ccc.de:8443;
         id.hamburg.ccc.de 172.31.17.144:8443;
diff --git a/roles/nextcloud/templates/nginx_nextcloud.conf.j2 b/roles/nextcloud/templates/nginx_nextcloud.conf.j2
index c15a653..1beeaf3 100644
--- a/roles/nextcloud/templates/nginx_nextcloud.conf.j2
+++ b/roles/nextcloud/templates/nginx_nextcloud.conf.j2
@@ -4,6 +4,7 @@
 server {
     # Listen on a custom port for the proxy protocol.
     listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.

From 570600fce31e2df5fe2f11beedbe56cabffe377f Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Tue, 16 Dec 2025 20:58:05 +0100
Subject: [PATCH 15/24] eh22-wiki(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf | 3 ++-
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 5aa1363..c18788e 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -11,9 +11,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     eh22-wiki:
-      ansible_host: eh22-wiki-intern.hamburg.ccc.de
+      ansible_host: eh22-wiki.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     grafana:
       ansible_host: grafana-intern.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf b/resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf
index d3ed959..8c801fe 100644
--- a/resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf
+++ b/resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf
@@ -3,11 +3,12 @@
 server {
     # Listen on a custom port for the proxy protocol.
     listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 9fdf0fc..290dbad 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -38,7 +38,7 @@ map $host $upstream_acme_challenge_host {
     eh11.easterhegg.eu 172.31.17.151:31820;
     eh20.easterhegg.eu 172.31.17.151:31820;
     www.eh20.easterhegg.eu 172.31.17.151:31820;
-    eh22.easterhegg.eu 172.31.17.165:31820;
+    eh22.easterhegg.eu eh22-wiki.hosts.hamburg.ccc.de:31820;
     easterheggxxxx.hamburg.ccc.de 172.31.17.151:31820;
     eh2003.hamburg.ccc.de 172.31.17.151:31820;
     www.eh2003.hamburg.ccc.de 172.31.17.151:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index 84c1187..076618a 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -56,7 +56,7 @@ stream {
         eh11.easterhegg.eu 172.31.17.151:8443;
         eh20.easterhegg.eu 172.31.17.151:8443;
         www.eh20.easterhegg.eu 172.31.17.151:8443;
-        eh22.easterhegg.eu 172.31.17.165:8443;
+        eh22.easterhegg.eu eh22-wiki.hosts.hamburg.ccc.de:8443;
         easterheggxxxx.hamburg.ccc.de 172.31.17.151:8443;
         eh2003.hamburg.ccc.de 172.31.17.151:8443;
         www.eh2003.hamburg.ccc.de 172.31.17.151:8443;

From b9add5bda3957778dba8b3b5849a82e625ce0609 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Tue, 16 Dec 2025 20:59:15 +0100
Subject: [PATCH 16/24] cloud(host): set correct new proxy protocol reverse
 proxy ip

---
 inventories/chaosknoten/host_vars/cloud.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inventories/chaosknoten/host_vars/cloud.yaml b/inventories/chaosknoten/host_vars/cloud.yaml
index fc4e23c..b6cf771 100644
--- a/inventories/chaosknoten/host_vars/cloud.yaml
+++ b/inventories/chaosknoten/host_vars/cloud.yaml
@@ -7,5 +7,5 @@ nextcloud__data_dir: /data/nextcloud
 nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"
 nextcloud__use_custom_new_user_skeleton: true
 nextcloud__custom_new_user_skeleton_directory: "resources/chaosknoten/cloud/nextcloud/new_user_skeleton_directory/"
-nextcloud__proxy_protocol_reverse_proxy_ip: 172.31.17.140
+nextcloud__proxy_protocol_reverse_proxy_ip: "2a00:14b0:4200:3000:125::1"
 nextcloud__certbot_acme_account_email_address: le-admin@hamburg.ccc.de

From 1ca71a053e4f554ae8e1e53bc2accbe124afe78e Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Tue, 16 Dec 2025 21:12:21 +0100
Subject: [PATCH 17/24] pad(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf       | 3 ++-
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index c18788e..3d67707 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -41,9 +41,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
     pad:
-      ansible_host: pad-intern.hamburg.ccc.de
+      ansible_host: pad.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     pretalx:
       ansible_host: pretalx-intern.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf b/resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf
index 53d0a0d..6c453d1 100644
--- a/resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf
@@ -3,11 +3,12 @@
 server {
     # Listen on a custom port for the proxy protocol.
     listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 290dbad..6899c57 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -21,7 +21,7 @@ map $host $upstream_acme_challenge_host {
     element-admin.hamburg.ccc.de 172.31.17.151:31820;
     netbox.hamburg.ccc.de 172.31.17.167:31820;
     onlyoffice.hamburg.ccc.de 172.31.17.147:31820;
-    pad.hamburg.ccc.de 172.31.17.141:31820;
+    pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:31820;
     pretalx.hamburg.ccc.de 172.31.17.157:31820;
     spaceapi.hamburg.ccc.de 172.31.17.151:31820;
     staging.hamburg.ccc.de 172.31.17.151:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index 076618a..d884bc1 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -21,7 +21,7 @@ stream {
         ccchoir.de ccchoir-intern.hamburg.ccc.de:8443;
         www.ccchoir.de ccchoir-intern.hamburg.ccc.de:8443;
         cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:8443;
-        pad.hamburg.ccc.de pad-intern.hamburg.ccc.de:8443;
+        pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:8443;
         pretalx.hamburg.ccc.de pretalx-intern.hamburg.ccc.de:8443;
         id.hamburg.ccc.de 172.31.17.144:8443;
         invite.hamburg.ccc.de 172.31.17.144:8443;

From 366456eff8f5280b14d755aefbf8c0abda567fc0 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Tue, 16 Dec 2025 21:50:40 +0100
Subject: [PATCH 18/24] keycloak(host): move to new network and hostname

Also just listen on port 8443 for keycloak-admin proxy protocol.
---
 inventories/chaosknoten/hosts.yaml                          | 4 ++--
 resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf | 3 ++-
 .../chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf   | 3 ++-
 .../keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf       | 5 +++--
 .../public-reverse-proxy/nginx/acme_challenge.conf          | 6 +++---
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf | 6 +++---
 6 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 3d67707..dfa841e 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -23,9 +23,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
     keycloak:
-      ansible_host: keycloak-intern.hamburg.ccc.de
+      ansible_host: keycloak.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     lists:
       ansible_host: lists.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
index 303b052..939e1da 100644
--- a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
@@ -4,11 +4,12 @@
 server {
     # Listen on a custom port for the proxy protocol.
     listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf
index 4a9cfe6..de1e9d6 100644
--- a/resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf
@@ -4,11 +4,12 @@
 server {
     # Listen on a custom port for the proxy protocol.
     listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
index 2b0d919..cd56b98 100644
--- a/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
@@ -7,12 +7,13 @@ server {
     ##listen [::]:443 ssl http2;
 
     # Listen on a custom port for the proxy protocol.
-    listen 8444 ssl http2 proxy_protocol;
+    listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 6899c57..4d6d4c0 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -13,9 +13,9 @@ map $host $upstream_acme_challenge_host {
     hackertours.hamburg.ccc.de 172.31.17.151:31820;
     staging.hackertours.hamburg.ccc.de 172.31.17.151:31820;
     hamburg.ccc.de 172.31.17.151:31820;
-    id.hamburg.ccc.de 172.31.17.144:31820;
-    invite.hamburg.ccc.de 172.31.17.144:31820;
-    keycloak-admin.hamburg.ccc.de 172.31.17.144:31820;
+    id.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:31820;
+    invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:31820;
+    keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:31820;
     matrix.hamburg.ccc.de 172.31.17.150:31820;
     mas.hamburg.ccc.de 172.31.17.150:31820;
     element-admin.hamburg.ccc.de 172.31.17.151:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index d884bc1..de99d40 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -23,9 +23,9 @@ stream {
         cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:8443;
         pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:8443;
         pretalx.hamburg.ccc.de pretalx-intern.hamburg.ccc.de:8443;
-        id.hamburg.ccc.de 172.31.17.144:8443;
-        invite.hamburg.ccc.de 172.31.17.144:8443;
-        keycloak-admin.hamburg.ccc.de 172.31.17.144:8444;
+        id.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
+        invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
+        keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         grafana.hamburg.ccc.de 172.31.17.145:8443;
         wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443;
         wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443;

From 944c8cde8249673566e2e5bf20699e6c58a93049 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 17 Dec 2025 03:34:39 +0100
Subject: [PATCH 19/24] onlyoffice(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 .../onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf           | 4 +++-
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 2 +-
 4 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index dfa841e..1028deb 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -37,9 +37,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
     onlyoffice:
-      ansible_host: onlyoffice-intern.hamburg.ccc.de
+      ansible_host: onlyoffice.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     pad:
       ansible_host: pad.hosts.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf b/resources/chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf
index 2471525..8a9a486 100644
--- a/resources/chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf
@@ -3,11 +3,13 @@
 server {
     # Listen on a custom port for the proxy protocol.
     listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
+
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 4d6d4c0..409b5c6 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -20,7 +20,7 @@ map $host $upstream_acme_challenge_host {
     mas.hamburg.ccc.de 172.31.17.150:31820;
     element-admin.hamburg.ccc.de 172.31.17.151:31820;
     netbox.hamburg.ccc.de 172.31.17.167:31820;
-    onlyoffice.hamburg.ccc.de 172.31.17.147:31820;
+    onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:31820;
     pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:31820;
     pretalx.hamburg.ccc.de 172.31.17.157:31820;
     spaceapi.hamburg.ccc.de 172.31.17.151:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index de99d40..97e0e3c 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -29,7 +29,7 @@ stream {
         grafana.hamburg.ccc.de 172.31.17.145:8443;
         wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443;
         wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443;
-        onlyoffice.hamburg.ccc.de 172.31.17.147:8443;
+        onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:8443;
         hackertours.hamburg.ccc.de 172.31.17.151:8443;
         staging.hackertours.hamburg.ccc.de 172.31.17.151:8443;
         netbox.hamburg.ccc.de 172.31.17.167:8443;

From 25db54b8ad8314aeb35af0d7775e87c40a9239a5 Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Sat, 3 Jan 2026 14:02:56 +0100
Subject: [PATCH 20/24] Make sure pip is installed

---
 roles/ansible_pull/tasks/main.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roles/ansible_pull/tasks/main.yaml b/roles/ansible_pull/tasks/main.yaml
index 5abcd10..61a2635 100644
--- a/roles/ansible_pull/tasks/main.yaml
+++ b/roles/ansible_pull/tasks/main.yaml
@@ -3,6 +3,7 @@
     - name: ensure apt dependencies are installed
       ansible.builtin.apt:
         name:
+          - python3-pip
           - virtualenv
           - git
         state: present

From a328e9297102af66721951500cd90bedabb385a5 Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Sat, 3 Jan 2026 14:03:26 +0100
Subject: [PATCH 21/24] Should be compatible with trixie/13

---
 roles/certbot/meta/main.yaml                  | 1 +
 roles/docker/meta/main.yaml                   | 1 +
 roles/dokuwiki/meta/main.yml                  | 1 +
 roles/nginx/meta/main.yaml                    | 1 +
 roles/prometheus_node_exporter/meta/main.yaml | 1 +
 5 files changed, 5 insertions(+)

diff --git a/roles/certbot/meta/main.yaml b/roles/certbot/meta/main.yaml
index b4a1c6f..9b678e9 100644
--- a/roles/certbot/meta/main.yaml
+++ b/roles/certbot/meta/main.yaml
@@ -7,3 +7,4 @@ dependencies:
           major_versions:
             - 11
             - 12
+            - 13
diff --git a/roles/docker/meta/main.yaml b/roles/docker/meta/main.yaml
index b4a1c6f..9b678e9 100644
--- a/roles/docker/meta/main.yaml
+++ b/roles/docker/meta/main.yaml
@@ -7,3 +7,4 @@ dependencies:
           major_versions:
             - 11
             - 12
+            - 13
diff --git a/roles/dokuwiki/meta/main.yml b/roles/dokuwiki/meta/main.yml
index b4a1c6f..9b678e9 100644
--- a/roles/dokuwiki/meta/main.yml
+++ b/roles/dokuwiki/meta/main.yml
@@ -7,3 +7,4 @@ dependencies:
           major_versions:
             - 11
             - 12
+            - 13
diff --git a/roles/nginx/meta/main.yaml b/roles/nginx/meta/main.yaml
index 02b00ac..78bb770 100644
--- a/roles/nginx/meta/main.yaml
+++ b/roles/nginx/meta/main.yaml
@@ -7,3 +7,4 @@ dependencies:
           major_versions:
             - "11"
             - "12"
+            - "13"
diff --git a/roles/prometheus_node_exporter/meta/main.yaml b/roles/prometheus_node_exporter/meta/main.yaml
index 02b00ac..78bb770 100644
--- a/roles/prometheus_node_exporter/meta/main.yaml
+++ b/roles/prometheus_node_exporter/meta/main.yaml
@@ -7,3 +7,4 @@ dependencies:
           major_versions:
             - "11"
             - "12"
+            - "13"

From 80ddb2efc927c894074558f0a8f13377bb934cb4 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 7 Jan 2026 17:25:27 +0100
Subject: [PATCH 22/24] router: enable a DHCP server for the v4-NAT network as
 well

As the hosts don't really need a static v4, just do DHCP.
---
 resources/chaosknoten/router/nftables/nftables.conf         | 2 +-
 .../router/systemd_networkd/21-net0.2-v4_nat.network        | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/resources/chaosknoten/router/nftables/nftables.conf b/resources/chaosknoten/router/nftables/nftables.conf
index 6d04a4c..3375bfb 100644
--- a/resources/chaosknoten/router/nftables/nftables.conf
+++ b/resources/chaosknoten/router/nftables/nftables.conf
@@ -45,7 +45,7 @@ table inet host {
         tcp dport 22 accept comment "allow ssh access"
 
         # Allow DHCP server access.
-		iifname $if_net0_3_ci_runner udp dport 67 accept comment "allow dhcp server access"
+		iifname { $if_net0_2_v4_nat, $if_net0_3_ci_runner } udp dport 67 accept comment "allow dhcp server access"
     }
 }
 
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
index c7fd9a7..b15259d 100644
--- a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
@@ -11,6 +11,12 @@ Description=v4-NAT
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
 
+DHCPServer=true
+
+[DHCPServer]
+PoolOffset=100
+PoolSize=150
+
 [Address]
 Address=10.32.2.1/24
 

From fbd3ea54962e7b0348c9ccb4471f493c26002322 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 7 Jan 2026 18:09:48 +0100
Subject: [PATCH 23/24] base_config: disable cloud-init ssh module to avoid
 hostkey regeneration

It should run once on first boot anyway and since it apparently runs for
every change in the Proxmox cloud init config, disable it, so it
doesn't, since it's annoying to have "random" hostkey changes.
---
 roles/base_config/tasks/main.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 roles/base_config/tasks/main.yaml

diff --git a/roles/base_config/tasks/main.yaml b/roles/base_config/tasks/main.yaml
new file mode 100644
index 0000000..cd8affd
--- /dev/null
+++ b/roles/base_config/tasks/main.yaml
@@ -0,0 +1,13 @@
+# Ensure the ssh module is disabled, so a cloud-init config change doesn't regenerate the host keys for no reason.
+- name: check if cloud-init config file exists
+  ansible.builtin.stat:
+    path: /etc/cloud/cloud.cfg
+  register: base_config__stat_cloud_cfg
+
+- name: ensure the cloud-init ssh module is disabled
+  ansible.builtin.replace:
+    path: /etc/cloud/cloud.cfg
+    regexp: " - ssh$"
+    replace: " #- ssh"
+  become: true
+  when: base_config__stat_cloud_cfg.stat.exists

From 35502e53ff273b0923f5c11844706d875280cdd8 Mon Sep 17 00:00:00 2001
From: Renovate <no-reply@git.hamburg.ccc.de>
Date: Wed, 7 Jan 2026 17:16:48 +0000
Subject: [PATCH 24/24] Update docker.io/library/redis Docker tag to v8

---
 resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
index 938883b..6acbd2b 100644
--- a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
@@ -13,7 +13,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: docker.io/library/redis:7.4.7
+    image: docker.io/library/redis:8.4.0
     ports:
       - "6379:6379"
     volumes: