Update docker.io/library/postgres Docker tag to v18

.sops.yaml

@@ -33,7 +33,6 @@ keys:
         - &host_public_reverse_proxy_ansible_pull_age_key age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen
         - &host_zammad_ansible_pull_age_key age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs
         - &host_ntfy_ansible_pull_age_key age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg
-        - &host_spaceapiccc_ansible_pull_age_key age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa
     external:
       age: &host_external_age_keys
         - &host_status_ansible_pull_age_key age1yl9ts8k6ceymaxjs72r5puetes5mtuzxuger7qgme9qkagfrm9hqzxx9qr
@@ -161,12 +160,6 @@ creation_rules:
           *admin_gpg_keys
         age:
           - *host_public_reverse_proxy_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/spaceapiccc.*
-    key_groups:
-      - pgp:
-          *admin_gpg_keys
-        age:
-          - *host_spaceapiccc_ansible_pull_age_key
   # external hosts
   - path_regex: inventories/external/host_vars/status.*
     key_groups:

docs/create-new-web-service-vm.md

@@ -1,79 +0,0 @@
-# How to create all necessary entries for new (web service) VM
-
-Let's assume that you want to add a new web service `example.hamburg.ccc.de` which is going to be hosted on the VM `example` on chaosknoten. These are the steps that you need to take to create the VM and add it to the Ansible repo.
-
-## IP, DNS, VM
-
-1. Allocate a fresh [IPv6 in Netbox in the 2a00:14b0:42:102::/64 net](https://netbox.hamburg.ccc.de/ipam/prefixes/47/ip-addresses/). This will be the management address for the VM. 
-2. Add an entry `example.hosts.hamburg.ccc.de` with that AAAA to the name server (`ns-intern`).
-3. Add an entry `example.hamburg.ccc.de` as a CNAME for `public-reverse-proxy` to the same zone.
-4. Commit and reload the zone.
-5. Create a new VM on chaosknoten, for example by cloning the Debian template 9023. Give it the name `example`.
-6. Edit the ethernet interface to be connected to `vmbr0`, VLAN tag `2`.
-7. Configure the IPv6 address in the Cloud-Init section. Leave IPv4 set to DHCP.
-8. Make sure the VM is started at boot (options).
-9. Adjust any other VM parameters as needed.
-10. Boot the VM.
-11. Add the [VM to Netbox](https://netbox.hamburg.ccc.de/virtualization/virtual-machines/). Make sure to enter the VM ID.
-12. Add an Ethernet interface to the VM; we typically use `eth0` as a name.
-13. Add IP for that interface, then choose "Assign IP" and search for the IP you've created. Make it the primary IP of that interface.
-
-## Ansible Basics
-
-As the first step, we need to make the host known to Ansible.
-
-1. In `.sops.yaml`, add an entry for the host. Follow the other entries there.
-   1. `keys.hosts.chaosknoten.age` needs an age public key (the private key is needed in the host-specific YAML)
-   2. `creation_rules` needs an entry for the host, referencing the age key.
-2. In `inventories/chaosknoten/hosts.yaml`:
-   1. Configure basic connection info:
-        ```
-        example:
-            ansible_host: example.hosts.hamburg.ccc.de
-            ansible_user: chaos
-            ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
-        ```
-        You typically will want to use router as a jump host so that you can run Ansible on an IPv4 only connection.
-    2. Add the host to the desired roles. As a minimum, you'll want `base_config_hosts` and `infrastructure_authorized_keys_hosts`. For a typical web service based on Docker Compose, you'll want `docker_compose_hosts`, `nginx_hosts`, and `certbot_hosts`.
- 3. In the directorry `inventories/chaosknoten/host_var/`:
-    1. A file `inventories/chaosknoten/host_var/example.yaml` with the host/service specific configuration.
-    2. A file `inventories/chaosknoten/host_var/example.sops.yaml` with the encrypted secrets for the host/service. Run `sops inventories/chaosknoten/host_var/example.yaml` to edit/create that file. Entries there should generally be prefixed with `secret__` to make it easier to see where that variable is coming from in templates etc.
-
-## Service-specific config
-
-From here, we go into the details of the web service that you want to configure. For a typical web service with Docker Compose, you will likely want to configure the following.
-
-Make `inventories/chaosknoten/host_var/example.yaml` look like this:
-```yaml
-certbot__version_spec: ""
-certbot__acme_account_email_address: le-admin@hamburg.ccc.de
-certbot__certificate_domains:
-  - "example.hamburg.ccc.de"
-certbot__new_cert_commands:
-  - "systemctl reload nginx.service"
-
-docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/example/docker_compose/compose.yaml.j2') }}"
-
-nginx__version_spec: ""
-nginx__configurations:
-  - name: example.hamburg.ccc.de
-    content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/spaceapiccc/nginx/example.hamburg.ccc.de.conf') }}"
-```
-
-This will create `compose.yaml` from the template `resources/chaosknoten/example/docker_compose/compose.yaml.j2'`, and the nginx config from `resources/chaosknoten/spaceapiccc/nginx/example.hamburg.ccc.de.conf`. Of course, depending on your service, you might need additional entries. See the other hosts and the roles for more info.
-
-## First Ansible run
-
-Before you can run Ansible successfully, you will want to make sure you can connect to the VM, and that the host key has been added to your known hosts:
-* `ssh chaos@example.hosts.hamburg.ccc.de`
-* `ssh -J chaos@router.hamburg.ccc.de chaos@example.hosts.hamburg.ccc.de`
-
-Then run Ansible for `public-reverse-proxy` to add the necessary entries: `ansible-playbook playbooks/deploy.yaml --inventory inventories/chaosknoten/hosts.yaml --limit public-reverse-proxy`.
-
-Finally run Ansible for the new host: `ansible-playbook playbooks/deploy.yaml --inventory inventories/chaosknoten/hosts.yaml --limit example`
-
-# Commit your changes
-
-Do not forget to commit your changes, whether it's a new host or you are making changes to an existing host.
-
-And always `git pull` before you run Ansible so avoid reverting anything!

inventories/chaosknoten/host_vars/spaceapiccc.sops.yaml

@@ -1,215 +0,0 @@
-ansible_pull__age_private_key: ENC[AES256_GCM,data:ZQJCVOcc2UTH/3tZRZEZAig2A7Vc/zBBz5IY+gKYMYpIKhLZN9S/OGrRdCc8VbXkN7pmZhzDL531PapI54cmFeCKr2yFJMlfXdE=,iv:1ilb+njcqgYVdownNiMNcAcG/TNpyRnLtAjEUGsCsl0=,tag:Od7kvNn8ZBl1LUnMyFwxpA==,type:str]
-secret__spaceapiccc__shared_secret: ENC[AES256_GCM,data:0foffl4HF1SeL9rE3g==,iv:GzRTZAmr7zSBs1W+Vhyv6sMGhPnSy/SUZOSO39lzWHk=,tag:8IAS6Lt9vfpsJQwQfcunXg==,type:str]
-secret__spaceapiccc__doku_ccc_de__username: ENC[AES256_GCM,data:fbrZROQz8Fzg/vI=,iv:LaR5UmkS3IhtroJp3C3xNF4ja7IhIiPRzGBHAfQbQGw=,tag:/VCNMKkw5qRbnRNHDnPj/w==,type:str]
-secret__spaceapiccc__doku_ccc_de__password: ENC[AES256_GCM,data:mwkjOjRT7gOv,iv:wBzSeLzSWWe0j3LJesN/wnZ0tmUmXMVkRIBnp00qRhg=,tag:JSsbq1+qs2yA9BM2LouG1w==,type:str]
-sops:
-  age:
-    - recipient: age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCY1Z0Slg4UmpQQUhGKzJX
-        S0ROZ2owdmNVRUFzbDhjWEJpNkxGQnF1RFFVClgrZDlZRDNCbllWeElEWFN4Uy95
-        YXNzUGptcU9adjdJQVphSS9NQ1NaVTQKLS0tIEtQUlIyTURXK2lDbWtmMXU2OWtx
-        TnNtQjVpMUIzZjgzQnZicHV6OXE3ZlUKtChQKJlUmTV42FEpO2S1sTAI2+K/mro+
-        C3cvwiqydpOlbH6tulcP6HSeDVExAAMeDZMfjebg/5cfq7Yfh6xa5Q==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-01-25T11:18:43Z"
-  mac: ENC[AES256_GCM,data:4s5GiYhU/+kieEGUY9bS5W0MAQ/AUS3TbvLezSypH8Div5HRoM7YfMeqgLq4jC+TjUL9d+ZfusjAmsOEG9PjHbIH051gg8U5TvB38wzmw3RpJxnpDtmiFrRh9QbXl+Fz8V/Oigf6hhXbgu01zZpZY9jy6YLNtUZc6AoqAQh27us=,iv:YUS/vGXcbgQPM1CKcK8YjOH5+KPlzBXcOtx3jmUblqA=,tag:jYzqaMfHv4Tyv2NelSSVvQ==,type:str]
-  pgp:
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAxK/JaB2/SdtARAAoP0ZuYWL+Z9vrnMN+ISg6/yx8Z3Oq2GufmYMowk/nQ7A
-        wk+xQQcywn7zLCweaTNtNb8CXtAcInnLhXZNRjviOecyAexZdFxcX+SIiT9x32aZ
-        xk2M3Bgnrtf9GQMV9q/mr7fgn+iaILyRjWTQMjUYFGuA5Hu7PNICxZZtA1y6p3G8
-        iBDROt1vZS2M6WorA5n3FGSwCRFUCqWnRsBR+AkR0vjb/0xEmS4YpDZCdsqWVITq
-        fBxDZntznqQpmlTH9AxJV48QlfYMLAYFV7seHxp5VSjgDxaPJD4QIiNZMOylRa/y
-        9hx1S5VN8KIfT9eW5piOeyNikE3Wv7hdwd4zOQ/ObESADh/QWFN582Smk+fxf76Q
-        /KlP7BM8JW7afjkvTHXg7cvc1qo9+GilWcWX9pK04v9bZtXTbO6H+uOhydlSmtUe
-        FGoHgQsMi52S4vHTFF1A8o76pvpQAIYNC2Zif2zZYq9ERvbLeAcgoIoo7bQihttc
-        lY8ZOqxQj9KbkFNbyLTlyekebNhfa512XjJij14YkYUVU2Y65kxtimZ3WpwKvLO2
-        JcDWHOJduhUC+21TGTq6QFo1LNhpowyC447eybi8T0/WxMCBms/fhW+m4Mkt4bRi
-        ByjgQe8makgLqw2/EUlFl1qyF4zU0zjn+97pISvg0YBfQYhPIb5k8AWWkUF4mHHU
-        aAEJAhDMVlvoC4bopmVlgoCrCejX5wb+ULW9hle6S69440PVK4uN94Ral+NSH99o
-        CU4gmqngD9N6sw8SBp8lFFUzjhoqfcNwJ9cv8T9PIPgHLriPnRqwPsy4dHSYSsv1
-        wWY4KUeOqk6Y
-        =Wm7O
-        -----END PGP MESSAGE-----
-      fp: EF643F59E008414882232C78FFA8331EEB7D6B70
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMA6EyPtWBEI+2ARAAh2b51c4cFL0wOPTuQtxjthkEZGVv0sQC19PiDOWAy/zi
-        457Ix+QPA31Wmun4uGQF8E+vJC9StDXvOuEku2639wK7Gx8UVHSJM+QhFt+f9tiI
-        df5mVRPz4R1tVMU6P/f2rTOqqQyugR2pi3wCcwntnZplEuL/Gxw2SI4gGAq9B1Kb
-        FVVdMkJOxhx33QWFhIEOqLLfMU+gdvGPtRaDPkMA5KJD5FDO0xYzgd+5j6wKLsdb
-        rY7MVvaP3HWbmsMOpJD+8zo3ONBeaG3OwdhhF8KgbHxGP/49r25WwI5YWqXI44K9
-        xIQvtBJFTLaisO3q5rTOZgqKEvWAAX3e82cY3tCUG4aDyKEeF8dOqQ9GbI+KWaKh
-        kqTFDz3gh9sWI3Ex2/JHxq4xGJE433x4ArxHgSmXxfKWfc9zhiDuhtE1GBfEWP8t
-        a+07FWvsG8TCbS8pzFu40z/6we2O/VGXnZBa+vlc/9YPyLBN+zmAH3+jfhgYzV22
-        oF0HPQTzLdd6FoUx771ETTOqDgwg2H8Lqv+cC5MjPgxUPyScP4G7t0r9TMSydxFv
-        85Yo7ZWiBjo5TgdiU7agCCLKYct1C1R+9M20uRyrttDBhrVSjDlsIKmuStIdI7jk
-        k/PPLjxUKf5osTw8KKsSLvHTxt0G+rRzt38HgOCsOPBSoE6zlMTn79rgy+Ipm7fS
-        XgHPPTT78/y2Xvx3QGx9C2X9YqPDGhs12uzQ7HdcRlUu3Ay9akrSiV99CKCFb6ZZ
-        lDzOZrWvuWHcOLLqykhK3x8uhieMmwsM5WCNopr1j7i74b8UlVCmItXFXCaTRqg=
-        =ytkN
-        -----END PGP MESSAGE-----
-      fp: F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAz5uSgHG2iMJARAA7Wenq30iYLUH7qTgwPJyIyPz0blUzqEpEeDyVjfLVxee
-        VzXUfrxL8ybD+1JNISQNogDRP+gi4Sa/kTwAwEudqg9nv8DTff2l+Ge7YRifTgoO
-        tK1yjPKpl/iH33s2tIRRPI9DJ38NKtIN7pFrZ9Icyinyx8O+Tx0U/rVOs+4I4i0K
-        eIhsjG2tD6z5AvDkTqJ70S16LWdlr+hrHfEFmZ9NDbesoVj6YlDjx8yXr6UAdBAd
-        nx4aVjy2vygBJFZHN3iqitD6pnBvFC6QM1SZTRfe1l0lb1NXiVbT42ir7hsQ1/Di
-        MKRw/GuD+5jwHWLAzFbmMeirLY1hw418AzMPmCUqg3xJxmm53v4abD/j6cnHaM8h
-        vkSEsO9iA9exDjM9RPqS5GXCGx3E2MdBzgBMZIdvRmEV8G7FTqBZAJZsElAA/wTl
-        WhCEB3iDqdTSuDUnEj2FHIrUGNG4IDKOm9mIexqkpdvF6ByXYHeOAVbeb0ByJmgO
-        3QIYGsOYiWW2Uq1OCT2F+sP9ogn2GxInfMgPK7shFcUiXUbUKSnfBh4b5DbKPcJJ
-        wFtuJA4NbWgXbDPn0k2Lwbv33tMVuwQBRbCjseXD5JYUA+wEbNg341oNEl7gIBCp
-        oNyNJ0y2rkp8rxvf5mYLjk6VsMs0VO4vgRItg8oi78cZMmSrk2zdCda9yZA+JeHS
-        XgGnSemRkXBLcDcZMa1M178H/YTxispkRvsGyscxn7sjBRUgrFHnWM9j9P0GHtHE
-        RzBflQuBiG60jDb14l0SBEGDAm3Dp1bT5Up8attUJ0+03ta6E4G6iAR+fMXiBJA=
-        =LEoh
-        -----END PGP MESSAGE-----
-      fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMAw5vwmoEJHQ1AQ/7Be0MaQ6HSb4N2DW+z2ALOuKSljRhSHLiLXt6bmhot+2Z
-        RRMsfsPGHWwDFzy5WWL6117ViPsxdFy88ZC8IhfT2ysf9d7IsNqBAj/W/a1kUXBg
-        b3PLPGXT3yHRitmRA0PxBWjmKBHuiKJgpj2AvKPBqmpJOpyWU8Yr0yu+fdPgHHmO
-        9gMPwmoeDKCuVUQMtg78cxx3b9v3WzBXbx+VuhPepVPPUr7/iTWYnLWy8+s55hOV
-        A6qQS8f6JH9rhS7dqoSCMQ3wrqkSVzXhluhjfUXa/FW/EVp0g1r+lLMXHARA1Gtp
-        EGQS2SfwDB95xl6uLfqKblezzxt52yPvGp+hisAhgkCyoLonhL27fMTmtZ0+q9RX
-        FJoT2pPNTSP/zoLxfEJzsa9MgTCDKQL55215hTGHS2I/2ZeDtfINyc+/4LE/AhSc
-        4OOdPSbgG7bIPkCepphBAccjbCVmPOQqaEOk5C9TfLbZREEBv0mQA7pzWVIsa6Gc
-        xep0qJGMSmRT5rmqs9pFFISAx57H7w91cRaEtwtGkg9/90+wTW2kIvnHMLXV/T6z
-        wxVG4RHn7eXlDdh9oz0ncpA1uh2A4fvEJN5dAbQHawiAUaOokm8cmv42LQ1zTF0x
-        4EcZPQ1VAFzKsZE7/3TnCWoLPOUSNSOG+uJm2Gaps8P1DzIfgUAcSybaB+3cbGjS
-        XgEVALzLzyRrFB48McT/fU4l0dMiQ49OdFmWm5oWgOWDCCrHBomxPmWRQ5cUzVSV
-        wvgo/MrfGVOLrwinfeu/izoy9U0LxFcJtqiVLyxtUTARDlDcjv6OYWoRzvb0DzA=
-        =KudR
-        -----END PGP MESSAGE-----
-      fp: 87AB00D45D37C9E9167B5A5A333448678B60E505
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DerEtaFuTeewSAQdAlSeQVBNgJ8WxD85XYmcCHmlNXIyIkAJPEu0coBpNpVQw
-        mGZKY6j0WkQSmHdCVAeh8/z6LOEgXMphP2jn0ZpZHiMu3FGNJJtWFloRKxOvOxr5
-        0l4BXq0oVpIYhcxeVxS1prF1F2EJf/OuRX8Zz9ngZuL7UlMoToBYHksPMaBfLlKB
-        iFcXPURafpmhvWpRaqD9CRqM3XRagm1nYPS6Zg8Yae9cfSmU7UnYMtJZwdMmJ+x4
-        =gfNC
-        -----END PGP MESSAGE-----
-      fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQILAxjNhCKPP69fAQ/4mdGngFM8WhiX5P5RFo679yRMp5iHtiPqD0V1dE1byyje
-        d7WzceQwOYfYq/UEEw2ruiqIPhUjHlzB/GQ6wqFbj0+1tm7+/X2B42tO7vkO9gQf
-        2mvG0gCGB1iykMnfARQ6EH1s90oAHCBcPFamjBZ3oawS0sI34aSInQGqLl7Ss+O+
-        UgoOc2fbhYmRriZW7Elyx+8DuQg4RZ6/oPs18mtwQdLfKB8dwrt1TQrJvBx7iPh4
-        RQWrRf3id+C8EeysmWPtMotukh1FgvBtBFEXIL66wntJTDC65AlNU1c2xkgUTATI
-        rA6ucSoyROTGDOTAWhBdwA+yV9Tf2zw5hzu8G2vT1nFLU+DFQiuQWj6TNn1s5xzc
-        63bQ9bFzY/0pKKB2T1TLdeU6xoSt9QoJukagFS86Tgh3NcoMi69dFSSlchldgeX2
-        wiJwpUjl8DgeJFEXcQES1vbn+MNJHYZHSSAcZecQX5rauSj6EmTFTXxYg7Vp98D9
-        S4lVnXl6P7OByxqRJyQUzBmSD21KYeVXs6O4hY4cAxKx+pXYXqlGMmSpQi4SqJKF
-        xyD0f7Iz1FjB1u3dpcJmf5/71wLkZWc9smKfJICLaFZzYKfbfrF32xbAPGRuTq50
-        Fv5d3R1YJKA9afQUI3HT0PpCEOnsI44WPqgnoOPHyT032gruZt9geL7yM1sRj9Je
-        AfCwLc18oeiRWhnZLw/K1YMTnDACVhMMRufyoE7MEEixsV3xhuG54+5FIufERSO3
-        aW2vmDt65mLjqGVcepqbEz/Ip4hfGeMOnPfNbNil79Hc6TV1SzTcPnem40QPAA==
-        =7Qbv
-        -----END PGP MESSAGE-----
-      fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMA1Hthzn+T1OoAQ//QizKfdVMoIVzretcwqPNQPhXnKYbHNI/AHhpsK2AeOFw
-        N2pP+8itgzpoJ+l3qYc1s7HnUYqN69cVXNOkuB9+EKUmEoubj9oLJEJQdfr1apux
-        wrqgvIfeXuQZWp4E4aI/02ndyWzzedfVV3/qf+JC0ZColccmKFReSsMedz7dOmWK
-        BM2bieM1PajS65leCAO2VVFTrwayKiHWpURMUY8HvrMk8N6GQkXqe1XDdxXNJqFr
-        irXgWtBaKbl/KJgrxnT9HwlH9YkCebsyCi2sZKmJEqyIi78SOrhmWzeoTs5Mgg/M
-        EqZLWrGhOOD2/ineOxiDhFPOEDVjgoprghxei2Ef0i9pYITJmGMuB76KayMW3nbY
-        mEJgASKsWFN10zTiZK5DjxJoDEq4fyqtzFhYhRenwcvZqiklr2JudSzBWkKfx4Y/
-        TOoLwwn93TQDLoIIEsOlLaWMBxm3LsAe4MAr2k9/gAkGGMzeOiTRISHJeFtaNRPe
-        xPv2hJBKqAJJkWu5nlcn5FEtAqdG8hPRPqEZWDyWRmQDlk0Rx286UFIS+BKSfwvo
-        Ak52YxruVlkwxn4lRJ8yCrIneZocLFlBgTNoqbr0uYSHkg6XHwzniN+qGRHxjrm8
-        hDYcnVeAnLCDGEwPpMcx7KYVtLeEcr2Tm5btAlHugpQ1pNrUuZ3Lf47AdneMSY7S
-        XgE32gbAcEaZVQRl1fnehRIwqqNIuFDxjhFpDYpvX1Rep2NEUtEaxd50aqMh3PKm
-        XE6ZBkKbhSylRnOs8dgVZK3nqEe1xDsdcx5hFAoyyhs1QhWVT/MHUtfuB2PBcjo=
-        =T4dN
-        -----END PGP MESSAGE-----
-      fp: 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMA46L6MuPqfJqAQ//SZac3kFkPkHZ4CveGECwnJLKA/UJO/XoV44mjiQDtY4Q
-        tFJ+YauR7GHK3CYMvpx8uWejiW6PzMkuqVuKwk5QMBsRA7q/6SmQeLUNNIPx8AAm
-        s1Lo1Cdjv5Ku8AnR7gAJ9w3O+qM635xo7zgtvEv5qJuPrwbqy8kstvS2fnxg9Zb3
-        Dl4J+Wp1kRs8hHsFIkECKPqKNB0LfP57s63Vwd5tI2TltDMlMkvKvjgsQSPhUqQl
-        z0AIPT+zON37P4EW5buJ5NKvojYZ/QyzoqJ+Zb+2jn3uyMRDo4lqaT+uiVDcmB6w
-        jg2yBGKgU5XGAU5NyCSldBGW3yQfNHAEjTPHWIvcplfUOUQ2mKIV31c3ci8cBWa5
-        zfA4K2UOFPSHSraohaT770Ani/qvm5XH9HvAA2HOI50LuIh4t8cWGocbW1f5PfvZ
-        gMIuA27UfWWD10tz+J3qvz2RGcfBPV+3BS8BJUh2SRC80ba8nDM/VSuQUkxQA1go
-        AHogKohH7v5vIPEN6ggRxZ3yCroQ3zfdABekrP8sfKXU652/vhw5MFPtqp8ow5hU
-        uJ3S3lCoKQCKE8tc+288WuJXIGaYG4LKhaVlFWFqQDib+0jfm8RfwqqxV5vis7np
-        mbPMIyl/MTAeevsQC2yqbHeZ+nDXhrb8b4lfWCnn5jpNwZFpP+RZpJT6XxFbONTS
-        XgGQowdDlIEa1Hs1klR8lPOScW3VyhWbTyfWkhg4cI6js21/0MMsC22myhjxjZKU
-        rCn8k0mgZw+HyB9qfm3eM4fYXHs+CXQM22eBQK+IK2VvzT9jbpSBIoJEDW0B47c=
-        =PbAZ
-        -----END PGP MESSAGE-----
-      fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DQrf1tCqiJxoSAQdArbiHTkrjSYBSPIIgSNnEoAWkU43Zn8/6rtksEivhPVgw
-        ik9/LvTH3VUSS1pDtLNoJq3wfE8aCoGTVXHjCtaEQqp7PJ9c83afZuT0/jSs20vo
-        0l4Bbp+AopvK8wlLakYZM0rbXzJw7LyW7hyA3wSN/gL0MwT8sW6hb08BB3+zRY+f
-        dQGtPMDNZ0aJ8nzJ/WLVxi4GdC3pAWxqw/1AX0SwwMb0PEf9kdYSgnrmYQsqx9KU
-        =Cbzj
-        -----END PGP MESSAGE-----
-      fp: B71138A6A8964A3C3B8899857B4F70C356765BAB
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hF4DzAGzViGx4qcSAQdAQKsWq8NPJbW2SBhKhlgkW1gzYnx9baL8spEk1Wv31Asw
-        fuq75JZ/m8yR6+jnchE8ikuWrVQ1IRwyQBB2qlaArrdwnVpkF5HG/ggpDy4l5UYK
-        0lgBhuKG36g1P7G0incMXR+S+UswYQhzm+19LqoB247HvZZoyIT4m0k7XndHBpUw
-        fzQyFTKdwQpmWyQWsbkW/ycvxkKyKcEce6xkga0e8UbB8w1fJ0P6gErz
-        =g5Ck
-        -----END PGP MESSAGE-----
-      fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-    - created_at: "2026-01-25T11:17:03Z"
-      enc: |-
-        -----BEGIN PGP MESSAGE-----
-
-        hQIMA2pVdGTIrZI+AQ//X0eMLW5Con7f2J4S15RwQX/uMc+p0tabrfSYAT8cg1oR
-        X8qyFgBWL4EK/VAcgS+Loe6cOCO8pDv7R81nn18wg2D6hVN3BOcotgLtLpqWEdMz
-        FguVIc++/Nh5+s+H1oDxqfwO6LbcuewBvvNS9xvBUtHBMuoAGVO0mUu7jpxrg+4k
-        dh2QeA/YWc4hGly/lO6eOhq61arAY4tukqs1K4JRY7z1vZYb2658HamfruLcRP1j
-        kM6yvJ9bgrg3hIEPG48lWX3SATRpKDP4ukyTYMFPN5rePUu67rnkwCvXwvBzWV4v
-        fvjmDZ4U2AD6Ihn5Be3ThZyQivZJPmxBlgit6uQOdu08Q5/S0DDWSS/MnbRnElQt
-        caQMnIcSbwLJfum2/0AS/dcl6f36vOl5t9eiy3nnrgufFEUcAMgJ2bJk8+6nPRli
-        MImBTXLMor97XD4DS+xyQ8NjYzf8XxEDduCzWA/EQborLkkaXj5J9ZmQSKDfv6bb
-        wcGfxt0+JGEPmOuOD/BwZHhEcd6eV8k3cM6k4oQ3k9cMGele+dtSkrlkyFKnnBNV
-        NrZVBE5j62sgnUUgKCesbKPfauETE5Z+R2uvOK5Y0gqjTfaw8hV1YF2q+x2qRWig
-        6NjHheUtjigCgF61OK4x1a5WDJmVeuAe03JnwKYMujN4H5Oi9YMhSX65lX1+fhrU
-        aAEJAhCV01dJAuYksyvp+F5Dx62eKZj7gL/MHL3zHw97WbONvI7ApC3/Q7fkupYm
-        oPfYKQD5ov77V3u+Y8nVOoYM+Hb4thFQdEV01r90g9WUj8LrXvxd08j3GwAnzDMG
-        xU5hdDPzz/jT
-        =zb8A
-        -----END PGP MESSAGE-----
-      fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
-  unencrypted_suffix: _unencrypted
-  version: 3.11.0

inventories/chaosknoten/host_vars/spaceapiccc.yaml

@@ -1,16 +0,0 @@
-docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/spaceapiccc/docker_compose/compose.yaml.j2') }}"
-docker_compose__build: never
-docker_compose__pull: never
-
-certbot__version_spec: ""
-certbot__acme_account_email_address: le-admin@hamburg.ccc.de
-certbot__certificate_domains:
-  # - "spaceapi.ccc.de" # after DNS has been adjusted
-  - "spaceapiccc.hamburg.ccc.de"
-certbot__new_cert_commands:
-  - "systemctl reload nginx.service"
-
-nginx__version_spec: ""
-nginx__configurations:
-  - name: spaceapiccc.hamburg.ccc.de
-    content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/spaceapiccc/nginx/spaceapiccc.hamburg.ccc.de.conf') }}"

inventories/chaosknoten/hosts.yaml

@@ -74,10 +74,6 @@ all:
       ansible_host: renovate.hosts.hamburg.ccc.de
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
-    spaceapiccc:
-      ansible_host: spaceapiccc.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
 hypervisors:
   hosts:
     chaosknoten:
@@ -102,7 +98,6 @@ base_config_hosts:
     ntfy:
     sunders:
     renovate:
-    spaceapiccc:
 systemd_networkd_hosts:
   hosts:
     router:
@@ -122,7 +117,6 @@ docker_compose_hosts:
     zammad:
     ntfy:
     sunders:
-    spaceapiccc:
 nextcloud_hosts:
   hosts:
     cloud:
@@ -144,7 +138,6 @@ nginx_hosts:
     zammad:
     ntfy:
     sunders:
-    spaceapiccc:
 public_reverse_proxy_hosts:
   hosts:
     public-reverse-proxy:
@@ -165,7 +158,6 @@ certbot_hosts:
     zammad:
     ntfy:
     sunders:
-    spaceapiccc:
 prometheus_node_exporter_hosts:
   hosts:
     ccchoir:
@@ -197,7 +189,6 @@ infrastructure_authorized_keys_hosts:
     ntfy:
     sunders:
     renovate:
-    spaceapiccc:
 wiki_hosts:
   hosts:
     eh22-wiki:

resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf

@@ -78,8 +78,6 @@ map $host $upstream_acme_challenge_host {
     cryptoparty.hamburg.ccc.de 172.31.17.151:31820;
     staging.cryptoparty-hamburg.de 172.31.17.151:31820;
     staging.cryptoparty.hamburg.ccc.de 172.31.17.151:31820;
-    spaceapiccc.hamburg.ccc.de spaceapiccc.hosts.hamburg.ccc.de:31820;
-    spaceapi.ccc.de spaceapiccc.hosts.hamburg.ccc.de:31820;
     default "";
 }
 

resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf

@@ -96,8 +96,6 @@ stream {
         cryptoparty.hamburg.ccc.de 172.31.17.151:8443;
         staging.cryptoparty-hamburg.de 172.31.17.151:8443;
         staging.cryptoparty.hamburg.ccc.de 172.31.17.151:8443;
-        spaceapiccc.hamburg.ccc.de spaceapiccc.hosts.hamburg.ccc.de:8443;
-        spaceapi.ccc.de spaceapiccc.hosts.hamburg.ccc.de:8443;
     }
 
     server {

resources/chaosknoten/spaceapiccc/docker_compose/compose.yaml.j2

@@ -1,39 +0,0 @@
----
-services:
-    frontend:
-        #build: ./frontend
-        networks:
-            spaceapi-network:
-                ipv4_address: 172.16.238.10
-        image: gidsi/spaceapi-ccc-frontend:saved_from_old_host
-        restart: always
-        expose:
-            - "80"
-        depends_on:
-            - backend
-    backend:
-        #build: ./backend
-        networks:
-          - spaceapi-network
-        image: gidsi/spaceapi-ccc-backend:saved_from_old_host
-        restart: always
-        environment:
-            SHARED_SECRET: "{{ secret__spaceapiccc__shared_secret }}"
-            DOKU_WIKI_USER: "{{ secret__spaceapiccc__doku_ccc_de__username }}"
-            DOKU_WIKI_PASSWORD: "{{ secret__spaceapiccc__doku_ccc_de__password }}"
-        depends_on:
-            - database
-    database:
-        image: mongo:saved_from_old_host
-        networks:
-          - spaceapi-network
-        restart: always
-        volumes:
-          - ./data/database:/data/db
-
-networks:
-    spaceapi-network:
-        ipam:
-            driver: default
-            config:
-                - subnet: 172.16.238.0/24

resources/chaosknoten/spaceapiccc/nginx/spaceapiccc.hamburg.ccc.de.conf

@@ -1,42 +0,0 @@
-# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
-# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
-server {
-    # Listen on a custom port for the proxy protocol.
-    listen [::]:8443 ssl http2 proxy_protocol;
-    # Make use of the ngx_http_realip_module to set the $remote_addr and
-    # $remote_port to the client address and client port, when using proxy
-    # protocol.
-    # First set our proxy protocol proxy as trusted.
-    set_real_ip_from 2a00:14b0:4200:3000:125::1;
-    # Then tell the realip_module to get the addreses from the proxy protocol
-    # header.
-    real_ip_header proxy_protocol;
-
-    server_name spaceapi.ccc.de spaceapiccc.hamburg.ccc.de;
-
-    ssl_certificate /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/privkey.pem;
-    # verify chain of trust of OCSP response using Root CA and Intermediate certs
-    ssl_trusted_certificate /etc/letsencrypt/live/spaceapiccc.hamburg.ccc.de/chain.pem;
-
-    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
-    add_header Strict-Transport-Security "max-age=63072000" always;
-
-    proxy_set_header Host $host;
-    proxy_set_header X-Forwarded-Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Port 443;
-    # This is https in any case.
-    proxy_set_header X-Forwarded-Proto https;
-    # Hide the X-Forwarded header.
-    proxy_hide_header X-Forwarded;
-    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
-    # is transparent).
-    # Also provide "_hidden" for by, since it's not relevant.
-    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
-
-    location / {
-        proxy_pass http://172.16.238.10/;
-    }
-}