Update docker.io/pretix/standalone Docker tag to v2026.4

Allows storage of secrets to then be referenced in other places.
The motivation was storing WireGuard secrets for systemd-networkd.

inventories/chaosknoten/hosts.yaml

@@ -291,3 +291,5 @@ msmtp_hosts:
 renovate_hosts:
   hosts:
     renovate:
+secrets_hosts:
+  hosts:

inventories/external/hosts.yaml

@@ -22,3 +22,5 @@ infrastructure_authorized_keys_hosts:
 ansible_pull_hosts:
   hosts:
     status:
+secrets_hosts:
+  hosts:

inventories/z9/hosts.yaml

@@ -57,3 +57,5 @@ ansible_pull_hosts:
     light:
     waybackproxy:
     yate:
+secrets_hosts:
+  hosts:

playbooks/deploy.yaml

@@ -6,6 +6,13 @@
   tags:
     - base_config
 
+- name: Ensure secrets deployment on secrets_hosts
+  hosts: secrets_hosts
+  roles:
+    - secrets
+  tags:
+    - secrets
+
 - name: Ensure systemd-networkd config deployment on systemd_networkd_hosts
   hosts: systemd_networkd_hosts
   roles:

roles/secrets/README.md

@@ -0,0 +1,24 @@
+# Role `secrets`
+
+Allows storing the given secret contents in the configured files.
+
+## Supported Distributions
+
+Should work on Debian-based distributions.
+
+## Required Arguments
+
+None.
+
+## Optional Arguments
+
+- `secrets__secrets`: List of secrets.
+  Defaults to the empty list (`[ ]`).
+- `secrets__secrets.*.name`: (File)name for the secret (in the `/etc/ansible_secrets` directory).
+- `secrets__secrets.*.content`: The secret content to store.
+- `secrets__secrets.*.owner`: The owner of the secret file.
+  Defaults to `root`.
+- `secrets__secrets.*.group`: The group of the secret file.
+  Defaults to `root`.
+- `secrets__secrets.*.mode`: The mode of the secret file.
+  Defaults to `0640`.

roles/secrets/defaults/main.yaml

@@ -0,0 +1 @@
+secrets__secrets: [ ]

roles/secrets/meta/argument_specs.yaml

@@ -0,0 +1,6 @@
+argument_specs:
+  main:
+    options:
+      secrets__secrets:
+        type: list
+        required: false

roles/secrets/tasks/main.yaml

@@ -0,0 +1,53 @@
+- name: validate secret configs
+  ansible.builtin.validate_argument_spec:
+    argument_spec: "{{ required_data }}"
+    provided_arguments:
+      config: "{{ item }}"
+  loop: "{{ secrets__secrets }}"
+  loop_control:
+    label: "{{ item.name }}"
+  vars:
+    required_data:
+      config:
+        type: dict
+        required: true
+        options:
+          name:
+            type: str
+            required: true
+          content:
+            type: str
+            required: true
+          owner:
+            type: str
+            required: false
+            default: root
+          group:
+            type: str
+            required: false
+            default: root
+          mode:
+            type: str
+            required: false
+            default: "0640"
+
+- name: ensure secrets directory exists
+  ansible.builtin.file:
+    path: "/etc/ansible_secrets"
+    state: directory
+    owner: root
+    group: root
+    mode: "0750"
+  become: true
+
+- name: ensure secrets are present
+  ansible.builtin.copy:
+    content: "{{ item.content }}"
+    dest: "/etc/ansible_secrets/{{ item.name }}"
+    mode: "{{ item.mode | default('0640') }}"
+    owner: "{{ item.owner | default('root') }}"
+    group: "{{ item.group | default('root') }}"
+  become: true
+  loop: "{{ secrets__secrets }}"
+  loop_control:
+    label: "{{ item.name }}"