From ff550cbd8ad8cfd9be7bbc9d5f4c620172e5d90f Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sun, 11 Jan 2026 00:00:18 +0100
Subject: [PATCH 1/9] tickets(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 2 +-
 .../chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf     | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 14fe23a..fab9127 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -19,9 +19,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
     tickets:
-      ansible_host: tickets-intern.hamburg.ccc.de
+      ansible_host: tickets.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     keycloak:
       ansible_host: keycloak.hosts.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 06595e3..b8b44b5 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -28,7 +28,7 @@ map $host $upstream_acme_challenge_host {
     wiki.ccchh.net wiki.hosts.hamburg.ccc.de:31820;
     wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:31820;
     www.hamburg.ccc.de 172.31.17.151:31820;
-    tickets.hamburg.ccc.de 172.31.17.148:31820;
+    tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:31820;
     sunders.hamburg.ccc.de sunders.hosts.hamburg.ccc.de:31820;
     zammad.hamburg.ccc.de 172.31.17.152:31820;
     eh03.easterhegg.eu 172.31.17.151:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index 78a91ff..e540f13 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -42,7 +42,7 @@ stream {
         hamburg.ccc.de 172.31.17.151:8443;
         staging.hamburg.ccc.de 172.31.17.151:8443;
         spaceapi.hamburg.ccc.de 172.31.17.151:8443;
-        tickets.hamburg.ccc.de 172.31.17.148:8443;
+        tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:8443;
         sunders.hamburg.ccc.de sunders.hosts.hamburg.ccc.de:8443;
         zammad.hamburg.ccc.de 172.31.17.152:8443;
         c3cat.de 172.31.17.151:8443;
diff --git a/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf b/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf
index 9e2ca26..8d36244 100644
--- a/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf
@@ -2,7 +2,7 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.

From a41b07949cd6ffda5b334065c7b8ce362e11af16 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sun, 11 Jan 2026 00:22:37 +0100
Subject: [PATCH 2/9] zammad(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 2 +-
 resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index fab9127..1b88df6 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -59,9 +59,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     zammad:
-      ansible_host: zammad-intern.hamburg.ccc.de
+      ansible_host: zammad.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     ntfy:
       ansible_host: ntfy-intern.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index b8b44b5..d976089 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -30,7 +30,7 @@ map $host $upstream_acme_challenge_host {
     www.hamburg.ccc.de 172.31.17.151:31820;
     tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:31820;
     sunders.hamburg.ccc.de sunders.hosts.hamburg.ccc.de:31820;
-    zammad.hamburg.ccc.de 172.31.17.152:31820;
+    zammad.hamburg.ccc.de zammad.hosts.hamburg.ccc.de:31820;
     eh03.easterhegg.eu 172.31.17.151:31820;
     eh05.easterhegg.eu 172.31.17.151:31820;
     eh07.easterhegg.eu 172.31.17.151:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index e540f13..c4d1fbc 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -44,7 +44,7 @@ stream {
         spaceapi.hamburg.ccc.de 172.31.17.151:8443;
         tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:8443;
         sunders.hamburg.ccc.de sunders.hosts.hamburg.ccc.de:8443;
-        zammad.hamburg.ccc.de 172.31.17.152:8443;
+        zammad.hamburg.ccc.de zammad.hosts.hamburg.ccc.de:8443;
         c3cat.de 172.31.17.151:8443;
         www.c3cat.de 172.31.17.151:8443;
         staging.c3cat.de 172.31.17.151:8443;
diff --git a/resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf b/resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf
index c1f9182..5bb2435 100644
--- a/resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf
@@ -2,7 +2,7 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.

From bb30e88404d9e3d6c2325a2572b45aac10113041 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sun, 11 Jan 2026 00:29:16 +0100
Subject: [PATCH 3/9] router(host): allowlist only certain icmpv6 types

---
 .../chaosknoten/router/nftables/nftables.conf  | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/resources/chaosknoten/router/nftables/nftables.conf b/resources/chaosknoten/router/nftables/nftables.conf
index 3375bfb..ca62a97 100644
--- a/resources/chaosknoten/router/nftables/nftables.conf
+++ b/resources/chaosknoten/router/nftables/nftables.conf
@@ -39,7 +39,23 @@ table inet host {
         ct state established,related accept
 
 		ip protocol icmp accept
-		ip6 nexthdr icmpv6 accept
+        # ICMPv6
+        # https://datatracker.ietf.org/doc/html/rfc4890#autoid-24
+        # Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped"
+        # Error messages that are essential to the establishment and maintenance of communications:
+        icmpv6 type { destination-unreachable, packet-too-big } accept
+        icmpv6 type { time-exceeded } accept
+        icmpv6 type { parameter-problem } accept
+        # Connectivity checking messages:
+        icmpv6 type { echo-request, echo-reply } accept
+        # Address Configuration and Router Selection messages:
+        icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } accept
+        # Link-Local Multicast Receiver Notification messages:
+        icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report } accept
+        # SEND Certificate Path Notification messages:
+        icmpv6 type { 148, 149 } accept
+        # Multicast Router Discovery messages:
+        icmpv6 type { 151, 152, 153 } accept
 
         # Allow SSH access.
         tcp dport 22 accept comment "allow ssh access"

From 2fbb37db18c0cb3c01f00d83666524f6c5cc887e Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sun, 11 Jan 2026 00:59:52 +0100
Subject: [PATCH 4/9] grafana(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 .../chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf     | 2 +-
 resources/chaosknoten/grafana/nginx/loki.hamburg.ccc.de.conf  | 2 --
 .../chaosknoten/grafana/nginx/metrics.hamburg.ccc.de.conf     | 1 -
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 2 +-
 6 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 1b88df6..f72e4ac 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -15,9 +15,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     grafana:
-      ansible_host: grafana-intern.hamburg.ccc.de
+      ansible_host: grafana.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     tickets:
       ansible_host: tickets.hosts.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf b/resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf
index c5b68e1..a6dcdc1 100644
--- a/resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf
@@ -2,7 +2,7 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl proxy_protocol;
+    listen [::]:8443 ssl proxy_protocol;
     http2 on;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/grafana/nginx/loki.hamburg.ccc.de.conf b/resources/chaosknoten/grafana/nginx/loki.hamburg.ccc.de.conf
index e2bf4a7..8a509be 100644
--- a/resources/chaosknoten/grafana/nginx/loki.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/grafana/nginx/loki.hamburg.ccc.de.conf
@@ -17,7 +17,6 @@ server {
     server_name loki.hamburg.ccc.de;
 
     listen [::]:50051 ssl;
-    listen 172.31.17.145:50051 ssl;
 
     http2 on;
 
@@ -59,7 +58,6 @@ server {
     server_name loki.hamburg.ccc.de;
 
     listen [::]:443 ssl;
-    listen 172.31.17.145:443 ssl;
 
     http2 on;
 
diff --git a/resources/chaosknoten/grafana/nginx/metrics.hamburg.ccc.de.conf b/resources/chaosknoten/grafana/nginx/metrics.hamburg.ccc.de.conf
index 2c52523..ef2fe07 100644
--- a/resources/chaosknoten/grafana/nginx/metrics.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/grafana/nginx/metrics.hamburg.ccc.de.conf
@@ -18,7 +18,6 @@ server {
     server_name metrics.hamburg.ccc.de;
 
     listen [::]:443 ssl;
-    listen 172.31.17.145:443 ssl;
     http2 on;
 
     client_body_buffer_size 512k;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index d976089..7af3beb 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -9,7 +9,7 @@ map $host $upstream_acme_challenge_host {
     cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:31820;
     element.hamburg.ccc.de 172.31.17.151:31820;
     git.hamburg.ccc.de 172.31.17.154:31820;
-    grafana.hamburg.ccc.de 172.31.17.145:31820;
+    grafana.hamburg.ccc.de grafana.hosts.hamburg.ccc.de:31820;
     hackertours.hamburg.ccc.de 172.31.17.151:31820;
     staging.hackertours.hamburg.ccc.de 172.31.17.151:31820;
     hamburg.ccc.de 172.31.17.151:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index c4d1fbc..42120db 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -26,7 +26,7 @@ stream {
         id.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
-        grafana.hamburg.ccc.de 172.31.17.145:8443;
+        grafana.hamburg.ccc.de grafana.hosts.hamburg.ccc.de:8443;
         wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443;
         wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443;
         onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:8443;

From 372f264bcbc7de743c6cda57126395f7df906b47 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sun, 11 Jan 2026 01:29:15 +0100
Subject: [PATCH 5/9] ccchoir(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                        | 4 ++--
 resources/chaosknoten/ccchoir/nginx/ccchoir.de.conf       | 8 ++++----
 .../public-reverse-proxy/nginx/acme_challenge.conf        | 4 ++--
 .../chaosknoten/public-reverse-proxy/nginx/nginx.conf     | 4 ++--
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index f72e4ac..4b8e388 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -1,9 +1,9 @@
 all:
   hosts:
     ccchoir:
-      ansible_host: ccchoir-intern.hamburg.ccc.de
+      ansible_host: ccchoir.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     chaosknoten:
       ansible_host: chaosknoten.hamburg.ccc.de
     cloud:
diff --git a/resources/chaosknoten/ccchoir/nginx/ccchoir.de.conf b/resources/chaosknoten/ccchoir/nginx/ccchoir.de.conf
index ff37e48..a8d71a9 100644
--- a/resources/chaosknoten/ccchoir/nginx/ccchoir.de.conf
+++ b/resources/chaosknoten/ccchoir/nginx/ccchoir.de.conf
@@ -2,12 +2,12 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
@@ -43,12 +43,12 @@ server {
 
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 7af3beb..0c62760 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -4,8 +4,8 @@ map $host $upstream_acme_challenge_host {
     c3cat.de 172.31.17.151:31820;
     www.c3cat.de 172.31.17.151:31820;
     staging.c3cat.de 172.31.17.151:31820;
-    ccchoir.de ccchoir-intern.hamburg.ccc.de:31820;
-    www.ccchoir.de ccchoir-intern.hamburg.ccc.de:31820;
+    ccchoir.de ccchoir.hosts.hamburg.ccc.de:31820;
+    www.ccchoir.de ccchoir.hosts.hamburg.ccc.de:31820;
     cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:31820;
     element.hamburg.ccc.de 172.31.17.151:31820;
     git.hamburg.ccc.de 172.31.17.154:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index 42120db..b3f3636 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -18,8 +18,8 @@ stream {
     resolver 212.12.50.158 192.76.134.90;
 
     map $ssl_preread_server_name $address {
-        ccchoir.de ccchoir-intern.hamburg.ccc.de:8443;
-        www.ccchoir.de ccchoir-intern.hamburg.ccc.de:8443;
+        ccchoir.de ccchoir.hosts.hamburg.ccc.de:8443;
+        www.ccchoir.de ccchoir.hosts.hamburg.ccc.de:8443;
         cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:8443;
         pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:8443;
         pretalx.hamburg.ccc.de pretalx-intern.hamburg.ccc.de:8443;

From 1971598e71379ed967b8790353dd2ac6dc854712 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sun, 11 Jan 2026 03:22:11 +0100
Subject: [PATCH 6/9] pretalx(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 .../chaosknoten/pretalx/nginx/cfp.eh22.easterhegg.eu.conf     | 4 ++--
 .../chaosknoten/pretalx/nginx/pretalx.hamburg.ccc.de.conf     | 4 ++--
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 4 ++--
 5 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 4b8e388..d5dea1c 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -45,9 +45,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     pretalx:
-      ansible_host: pretalx-intern.hamburg.ccc.de
+      ansible_host: pretalx.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     public-reverse-proxy:
       ansible_host: public-reverse-proxy.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/pretalx/nginx/cfp.eh22.easterhegg.eu.conf b/resources/chaosknoten/pretalx/nginx/cfp.eh22.easterhegg.eu.conf
index 0fa99e7..a4f5bb9 100644
--- a/resources/chaosknoten/pretalx/nginx/cfp.eh22.easterhegg.eu.conf
+++ b/resources/chaosknoten/pretalx/nginx/cfp.eh22.easterhegg.eu.conf
@@ -2,12 +2,12 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/pretalx/nginx/pretalx.hamburg.ccc.de.conf b/resources/chaosknoten/pretalx/nginx/pretalx.hamburg.ccc.de.conf
index f12067a..d66e977 100644
--- a/resources/chaosknoten/pretalx/nginx/pretalx.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/pretalx/nginx/pretalx.hamburg.ccc.de.conf
@@ -2,12 +2,12 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
+    listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 0c62760..71f0290 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -22,7 +22,7 @@ map $host $upstream_acme_challenge_host {
     netbox.hamburg.ccc.de netbox.hosts.hamburg.ccc.de:31820;
     onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:31820;
     pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:31820;
-    pretalx.hamburg.ccc.de 172.31.17.157:31820;
+    pretalx.hamburg.ccc.de pretalx.hosts.hamburg.ccc.de:31820;
     spaceapi.hamburg.ccc.de 172.31.17.151:31820;
     staging.hamburg.ccc.de 172.31.17.151:31820;
     wiki.ccchh.net wiki.hosts.hamburg.ccc.de:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index b3f3636..d7cd97e 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -22,7 +22,7 @@ stream {
         www.ccchoir.de ccchoir.hosts.hamburg.ccc.de:8443;
         cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:8443;
         pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:8443;
-        pretalx.hamburg.ccc.de pretalx-intern.hamburg.ccc.de:8443;
+        pretalx.hamburg.ccc.de pretalx.hosts.hamburg.ccc.de:8443;
         id.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
@@ -90,7 +90,7 @@ stream {
         woodpecker.hamburg.ccc.de 172.31.17.160:8443;
         design.hamburg.ccc.de 172.31.17.162:8443;
         hydra.hamburg.ccc.de 172.31.17.163:8443;
-        cfp.eh22.easterhegg.eu pretalx-intern.hamburg.ccc.de:8443;
+        cfp.eh22.easterhegg.eu pretalx.hosts.hamburg.ccc.de:8443;
         ntfy.hamburg.ccc.de 172.31.17.149:8443;
         cryptoparty-hamburg.de 172.31.17.151:8443;
         cryptoparty.hamburg.ccc.de 172.31.17.151:8443;

From 255327952e3b1e718e7d0e53c0c189a6e6f13052 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Sun, 11 Jan 2026 03:57:11 +0100
Subject: [PATCH 7/9] ntfy(host): move to new network and hostname

---
 inventories/chaosknoten/hosts.yaml                            | 4 ++--
 resources/chaosknoten/ntfy/nginx/ntfy.hamburg.ccc.de.conf     | 4 ++--
 .../public-reverse-proxy/nginx/acme_challenge.conf            | 2 +-
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf   | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index d5dea1c..93c61be 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -63,9 +63,9 @@ all:
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     ntfy:
-      ansible_host: ntfy-intern.hamburg.ccc.de
+      ansible_host: ntfy.hosts.hamburg.ccc.de
       ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
+      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     sunders:
       ansible_host: sunders.hosts.hamburg.ccc.de
       ansible_user: chaos
diff --git a/resources/chaosknoten/ntfy/nginx/ntfy.hamburg.ccc.de.conf b/resources/chaosknoten/ntfy/nginx/ntfy.hamburg.ccc.de.conf
index e7d404d..ebae48d 100644
--- a/resources/chaosknoten/ntfy/nginx/ntfy.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/ntfy/nginx/ntfy.hamburg.ccc.de.conf
@@ -2,13 +2,13 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl proxy_protocol;
+    listen [::]:8443 ssl proxy_protocol;
     http2 on;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
index 71f0290..82e596a 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@@ -73,7 +73,7 @@ map $host $upstream_acme_challenge_host {
     design.hamburg.ccc.de 172.31.17.162:31820;
     hydra.hamburg.ccc.de 172.31.17.163:31820;
     cfp.eh22.easterhegg.eu 172.31.17.157:31820;
-    ntfy.hamburg.ccc.de 172.31.17.149:31820;
+    ntfy.hamburg.ccc.de ntfy.hosts.hamburg.ccc.de:31820;
     cryptoparty-hamburg.de 172.31.17.151:31820;
     cryptoparty.hamburg.ccc.de 172.31.17.151:31820;
     staging.cryptoparty-hamburg.de 172.31.17.151:31820;
diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index d7cd97e..489dda5 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -91,7 +91,7 @@ stream {
         design.hamburg.ccc.de 172.31.17.162:8443;
         hydra.hamburg.ccc.de 172.31.17.163:8443;
         cfp.eh22.easterhegg.eu pretalx.hosts.hamburg.ccc.de:8443;
-        ntfy.hamburg.ccc.de 172.31.17.149:8443;
+        ntfy.hamburg.ccc.de ntfy.hosts.hamburg.ccc.de:8443;
         cryptoparty-hamburg.de 172.31.17.151:8443;
         cryptoparty.hamburg.ccc.de 172.31.17.151:8443;
         staging.cryptoparty-hamburg.de 172.31.17.151:8443;

From 968e29ccb8fa144c7ec3ebd56d8d38adb4416397 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Mon, 12 Jan 2026 03:02:09 +0100
Subject: [PATCH 8/9] do v6-only for internal proxy protocol communication

Since we want to do v6-only internally, only listen on v6 for proxy
protocol.
This is also needed as we only have set_real_ip_from pointing to a v6.
---
 resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf   | 1 -
 resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf | 2 +-
 resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf     | 1 -
 resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf | 1 -
 .../keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf           | 1 -
 resources/chaosknoten/netbox/nginx/netbox.hamburg.ccc.de.conf   | 2 +-
 .../chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf | 1 -
 resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf         | 1 -
 resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf | 2 +-
 resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf | 2 +-
 resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf            | 1 -
 resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf       | 1 -
 resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf   | 2 +-
 13 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf b/resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf
index 8c801fe..d213d61 100644
--- a/resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf
+++ b/resources/chaosknoten/eh22-wiki/nginx/eh22.easterhegg.eu.conf
@@ -2,7 +2,6 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
     listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf b/resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf
index a6dcdc1..98f7f40 100644
--- a/resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/grafana/nginx/grafana.hamburg.ccc.de.conf
@@ -8,7 +8,7 @@ server {
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
index 939e1da..82ba082 100644
--- a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
@@ -3,7 +3,6 @@
 # Also see: https://www.keycloak.org/server/reverseproxy
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
     listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf
index de1e9d6..ecb7e2d 100644
--- a/resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/invite.hamburg.ccc.de.conf
@@ -3,7 +3,6 @@
 # Also see: https://www.keycloak.org/server/reverseproxy
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
     listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
index cd56b98..b2e7eec 100644
--- a/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
@@ -7,7 +7,6 @@ server {
     ##listen [::]:443 ssl http2;
 
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
     listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/netbox/nginx/netbox.hamburg.ccc.de.conf b/resources/chaosknoten/netbox/nginx/netbox.hamburg.ccc.de.conf
index 533c9d2..0c2a3be 100644
--- a/resources/chaosknoten/netbox/nginx/netbox.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/netbox/nginx/netbox.hamburg.ccc.de.conf
@@ -7,7 +7,7 @@ server {
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf b/resources/chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf
index 8a9a486..f3e77f1 100644
--- a/resources/chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/onlyoffice/nginx/onlyoffice.hamburg.ccc.de.conf
@@ -2,7 +2,6 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
     listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf b/resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf
index 6c453d1..cf49d23 100644
--- a/resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf
@@ -2,7 +2,6 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
     listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf b/resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf
index ceb9b2b..185c005 100644
--- a/resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf
@@ -7,7 +7,7 @@ server {
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf b/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf
index 8d36244..e93ff93 100644
--- a/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf
@@ -7,7 +7,7 @@ server {
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;
diff --git a/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf b/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
index 472236a..d89b5b8 100644
--- a/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
+++ b/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf
@@ -2,7 +2,6 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
     listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf b/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
index b4eab7f..5065c1d 100644
--- a/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf
@@ -2,7 +2,6 @@
 # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
 server {
     # Listen on a custom port for the proxy protocol.
-    listen 8443 ssl http2 proxy_protocol;
     listen [::]:8443 ssl http2 proxy_protocol;
     # Make use of the ngx_http_realip_module to set the $remote_addr and
     # $remote_port to the client address and client port, when using proxy
diff --git a/resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf b/resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf
index 5bb2435..b94cb5c 100644
--- a/resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/zammad/nginx/zammad.hamburg.ccc.de.conf
@@ -7,7 +7,7 @@ server {
     # $remote_port to the client address and client port, when using proxy
     # protocol.
     # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 172.31.17.140;
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
     # Then tell the realip_module to get the addreses from the proxy protocol
     # header.
     real_ip_header proxy_protocol;

From 816b613b3f92bec9f012acc1305611cc10a98d50 Mon Sep 17 00:00:00 2001
From: Renovate <no-reply@git.hamburg.ccc.de>
Date: Mon, 12 Jan 2026 02:17:50 +0000
Subject: [PATCH 9/9] Update docker.io/library/postgres Docker tag to v18

---
 inventories/chaosknoten/host_vars/cloud.yaml                  | 2 +-
 resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 | 2 +-
 resources/chaosknoten/lists/docker_compose/compose.yaml       | 2 +-
 resources/chaosknoten/pad/docker_compose/compose.yaml.j2      | 2 +-
 resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2  | 2 +-
 resources/chaosknoten/tickets/docker_compose/compose.yaml.j2  | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/inventories/chaosknoten/host_vars/cloud.yaml b/inventories/chaosknoten/host_vars/cloud.yaml
index b6cf771..1164730 100644
--- a/inventories/chaosknoten/host_vars/cloud.yaml
+++ b/inventories/chaosknoten/host_vars/cloud.yaml
@@ -1,7 +1,7 @@
 # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud
 nextcloud__version: 32
 # renovate: datasource=docker depName=docker.io/library/postgres
-nextcloud__postgres_version: 15.15
+nextcloud__postgres_version: 18.1
 nextcloud__fqdn: cloud.hamburg.ccc.de
 nextcloud__data_dir: /data/nextcloud
 nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"
diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
index a260ab1..562df5c 100644
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@@ -46,7 +46,7 @@ services:
       - "8080:8080"
 
   db:
-    image: docker.io/library/postgres:15.15
+    image: docker.io/library/postgres:18.1
     restart: unless-stopped
     networks:
       - keycloak
diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml b/resources/chaosknoten/lists/docker_compose/compose.yaml
index cdfd70a..7050a8b 100644
--- a/resources/chaosknoten/lists/docker_compose/compose.yaml
+++ b/resources/chaosknoten/lists/docker_compose/compose.yaml
@@ -56,7 +56,7 @@ services:
       - POSTGRES_DB=mailmandb
       - POSTGRES_USER=mailman
       - POSTGRES_PASSWORD=wvQjbMRnwFuxGEPz
-    image: docker.io/library/postgres:12-alpine
+    image: docker.io/library/postgres:18-alpine
     volumes:
       - /opt/mailman/database:/var/lib/postgresql/data
     networks:
diff --git a/resources/chaosknoten/pad/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pad/docker_compose/compose.yaml.j2
index 455caa3..b27229b 100644
--- a/resources/chaosknoten/pad/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/pad/docker_compose/compose.yaml.j2
@@ -3,7 +3,7 @@
 
 services:
   database:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:18-alpine
     environment:
       - "POSTGRES_USER=hedgedoc"
       - "POSTGRES_PASSWORD={{ secret__hedgedoc_db_password }}"
diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
index dda67bb..66cb5df 100644
--- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
@@ -3,7 +3,7 @@
 
 services:
   database:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:18-alpine
     environment:
       - "POSTGRES_USER=pretalx"
       - "POSTGRES_PASSWORD={{ secret__pretalx_db_password }}"
diff --git a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
index 938883b..3d35c0b 100644
--- a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
@@ -1,7 +1,7 @@
 ---
 services:
   database:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:18-alpine
     environment:
       - "POSTGRES_USER=pretix"
       - "POSTGRES_PASSWORD={{ secret__pretix_db_password }}"