unbound(role): add config flag in README

- edit config to work with update kea role
- fix ipv6 addresses

docs/guides/wiregueard-admin-vpn.md

@@ -0,0 +1,43 @@
+---
+title: "Wiregard Admin VPN"
+summary: How to configure your Wireguard client to access the Z9 network
+---
+
+# Onboarding
+
+tbd. where to add your key
+
+# Local Client Configuration
+
+## Example Config
+
+Replace `YOUR_IP_IN_DEC` with your IP in decimal, and `YOUR_IP_IN_HEX` with your IP in hexadecimal.
+
+See [resources/z9/z9-router/systemd_networkd/10-wg56.netdev](resources/z9/z9-router/systemd_networkd/10-wg56.netdev) for the Wireguard endpoints configured on the router.
+
+```
+[Interface]
+PrivateKey = YOUR_PRIVATE_KEY
+Address = 10.89.214.YOUR_IP_IN_DEC/32, 2a07:c481:1:37::YOUR_IP_IN_HEX/128
+
+[Peer]
+PublicKey = fmlxjh3iOfpgrHQQpK3dyOD0BvDppGCUkFuMSroqQR4=
+AllowedIPs = 10.89.208.0/20, 2a07:c481:1::/48, 212.12.48.120/29, 2a00:14b0:4200:3000::/64, 212.12.50.208/29, 2a00:14b0:42:100::/56, 212.12.51.128/28, 2a00:14b0:f000:23::/64
+Endpoint = rt-wan.ccchh.net:51820
+```
+
+## AllowedIDs
+
+The following prefixes should be tunneled to gain access to both CCCHH Z9 resources as well as Chaosknoten. It is also possible to run a default route through wireguard, but please do not abuse this as a general VPN for purposes other than admin tasks.
+
+| Prefix | Description |
+|--|--|
+| [10.89.208.0/20](https://netbox.hamburg.ccc.de/ipam/prefixes/114/prefixes/) | prefix for CCCHH Z9 local networks |
+| [2a07:c481:1::/48](https://netbox.hamburg.ccc.de/ipam/prefixes/50/) | prefix for CCCHH Z9 local networks |
+| 212.12.48.120/29 | Fakep refix for hosts that come from [212.12.48.0/24](https://netbox.hamburg.ccc.de/ipam/prefixes/12/) |
+| [2a00:14b0:4200:3000::/64](https://netbox.hamburg.ccc.de/ipam/prefixes/36/) | Public IPv6 in Wieske's shared network |
+| [212.12.50.208/29](https://netbox.hamburg.ccc.de/ipam/prefixes/13/) | Public IPv4 for VMs on chaosknoten, routed by router |
+| [2a00:14b0:42:100::/56](https://netbox.hamburg.ccc.de/ipam/prefixes/46/) | Public IPv6 for VMs on chaosknoten, routed by router |
+| [212.12.51.128/28](https://netbox.hamburg.ccc.de/ipam/prefixes/15/) | IPv4 for VMs on chaosknoten, routed by Wieske |
+| [2a00:14b0:f000:23::/64](https://netbox.hamburg.ccc.de/ipam/prefixes/35/) |IPv6 for VMs on chaosknoten, routed by Wieske |
+

inventories/chaosknoten/host_vars/git-pages.yaml

@@ -0,0 +1,2 @@
+# renovate: datasource=docker depName=codeberg.org/git-pages/git-pages
+git_pages__version: latest

inventories/z9/host_vars/yate.yaml

@@ -6,3 +6,9 @@ docker_compose__configuration_files:
     content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/regexroute.conf.j2') }}"
   - name: regfile.conf
     content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/regfile.conf.j2') }}"
+  - name: rmanager.conf
+    content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/rmanager.conf.j2') }}"
+  - name: yrtpchan.conf
+    content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/yrtpchan.conf.j2') }}"
+  - name: ysipchan.conf
+    content: "{{ lookup('ansible.builtin.template', 'resources/z9/yate/docker_compose/ysipchan.conf.j2') }}"

inventories/z9/hosts.yaml

@@ -15,7 +15,7 @@ all:
       ansible_host: waybackproxy.ccchh.net
       ansible_user: chaos
     yate:
-      ansible_host: yate.ccchh.net
+      ansible_host: yate.z9.ccchh.net
       ansible_user: chaos
     z9-router:
       ansible_host: z9-router.ccchh.net

resources/chaosknoten/lists/docker_compose/compose.yaml.j2

@@ -72,7 +72,7 @@ services:
     restart: unless-stopped
     command: ["uv", "run", "main.py", "sync"]
     environment:
-      - DRY_RUN=true
+      - DRY_RUN=false
       - KEYCLOAK_CLIENT_ID=mailman-sync
       - KEYCLOAK_CLIENT_SECRET={{ secret__lists__keycloak_client_secret }}
       - KEYCLOAK_REALM=ccchh

resources/chaosknoten/zammad/docker_compose/compose.yaml

@@ -57,7 +57,7 @@ x-shared:
       LETSENCRYPT_HOST:
       LETSENCRYPT_EMAIL:
 
-    image: ${IMAGE_REPO:-ghcr.io/zammad/zammad}:${VERSION:-6.5.3}
+    image: ${IMAGE_REPO:-ghcr.io/zammad/zammad}:${VERSION:-7.1.2}
     restart: ${RESTART:-always}
     volumes:
       - zammad-storage:/opt/zammad/storage
@@ -76,7 +76,7 @@ services:
     user: 0:0
 
   zammad-elasticsearch:
-    image: elasticsearch:${ELASTICSEARCH_VERSION:-8.19.13}
+    image: elasticsearch:${ELASTICSEARCH_VERSION:-8.19.19}
     restart: ${RESTART:-always}
     volumes:
       - elasticsearch-data:/usr/share/elasticsearch/data

resources/z9/yate/docker_compose/rmanager.conf.j2

@@ -0,0 +1,4 @@
+; https://github.com/eventphone/yate/blob/master/conf.d/rmanager.conf.sample
+[general]
+; password: string: Password required to authenticate as admin, default empty!
+;password=

resources/z9/yate/docker_compose/yrtpchan.conf.j2

@@ -0,0 +1,4 @@
+; https://github.com/eventphone/yate/blob/master/conf.d/yrtpchan.conf.sample
+[general]
+minport=42000
+maxport=42999

resources/z9/yate/docker_compose/ysipchan.conf.j2

@@ -0,0 +1,6 @@
+; Setting for all SIP channels
+; https://github.com/eventphone/yate/blob/master/conf.d/ysipchan.conf.sample
+
+[general]
+; try to avoid `Transport(general) received likely truncated packet with length 1500, try to increase maxpkt`
+maxpkt=8192

roles/dooris/meta/argument_specs.yml

@@ -45,4 +45,3 @@ argument_specs:
           apiKey:
             required: true
             type: str
-