Update docker.io/library/mariadb Docker tag to v13

inventories/chaosknoten/host_vars/wiki.yaml

@@ -1,10 +1,13 @@
 nginx__version_spec: ""
 nginx__configurations:
+  - name: wiki.ccchh.net
+    content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf') }}"
   - name: wiki.hamburg.ccc.de
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf') }}"
 
 certbot__acme_account_email_address: j+letsencrypt-ccchh@jsts.xyz
 certbot__certificate_domains:
+  - "wiki.ccchh.net"
   - "wiki.hamburg.ccc.de"
 certbot__new_cert_commands:
   - "systemctl reload nginx.service"

resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf

@@ -27,6 +27,7 @@ map $host $upstream_acme_challenge_host {
     pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:31820;
     spaceapi.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
     staging.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
+    wiki.ccchh.net wiki.hosts.hamburg.ccc.de:31820;
     wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:31820;
     www.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
     tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:31820;

resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf

@@ -29,6 +29,7 @@ stream {
         invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
         grafana.hamburg.ccc.de grafana.hosts.hamburg.ccc.de:8443;
+        wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443;
         wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443;
         onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:8443;
         hackertours.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;

resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf

@@ -0,0 +1,26 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+server {
+    # Listen on a custom port for the proxy protocol.
+    listen [::]:8443 ssl http2 proxy_protocol;
+    # Make use of the ngx_http_realip_module to set the $remote_addr and
+    # $remote_port to the client address and client port, when using proxy
+    # protocol.
+    # First set our proxy protocol proxy as trusted.
+    set_real_ip_from 2a00:14b0:4200:3000:125::1;
+    # Then tell the realip_module to get the addreses from the proxy protocol
+    # header.
+    real_ip_header proxy_protocol;
+
+    server_name wiki.ccchh.net;
+
+    ssl_certificate /etc/letsencrypt/live/wiki.ccchh.net/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/wiki.ccchh.net/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/wiki.ccchh.net/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    return 302 https://wiki.hamburg.ccc.de$request_uri;
+}

roles/dokuwiki/tasks/main.yml

@@ -12,24 +12,6 @@
       - git
   diff: false
 
-- name: Configure php.ini for php-fpm
-  become: true
-  block:
-    - name: Ensure `session.use_strict_mode` is enabled via php.ini
-      ansible.builtin.lineinfile:
-        path: /etc/php/8.4/fpm/php.ini
-        regexp: '^session\.use_strict_mode'
-        line: 'session.use_strict_mode = 1'
-        state: present
-
-    - name: Ensure `session.upload_progress.enabled` is disabled via php.ini
-      become: true
-      ansible.builtin.lineinfile:
-        path: /etc/php/8.4/fpm/php.ini
-        regexp: '^session\.upload_progress\.enabled'
-        line: 'session.upload_progress.enabled = Off'
-        state: present
-
 - name: Ensure `php-fpm` is enabled
   become: true
   ansible.builtin.systemd: