unbound(role): add config flag in README

- edit config to work with update kea role
- fix ipv6 addresses

docs/guides/wiregueard-admin-vpn.md

@@ -1,43 +0,0 @@
----
-title: "Wiregard Admin VPN"
-summary: How to configure your Wireguard client to access the Z9 network
----
-
-# Onboarding
-
-tbd. where to add your key
-
-# Local Client Configuration
-
-## Example Config
-
-Replace `YOUR_IP_IN_DEC` with your IP in decimal, and `YOUR_IP_IN_HEX` with your IP in hexadecimal.
-
-See [resources/z9/z9-router/systemd_networkd/10-wg56.netdev](resources/z9/z9-router/systemd_networkd/10-wg56.netdev) for the Wireguard endpoints configured on the router.
-
-```
-[Interface]
-PrivateKey = YOUR_PRIVATE_KEY
-Address = 10.89.214.YOUR_IP_IN_DEC/32, 2a07:c481:1:37::YOUR_IP_IN_HEX/128
-
-[Peer]
-PublicKey = fmlxjh3iOfpgrHQQpK3dyOD0BvDppGCUkFuMSroqQR4=
-AllowedIPs = 10.89.208.0/20, 2a07:c481:1::/48, 212.12.48.120/29, 2a00:14b0:4200:3000::/64, 212.12.50.208/29, 2a00:14b0:42:100::/56, 212.12.51.128/28, 2a00:14b0:f000:23::/64
-Endpoint = rt-wan.ccchh.net:51820
-```
-
-## AllowedIDs
-
-The following prefixes should be tunneled to gain access to both CCCHH Z9 resources as well as Chaosknoten. It is also possible to run a default route through wireguard, but please do not abuse this as a general VPN for purposes other than admin tasks.
-
-| Prefix | Description |
-|--|--|
-| [10.89.208.0/20](https://netbox.hamburg.ccc.de/ipam/prefixes/114/prefixes/) | prefix for CCCHH Z9 local networks |
-| [2a07:c481:1::/48](https://netbox.hamburg.ccc.de/ipam/prefixes/50/) | prefix for CCCHH Z9 local networks |
-| 212.12.48.120/29 | Fakep refix for hosts that come from [212.12.48.0/24](https://netbox.hamburg.ccc.de/ipam/prefixes/12/) |
-| [2a00:14b0:4200:3000::/64](https://netbox.hamburg.ccc.de/ipam/prefixes/36/) | Public IPv6 in Wieske's shared network |
-| [212.12.50.208/29](https://netbox.hamburg.ccc.de/ipam/prefixes/13/) | Public IPv4 for VMs on chaosknoten, routed by router |
-| [2a00:14b0:42:100::/56](https://netbox.hamburg.ccc.de/ipam/prefixes/46/) | Public IPv6 for VMs on chaosknoten, routed by router |
-| [212.12.51.128/28](https://netbox.hamburg.ccc.de/ipam/prefixes/15/) | IPv4 for VMs on chaosknoten, routed by Wieske |
-| [2a00:14b0:f000:23::/64](https://netbox.hamburg.ccc.de/ipam/prefixes/35/) |IPv6 for VMs on chaosknoten, routed by Wieske |
-

inventories/chaosknoten/host_vars/git-pages.yaml

@@ -1,2 +0,0 @@
-# renovate: datasource=docker depName=codeberg.org/git-pages/git-pages
-git_pages__version: latest

inventories/z9/host_vars/yate.yaml

@@ -6,9 +6,3 @@ docker_compose__configuration_files:
     content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/regexroute.conf.j2') }}"
   - name: regfile.conf
     content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/regfile.conf.j2') }}"
-  - name: rmanager.conf
-    content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/rmanager.conf.j2') }}"
-  - name: yrtpchan.conf
-    content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/yrtpchan.conf.j2') }}"
-  - name: ysipchan.conf
-    content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/ysipchan.conf.j2') }}"

inventories/z9/hosts.yaml

@@ -15,7 +15,7 @@ all:
       ansible_host: waybackproxy.ccchh.net
       ansible_user: chaos
     yate:
-      ansible_host: yate.z9.ccchh.net
+      ansible_host: yate.ccchh.net
       ansible_user: chaos
     z9-router:
       ansible_host: z9-router.ccchh.net

resources/chaosknoten/lists/docker_compose/compose.yaml.j2

@@ -72,7 +72,7 @@ services:
     restart: unless-stopped
     command: ["uv", "run", "main.py", "sync"]
     environment:
-      - DRY_RUN=false
+      - DRY_RUN=true
       - KEYCLOAK_CLIENT_ID=mailman-sync
       - KEYCLOAK_CLIENT_SECRET={{ secret__lists__keycloak_client_secret }}
       - KEYCLOAK_REALM=ccchh

resources/chaosknoten/zammad/docker_compose/compose.yaml

@@ -57,7 +57,7 @@ x-shared:
       LETSENCRYPT_HOST:
       LETSENCRYPT_EMAIL:
 
-    image: ${IMAGE_REPO:-ghcr.io/zammad/zammad}:${VERSION:-7.1.2}
+    image: ${IMAGE_REPO:-ghcr.io/zammad/zammad}:${VERSION:-6.5.3}
     restart: ${RESTART:-always}
     volumes:
       - zammad-storage:/opt/zammad/storage
@@ -76,7 +76,7 @@ services:
     user: 0:0
 
   zammad-elasticsearch:
-    image: elasticsearch:${ELASTICSEARCH_VERSION:-8.19.19}
+    image: elasticsearch:${ELASTICSEARCH_VERSION:-8.19.13}
     restart: ${RESTART:-always}
     volumes:
       - elasticsearch-data:/usr/share/elasticsearch/data

resources/z9/yate/docker_compose/rmanager.conf.j2

@@ -1,4 +0,0 @@
-; https://github.com/eventphone/yate/blob/master/conf.d/rmanager.conf.sample
-[general]
-; password: string: Password required to authenticate as admin, default empty!
-;password=

resources/z9/yate/docker_compose/yrtpchan.conf.j2

@@ -1,4 +0,0 @@
-; https://github.com/eventphone/yate/blob/master/conf.d/yrtpchan.conf.sample
-[general]
-minport=42000
-maxport=42999

resources/z9/yate/docker_compose/ysipchan.conf.j2

@@ -1,6 +0,0 @@
-; Setting for all SIP channels
-; https://github.com/eventphone/yate/blob/master/conf.d/ysipchan.conf.sample
-
-[general]
-; try to avoid `Transport(general) received likely truncated packet with length 1500, try to increase maxpkt`
-maxpkt=8192

roles/dooris/meta/argument_specs.yml

@@ -45,3 +45,4 @@ argument_specs:
           apiKey:
             required: true
             type: str
+