From 39d8ff4ef82138a68351ac9df8bccb2bde5887eb Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 17:19:05 +0200 Subject: [PATCH 1/3] update wireguard publicKey for lilly --- resources/z9/z9-router/systemd_networkd/10-wg56.netdev | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/z9/z9-router/systemd_networkd/10-wg56.netdev b/resources/z9/z9-router/systemd_networkd/10-wg56.netdev index 70966e22..241ea5af 100644 --- a/resources/z9/z9-router/systemd_networkd/10-wg56.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-wg56.netdev @@ -76,7 +76,7 @@ PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_home_psk [WireGuardPeer] # friendly_name = lilly-lillysLaptop AllowedIPs = 10.89.214.16/32,2a07:c481:1:37::16/128 -PublicKey = IBsI+N8qUNpQnDc5HnqQ2Zo/1graFM0RMIecHmAF+Vk= +PublicKey = v0MiwjhCj1w4J3fKl2d18wNIdbdd9tvdjIRQTRjIeGY= [WireGuardPeer] # friendly_name = bitwhisker From 73760a999530f46addd3e851459a09af050ca0a1 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 17:38:34 +0200 Subject: [PATCH 2/3] fix ansible-lint warnings --- resources/z9/z9-router/kea_dhcp.yaml | 36 ++++++++++++------------- roles/kea_dhcp/meta/argument_specs.yaml | 4 +-- roles/secrets/meta/argument_specs.yaml | 19 ++++++------- 3 files changed, 30 insertions(+), 29 deletions(-) diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index 2d0033bd..53a89dfa 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -6,7 +6,7 @@ kea_dhcp__dns_servers: kea_dhcp__dhcp4: enable: true - interfaces: ["netlan.51", "netlan.52", "netlan"] + interfaces: [ "netlan.51", "netlan.52", "netlan" ] subnets: - id: 1 subnet: 10.89.208.0/22 @@ -234,7 +234,7 @@ kea_dhcp__dhcp4: kea_dhcp__dhcp6: enable: true - interfaces: ["netlan.51", "netlan.52", "netlan"] + interfaces: [ "netlan.51", "netlan.52", "netlan" ] subnets: - id: 1 subnet: "2a07:c481:1:33::/64" @@ -246,7 +246,7 @@ kea_dhcp__dhcp6: - pool: "2a07:c481:1:33::/64" allocator: random reservations: - - ip-addresses: ["2a07:c481:1:33::1c"] + - ip-addresses: [ "2a07:c481:1:33::1c" ] hostname: dooris hw-address: "bc:24:11:b3:93:9c" - id: 2 @@ -258,7 +258,7 @@ kea_dhcp__dhcp6: pools: - pool: "2a07:c481:1:34::/64" reservations: - - ip-addresses: ["2a07:c481:1:34::66"] + - ip-addresses: [ "2a07:c481:1:34::66" ] hostname: esphome hw-address: "7e:3c:f0:77:8a:f4" - id: 3 @@ -270,45 +270,45 @@ kea_dhcp__dhcp6: pools: - pool: "2a07:c481:1:36::/64" reservations: - - ip-addresses: ["2a07:c481:1:36::2"] + - ip-addresses: [ "2a07:c481:1:36::2" ] hostname: sw-rack-1 hw-address: "F0:9F:C2:10:C3:AA" - - ip-addresses: ["2a07:c481:1:36::3"] + - ip-addresses: [ "2a07:c481:1:36::3" ] hostname: sw-rack-2-peo hw-address: "44:d9:e7:06:69:5d" - - ip-addresses: ["2a07:c481:1:36::4"] + - ip-addresses: [ "2a07:c481:1:36::4" ] hostname: sw-main-1 hw-address: "a8:9c:6c:16:df:cc" - - ip-addresses: ["2a07:c481:1:36::5"] + - ip-addresses: [ "2a07:c481:1:36::5" ] hostname: sw-main-2 hw-address: "a8:9c:6c:16:e8:86" - - ip-addresses: ["2a07:c481:1:36::6"] + - ip-addresses: [ "2a07:c481:1:36::6" ] hostname: sw-shop-1 hw-address: "C0:4A:00:FB:DA:C5" - - ip-addresses: ["2a07:c481:1:36::7"] + - ip-addresses: [ "2a07:c481:1:36::7" ] hostname: sw-shop-2-peo hw-address: "f4:e2:c6:bf:20:ee" - - ip-addresses: ["2a07:c481:1:36::8"] + - ip-addresses: [ "2a07:c481:1:36::8" ] hostname: sw-shop-3-peo hw-address: "d8:b3:70:85:72:76" - - ip-addresses: ["2a07:c481:1:36::b"] + - ip-addresses: [ "2a07:c481:1:36::b" ] hostname: pve01 hw-address: "38:05:25:30:80:35" - - ip-addresses: ["2a07:c481:1:36::c"] + - ip-addresses: [ "2a07:c481:1:36::c" ] hostname: pve02 hw-address: "b8:85:84:b1:57:b6" - - ip-addresses: ["2a07:c481:1:36::d"] + - ip-addresses: [ "2a07:c481:1:36::d" ] hostname: pve03 hw-address: "98:fa:9b:a2:ed:e8" - - ip-addresses: ["2a07:c481:1:36::f"] + - ip-addresses: [ "2a07:c481:1:36::f" ] hostname: pbs hw-address: "BC:24:11:D6:2C:81" - - ip-addresses: ["2a07:c481:1:36::21"] + - ip-addresses: [ "2a07:c481:1:36::21" ] hostname: unifi hw-address: "BC:24:11:25:77:60" - - ip-addresses: ["2a07:c481:1:36::31"] + - ip-addresses: [ "2a07:c481:1:36::31" ] hostname: light hw-address: "72:61:ea:e6:49:e3" - - ip-addresses: ["2a07:c481:1:36::32"] + - ip-addresses: [ "2a07:c481:1:36::32" ] hostname: club-assistant hw-address: "7a:55:61:c3:a2:89" diff --git a/roles/kea_dhcp/meta/argument_specs.yaml b/roles/kea_dhcp/meta/argument_specs.yaml index 13339ff3..aaa9de7c 100644 --- a/roles/kea_dhcp/meta/argument_specs.yaml +++ b/roles/kea_dhcp/meta/argument_specs.yaml @@ -70,7 +70,7 @@ argument_specs: interfaces: type: "list" elements: "str" - default: [] + default: [ ] control-sockets: type: "list" elements: "dict" @@ -107,7 +107,7 @@ argument_specs: interfaces: type: "list" elements: "str" - default: [] + default: [ ] control-sockets: type: "list" elements: "dict" diff --git a/roles/secrets/meta/argument_specs.yaml b/roles/secrets/meta/argument_specs.yaml index 2856d577..63419ae2 100644 --- a/roles/secrets/meta/argument_specs.yaml +++ b/roles/secrets/meta/argument_specs.yaml @@ -5,12 +5,13 @@ argument_specs: type: list required: false secrets__folder: - owner: - type: string - required: false - group: - type: string - required: false - mode: - type: string - required: false + options: + owner: + type: str + required: false + group: + type: str + required: false + mode: + type: str + required: false From 29a7a2a73136712b3b9f4dc8130183112d399676 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 11 Aug 2026 16:20:08 +0200 Subject: [PATCH 3/3] add configuration required for dooris -> spaceapid integration --- inventories/z9/host_vars/dooris.sops.yaml | 7 ++++--- inventories/z9/host_vars/dooris.yaml | 1 + roles/dooris/README.md | 3 +++ roles/dooris/defaults/main.yml | 1 + roles/dooris/meta/argument_specs.yml | 15 +++++++++++++++ roles/dooris/templates/compose.yaml.j2 | 3 +++ 6 files changed, 27 insertions(+), 3 deletions(-) create mode 100644 roles/dooris/defaults/main.yml diff --git a/inventories/z9/host_vars/dooris.sops.yaml b/inventories/z9/host_vars/dooris.sops.yaml index 9620b051..1395425a 100644 --- a/inventories/z9/host_vars/dooris.sops.yaml +++ b/inventories/z9/host_vars/dooris.sops.yaml @@ -1,6 +1,7 @@ dooris__static_api_token: ENC[AES256_GCM,data:pXmjn36FnOwA7fWAd3Go4W1CiMeRbbAiquj9KI/pQEDy1qDuobBbBft25m3uSAo6VI02PW2oZ4koY8uoPDUwNA==,iv:TNaZjwGBHvIbmF7VPIOo5mYzH1NEIyKIgjzkrobNCoI=,tag:4dHZepMxUGcvBYEp0kNwYQ==,type:str] dooris__openid_client_secret: ENC[AES256_GCM,data:PqmtHR6LCGXcK5dyqKihUqU6+lydW0mJf7kMMf41qh4=,iv:ZjIl8jwB2lfJHjwcDEFFCbafMBnpzkccxBvvsjg+ia8=,tag:+eCnr9ojv9uUoO9k5khY6w==,type:str] dooris__ccujack_password: ENC[AES256_GCM,data:FBbrdoQRdVZ+1n8WZg42jZz/xvQ=,iv:GLuen+LiB4MrvU71gEdVYWbdHKaDcEKify3vPePuoO0=,tag:nuqkP0cJLsvNAieWDNY3HA==,type:str] +dooris__spaceapid_password: ENC[AES256_GCM,data:3MLPzV7NxvOLQSHoBgPdR1WeGGhDZVnxDHDNviPseOQDkFkqUXFGPtfPQqI/pjs0VV607ehw+SfF3T8tMhorgA==,iv:U5j0SmM9rNsQTSxuLSiuG6zyMxVjfdNnu9BPXcaDjko=,tag:glvUmu79iCFEXmGDvm7Vuw==,type:str] dooris__acmedns: subdomain: ENC[AES256_GCM,data:XncJZ7qT51dLSkvfIc0Nc3SFxK1y/ip1cO4HA9CJMFtQy+mP,iv:mgwfx0QMzHadvUDZDYCzsiP1Oh+P/5DekbZ4M6y08t4=,tag:4oyXvAJEOFlw7wrrrhwspQ==,type:str] apiUser: ENC[AES256_GCM,data:YLhXPrrts+JtwRMLrU2oM8hLTiFvZuqrlLrNKtgoL8IUdTxe,iv:L2R0YNRNoMuWGMYvgwRLP0RZwxqmMfQL4REyMX6VIuo=,tag:LegIPuVqMcxpIL1ZksIgbg==,type:str] @@ -17,8 +18,8 @@ sops: aHvFML6xynRtBrMsp9IebicBxZKSWLi7uHi+LuAzkIcqpAlJUUBAbg== -----END AGE ENCRYPTED FILE----- recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax - lastmodified: "2026-07-29T12:14:25Z" - mac: ENC[AES256_GCM,data:rBtCeee53GXl+upHXGP4TTpUvszMzV0r1eQqzE7jG3WP/ywqfWqsM+sp3124wQzHTZoMxJc0m95YAseSdA+7EFSAQPRRdpfzMxTpoKQBFHS0BfgM/14ppB+kDER1ucNKT521+PyOjbmB86ovTc8MfR2vsHDZ+FrIopUGzPpcBPs=,iv:JiSoJxPt9JW/kWy0aVz6jGNOoQPkZKG/vTkdis/fKSo=,tag:0V6hicsuT6/qLjGb/+fJPw==,type:str] + lastmodified: "2026-08-11T14:12:13Z" + mac: ENC[AES256_GCM,data:yFvVk8J3Kjf7hYQ5E7tN0Dpa8943n2OLcVKEQWcyMFrl991cYjpti+a766Bx79KgaBqSW70E7Y13KfdXw0wpETte+KwpXEmlh54/3UihdvcavcH0ep7zZhyXEtoBfDTKoFMkvDgmQbljnOOWbWpW0X60lyWe0/xHIHJonlZ7PuY=,iv:9HdGaa4CXKJfI7LgY7oSsLU0VPZZ+dSW+k1s9v5xZkk=,tag:g4BSo09RAslC3H1djw6B2Q==,type:str] pgp: - created_at: "2026-05-20T02:08:48Z" enc: |- @@ -191,4 +192,4 @@ sops: -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted - version: 3.13.2 + version: 3.13.3 diff --git a/inventories/z9/host_vars/dooris.yaml b/inventories/z9/host_vars/dooris.yaml index 14231924..bae5bf90 100644 --- a/inventories/z9/host_vars/dooris.yaml +++ b/inventories/z9/host_vars/dooris.yaml @@ -1,5 +1,6 @@ dooris__hostname: "dooris.ccchh.net" dooris__openid_client_id: "dooris" dooris__ccujack_user: "dooris" +dooris__spaceapid_user: "dooris" certbot__acme_account_email_address: le-admin@hamburg.ccc.de diff --git a/roles/dooris/README.md b/roles/dooris/README.md index f868b1d5..6b7efa2a 100644 --- a/roles/dooris/README.md +++ b/roles/dooris/README.md @@ -11,6 +11,9 @@ For an exact description of host requirements, see the README of dooris itself. - `dooris__openid_client_id`: Client-ID in CCCHH ID for dooris - `dooris__openid_client_secret`: Client-Secret in CCCHH ID for dooris - `dooris__static_api_token`: A static token that is valid on the servers API and can operate locks +- `dooris__spaceapid_user`: Username for authentication against our spaceapid +- `dooris__spaceapid_password`: Password for authentication against our spaceapid +- `dooris__main_lock`: Name or ID of the main lock whose status gets pushed to spaceapid - `dooris__acmedns`: Configuration of ACMEDNS domain + credentials for dooris. Must be a dict with keys `subdomain`, `apiUser`, `apiKey` which are shown when creating a domain in ACMEDNS. diff --git a/roles/dooris/defaults/main.yml b/roles/dooris/defaults/main.yml new file mode 100644 index 00000000..0f292e95 --- /dev/null +++ b/roles/dooris/defaults/main.yml @@ -0,0 +1 @@ +dooris__main_lock: "" diff --git a/roles/dooris/meta/argument_specs.yml b/roles/dooris/meta/argument_specs.yml index 134292d8..5f66e956 100644 --- a/roles/dooris/meta/argument_specs.yml +++ b/roles/dooris/meta/argument_specs.yml @@ -31,6 +31,21 @@ argument_specs: required: true type: str + dooris__spaceapid_user: + description: "Username for authentication against out spaceapid" + required: true + type: str + + dooris__spaceapid_password: + description: "Password for authentication against out spaceapid" + required: true + type: str + + dooris__main_lock: + description: "Name or ID of the main lock whose status gets pushed to spaceapid" + required: false + type: str + dooris__acmedns: description: "Configuration of ACMEDNS domain + credentials for dooris" required: true diff --git a/roles/dooris/templates/compose.yaml.j2 b/roles/dooris/templates/compose.yaml.j2 index 2bb5e825..2a39b42a 100644 --- a/roles/dooris/templates/compose.yaml.j2 +++ b/roles/dooris/templates/compose.yaml.j2 @@ -11,6 +11,9 @@ services: DOORIS_CCUJACK_PASSWORD: "{{ dooris__ccujack_password }}" DOORIS_AUTHORIZED_KEYS_FILE: "/srv/state/dooris_authorized_keys" DOORIS_STATIC_API_TOKENS: "{{ dooris__static_api_token }}" + DOORIS_SPACEAPID_USER: "{{ dooris__spaceapid_user }}" + DOORIS_SPACEAPID_PASSWORD: "{{ dooris__spaceapid_password }}" + DOORIS_MAIN_LOCK: "{{ dooris__main_lock }}" network_mode: host restart: unless-stopped volumes: