From a0c3aa1b5ce238c028a958ff0151128de2c3e3bb Mon Sep 17 00:00:00 2001 From: Renovate Date: Wed, 21 Oct 2026 14:46:45 +0000 Subject: [PATCH 1/4] Update docker.io/library/postgres Docker tag to v17 --- inventories/chaosknoten/host_vars/cloud.yaml | 2 +- resources/chaosknoten/lists/docker_compose/compose.yaml.j2 | 2 +- resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/inventories/chaosknoten/host_vars/cloud.yaml b/inventories/chaosknoten/host_vars/cloud.yaml index 8f299b2d..fbd9f76b 100644 --- a/inventories/chaosknoten/host_vars/cloud.yaml +++ b/inventories/chaosknoten/host_vars/cloud.yaml @@ -1,7 +1,7 @@ # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud nextcloud__version: 34 # renovate: datasource=docker depName=docker.io/library/postgres -nextcloud__postgres_version: 15.18 +nextcloud__postgres_version: 17.11 nextcloud__fqdn: cloud.hamburg.ccc.de nextcloud__data_dir: /data/nextcloud nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}" diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index 7a109e8c..3f414e98 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -62,7 +62,7 @@ services: - POSTGRES_DB=mailmandb - POSTGRES_USER=mailman - "POSTGRES_PASSWORD={{ secret__lists__postgres_password }}" - image: docker.io/library/postgres:12-alpine + image: docker.io/library/postgres:17-alpine volumes: - /opt/mailman/database:/var/lib/postgresql/data networks: diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index 6b1683cc..308c75f3 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -3,7 +3,7 @@ services: database: - image: docker.io/library/postgres:15-alpine + image: docker.io/library/postgres:17-alpine environment: - "POSTGRES_USER=pretalx" - "POSTGRES_PASSWORD={{ secret__pretalx_db_password }}" From be76c3d7920444adb9e1498c4f3c9d8ef02affb6 Mon Sep 17 00:00:00 2001 From: chris Date: Wed, 21 Oct 2026 16:55:32 +0200 Subject: [PATCH 2/4] wiki.ccchh.net is not longer in the dns so we remove it from all other configs as well --- inventories/chaosknoten/host_vars/wiki.yaml | 3 --- .../nginx/acme_challenge.conf | 1 - .../public-reverse-proxy/nginx/nginx.conf | 1 - .../wiki/nginx/wiki.ccchh.net.conf | 26 ------------------- 4 files changed, 31 deletions(-) delete mode 100644 resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf diff --git a/inventories/chaosknoten/host_vars/wiki.yaml b/inventories/chaosknoten/host_vars/wiki.yaml index 716547dd..bde1e49e 100644 --- a/inventories/chaosknoten/host_vars/wiki.yaml +++ b/inventories/chaosknoten/host_vars/wiki.yaml @@ -1,13 +1,10 @@ nginx__version_spec: "" nginx__configurations: - - name: wiki.ccchh.net - content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf') }}" - name: wiki.hamburg.ccc.de content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/wiki/nginx/wiki.hamburg.ccc.de.conf') }}" certbot__acme_account_email_address: j+letsencrypt-ccchh@jsts.xyz certbot__certificate_domains: - - "wiki.ccchh.net" - "wiki.hamburg.ccc.de" certbot__new_cert_commands: - "systemctl reload nginx.service" diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf index 33453bbe..414f8ca4 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf @@ -27,7 +27,6 @@ map $host $upstream_acme_challenge_host { pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:31820; spaceapi.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820; staging.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820; - wiki.ccchh.net wiki.hosts.hamburg.ccc.de:31820; wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:31820; www.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820; tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:31820; diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf index f8bb5f2e..0ec2967f 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf @@ -29,7 +29,6 @@ stream { invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443; keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443; grafana.hamburg.ccc.de grafana.hosts.hamburg.ccc.de:8443; - wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443; wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443; onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:8443; hackertours.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443; diff --git a/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf b/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf deleted file mode 100644 index d89b5b88..00000000 --- a/resources/chaosknoten/wiki/nginx/wiki.ccchh.net.conf +++ /dev/null @@ -1,26 +0,0 @@ -# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration -# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 -server { - # Listen on a custom port for the proxy protocol. - listen [::]:8443 ssl http2 proxy_protocol; - # Make use of the ngx_http_realip_module to set the $remote_addr and - # $remote_port to the client address and client port, when using proxy - # protocol. - # First set our proxy protocol proxy as trusted. - set_real_ip_from 2a00:14b0:4200:3000:125::1; - # Then tell the realip_module to get the addreses from the proxy protocol - # header. - real_ip_header proxy_protocol; - - server_name wiki.ccchh.net; - - ssl_certificate /etc/letsencrypt/live/wiki.ccchh.net/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/wiki.ccchh.net/privkey.pem; - # verify chain of trust of OCSP response using Root CA and Intermediate certs - ssl_trusted_certificate /etc/letsencrypt/live/wiki.ccchh.net/chain.pem; - - # HSTS (ngx_http_headers_module is required) (63072000 seconds) - add_header Strict-Transport-Security "max-age=63072000" always; - - return 302 https://wiki.hamburg.ccc.de$request_uri; -} From 39028a6557abd9c0aba26aadb676d94e7e958bc4 Mon Sep 17 00:00:00 2001 From: chris Date: Wed, 21 Oct 2026 18:02:13 +0200 Subject: [PATCH 3/4] dokuwiki(role): set php strict_mode and disable upload_progress --- roles/dokuwiki/tasks/main.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/roles/dokuwiki/tasks/main.yml b/roles/dokuwiki/tasks/main.yml index 8c836ce0..239803ee 100644 --- a/roles/dokuwiki/tasks/main.yml +++ b/roles/dokuwiki/tasks/main.yml @@ -12,6 +12,24 @@ - git diff: false +- name: Configure php.ini for php-fpm + become: true + block: + - name: Ensure `session.use_strict_mode` is enabled via php.ini + ansible.builtin.lineinfile: + path: /etc/php/8.4/fpm/php.ini + regexp: '^session\.use_strict_mode' + line: 'session.use_strict_mode = 1' + state: present + + - name: Ensure `session.upload_progress.enabled` is disabled via php.ini + become: true + ansible.builtin.lineinfile: + path: /etc/php/8.4/fpm/php.ini + regexp: '^session\.upload_progress\.enabled' + line: 'session.upload_progress.enabled = Off' + state: present + - name: Ensure `php-fpm` is enabled become: true ansible.builtin.systemd: From 0efffaf344b56db467c34440ee44eb1cfc8b33d8 Mon Sep 17 00:00:00 2001 From: Renovate Date: Wed, 21 Oct 2026 20:18:29 +0000 Subject: [PATCH 4/4] Update docker.io/library/postgres Docker tag to v17 --- inventories/chaosknoten/host_vars/cloud.yaml | 2 +- resources/chaosknoten/lists/docker_compose/compose.yaml.j2 | 2 +- resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/inventories/chaosknoten/host_vars/cloud.yaml b/inventories/chaosknoten/host_vars/cloud.yaml index 8f299b2d..fbd9f76b 100644 --- a/inventories/chaosknoten/host_vars/cloud.yaml +++ b/inventories/chaosknoten/host_vars/cloud.yaml @@ -1,7 +1,7 @@ # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud nextcloud__version: 34 # renovate: datasource=docker depName=docker.io/library/postgres -nextcloud__postgres_version: 15.18 +nextcloud__postgres_version: 17.11 nextcloud__fqdn: cloud.hamburg.ccc.de nextcloud__data_dir: /data/nextcloud nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}" diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index 7a109e8c..3f414e98 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -62,7 +62,7 @@ services: - POSTGRES_DB=mailmandb - POSTGRES_USER=mailman - "POSTGRES_PASSWORD={{ secret__lists__postgres_password }}" - image: docker.io/library/postgres:12-alpine + image: docker.io/library/postgres:17-alpine volumes: - /opt/mailman/database:/var/lib/postgresql/data networks: diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index 6b1683cc..308c75f3 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -3,7 +3,7 @@ services: database: - image: docker.io/library/postgres:15-alpine + image: docker.io/library/postgres:17-alpine environment: - "POSTGRES_USER=pretalx" - "POSTGRES_PASSWORD={{ secret__pretalx_db_password }}"