From 8b829781de51a065c7038857513c804e37bb550e Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 23 May 2026 23:46:00 +0200 Subject: [PATCH 01/38] rt1(z9 host): create host and configure networkd and nftables --- inventories/z9/host_vars/rt1.sops.yaml | 198 ++++++++++++++++++ inventories/z9/host_vars/rt1.yaml | 6 + inventories/z9/hosts.yaml | 11 + resources/z9/rt1/nftables/nftables.conf | 111 ++++++++++ .../z9/rt1/systemd_networkd/00-netlan.link | 6 + .../z9/rt1/systemd_networkd/00-netwan.link | 6 + .../rt1/systemd_networkd/10-netlan.51.netdev | 7 + .../rt1/systemd_networkd/10-netlan.52.netdev | 7 + .../rt1/systemd_networkd/10-netlan.53.netdev | 7 + .../rt1/systemd_networkd/10-netlan.54.netdev | 7 + .../rt1/systemd_networkd/10-netwan.400.netdev | 7 + .../z9/rt1/systemd_networkd/10-wg55.netdev | 90 ++++++++ .../z9/rt1/systemd_networkd/20-netlan.network | 12 ++ .../z9/rt1/systemd_networkd/20-netwan.network | 9 + .../z9/rt1/systemd_networkd/20-wg55.network | 6 + .../21-netlan.51-clients.network | 27 +++ .../systemd_networkd/21-netlan.52-iot.network | 27 +++ .../21-netlan.53-public.network | 27 +++ .../21-netlan.54-management.network | 27 +++ .../21-netwan.400-fux_uplink.network | 26 +++ .../rt1/systemd_networkd_global_config.conf | 3 + 21 files changed, 627 insertions(+) create mode 100644 inventories/z9/host_vars/rt1.sops.yaml create mode 100644 inventories/z9/host_vars/rt1.yaml create mode 100644 resources/z9/rt1/nftables/nftables.conf create mode 100644 resources/z9/rt1/systemd_networkd/00-netlan.link create mode 100644 resources/z9/rt1/systemd_networkd/00-netwan.link create mode 100644 resources/z9/rt1/systemd_networkd/10-netlan.51.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-netlan.52.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-netlan.53.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-netlan.54.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-netwan.400.netdev create mode 100644 resources/z9/rt1/systemd_networkd/10-wg55.netdev create mode 100644 resources/z9/rt1/systemd_networkd/20-netlan.network create mode 100644 resources/z9/rt1/systemd_networkd/20-netwan.network create mode 100644 resources/z9/rt1/systemd_networkd/20-wg55.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netlan.53-public.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netlan.54-management.network create mode 100644 resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network create mode 100644 resources/z9/rt1/systemd_networkd_global_config.conf diff --git a/inventories/z9/host_vars/rt1.sops.yaml b/inventories/z9/host_vars/rt1.sops.yaml new file mode 100644 index 0000000..f4141fd --- /dev/null +++ b/inventories/z9/host_vars/rt1.sops.yaml @@ -0,0 +1,198 @@ +secrets__secrets: + - name: ENC[AES256_GCM,data:MmqDXUKy+U67JZFmKJTGLYAJcYPClQ8M2w==,iv:/eDx++bJCzdKXYB8YipB/GB6aM421JR3sy8i5trBKxk=,tag:/zTklys9bN839iT1qOH0UQ==,type:str] + content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str] + - name: ENC[AES256_GCM,data:9i4hZU7Hv/IMlI/1oYthx8g57nrst9LHZQk=,iv:IQanD/CA64A+hVyTQBiTvWdXyY8qNF9BpehWZxI5a9c=,tag:RiY0OJe2xbFPG6wfe5XjiA==,type:str] + content: ENC[AES256_GCM,data:lrwHaNvHkh5E94ziiQsd8ua9YvuwmhZ6iIGZS0oFnZdYKuyNh7egWOoii2o=,iv:LLRKhbiJl1GwK/SfqNdNrrJuDF17YXw3hHmuhlyI87w=,tag:DbR/a7jfy1+4yswSdYfOFA==,type:str] + - name: ENC[AES256_GCM,data:2lJUcDJ7ECJ1bF4Fg1VwOR2tBIQ77ZvDAbFF8w==,iv:HrPWIetjN/lOyQ7Mvk0sM1w+bWldlNfWhvw7/sfqKN8=,tag:AJL0s+f0O/yR4G3RVd1IHQ==,type:str] + content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str] + - name: ENC[AES256_GCM,data:ESxpEp9k9BdD1GJv+af+U3ny0+RPuaJjWDhQ,iv:DxsZLiDF8F+ixepbUdlitMJ7DLHjGNFNuxRwLl7efo8=,tag:STnv/oLzbchdiwXfKP3fow==,type:str] + content: ENC[AES256_GCM,data:W2h5AcoT85OkekPeRkrf1m0bDdBjG/YNSbWlrcZtP7FjaPh/F+cx+J6oRRI=,iv:CLVXTqfstpIU3BX/Zdcnp9w0gWxeGDI/G1MNl6xr4ZU=,tag:yCqN4r1MV/VTWQvZ6COfIw==,type:str] + - name: ENC[AES256_GCM,data:IRwwy+WQxgQ8cDpB8HaCLpKwJj7oC87p0XOxWRo=,iv:BLXNMcigvaOeY6y4NlLPMMWQt9XFi6nodRwIYFgAAnU=,tag:OdQalmujOgrzW8oi64xMRg==,type:str] + content: ENC[AES256_GCM,data:C5oIcuEYtODsvjQZnbqbWVfP63mQzcRuh8f5rlBCyjwSq2mZiYGQe9t0T78=,iv:sITUDo9SKZTSwPfsMv4m4U0ruuVCcaxu7SUT52U4FSE=,tag:4CsSMJWQQPAIeK8DwUDBqg==,type:str] + - name: ENC[AES256_GCM,data:r0sbpjaGjezoNlyl1khy+Dly+8xbbfQZNB8om/E4/tj9lmM=,iv:MLrglBJA6BrHGmFRprlQcf5/Hqh952e5OyQQ9nPxumY=,tag:Se05kMBkSQ7TRxzij7Fo8A==,type:str] + content: ENC[AES256_GCM,data:/c1nRf1eZhbUmoQWvcj8yDaVPtyAN7Uu+S054q3C1/kXlQ7CgOe4CrMXnmk=,iv:ppar0aCKuIU3DOjwAoliZ5TOL199Z+Ffo4pCktjs0W8=,tag:nfaGutK+5KnlWBKU1MTxkQ==,type:str] + - name: ENC[AES256_GCM,data:7mwuykEqbGISOa2n+pWb6INLsHYdjyf2HxTtWpAr5xP1,iv:NMcg+L2DFtBO1nhyPid31yzLr+ZX7DUGl/WxV1MnrqU=,tag:65/BiUEI8v5oMlQqpKNDRg==,type:str] + content: ENC[AES256_GCM,data:SObbA3D/sGN5/i5ps4Zz3alygIXKbSgptFjfPHlwC8G588O+gKAkvKQwU/s=,iv:PY2vLfI3gInFeQbse49KC2/zZ9O4jeXAQ0fpP84GHHE=,tag:214Mb8hIYDkQ4+UkRWtc9w==,type:str] + - name: ENC[AES256_GCM,data:bES9O6JI4wTnuZsup9gflfaozeUDkfjVGNIFn8RnZQ==,iv:98kigM3KZIN5qXNdgfLg5WLmxzAsYCjNqVzyUPco/BI=,tag:1fwEtwQ6i9QQC3OCewN0eA==,type:str] + content: ENC[AES256_GCM,data:flO3Nb4u2WfWNVhn8k5Bgo3LmsHo2cVnLCsrz8ST9Ip7gO9FY9d27FQgphM=,iv:aiDoq+41cSjwcCZRaIPLtbltkOpc7FeuNN7swPqkHXQ=,tag:OhzcY2xKKJF2jZVRseXCFg==,type:str] + - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str] + content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str] +sops: + lastmodified: "2026-05-23T21:19:38Z" + mac: ENC[AES256_GCM,data:Ded0VfGn8H2qGMk5LDyqF1gW8hajKc9FgvCynHPQkWkhMSdaHYbFwf//gWi2TjIO22HD5sPw1w9KAjPy53b57RwBCjXfMMq0JCPvuePLK40NC8uCAi+wr5Er0fAWz1JiaA+dowposoi6RxBtyHCaNHMDVGMLh1j+IL+pTOyi6fk=,iv:gssOMmR0DDQC4WjMVXTD/zqbQa8qlBr9ZZWF15W0WnE=,tag:DORTxQfCmpVjDjyGSNH7dw==,type:str] + pgp: + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxK/JaB2/SdtAQ//bbr0oza/X6GG43ay9coZbb+0aptj3pGzQqT1ND6nsI34 + iY3IZaMZIti+j/BS5kEfmRn56WZSx6EcbSrlbiyL5NZw9R4/bGRd848rOLwMvuYO + 8Usei9jHdpHiPvKBZnZXaXGU8E27L0Y/LCxSIFOXbyHzHogjz3JmtJQsYpSC+ue6 + mIRrSAJPALrqEL+DZ2bl5UYlBIRXdtIe/jL1CFCJhULt+EjJw72T62DZK/jaNZTj + eint63+IFZSxx5e5vrAeQB+p2EDsp6c5NbDrlgQWb8/J1q/G5bG4KxBs/0hum7OW + /sSsIDb4Qb8U/axt5LduV6AkMXXsclNLQU/LbFAbBRcV8Lvh11f0U3V/UnqUdmvp + efesb5VQh1x0uWjzobxaioLEV/YYbWx8binvuJ3MBHKp6E2xj7IrBTVl0MWgjEou + ZbQDF8DvxA49xEnJyOviL2/zjnV1kXy+Q+BKZga3pr8AnBHA8Ftbsvmk6CyDEM0R + i4FAUOVa9VWiszoOaqyn1Fl02YlweFmgzuFjd3wi74Tbi6RE37rN/vBKySbnRQYl + rFUU3SQlztxd4UBAXBo6gQKTz5B4rehvKVye2mmqEE9bas/lCWAKVJ7+3+0NQdA2 + lp/X7h7DRSD2Qkd35SzxkJz7P86rd0LM1aOu87psxYavEWw6vFs2ErDkSeqDn1DU + aAEJAhDb1s+jpDUa3GvVZjoiiCyutI018jfJU1vi12PGktg4KJcXBx66R/nLItO2 + ba6o66scIiAJZ+jYymW6RbJTI7XRHJp4Cs8COhpMRQeOGwEHFGGL2rpGd3KrOLQe + 0/C6EmrJvGpl + =atNE + -----END PGP MESSAGE----- + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQEMA1QflAioE8i3AQf+NkUGCBrTCkkyl+iBb6P1IWLDGqAY8s20mBZ7G3plKE/J + UrIe947letj/8EA+yoN0uzjwEkh3rDLtZrOLTSgflq1GMpdVhdaTbS71fD3kghJQ + P9tz0zDQEgXHBi+2q7iRrEETx/cu7UDNkSCNvQbWvDmo8MfbSBy+VFCknfupdQxj + 9hlq4kBA0pckPCY8V7E05nDhQntS8wpXIEO1SWiSuiGg+p4yFlvNzWNfhLyEFHxL + BZHVVIU/mzyClMajjLJWjKI1LSgHXXIa28tgdrtiBZOsF+CWveYqJlRJh9NUepJI + ZSeFNhyWmnS9ZkQu5BUyb7+oRxfq2NY51T76Xbo8gNJeAZWwyr1sj1wjubuVeNMF + aU6FiynYWr3I35JRVghTMJ93CnPl+NTpWnQuHpq1bzEGe2u8BMFhgrTu2yMD23VQ + eGien6SqfEbA/wAiz9ZaUgTQH8UyHpliteZ8/SQgkw== + =UJvq + -----END PGP MESSAGE----- + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAz5uSgHG2iMJAQ/+O5JOJfDp/BuBCuXDQVUgJagspQO6LZ/MLrl9qH282AMf + MdgN5M/WjbOv6WZDCMg4nfXps1XgzUEiaA/1m4PxHlMmxjEoQHAE51GMcxsXg+B1 + lM+8uJ1+js1sdDX4xsZtJpbVxJKIbPuhF7oM950oDlL2+UKhUbPlCoxeOihlkVGa + RqHJ/M74xkyKH281oRI5bllJaAroBnXVSFIvbCxA7ts/O7YJPKBowTIj62Kye9Ra + aHC11bPy2RlJCcFZJjPSdnXvzUMpfzEd6O72VUtMBBQZn/in7efutC8FwpRYuUW7 + vSofxUN5n6Mtb8A1XSMFD/nfXVc/pM6Cu7kdtHSwSKgbKKf6mrCeVgaM9xcG0t2W + 9yEtWvkdvOOSqz/vd1vkftbBWcCejX7bktfmD408CJAs1bjzz5CyrDoWcnYmbxFY + 6N4rhMDRMTe19VH2UQ4EvSjQjmmYCspnUW3/78zi5kU1ijyQy13UpbgwulU7tSGc + KKtBjPoy6mLIVl0YhnEJZWD/XPIRWyW+0s+7m70YXCWSVipvCelEE8oPWjf8PLaE + J85crlZGkSRcRO7yOP/YtB9ZnajgaF33zJU3ZWr0C/IXj2TeepZp/JUteD2H/LRf + 9YJzOFYDOFIWcdmaTzJLBEaefWcDjT6wkIf6TBqQRMLsu8JUwy9VwFcsi/d5aMXS + XgEQqSxYb1B39OR0sS1Xpw0/CFe4imBPuG3w0tOAyM3DbPWYY1kZYIRZenV1ZIOS + aRZJh086kuWgHYB76VoNzDK3QperWvHL/8CT2g3HuPiVGSrrXwxCYXk5+UXB9bQ= + =Xx91 + -----END PGP MESSAGE----- + fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DsZXvxFXTXoQSAQdA0rZTVdySF9nUiz7ZyFJgq1tojyLojGTgE4UIEJzFSTUw + 9y4kbGn1cWMpAqr+sE3WHV9p7v6kgm/XdUjXGN4DadpUbiYx6sQW2Jov6Km2EYhq + 0l4BawupjX25wi7c2yR5iGdxYS8oCYVmGgcAB3T96v8VsXpkAOYQAOOh7B9GQIxm + hB3cFQLCy2un3VvBsiKGFMA2FhZYBOuaEwP/KmWnPv0IPIRH4by6LDB0xgq8MUNz + =xoVE + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAgcGcZ3BT6lsJ8FxkMghxg5/PZLtIzNeJaEUbxN0EFhsw + uM+Lec3k9BJSUJK8GeVmesYxQh8vP6Yi/+m2LnGjHXzkQg8Bx1HJzuC/Ap36rC6N + 0l4Bxj1URTsRD4yILEA3TY4Dn9St9uOtodJcf5YdAKvmeb3Uwy//huNnA1eK7b+v + WRHcU2K+GgkSzLiRLZTc/nMrrCQ/P5HzwYHmP2rypFX7kxXlPd3K6yMZWTiSgYZd + =gZLQ + -----END PGP MESSAGE----- + fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxjNhCKPP69fAQ//YGOLOFtORNbOu+KFCtGcJBXQMy6Ej3/tePVuDi2vmqLD + 3Dz6stB9D+BmBbcgbFlDA+g7Vi6DD+zcze9wM10iuc9t9ucAuQ7B/ymSvJc4MrYn + MJFvQv5IYgWJmzXLYEFYYpmZPGG3hSHSgWIPs+574wEA/L867ktguW6ZD3ZuMn3E + yjCTeT/ZkGjuIpGqMu2/o9Wvc+RYgWlCB69D8kTHtnbFzbqEzvKU5/zte5ThchA+ + QZwFd/gk3o1G/7WOYJJ6CbBSOQaSrfm0mnb6sppNPdOAQtqHVSFVX5vX96gXsht/ + AkrvD6/2R5eNzbqRaU83cg7c5far49xoBbL6czreWY3D56yK4BJbrrg9mK7oCEfO + GaRDFFD7R4LJPfVx2xDoIQ3Hyp4E3dz4nyJx0Kg7NSEt7soOb5MnZ+04LLAiHbaT + qZr618V530uw3qaCsYcgHy+WsZXXlqXQey3A7jphi3u9Kvn9UjeegjNvpOrMk6g1 + RhGzv72G0wjZnzjTjPlzeROHaQ6RPgfpkZjEcVZNZkfAgAbB3XPgCFGKz4qvx9MP + 4eHIlBSJizLzSi519o+0i5PwrZdEf9L4RUVxgQgdJXMh1JaydVh5DOU+xomdStD5 + Maymkt8fSgYgDaS953YA2e04PrkXCH0EHZ62T9EMxreEoU3nYTmw/TGx7RfU+wzS + XgEuQkLWSToJ40/Ir3obDA246yv7J2FpmPwG4oFypkM5xe1WjlMlk90b9RBhUgXk + ylRXXLBzau6mtbPOa7LGdVyVs2DClWQo9BoK+dxEsnW+TR144O4UmZEfifJXvgQ= + =ympd + -----END PGP MESSAGE----- + fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA46L6MuPqfJqARAAshm2x7wX/9g3XJtSN0AnSeCwSHO1I4+ebLKOsB7zcXh8 + hrVO3694jQcU9L01H7jGYw4lNNzBd61/uVE5AvMq4Sqn9iH3MFNESbAEOWVV+TRf + 53JMg9C/aZfde8gHgHPaiVXlCBVEVY9CqHpUXUKDmEE7iRb5P4DuMxOmybDYZGzY + 4c5Ke1MFMkGRmAtsT1qLrT2vh+F0CX4JwpMkxCmOzSWAXbwrVOigJ35l5zM6vme4 + 5EQu9jI8FApTxVchZbr0v3UOKxp5OebqC0jGeznZNf4qb0qnsvuowY6IIw5Tl3/q + H4TLq5EUOVqTC1voIWY/gMjieiW1gtr6vASy4MvbswsZLc26YVE9IbHzAOUWDN2o + f2iQ3aZYuINvniD23XtM0TKepDXWq5eF+AJpmyP/LL8sYvSnWFD+muK3O657djEu + yGZs2EFTrkiUvhBq3apOOYiU0eOi4Aq6UeEbOsLENnQrBRXuHEm4KUSwzOitVwJ1 + ByxQTu7wzY727SOR2hzjMC0LI602WGpEQU7ech5L4uWqtMFwaBP9HnUamcofKqqt + 1vI2BevsJfQ0rtTE6GWseHt702lllTGe3RnHWc6YsMWLwUfRdBPggMW37hAPPcfO + ytbU3RJIxx4vImRtXhkI5yvbpFQrooz1zSeXWaitPE5jmmiKe9IRStLnfiq9E2TS + XgFVuQM8K0LgUYEoAipvafhnC3ohfGsM2AYd36EoaMNLeQ2ZZEiV06/Y3EWoI0iM + aqRLwyBvTuDOc5BK32nCbAgUbbPJjPhqWaoNp5ymCBV76oW613gApkzoUF+OIUU= + =KKaI + -----END PGP MESSAGE----- + fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DQrf1tCqiJxoSAQdA8YKD21h5POTLPf04KvGN93omFgkYO+Y8Kc0jM0vdqm8w + 3zYRaLsDjdh8Zd89/HhHJUfLrTp/IJ0n81sK0ZjznbXKxgkseGthMzof+L7BnPAp + 0l4BnAs9iZS4q2LZVS7ySBP89xLmF97qhK2jagMNSAwq8Afxbcw8oQAVQmeyYfxx + X59irIHjI1ugO4o1WnTN67nTQjU5msbVBs0eALrw3jobzFHRL67fS0a4Soa59LTY + =ZHIU + -----END PGP MESSAGE----- + fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdAN7rRlv3dMoFOfj9eHgf+0H8521b32nWqySUdriEy6Tcw + gjuReMBpKQOgUfuhIiWkHIKNtNgMrYWiC20ESOXX5b9uYZNpqHCgHQPlX0lEeGim + 0lgBOieL7mSEq4wkWLCSv4sBAmkQA+dnugBeF+TrlqKQTZsbe/Z+jNG4ZrHRvdqi + 4I5It+uaRV9Vrul1c6H7fNreRPUd4hNyJwU7gZQ+vU2WyAmgqerxE1Wb + =gplT + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+ARAAjWK8mU99VcnM/Ckzm+YsZFTwnz4PDAenDDdZ1OOz5IXe + tS4SQPcQlSSOuXEkFLJMmm8QVxtUC3Gh4nF7o+7OygT+0ZXOrB7jFgg10+v/KVA9 + hSlqBdsMxcC0OzBtkGyAOXOxqnTVubuHEGyGpIryHt1/lthUUZHBbjgw7P0Tw2/U + sYK5j5YbqhyBl20gyZorkTTq7pHfVXDVtpe75+ZkqbOg4S6HgW3/dl+v6N0TLfRs + GVl0fUlWIK/akGCB71zdwJs2I1qTeMTlL6v+XSUdXj0YV+5fjh3wf8qzN9geIjQK + ybxGFWDKCAgTMnqoFF5BCL23hFtnCbTtLN1wQT7/m7zpjaBKHOBXZOGXYZCMGZui + sBsUvPANgNdfOse9H2aABQvUQh8WqFw8S73GasvrZHAwEmvnXzocMJd+kUovzmQu + 9FBk5UkcgXfmxeamoP8C700vh4zI+sKz6uEW0+AuVtLlLVqlb2w21kTc+ArZW52n + HLolH5q3Wj6pKuuFCWKr6UgLFcq2w4QngB2p+UABHU3RbwXIra7prDXCUcNC5iCn + ElRFY7OZ3nbHOf9oaW/MitcfszVLyl0ueoay6qxdlIGdXKRGpqxHqqr+92INV/iz + 6CRoAsTqVq1a7ZuAaUdJPvfKVAHHEHjPwlrOc9cXvykG0iQKsRzgqiOtPiGQShnU + aAEJAhDSqCwywHDnQ7X9ZWIzPjwvqyHpEVez8zYh3vpgKpsLb9uL+JizZjV02HMe + nhiL+4o/aNjJgGJWph1uPFhU4wO4AavnNBsHbJSiL/1yTS96hdf8d+gB41yVLU3e + kBkDFLKkIBkU + =aRLd + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-05-23T20:58:22Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdABId/P8ozRgJ4ItF1zvxp98aH+g3LZ6UGnxjYjtDxjEIw + VmyerznjOLnpz0EobXRRoot1Lo82Va64HQmXt26LG3gFY1HVp0WOnIZXa/CUoUb8 + 1GgBCQIQloFxKcgFTiRidaJfN7hSeQLleiEe3aifZUyJj8niTmBaY29t+CSoA46N + xZzX1AlxVjfmputhYdTyOYSJtGrj7otmnUN2P+55pjz4L2qCYAEKi1+ibqgpmJh/ + bETQsT6WKJ8FXA== + =Ci7L + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/inventories/z9/host_vars/rt1.yaml b/inventories/z9/host_vars/rt1.yaml new file mode 100644 index 0000000..218f4c4 --- /dev/null +++ b/inventories/z9/host_vars/rt1.yaml @@ -0,0 +1,6 @@ +systemd_networkd__config_dir: 'resources/z9/rt1/systemd_networkd/' +systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/systemd_networkd_global_config.conf') }}" +nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/nftables/nftables.conf') }}" +ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin" +ansible_pull__timer_randomized_delay_sec: 0min +unbound_access_control: [ "10.89.208.0/20" ] diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 0c6e16d..2ef790b 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -15,6 +15,9 @@ all: yate: ansible_host: yate.ccchh.net ansible_user: chaos + rt1: + ansible_host: rt1.ccchh.net + ansible_user: chaos certbot_hosts: hosts: dooris: @@ -36,6 +39,7 @@ infrastructure_authorized_keys_hosts: light: waybackproxy: yate: + rt1: nginx_hosts: hosts: dooris: @@ -47,6 +51,12 @@ ola_hosts: proxmox_vm_template_hosts: hosts: thinkcccore0: +systemd_networkd_hosts: + hosts: + rt1: +nftables_hosts: + hosts: + rt1: alloy_hosts: hosts: light: @@ -60,3 +70,4 @@ ansible_pull_hosts: yate: secrets_hosts: hosts: + rt1: diff --git a/resources/z9/rt1/nftables/nftables.conf b/resources/z9/rt1/nftables/nftables.conf new file mode 100644 index 0000000..21bfbd1 --- /dev/null +++ b/resources/z9/rt1/nftables/nftables.conf @@ -0,0 +1,111 @@ +#!/usr/sbin/nft -f + +## Variables + +# Hosts + + +# Interfaces +define if_netwan = "netwan" +define if_netlan = "netlan" +define if_wg55_management = "wg55" +define if_netwan_400_fux_uplink = "netwan.400" +define if_netlan_51_clients = "netlan.51" +define if_netlan_52_iot = "netlan.52" +define if_netlan_53_public = "netlan.53" +define if_netlan_54_management = "netlan.54" + +# Interface Groups +define wan_ifs = { $if_netwan_400_fux_uplink } +define lan_ifs = { $if_netlan_51_clients, + $if_netlan_52_iot, + $if_netlan_53_public, + $if_netlan_54_management } +define v4_exposed_ifs = { $if_netlan_53_public } +define v6_exposed_ifs = { $if_netlan_53_public } +define v4_nat_ifs = { $if_netlan_51_clients, + $if_netlan_52_iot, + $if_netlan_54_management } + + +## Rules + +table inet reverse-path-forwarding { + chain rpf-filter { + type filter hook prerouting priority mangle + 10; policy drop; + + # Only allow packets if their source address is routed via their incoming interface. + # https://github.com/NixOS/nixpkgs/blob/d9d87c51960050e89c79e4025082ed965e770d68/nixos/modules/services/networking/firewall-nftables.nix#L100 + fib saddr . mark . iif oif exists accept + } +} + +table inet host { + chain input { + type filter hook input priority filter; policy drop; + + iifname "lo" accept comment "allow loopback" + + ct state invalid drop + ct state established,related accept + + ip protocol icmp accept + # ICMPv6 + # https://datatracker.ietf.org/doc/html/rfc4890#autoid-24 + # Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped" + # Error messages that are essential to the establishment and maintenance of communications: + icmpv6 type { destination-unreachable, packet-too-big } accept + icmpv6 type { time-exceeded } accept + icmpv6 type { parameter-problem } accept + # Connectivity checking messages: + icmpv6 type { echo-request, echo-reply } accept + # Address Configuration and Router Selection messages: + icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } accept + # Link-Local Multicast Receiver Notification messages: + icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report } accept + # SEND Certificate Path Notification messages: + icmpv6 type { 148, 149 } accept + # Multicast Router Discovery messages: + icmpv6 type { 151, 152, 153 } accept + + # Allow SSH access. + tcp dport 22 accept comment "allow ssh access" + + # Allow WireGuard access. + udp dport 51820 accept comment "allow WireGuard access" + + # Allow DHCP server access. + iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access" + } +} + +table ip v4nat { + chain prerouting { + type nat hook prerouting priority dstnat; policy accept; + } + + chain postrouting { + type nat hook postrouting priority srcnat; policy accept; + + iifname { $v4_nat_ifs, $if_wg55_management } oifname $wan_ifs masquerade + } +} + +table inet forward { + chain forward { + type filter hook forward priority filter; policy drop; + + ct state invalid drop + ct state established,related accept + + # Allow internet access. + iifname { $lan_ifs, $if_wg55_management } oifname $wan_ifs accept comment "allow internet access" + + # Allow access to exposed networks from internet. + meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access" + meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access" + + # Allow clients and managment to most + iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "allow clients and managment to lan_ifs" + } +} diff --git a/resources/z9/rt1/systemd_networkd/00-netlan.link b/resources/z9/rt1/systemd_networkd/00-netlan.link new file mode 100644 index 0000000..c2e2470 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/00-netlan.link @@ -0,0 +1,6 @@ +[Match] +MACAddress=BC:24:11:72:A3:27 +Type=ether + +[Link] +Name=netlan diff --git a/resources/z9/rt1/systemd_networkd/00-netwan.link b/resources/z9/rt1/systemd_networkd/00-netwan.link new file mode 100644 index 0000000..523e18a --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/00-netwan.link @@ -0,0 +1,6 @@ +[Match] +MACAddress=BC:24:11:CF:65:57 +Type=ether + +[Link] +Name=netwan diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.51.netdev b/resources/z9/rt1/systemd_networkd/10-netlan.51.netdev new file mode 100644 index 0000000..b951ecc --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netlan.51.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netlan.51 +Kind=vlan + +[VLAN] +Id=51 + diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.52.netdev b/resources/z9/rt1/systemd_networkd/10-netlan.52.netdev new file mode 100644 index 0000000..1f345c7 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netlan.52.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netlan.52 +Kind=vlan + +[VLAN] +Id=52 + diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.53.netdev b/resources/z9/rt1/systemd_networkd/10-netlan.53.netdev new file mode 100644 index 0000000..c6dab81 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netlan.53.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netlan.53 +Kind=vlan + +[VLAN] +Id=53 + diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.54.netdev b/resources/z9/rt1/systemd_networkd/10-netlan.54.netdev new file mode 100644 index 0000000..6271e6c --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netlan.54.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netlan.54 +Kind=vlan + +[VLAN] +Id=54 + diff --git a/resources/z9/rt1/systemd_networkd/10-netwan.400.netdev b/resources/z9/rt1/systemd_networkd/10-netwan.400.netdev new file mode 100644 index 0000000..e0b6afc --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-netwan.400.netdev @@ -0,0 +1,7 @@ +[NetDev] +Name=netwan.400 +Kind=vlan + +[VLAN] +Id=400 + diff --git a/resources/z9/rt1/systemd_networkd/10-wg55.netdev b/resources/z9/rt1/systemd_networkd/10-wg55.netdev new file mode 100644 index 0000000..b3e41a6 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/10-wg55.netdev @@ -0,0 +1,90 @@ +[NetDev] +Description=Admin-Wireguard +Kind=wireguard +Name=wg55 + +[WireGuard] +ListenPort=51820 +PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_privat_key + +# WireGuard Peers + +[WireGuardPeer] +# friendly_name = stb +AllowedIPs = 10.89.214.2/32,2a07:c481:1:37::2/128 +PublicKey = vILSL4dbaC5IaTsRhJviamV18ssxWSj+qLVyowLQ214= +PersistentKeepalive = 30 + +[WireGuardPeer] +# friendly_name = fi +AllowedIPs = 10.89.214.3/32,2a07:c481:1:37::3/128 +PublicKey = UHi/if5uW2V3+8Q3R+uk6/XpRi4fPXbw7chsKI4xlkI= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_fi_psk + +[WireGuardPeer] +# friendly_name = jtbx +AllowedIPs = 10.89.214.4/32,2a07:c481:1:37::4/128 +PublicKey = NyyEqdWgScgsnTF8Zz/Om4Lc84fdFMwVtvaCmLEkUlQ= + +[WireGuardPeer] +# friendly_name = June +AllowedIPs = 10.89.214.6/32,2a07:c481:1:37::6/128 +PublicKey = 6jAEB+f9przBGxPhuvv9U9gvZDEBQNqpQSD0BoGqXQQ= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_June_psk + +[WireGuardPeer] +# friendly_name = Max +AllowedIPs = 10.89.214.7/32,2a07:c481:1:37::7/128 +PublicKey = oC1hJjtlAgLX/CmbwTC+LPmd1uwluQTwsN8RaMNmHn0= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_Max_psk + +[WireGuardPeer] +# friendly_name = dario +AllowedIPs = 10.89.214.9/32,2a07:c481:1:37::9/128 +PublicKey = bYF2EGRGpEGjiKcasi/oaWoWeLsgqsF6FGaq3Z4ERww= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_dario_psk + +[WireGuardPeer] +# friendly_name = June-mobile +AllowedIPs = 10.89.214.11/32,2a07:c481:1:37::11/128 +PublicKey = 6edjXykegUgGjbkIG1aJyBlX1SgTKcqXXaSBVPHdKDc= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_June-mobile_psk + +[WireGuardPeer] +# friendly_name = djerun_at_ferrum.local +AllowedIPs = 10.89.214.12/32,2a07:c481:1:37::12/128 +PublicKey = aHbdkTHhPkd+o7wWfTua9nd72aF4OVp66zGtpaoD8Fg= + +[WireGuardPeer] +# friendly_name = c6ristian +AllowedIPs = 10.89.214.13/32,2a07:c481:1:37::13/128 +PublicKey = 6ndwj3Ur6AqfUPWuyPYXIaGZs2ujJKawSQ9LEvlYzEc= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_c6ristian_psk + +[WireGuardPeer] +# friendly_name = langoor +AllowedIPs = 10.89.214.14/32,2a07:c481:1:37::14/128 +PublicKey = qTnVQlQa1m4SucFFNli/xM6QWfsdWx2baRAit7Cg8RM= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_psk + +[WireGuardPeer] +# friendly_name = langoor_home +AllowedIPs = 10.89.214.15/32,2a07:c481:1:37::15/128 +PublicKey = NeMDs2+5rHuKO5ZYXVUR76GorgdesFUnDOFECQ3RzG4= +PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_home_psk + +[WireGuardPeer] +# friendly_name = lilly-lillysLaptop +AllowedIPs = 10.89.214.16/32 #,2a07:c481:1:37::/128 +PublicKey = IBsI+N8qUNpQnDc5HnqQ2Zo/1graFM0RMIecHmAF+Vk= + +[WireGuardPeer] +# friendly_name = bitwhisker +AllowedIPs = 10.89.214.17/32,2a07:c481:1:37::a/128 +PublicKey = DvEGvQPGi+IxeRTIA72Gx3WNINcrV9HRNB1v7mHnhjA= + +[WireGuardPeer] +# friendly_name = forestcat +AllowedIPs = 10.89.214.18/32,2a07:c481:1:37::b/128 +PublicKey = PdJ7KlIeASizj0WTY87d7oSi14/MebrhRa+L8YiPoQE= + diff --git a/resources/z9/rt1/systemd_networkd/20-netlan.network b/resources/z9/rt1/systemd_networkd/20-netlan.network new file mode 100644 index 0000000..3aed715 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/20-netlan.network @@ -0,0 +1,12 @@ +[Match] +Name=netlan + +[Link] +RequiredForOnline=no + +[Network] +VLAN=netwan.51 +VLAN=netwan.52 +VLAN=netwan.53 +VLAN=netwan.54 + diff --git a/resources/z9/rt1/systemd_networkd/20-netwan.network b/resources/z9/rt1/systemd_networkd/20-netwan.network new file mode 100644 index 0000000..89a8494 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/20-netwan.network @@ -0,0 +1,9 @@ +[Match] +Name=netwan + +[Link] +RequiredForOnline=no + +[Network] +VLAN=netwan.400 + diff --git a/resources/z9/rt1/systemd_networkd/20-wg55.network b/resources/z9/rt1/systemd_networkd/20-wg55.network new file mode 100644 index 0000000..750e844 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/20-wg55.network @@ -0,0 +1,6 @@ +[Match] +Name=wg55 + +[Network] +Address=10.89.214.1/24 +Address=2a07:c481:1:37::1/64 diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network b/resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network new file mode 100644 index 0000000..5e9635f --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network @@ -0,0 +1,27 @@ +[Match] +Name=netlan.51 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=clients + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=10.89.208.1/22 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:33::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network b/resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network new file mode 100644 index 0000000..5b58610 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network @@ -0,0 +1,27 @@ +[Match] +Name=netlan.52 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=IoT + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=10.89.212.1/24 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:34::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.53-public.network b/resources/z9/rt1/systemd_networkd/21-netlan.53-public.network new file mode 100644 index 0000000..f544a5b --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netlan.53-public.network @@ -0,0 +1,27 @@ +[Match] +Name=netlan.53 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=public + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=185.161.130.65/28 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:35::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.54-management.network b/resources/z9/rt1/systemd_networkd/21-netlan.54-management.network new file mode 100644 index 0000000..2396da0 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netlan.54-management.network @@ -0,0 +1,27 @@ +[Match] +Name=netlan.54 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=Management + +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=yes + +[Address] +Address=10.89.213.0/24 + +[IPv6SendRA] +UplinkInterface=netwan.400 +EmitDomains=true +Domains=ccchh.net +Managed=true + +[IPv6Prefix] +Prefix=2a07:c481:1:36::/64 +Assign=true +Token=static:::1 + diff --git a/resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network b/resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network new file mode 100644 index 0000000..1657c40 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network @@ -0,0 +1,26 @@ +[Match] +Name=netwan.400 +Type=vlan + +[Link] +RequiredForOnline=no + +[Network] +Description=fux-uplink + +DNS=185.161.128.66 +DNS=2a07:c481:0:4::2 +DNS=185.161.128.67 +DNS=2a07:c481:0:4::3 + +IPv6AcceptRA=no +# Masquerading done in nftables (nftables.conf). +IPv6SendRA=no + +[Address] +Address=185.161.129.134/25 +Address=2a07:c481::1:2/64 + +[Route] +Gateway=185.161.129.129 +Gateway=2a07:c481::1 diff --git a/resources/z9/rt1/systemd_networkd_global_config.conf b/resources/z9/rt1/systemd_networkd_global_config.conf new file mode 100644 index 0000000..2d3d8a3 --- /dev/null +++ b/resources/z9/rt1/systemd_networkd_global_config.conf @@ -0,0 +1,3 @@ +[Network] +IPv4Forwarding=true +IPv6Forwarding=true From 0986e457355435ef6386efc4e37969e7888af877 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 24 May 2026 04:01:11 +0200 Subject: [PATCH 02/38] rt1(z9 host) unbound(role) kea_dhcp(role): create unbound and kea_dhcp role for rt1 - create unbound role - create kea_dhcp role - configure unbound and keadhcp on rt1(z9 host) --- inventories/z9/host_vars/rt1.yaml | 1 + inventories/z9/hosts.yaml | 7 + playbooks/deploy.yaml | 14 + resources/z9/rt1/kea_dhcp.yaml | 293 ++++++++++++++++++ resources/z9/rt1/nftables/nftables.conf | 3 + roles/kea_dhcp/defaults/main.yaml | 69 +++++ roles/kea_dhcp/handlers/main.yml | 30 ++ roles/kea_dhcp/meta/argument_specs.yaml | 125 ++++++++ roles/kea_dhcp/tasks/install_archlinux.yml | 8 + roles/kea_dhcp/tasks/install_debian.yml | 22 ++ roles/kea_dhcp/tasks/kea.yaml | 51 +++ roles/kea_dhcp/tasks/main.yml | 19 ++ roles/kea_dhcp/tasks/stork-agent.yaml | 76 +++++ .../kea_dhcp/templates/kea-ctrl-agent.conf.j2 | 20 ++ roles/kea_dhcp/templates/kea-dhcp4.conf.jinja | 27 ++ roles/kea_dhcp/templates/kea-dhcp6.conf.jinja | 27 ++ .../kea_dhcp/templates/stork-agent.env.jinja | 44 +++ roles/unbound/README.md | 19 ++ roles/unbound/defaults/main.yml | 7 + roles/unbound/files/no-resolved.resolv.conf | 1 + roles/unbound/handlers/main.yml | 27 ++ roles/unbound/tasks/main.yml | 63 ++++ roles/unbound/tasks/prometheus-exporter.yml | 17 + roles/unbound/templates/unbound.conf.j2 | 73 +++++ 24 files changed, 1043 insertions(+) create mode 100644 resources/z9/rt1/kea_dhcp.yaml create mode 100644 roles/kea_dhcp/defaults/main.yaml create mode 100644 roles/kea_dhcp/handlers/main.yml create mode 100644 roles/kea_dhcp/meta/argument_specs.yaml create mode 100644 roles/kea_dhcp/tasks/install_archlinux.yml create mode 100644 roles/kea_dhcp/tasks/install_debian.yml create mode 100644 roles/kea_dhcp/tasks/kea.yaml create mode 100644 roles/kea_dhcp/tasks/main.yml create mode 100644 roles/kea_dhcp/tasks/stork-agent.yaml create mode 100644 roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2 create mode 100644 roles/kea_dhcp/templates/kea-dhcp4.conf.jinja create mode 100644 roles/kea_dhcp/templates/kea-dhcp6.conf.jinja create mode 100644 roles/kea_dhcp/templates/stork-agent.env.jinja create mode 100644 roles/unbound/README.md create mode 100644 roles/unbound/defaults/main.yml create mode 100644 roles/unbound/files/no-resolved.resolv.conf create mode 100644 roles/unbound/handlers/main.yml create mode 100644 roles/unbound/tasks/main.yml create mode 100644 roles/unbound/tasks/prometheus-exporter.yml create mode 100644 roles/unbound/templates/unbound.conf.j2 diff --git a/inventories/z9/host_vars/rt1.yaml b/inventories/z9/host_vars/rt1.yaml index 218f4c4..876776a 100644 --- a/inventories/z9/host_vars/rt1.yaml +++ b/inventories/z9/host_vars/rt1.yaml @@ -4,3 +4,4 @@ nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/nftables/ ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin" ansible_pull__timer_randomized_delay_sec: 0min unbound_access_control: [ "10.89.208.0/20" ] +kea_dhcp__include_vars: resources/z9/rt1/kea_dhcp.yaml diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 2ef790b..e25c822 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -57,11 +57,18 @@ systemd_networkd_hosts: nftables_hosts: hosts: rt1: +unbound_hosts: + hosts: + rt1: +kea_dhcp_hosts: + hosts: + rt1: alloy_hosts: hosts: light: yate: dooris: + rt1: ansible_pull_hosts: hosts: dooris: diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index b7ce104..54d4098 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -27,6 +27,20 @@ tags: - nftables +- name: Ensure unbound deployment on unbound_hosts + hosts: unbound_hosts + roles: + - unbound + tags: + - unbound + +- name: Ensure kea_dhcp deployment on kea_dhcp_hosts + hosts: kea_dhcp_hosts + roles: + - kea_dhcp + tags: + - kea_dhcp + - name: Ensure deployment of infrastructure authorized keys hosts: infrastructure_authorized_keys_hosts roles: diff --git a/resources/z9/rt1/kea_dhcp.yaml b/resources/z9/rt1/kea_dhcp.yaml new file mode 100644 index 0000000..d191881 --- /dev/null +++ b/resources/z9/rt1/kea_dhcp.yaml @@ -0,0 +1,293 @@ +kea_dhcp__dns_servers: + v4: + - 185.161.129.134 + v6: + - 2a07:c481::1:2 + +kea_dhcp__dhcp4: + enable: true + interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] + control-sockets: + - socket-name: /var/run/kea-dhcp4-ctrl-agent.sock + socket-type: unix + lease-database: + type: memfile + persist: true + option-data: + - name: "domain-name-servers" + code: 6 + csv-format: true + data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}" + subnets: + - id: 1 + subnet: 10.89.208.0/22 + pools: + - pool: "10.89.208.32 - 10.89.211.250" + reservations: + - ip-address: 10.89.208.11 + hostname: beamer + hw-address: "ac:87:a3:18:9e:01" + - ip-address: 10.89.208.12 + hostname: Brother-CCCHH + hw-address: "00:80:77:04:3a:55" + - ip-address: 10.89.208.13 + hostname: muzak + hw-address: "00:11:24:5f:4f:80" + - ip-address: 10.89.208.14 + hostname: Big-Room-Beamer + hw-address: "64:d2:c4:db:08:5c" + - ip-address: 10.89.208.16 + hostname: dooris + hw-address: "bc:24:11:b3:93:9c" + - ip-address: 10.89.208.17 + hostname: hmdooris-ccu + hw-address: "bc:24:11:5f:2d:b1" + - ip-address: 10.89.208.27 + hostname: cisco-slm248p + hw-address: "00:23:eb:b0:fc:3f" + - ip-address: 10.89.208.47 + hw-address: "6c:df:fb:0b:34:21" + - ip-address: 10.89.208.48 + hw-address: "6c:df:fb:0d:91:63" + - ip-address: 10.89.209.28 + hostname: hp-color + hw-address: "3c:52:82:29:21:79" + - ip-address: 10.89.209.29 + hostname: dooris-ng + hw-address: "6c:4b:90:19:21:a1" + - ip-address: 10.89.209.166 + hostname: encoder-ccchh + hw-address: "00:4e:01:a2:40:d7" + - ip-address: 10.89.209.254 + hostname: ki10 + hw-address: "dc:a6:32:a9:ff:82" + option-data: + - name: routers, + csv-format: true + data: 10.89.208.1 + - id: 2 + subnet: 10.89.212.0/24 + pools: + - pool: "10.89.212.32 - 10.89.212.250" + reservations: + - ip-address: 10.89.212.3 + hostname: prusamk3 + hw-address: "10:9c:70:2e:59:3e" + - ip-address: 10.89.212.4 + hostname: prusamk4 + hw-address: "10:9c:70:2e:6e:f0" + - ip-address: 10.89.212.11 + hostname: Ziggy + hw-address: "44:17:93:53:65:57" + - ip-address: 10.89.212.12 + hostname: legacy + hw-address: "00:15:65:a1:ed:98" + - ip-address: 10.89.212.23 + hostname: foobarpay + hw-address: "f4:f2:6d:09:a6:73" + - ip-address: 10.89.212.24 + hostname: foobackup + hw-address: "bc:24:11:20:1a:a8" + - ip-address: 10.89.212.27 + hostname: ender3v2-sonic-pad + hw-address: "fc:ee:91:00:0e:14" + - ip-address: 10.89.212.31 + hostname: octopi + hw-address: "b8:27:eb:0f:d8:09" + - ip-address: 10.89.212.32 + hostname: 433mhz-bridge + hw-address: "0c:b8:15:fe:e3:34" + - ip-address: 10.89.212.33 + hostname: wled-kueche + hw-address: "30:ae:a4:7a:8d:a0" + - ip-address: 10.89.212.34 + hostname: wled-serverschrank + hw-address: "18:fe:34:a6:64:76" + - ip-address: 10.89.212.35 + hostname: wled-couch + hw-address: "64:b7:08:40:ab:c0" + - ip-address: 10.89.212.36 + hostname: laser + hw-address: "b8:27:eb:be:38:fa" + - ip-address: 10.89.212.37 + hostname: laser-eth + hw-address: "b8:27:eb:eb:6d:af" + - ip-address: 10.89.212.42 + hostname: t-mix + hw-address: "40:a5:ef:d9:eb:93" + - ip-address: 10.89.212.86 + hostname: fritz-fon + hw-address: "00:1f:3f:c9:e5:b2" + - ip-address: 10.89.212.211 + hostname: hauptraum-esphome + hw-address: "e8:db:84:e8:18:d2" + - ip-address: 10.89.212.212 + hostname: werkstatt-esphome + hw-address: "3c:71:bf:26:42:32" + - ip-address: 10.89.212.213 + hostname: ir-bridge-beamer + hw-address: "8c:ce:4e:51:93:dd" + - ip-address: 10.89.212.215 + hostname: pi-dmx-werkstatt + hw-address: "b8:27:eb:65:e5:31" + - ip-address: 10.89.212.227 + hostname: SIP-T46S + hw-address: "80:5e:c0:09:bf:55" + - ip-address: 10.89.212.230 + hostname: SIP-T46S + hw-address: "80:5e:c0:22:33:08" + - ip-address: 10.89.212.232 + hostname: staubi + hw-address: "b8:4d:43:98:51:2b" + - ip-address: 10.89.212.233 + hostname: staubiv2 + hw-address: "70:c9:32:82:25:b2" + - ip-address: 10.89.212.234 + hostname: AtemMini + hw-address: "7c:2e:0d:13:72:a8" + - ip-address: 10.89.212.235 + hostname: okilaser + hw-address: "2c:ff:65:22:b4:63" + - ip-address: 10.89.212.236 + hw-address: "b8:27:eb:29:bd:77" + option-data: + - name: routers, + csv-format: true + data: 10.89.212.1 + - id: 3 + subnet: 10.89.213.0/24 + pools: + - pool: "10.89.213.32 - 10.89.213.250" + reservations: + - ip-address: 10.89.213.2 + hostname: sw-rack-1 + hw-address: "F0:9F:C2:10:C3:AA" + - ip-address: 10.89.213.3 + hostname: sw-rack-2-peo + hw-address: "44:d9:e7:06:69:5d" + - ip-address: 10.89.213.4 + hostname: sw-main-1 + hw-address: "a8:9c:6c:16:df:cc" + - ip-address: 10.89.213.5 + hostname: sw-main-2 + hw-address: "a8:9c:6c:16:e8:86" + - ip-address: 10.89.213.6 + hostname: sw-shop-1 + hw-address: "C0:4A:00:FB:DA:C5" + - ip-address: 10.89.213.7 + hostname: sw-shop-2-peo + hw-address: "f4:e2:c6:bf:20:ee" + - ip-address: 10.89.213.8 + hostname: sw-shop-3-peo + hw-address: "d8:b3:70:85:72:76" + - ip-address: 10.89.213.11 + hostname: pve01 + hw-address: "38:05:25:30:80:35" + - ip-address: 10.89.213.12 + hostname: pve02 + hw-address: "b8:85:84:b1:57:b6" + - ip-address: 10.89.213.13 + hostname: pve03 + hw-address: "98:fa:9b:a2:ed:e8" + - ip-address: 10.89.213.15 + hostname: pbs + hw-address: "BC:24:11:D6:2C:81" + - ip-address: 10.89.213.21 + hostname: unifi + hw-address: "BC:24:11:25:77:60" + - ip-address: 10.89.213.22 + hostname: club-assistant + hw-address: "7a:55:61:c3:a2:89" + - ip-address: 10.89.213.23 + hostname: automation + hw-address: "f2:20:75:5a:2f:8c" + - ip-address: 10.89.213.24 + hostname: yate + hw-address: "bc:24:11:73:3e:f7" + - ip-address: 10.89.213.25 + hostname: ptouch-print-server + hw-address: "bc:24:11:f2:cf:8f" + - ip-address: 10.89.213.26 + hostname: mqtt + hw-address: "bc:24:11:48:85:73" + - ip-address: 10.89.213.27 + hostname: factorio + hw-address: "bc:24:11:a3:43:7f" + - ip-address: 10.89.213.28 + hostname: light + hw-address: "72:61:ea:e6:49:e3" + - ip-address: 10.89.213.29 + hostname: homematic + hw-address: "fe:3a:42:77:3a:be" + - ip-address: 10.89.213.30 + hostname: proxmox-backup-server + hw-address: "8a:48:dd:a3:22:40" + option-data: + - name: routers, + csv-format: true + data: 10.89.213.1 + +kea_dhcp__dhcp6: + enable: true + interfaces: [ "netlan.51", "netlan.52", "netlan.54" ] + control-sockets: + - socket-name: /var/run/kea-dhcp6-ctrl-agent.sock + socket-type: unix + lease-database: + type: memfile + persist: true + option-data: + - name: "dns-servers" + code: 23 + csv-format: true + data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}" + subnets: + - id: 1 + subnet: "2a07:c481:1:33::/64" + pools: + - pool: "2a07:c481:1:33::1:1 - 2a07:c481:1:33::FFFF:FFFF" + - id: 2 + subnet: "2a07:c481:1:34::/64" + pools: + - pool: "2a07:c481:1:34::1:1 - 2a07:c481:1:34::FFFF:FFFF" + - id: 3 + subnet: "2a07:c481:1:36::/64" + pools: + - pool: "2a07:c481:1:36::1:1 - 2a07:c481:1:36::FFFF:FFFF" + reservations: + - ip-address: "2a07:c481:1:36::2" + hostname: sw-rack-1 + hw-address: "F0:9F:C2:10:C3:AA" + - ip-address: "2a07:c481:1:36::3" + hostname: sw-rack-2-peo + hw-address: "44:d9:e7:06:69:5d" + - ip-address: "2a07:c481:1:36::4" + hostname: sw-main-1 + hw-address: "a8:9c:6c:16:df:cc" + - ip-address: "2a07:c481:1:36::5" + hostname: sw-main-2 + hw-address: "a8:9c:6c:16:e8:86" + - ip-address: "2a07:c481:1:36::6" + hostname: sw-shop-1 + hw-address: "C0:4A:00:FB:DA:C5" + - ip-address: "2a07:c481:1:36::7" + hostname: sw-shop-2-peo + hw-address: "f4:e2:c6:bf:20:ee" + - ip-address: "2a07:c481:1:36::8" + hostname: sw-shop-3-peo + hw-address: "d8:b3:70:85:72:76" + - ip-address: "2a07:c481:1:36::b" + hostname: pve01 + hw-address: "38:05:25:30:80:35" + - ip-address: "2a07:c481:1:36::c" + hostname: pve02 + hw-address: "b8:85:84:b1:57:b6" + - ip-address: "2a07:c481:1:36::d" + hostname: pve03 + hw-address: "98:fa:9b:a2:ed:e8" + - ip-address: "2a07:c481:1:36::f" + hostname: pbs + hw-address: "BC:24:11:D6:2C:81" + - ip-address: "2a07:c481:1:36::14" + hostname: unifi + hw-address: "BC:24:11:25:77:60" diff --git a/resources/z9/rt1/nftables/nftables.conf b/resources/z9/rt1/nftables/nftables.conf index 21bfbd1..842ca04 100644 --- a/resources/z9/rt1/nftables/nftables.conf +++ b/resources/z9/rt1/nftables/nftables.conf @@ -76,6 +76,9 @@ table inet host { # Allow DHCP server access. iifname { $lan_ifs } udp dport 67 accept comment "allow dhcp server access" + + # Allow DNS server access from lan_ifs + iifname { $lan_ifs, $if_wg55_management } udp dport 53 accept comment "allow dns server access from lan_ifs" } } diff --git a/roles/kea_dhcp/defaults/main.yaml b/roles/kea_dhcp/defaults/main.yaml new file mode 100644 index 0000000..409f0a1 --- /dev/null +++ b/roles/kea_dhcp/defaults/main.yaml @@ -0,0 +1,69 @@ +kea_dhcp__stork_agent: + enable: false + prometheus_only: true +kea_dhcp__version_repo: "kea-3-0" +kea_dhcp__dns_servers: + v6: + - "2a07:c481:0:4::2" + - "2a07:c481:0:4::3" + v4: + - "185.161.128.66" + - "185.161.128.67" +kea_dhcp__include_vars: + +kea_dhcp__dhcp4: + enable: false + interfaces: [ ] + control-sockets: + - socket-name: /var/run/kea-dhcp4-ctrl-agent.sock + socket-type: unix + lease-database: + type: memfile + persist: true + option-data: + - name: "domain-name-servers" + code: 6 + csv-format: true + data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}" + subnets: + - id: 0 + subnet: nil + pools: + - pool: nil + reservations: + - ip-address: nil + hostname: beispiel.test + hw-address: "00:11:22:33:44:55" + option-data: + - name: nil, + code: nil, + csv-format: true + data: nil +kea_dhcp__dhcp6: + enable: false + interfaces: [ ] + lease-database: + type: memfile + persist: true + control-sockets: + - socket-name: /var/run/kea-dhcp6-ctrl-agent.sock + socket-type: unix + option-data: + - name: "dns-servers" + code: 23 + csv-format: true + data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}" + subnets: + - id: 0 + subnet: nil + pools: + - pool: nil + reservations: + - ip-address: nil + hostname: beispiel.test + hw-address: "00:11:22:33:44:55" + option-data: + - name: nil, + code: nil, + csv-format: true + data: nil diff --git a/roles/kea_dhcp/handlers/main.yml b/roles/kea_dhcp/handlers/main.yml new file mode 100644 index 0000000..5b44d6e --- /dev/null +++ b/roles/kea_dhcp/handlers/main.yml @@ -0,0 +1,30 @@ +--- +- name: Systemd.daemon_reload + become: true + ansible.builtin.systemd_service: + daemon_reload: true + +- name: Kea_dhcp4.reloaded + ansible.builtin.service: + name: kea-dhcp4 + state: restarted + enabled: true + +- name: Kea_dhcp6.reloaded + ansible.builtin.service: + name: kea-dhcp6 + state: restarted + enabled: true + +- name: Kea_ctrl.reloaded + ansible.builtin.systemd: + name: kea-ctrl-agent + state: restarted + enabled: true + +- name: Stork_agent.restarted + become: true + ansible.builtin.systemd: + name: isc-stork-agent + state: restarted + enabled: true diff --git a/roles/kea_dhcp/meta/argument_specs.yaml b/roles/kea_dhcp/meta/argument_specs.yaml new file mode 100644 index 0000000..995b838 --- /dev/null +++ b/roles/kea_dhcp/meta/argument_specs.yaml @@ -0,0 +1,125 @@ +--- +argument_specs: + main: + short_description: "Role for managing Kea DHCP server" + options: + kea_dhcp__stork_agent: + type: "dict" + description: "Configuration for Stork Agent" + options: + enable: + type: "bool" + default: false + prometheus_only: + type: "bool" + default: true + kea_dhcp__version_repo: + type: "str" + description: "Version of Kea DHCP repository to use" + default: "kea-3-0" + kea_dhcp__dns_servers: + type: "dict" + description: "Default DNS servers for DHCP clients" + options: + v6: + type: "list" + elements: "str" + v4: + type: "list" + elements: "str" + kea_dhcp__dhcp4: + type: "dict" + description: "Configuration for DHCPv4 service" + options: + enable: + type: "bool" + default: false + interfaces: + type: "list" + elements: "str" + default: [] + control-sockets: + type: "list" + elements: "dict" + lease-database: + type: "dict" + option-data: + type: "list" + elements: "dict" + subnets: + type: "list" + elements: "dict" + options: + id: + type: "int" + subnet: + type: "str" + pools: + type: "list" + elements: "dict" + options: + pool: + type: "str" + reservations: + type: "list" + elements: "dict" + options: + ip-address: + type: "str" + hostname: + type: "str" + hw-address: + type: "str" + duid: + type: "str" + option-data: + type: "list" + elements: "dict" + kea_dhcp__dhcp6: + type: "dict" + description: "Configuration for DHCPv6 service" + options: + enable: + type: "bool" + default: false + interfaces: + type: "list" + elements: "str" + default: [] + control-sockets: + type: "list" + elements: "dict" + lease-database: + type: "dict" + option-data: + type: "list" + elements: "dict" + subnets: + type: "list" + elements: "dict" + options: + id: + type: "int" + subnet: + type: "str" + pools: + type: "list" + elements: "dict" + options: + pool: + type: "str" + reservations: + type: "list" + elements: "dict" + options: + ip-address: + type: "str" + hostname: + type: "str" + hw-address: + type: "str" + duid: + type: "str" + option-data: + type: "list" + elements: "dict" diff --git a/roles/kea_dhcp/tasks/install_archlinux.yml b/roles/kea_dhcp/tasks/install_archlinux.yml new file mode 100644 index 0000000..7bdb140 --- /dev/null +++ b/roles/kea_dhcp/tasks/install_archlinux.yml @@ -0,0 +1,8 @@ +--- +- name: Install Kea on Archlinux + when: ansible_facts['distribution'] == "Archlinux" + become: true + community.general.pacman: + name: kea + state: present + update_cache: false diff --git a/roles/kea_dhcp/tasks/install_debian.yml b/roles/kea_dhcp/tasks/install_debian.yml new file mode 100644 index 0000000..2ac2346 --- /dev/null +++ b/roles/kea_dhcp/tasks/install_debian.yml @@ -0,0 +1,22 @@ +--- +- name: Register isc-kea apt repository + become: true + register: kea_dhcp_repo + when: ansible_facts['distribution'] == "Debian" + ansible.builtin.deb822_repository: + name: "isc-{{ kea_dhcp__version_repo }}" + uris: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/deb/debian" + suites: any-version + components: main + signed_by: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/gpg.key" + +- name: Install Kea packages + become: true + when: ansible_facts['distribution'] == "Debian" + ansible.builtin.apt: + name: + - isc-kea-dhcp4 + - isc-kea-dhcp6 + - isc-kea-ctrl-agent + - isc-kea-admin + update_cache: "{{ kea_dhcp_install_repo.changed }}" diff --git a/roles/kea_dhcp/tasks/kea.yaml b/roles/kea_dhcp/tasks/kea.yaml new file mode 100644 index 0000000..a4fd3b5 --- /dev/null +++ b/roles/kea_dhcp/tasks/kea.yaml @@ -0,0 +1,51 @@ +--- +- name: Include config vars + tags: [ kea, include_vars ] + when: kea_dhcp__include_vars is not None + ansible.builtin.include_vars: + file: "{{ kea_dhcp__include_vars }}" + +- name: Deploy kea-dhcp4 configuration file + tags: [ kea, dhcp4 ] + become: true + when: kea_dhcp__dhcp4.enable + ansible.builtin.template: + src: kea-dhcp4.conf.jinja + dest: /etc/kea/kea-dhcp4.conf + backup: true + owner: root + group: kea + mode: "u=rw,g=r,o=" + validate: kea-dhcp4 -T %s + notify: + - Kea_dhcp4.reloaded + +- name: Deploy kea-dhcp6 configuration file + tags: [ kea, dhcp6 ] + become: true + when: kea_dhcp__dhcp6.enable + ansible.builtin.template: + src: kea-dhcp6.conf.jinja + dest: /etc/kea/kea-dhcp6.conf + backup: true + owner: root + group: kea + mode: "u=rw,g=r,o=" + validate: kea-dhcp6 -T %s + notify: + - Kea_dhcp6.reloaded + +- name: Copy kea-ctrl-agent configuration file + tags: [ kea, ctrl-agent ] + become: true + when: kea_dhcp__stork_agent.enable + ansible.builtin.template: + src: kea-ctrl-agent.conf.j2 + dest: /etc/kea/kea-ctrl-agent.conf + owner: root + group: kea + mode: "u=rw,g=r,o=" + validate: kea-ctrl-agent -t %s + notify: + - Kea_ctrl.reloaded + - Stork_agent.restarted diff --git a/roles/kea_dhcp/tasks/main.yml b/roles/kea_dhcp/tasks/main.yml new file mode 100644 index 0000000..a3478fa --- /dev/null +++ b/roles/kea_dhcp/tasks/main.yml @@ -0,0 +1,19 @@ +--- +- name: Setup Kea DHCP + tags: [kea, dhcp] + block: + - name: Install Kea on Archlinux + when: ansible_facts['distribution'] == "Archlinux" + ansible.builtin.import_tasks: install_archlinux.yml + + - name: Install Kea on Debian + when: ansible_facts['distribution'] == "Debian" + ansible.builtin.import_tasks: install_debian.yml + + - name: Configure Kea + ansible.builtin.include_tasks: kea.yaml + +- name: Run stork-agent tasks + tags: [stork-agent, monitoring] + when: kea_dhcp__stork_agent.enable + ansible.builtin.include_tasks: stork-agent.yaml diff --git a/roles/kea_dhcp/tasks/stork-agent.yaml b/roles/kea_dhcp/tasks/stork-agent.yaml new file mode 100644 index 0000000..916760c --- /dev/null +++ b/roles/kea_dhcp/tasks/stork-agent.yaml @@ -0,0 +1,76 @@ +--- +- name: Install stork-agent + tags: [stork-agent] + block: + - name: Install stork-agent on Archlinux + when: ansible_facts['distribution'] == "Archlinux" + tags: [stork-agent, archlinux] + block: + - name: Create stork-agent user + ansible.builtin.user: + name: stork-agent + create_home: false + home: "/var/lib/stork-agent" + shell: "/usr/bin/nologin" + system: true + groups: ["kea"] + append: true + + - name: Install stork-agent with aur_pkg_install + ansible.builtin.include_role: + name: aur_pkg_install + vars: + aur_pkg_install__pkg_name: "stork-agent" + aur_pkg_install__git_clone_url: "https://ansible:{{ secret__ansible_git_token }}@git.fux-eg.net/aur-mirror/stork-agent.git" + aur_pkg_install__git_ref: "bf96e34" + + - name: Install stork-agent on Debian + when: ansible_facts['distribution'] == "Debian" + tags: [stork-agent, debian] + block: + - name: Register isc-stork apt repository + become: true + register: "kea_dhcp_install_repo" + ansible.builtin.deb822_repository: + name: isc-stork + uris: https://dl.cloudsmith.io/public/isc/stork/deb/debian + suites: any-version + components: main + signed_by: https://dl.cloudsmith.io/public/isc/stork/gpg.key + + - name: Install isc-stork-agent + become: true + ansible.builtin.apt: + name: isc-stork-agent + update_cache: "{{ kea_dhcp_install_repo.changed }}" + + - name: Add stork-agent user to _kea group on Debian + when: ansible_facts['distribution'] == "Debian" + become: true + ansible.builtin.user: + name: stork-agent + groups: ["_kea"] + append: true + + - name: Config for stork-agent + ansible.builtin.template: + src: stork-agent.env.jinja + dest: /etc/stork/agent.env + owner: root + group: root + mode: "0660" + notify: + - Systemd_daemon_reload + - Stork_agent.restarted + + - name: Flush handlers + ansible.builtin.meta: flush_handlers + + - name: Ensure that stork kea exporter is working + ansible.builtin.uri: + url: "http://localhost:9547/metrics" + method: GET + register: kea_dhcp_stork_status_code + retries: 6 + delay: 5 + until: kea_dhcp_stork_status_code.status == 200 diff --git a/roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2 b/roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2 new file mode 100644 index 0000000..5ac1473 --- /dev/null +++ b/roles/kea_dhcp/templates/kea-ctrl-agent.conf.j2 @@ -0,0 +1,20 @@ +{ +"Control-agent": { + "http-host": "127.0.0.1", + "http-port": 8000, + "control-sockets": { + {% if kea_dhcp__dhcp4.enable | default(false) %} + "dhcp4": { + "socket-type": "{{ kea_dhcp__dhcp4['control-sockets'][0]['socket-type'] }}", + "socket-name": "{{ kea_dhcp__dhcp4['control-sockets'][0]['socket-name'] }}" + }{% if kea_dhcp__dhcp6.enable %},{% endif %} + {% endif %} + {% if kea_dhcp__dhcp6.enable | default(false) %} + "dhcp6": { + "socket-type": "{{ kea_dhcp__dhcp6['control-sockets'][0]['socket-type'] }}", + "socket-name": "{{ kea_dhcp__dhcp6['control-sockets'][0]['socket-name'] }}" + }, + {% endif %} + } +} +} diff --git a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja new file mode 100644 index 0000000..78f06ae --- /dev/null +++ b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja @@ -0,0 +1,27 @@ +{ + "Dhcp4": { + "interfaces-config": { + "interfaces": {{ kea_dhcp__dhcp4.interfaces | to_nice_json }} + }, + "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json }}, + "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json }}, + {% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %} + "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json }}, + {% endif %} + "subnet4": [ + {% for subnet in kea_dhcp__dhcp4.subnets %} + { + "id": {{ subnet.id }}, + "subnet": "{{ subnet.subnet }}", + "pools": {{ subnet.pools | to_nice_json }}, + {% if subnet.reservations is defined and subnet.reservations %} + "reservations": {{ subnet.reservations | to_nice_json }}, + {% endif %} + {% if subnet['option-data'] is defined and subnet['option-data'] %} + "option-data": {{ subnet['option-data'] | to_nice_json }} + {% endif %} + }{% if not loop.last %},{% endif %} + {% endfor %} + ] + } +} diff --git a/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja b/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja new file mode 100644 index 0000000..da1929a --- /dev/null +++ b/roles/kea_dhcp/templates/kea-dhcp6.conf.jinja @@ -0,0 +1,27 @@ +{ + "Dhcp6": { + "interfaces-config": { + "interfaces": {{ kea_dhcp__dhcp6.interfaces | to_nice_json }} + }, + "control-sockets": {{ kea_dhcp__dhcp6['control-sockets'] | to_nice_json }}, + "lease-database": {{ kea_dhcp__dhcp6['lease-database'] | to_nice_json }}, + {% if kea_dhcp__dhcp6['option-data'] is defined and kea_dhcp__dhcp6['option-data'] %} + "option-data": {{ kea_dhcp__dhcp6['option-data'] | to_nice_json }}, + {% endif %} + "subnet6": [ + {% for subnet in kea_dhcp__dhcp6.subnets %} + { + "id": {{ subnet.id }}, + "subnet": "{{ subnet.subnet }}", + "pools": {{ subnet.pools | to_nice_json }}, + {% if subnet.reservations is defined and subnet.reservations %} + "reservations": {{ subnet.reservations | to_nice_json }}, + {% endif %} + {% if subnet['option-data'] is defined and subnet['option-data'] %} + "option-data": {{ subnet['option-data'] | to_nice_json }} + {% endif %} + }{% if not loop.last %},{% endif %} + {% endfor %} + ] + } +} diff --git a/roles/kea_dhcp/templates/stork-agent.env.jinja b/roles/kea_dhcp/templates/stork-agent.env.jinja new file mode 100644 index 0000000..bdfa4d2 --- /dev/null +++ b/roles/kea_dhcp/templates/stork-agent.env.jinja @@ -0,0 +1,44 @@ +### the IP or hostname to listen on for incoming Stork server connections +# STORK_AGENT_HOST= + +### the TCP port to listen on for incoming Stork server connections +# STORK_AGENT_PORT=8081 + +### listen for commands from the Stork server only, but not for Prometheus requests +# STORK_AGENT_LISTEN_STORK_ONLY=true + +{% if kea_dhcp__stork_agent.prometheus_only %} +### listen for Prometheus requests only, but not for commands from the Stork server +STORK_AGENT_LISTEN_PROMETHEUS_ONLY=true +{% endif %} + +### settings for exporting stats to Prometheus +### the IP or hostname on which the agent exports Kea statistics to Prometheus +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS= +### the port on which the agent exports Kea statistics to Prometheus +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT= +## enable or disable collecting per-subnet stats from Kea +# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PER_SUBNET_STATS=true +### the IP or hostname on which the agent exports BIND 9 statistics to Prometheus +# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_ADDRESS= +### the port on which the agent exports BIND 9 statistics to Prometheus +# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_PORT= + +### Stork Server URL used by the agent to send REST commands to the server during agent registration +# STORK_AGENT_SERVER_URL= + +### skip TLS certificate verification when the Stork Agent connects +### to Kea over TLS and Kea uses self-signed certificates +# STORK_AGENT_SKIP_TLS_CERT_VERIFICATION=true + + +### Logging parameters + +### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR +STORK_LOG_LEVEL=DEBUG +### disable output colorization +# CLICOLOR=false + +### path to the hook directory +# STORK_AGENT_HOOK_DIRECTORY= + diff --git a/roles/unbound/README.md b/roles/unbound/README.md new file mode 100644 index 0000000..806b9d8 --- /dev/null +++ b/roles/unbound/README.md @@ -0,0 +1,19 @@ +# Unbound DNS resolver + +Role fora a validating, recursive, caching DNS resolver based on [Unbound](https://nlnetlabs.nl/projects/unbound/about/). +It is designed to be fast and lean and incorporates modern features based on open standards. + +- [Documentation](https://unbound.docs.nlnetlabs.nl/en/latest/) + +## Role Customization + +The following variables can be used to customize this role: + +| Variable | Type | Default | Description | +|------------------------------------------|-----------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| unbound_install_prometheus_exporter | Boolean | `true` | Whether [Unbound Exporter](https://github.com/letsencrypt/unbound_exporter) should also be installed to expose resolver statistics in prometheus format. | +| unbound_bind_interfaces | List of Strings | `[0.0.0.0, ::]` | List of interface names or IP addresses on which unbound will listen for dns queries | +| unbound_enable_unbound_control | Boolean | `true` | Whether the [remote control](https://unbound.docs.nlnetlabs.nl/en/latest/getting-started/configuration.html#set-up-remote-control) feature of unbound should be configured. | +| unbound_enable_dnssec | Boolean | `true` | Whether dnssec validation should be enabled | +| unbound_access_control | List of Strings | `[]` | **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E) | +| unbound_disable_systemd_networkd | Boolean | `true` | If true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. | diff --git a/roles/unbound/defaults/main.yml b/roles/unbound/defaults/main.yml new file mode 100644 index 0000000..fa6cb24 --- /dev/null +++ b/roles/unbound/defaults/main.yml @@ -0,0 +1,7 @@ +unbound_install_prometheus_exporter: true +unbound_bind_interfaces: [ "0.0.0.0", "::" ] +unbound_disable_systemd_networkd: true +unbound_enable_unbound_control: true +unbound_enable_dnssec: true +unbound_access_control: [ ] +unbound_private_domain: [ ] diff --git a/roles/unbound/files/no-resolved.resolv.conf b/roles/unbound/files/no-resolved.resolv.conf new file mode 100644 index 0000000..bbc8559 --- /dev/null +++ b/roles/unbound/files/no-resolved.resolv.conf @@ -0,0 +1 @@ +nameserver 127.0.0.1 diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml new file mode 100644 index 0000000..e1345bf --- /dev/null +++ b/roles/unbound/handlers/main.yml @@ -0,0 +1,27 @@ +- name: unbound.restarted + tags: [ unbound, dns, dns_resolver ] + become: true + ansible.builtin.systemd: + name: unbound.service + state: restarted + +- name: unbound.reloaded + tags: [ unbound, dns, dns_resolver ] + become: true + ansible.builtin.systemd: + name: unbound.service + state: reloaded + +- name: prometheus-unbound-exporter.restarted + become: true + ansible.builtin.systemd: + name: prometheus-unbound-exporter.service + state: restarted + enabled: true + +- name: prometheus-unbound-exporter.enabled + become: true + ansible.builtin.systemd: + name: prometheus-unbound-exporter.service + enabled: true + daemon_reload: true diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml new file mode 100644 index 0000000..7ed42cb --- /dev/null +++ b/roles/unbound/tasks/main.yml @@ -0,0 +1,63 @@ +- name: unbound role main + tags: [ unbound, dns, dns_resolver ] + block: + + - name: install unbound dns resolver + become: true + ansible.builtin.package: + name: unbound + + - name: install extra dns tooling + become: true + ansible.builtin.package: + name: [ bind ] # the bind package includes tools like dig in archlinux + + - name: ensure correct directory permissions + become: true + ansible.builtin.file: + path: /etc/unbound + state: directory + mode: u=rwX,g=rX,o=rX + recurse: true + owner: unbound + group: unbound + + - name: configure unbound dns resolver + become: true + notify: unbound.restarted + ansible.builtin.template: + src: unbound.conf.j2 + dest: /etc/unbound/unbound.conf + owner: unbound + group: unbound + mode: u=rw,g=r,o=r + + - name: ensure unbound is running and enabled + become: true + ansible.builtin.systemd: + name: unbound.service + state: started + enabled: true + + - name: disable systemd-resolved + become: true + when: unbound_disable_systemd_networkd + ansible.builtin.systemd: + name: systemd-resolved.service + state: stopped + enabled: false + + - name: configure system resolver to point to local unbound + become: true + when: unbound_disable_systemd_networkd + ansible.builtin.copy: + src: no-resolved.resolv.conf + dest: /etc/resolv.conf + owner: unbound + group: unbound + mode: u=rw,g=r,o=r + + + - name: install and configure prometheus-exporter for unbound + ansible.builtin.import_tasks: prometheus-exporter.yml + when: unbound_install_prometheus_exporter diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml new file mode 100644 index 0000000..d05b838 --- /dev/null +++ b/roles/unbound/tasks/prometheus-exporter.yml @@ -0,0 +1,17 @@ +--- +- name: install unbound prometheus exporter + become: true + ansible.builtin.package: + name: prometheus-unbound-exporter + notify: prometheus-unbound-exporter.enabled + +- name: configure unbound exporter + become: true + ansible.builtin.copy: + dest: /etc/conf.d/prometheus-unbound-exporter + content: | + UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound-control.sock" + owner: root + group: root + mode: '0660' + notify: prometheus-unbound-exporter.restarted diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2 new file mode 100644 index 0000000..a1e310e --- /dev/null +++ b/roles/unbound/templates/unbound.conf.j2 @@ -0,0 +1,73 @@ +# ref: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html +# unbound.conf(5) man page +server: + {% if unbound_enable_dnssec -%} + # disable chroot because unbound is the only thing running on the VM + # and because it has issues with how archlinux configures the systemd units write protection regarding the anchor file + chroot: "" + + # location of the trust anchor file that enables DNSSEC + # this file is generated by the `unbound-anchor` command + auto-trust-anchor-file: "/etc/unbound/trusted-key.key" + {% endif -%} + + # use all CPUs + num-threads: 2 + + # more cache memory + rrset-cache-size: 60m + msg-cache-size: 30m + + # prefetch to keep the cache up to date + prefetch: yes + + # fetch the DNSKEYs earlier in the validation process, when a DS record is encountered + prefetch-key: yes + + # Faster UDP with multithreading (only on Linux). + so-reuseport: yes + + # disable special large send buffer handling and just use kernel defaults + so-sndbuf: 0 + + # send minimal amount of information to upstream servers to enhance privacy + qname-minimisation: yes + + # specify the interface to answer queries from by ip-address. + {% for i in unbound_bind_interfaces -%} + interface: "{{ i }}" + {% endfor %} + + # addresses from the IP range that are allowed to connect to the resolver + {% for i in unbound_access_control -%} + access-control: {{ i }} + {% endfor -%} + + {% for i in unbound_private_domain -%} + private-domain: {{ i }} + {% endfor -%} + + # The number of seconds between printing statistics to the log for every thread. + statistics-interval: 0 + + # Extended statistics are printed, Keeping track of more statistics takes time. + extended-statistics: yes + +remote-control: + control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} + control-interface: /run/unbound-control.sock + + +# configure some zones for which this resolver will act authoritatively +# https://www.dns.icann.org/services/axfr/ +{% for i in [ ".", "in-addr.arpa.", "arpa.", "root-servers.net.", "ip6.arpa.", "ip6-servers.arpa.", "mcast.net." ] %} +auth-zone: + name: "{{ i }}" + primary: "lax.xfr.dns.icann.org" + primary: "iad.xfr.dns.icann.org" + fallback-enabled: yes + for-downstream: no + for-upstream: yes + + +{% endfor %} From ffe6d5c07a2ea0a4ac2479bccf80b93b76d66a10 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 18:31:05 +0200 Subject: [PATCH 03/38] z9-router(host): rename rt1 to z9-router --- .../{rt1.sops.yaml => z9-router.sops.yaml} | 8 ++++---- .../z9/host_vars/{rt1.yaml => z9-router.yaml} | 8 ++++---- inventories/z9/hosts.yaml | 18 +++++++++--------- resources/z9/{rt1 => z9-router}/kea_dhcp.yaml | 0 .../{rt1 => z9-router}/nftables/nftables.conf | 0 .../systemd_networkd/00-netlan.link | 0 .../systemd_networkd/00-netwan.link | 0 .../systemd_networkd/10-netlan.51.netdev | 0 .../systemd_networkd/10-netlan.52.netdev | 0 .../systemd_networkd/10-netlan.53.netdev | 0 .../systemd_networkd/10-netlan.54.netdev | 0 .../systemd_networkd/10-netwan.400.netdev | 0 .../systemd_networkd/10-wg55.netdev | 0 .../systemd_networkd/20-netlan.network | 0 .../systemd_networkd/20-netwan.network | 0 .../systemd_networkd/20-wg55.network | 0 .../21-netlan.51-clients.network | 0 .../systemd_networkd/21-netlan.52-iot.network | 0 .../21-netlan.53-public.network | 0 .../21-netlan.54-management.network | 0 .../21-netwan.400-fux_uplink.network | 0 .../systemd_networkd_global_config.conf | 0 22 files changed, 17 insertions(+), 17 deletions(-) rename inventories/z9/host_vars/{rt1.sops.yaml => z9-router.sops.yaml} (94%) rename inventories/z9/host_vars/{rt1.yaml => z9-router.yaml} (53%) rename resources/z9/{rt1 => z9-router}/kea_dhcp.yaml (100%) rename resources/z9/{rt1 => z9-router}/nftables/nftables.conf (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/00-netlan.link (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/00-netwan.link (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netlan.51.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netlan.52.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netlan.53.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netlan.54.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-netwan.400.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/10-wg55.netdev (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/20-netlan.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/20-netwan.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/20-wg55.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netlan.51-clients.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netlan.52-iot.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netlan.53-public.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netlan.54-management.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd/21-netwan.400-fux_uplink.network (100%) rename resources/z9/{rt1 => z9-router}/systemd_networkd_global_config.conf (100%) diff --git a/inventories/z9/host_vars/rt1.sops.yaml b/inventories/z9/host_vars/z9-router.sops.yaml similarity index 94% rename from inventories/z9/host_vars/rt1.sops.yaml rename to inventories/z9/host_vars/z9-router.sops.yaml index f4141fd..89f18e1 100644 --- a/inventories/z9/host_vars/rt1.sops.yaml +++ b/inventories/z9/host_vars/z9-router.sops.yaml @@ -1,8 +1,8 @@ secrets__secrets: - - name: ENC[AES256_GCM,data:MmqDXUKy+U67JZFmKJTGLYAJcYPClQ8M2w==,iv:/eDx++bJCzdKXYB8YipB/GB6aM421JR3sy8i5trBKxk=,tag:/zTklys9bN839iT1qOH0UQ==,type:str] + - name: ENC[AES256_GCM,data:gt9BarzsfE/GJ5gQeelgePquW6KAgE3Exv4=,iv:IPpUQI+zkf8O+ej+ZxLFyWUOrxGGlZvmDRG0ut2cNsA=,tag:GP66MvcKyCqyKV814+uMYg==,type:str] content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str] - name: ENC[AES256_GCM,data:9i4hZU7Hv/IMlI/1oYthx8g57nrst9LHZQk=,iv:IQanD/CA64A+hVyTQBiTvWdXyY8qNF9BpehWZxI5a9c=,tag:RiY0OJe2xbFPG6wfe5XjiA==,type:str] - content: ENC[AES256_GCM,data:lrwHaNvHkh5E94ziiQsd8ua9YvuwmhZ6iIGZS0oFnZdYKuyNh7egWOoii2o=,iv:LLRKhbiJl1GwK/SfqNdNrrJuDF17YXw3hHmuhlyI87w=,tag:DbR/a7jfy1+4yswSdYfOFA==,type:str] + content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str] - name: ENC[AES256_GCM,data:2lJUcDJ7ECJ1bF4Fg1VwOR2tBIQ77ZvDAbFF8w==,iv:HrPWIetjN/lOyQ7Mvk0sM1w+bWldlNfWhvw7/sfqKN8=,tag:AJL0s+f0O/yR4G3RVd1IHQ==,type:str] content: ENC[AES256_GCM,data:68GUwG1Q2s2jH92HS0FQWrcMHJP8fHjrOqr21gsdswxKekQrpxX5B3BBFfM=,iv:HOsNUAKE5rOmKgZft2JK1NnZUuhk261d9WYWJS22nLM=,tag:3husFvB57AGVFzF7hKzLpw==,type:str] - name: ENC[AES256_GCM,data:ESxpEp9k9BdD1GJv+af+U3ny0+RPuaJjWDhQ,iv:DxsZLiDF8F+ixepbUdlitMJ7DLHjGNFNuxRwLl7efo8=,tag:STnv/oLzbchdiwXfKP3fow==,type:str] @@ -18,8 +18,8 @@ secrets__secrets: - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str] content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str] sops: - lastmodified: "2026-05-23T21:19:38Z" - mac: ENC[AES256_GCM,data:Ded0VfGn8H2qGMk5LDyqF1gW8hajKc9FgvCynHPQkWkhMSdaHYbFwf//gWi2TjIO22HD5sPw1w9KAjPy53b57RwBCjXfMMq0JCPvuePLK40NC8uCAi+wr5Er0fAWz1JiaA+dowposoi6RxBtyHCaNHMDVGMLh1j+IL+pTOyi6fk=,iv:gssOMmR0DDQC4WjMVXTD/zqbQa8qlBr9ZZWF15W0WnE=,tag:DORTxQfCmpVjDjyGSNH7dw==,type:str] + lastmodified: "2026-05-25T16:29:22Z" + mac: ENC[AES256_GCM,data:zxtV1xgjQuKNMvh6S8oAOxX5J6+iBRO6k3vGw3vWNlhah4Gu3S/lt+5v8lQHogz1Vyc+Zff0yMj1cn6RstDDj5AuOCljRQN0FYs0fjCo4Yrxx5sMMwcwBYquC77skEiZhRnqdXKkjiOM7EGE8qj8O3DJ29borIjm5NAsflH/qkA=,iv:7EUElg+gu8mk2Gq32JQMTf+A1+ZhZufoqt5bk4+Ca1E=,tag:XG+F/zlXizsc2B8THoXj4g==,type:str] pgp: - created_at: "2026-05-23T20:58:22Z" enc: |- diff --git a/inventories/z9/host_vars/rt1.yaml b/inventories/z9/host_vars/z9-router.yaml similarity index 53% rename from inventories/z9/host_vars/rt1.yaml rename to inventories/z9/host_vars/z9-router.yaml index 876776a..c9d2b6f 100644 --- a/inventories/z9/host_vars/rt1.yaml +++ b/inventories/z9/host_vars/z9-router.yaml @@ -1,7 +1,7 @@ -systemd_networkd__config_dir: 'resources/z9/rt1/systemd_networkd/' -systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/systemd_networkd_global_config.conf') }}" -nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/rt1/nftables/nftables.conf') }}" +systemd_networkd__config_dir: 'resources/z9/z9-router/systemd_networkd/' +systemd_networkd__global_config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/systemd_networkd_global_config.conf') }}" +nftables__config: "{{ lookup('ansible.builtin.file', 'resources/z9/z9-router/nftables/nftables.conf') }}" ansible_pull__timer_on_calendar: "*-*-* 04:00:00 Europe/Berlin" ansible_pull__timer_randomized_delay_sec: 0min unbound_access_control: [ "10.89.208.0/20" ] -kea_dhcp__include_vars: resources/z9/rt1/kea_dhcp.yaml +kea_dhcp__include_vars: resources/z9/z9-router/kea_dhcp.yaml diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index e25c822..47dbec7 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -15,8 +15,8 @@ all: yate: ansible_host: yate.ccchh.net ansible_user: chaos - rt1: - ansible_host: rt1.ccchh.net + z9-router: + ansible_host: z9-router.ccchh.net ansible_user: chaos certbot_hosts: hosts: @@ -39,7 +39,7 @@ infrastructure_authorized_keys_hosts: light: waybackproxy: yate: - rt1: + z9-router: nginx_hosts: hosts: dooris: @@ -53,22 +53,22 @@ proxmox_vm_template_hosts: thinkcccore0: systemd_networkd_hosts: hosts: - rt1: + z9-router: nftables_hosts: hosts: - rt1: + z9-router: unbound_hosts: hosts: - rt1: + z9-router: kea_dhcp_hosts: hosts: - rt1: + z9-router: alloy_hosts: hosts: light: yate: dooris: - rt1: + z9-router: ansible_pull_hosts: hosts: dooris: @@ -77,4 +77,4 @@ ansible_pull_hosts: yate: secrets_hosts: hosts: - rt1: + z9-router: diff --git a/resources/z9/rt1/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml similarity index 100% rename from resources/z9/rt1/kea_dhcp.yaml rename to resources/z9/z9-router/kea_dhcp.yaml diff --git a/resources/z9/rt1/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf similarity index 100% rename from resources/z9/rt1/nftables/nftables.conf rename to resources/z9/z9-router/nftables/nftables.conf diff --git a/resources/z9/rt1/systemd_networkd/00-netlan.link b/resources/z9/z9-router/systemd_networkd/00-netlan.link similarity index 100% rename from resources/z9/rt1/systemd_networkd/00-netlan.link rename to resources/z9/z9-router/systemd_networkd/00-netlan.link diff --git a/resources/z9/rt1/systemd_networkd/00-netwan.link b/resources/z9/z9-router/systemd_networkd/00-netwan.link similarity index 100% rename from resources/z9/rt1/systemd_networkd/00-netwan.link rename to resources/z9/z9-router/systemd_networkd/00-netwan.link diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.51.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netlan.51.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.52.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netlan.52.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.53.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netlan.53.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-netlan.54.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netlan.54.netdev rename to resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-netwan.400.netdev b/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-netwan.400.netdev rename to resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev diff --git a/resources/z9/rt1/systemd_networkd/10-wg55.netdev b/resources/z9/z9-router/systemd_networkd/10-wg55.netdev similarity index 100% rename from resources/z9/rt1/systemd_networkd/10-wg55.netdev rename to resources/z9/z9-router/systemd_networkd/10-wg55.netdev diff --git a/resources/z9/rt1/systemd_networkd/20-netlan.network b/resources/z9/z9-router/systemd_networkd/20-netlan.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/20-netlan.network rename to resources/z9/z9-router/systemd_networkd/20-netlan.network diff --git a/resources/z9/rt1/systemd_networkd/20-netwan.network b/resources/z9/z9-router/systemd_networkd/20-netwan.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/20-netwan.network rename to resources/z9/z9-router/systemd_networkd/20-netwan.network diff --git a/resources/z9/rt1/systemd_networkd/20-wg55.network b/resources/z9/z9-router/systemd_networkd/20-wg55.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/20-wg55.network rename to resources/z9/z9-router/systemd_networkd/20-wg55.network diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network b/resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netlan.51-clients.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.51-clients.network diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network b/resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netlan.52-iot.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.52-iot.network diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.53-public.network b/resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netlan.53-public.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.53-public.network diff --git a/resources/z9/rt1/systemd_networkd/21-netlan.54-management.network b/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netlan.54-management.network rename to resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network diff --git a/resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network b/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network similarity index 100% rename from resources/z9/rt1/systemd_networkd/21-netwan.400-fux_uplink.network rename to resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network diff --git a/resources/z9/rt1/systemd_networkd_global_config.conf b/resources/z9/z9-router/systemd_networkd_global_config.conf similarity index 100% rename from resources/z9/rt1/systemd_networkd_global_config.conf rename to resources/z9/z9-router/systemd_networkd_global_config.conf From 4626d04fb6aee6be836f4cd887e6a8610dd7fec8 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 19:26:52 +0200 Subject: [PATCH 04/38] z9-router(host): add ansible pull --- .sops.yaml | 7 + inventories/z9/group_vars/all.sops.yaml | 298 ++++++++++--------- inventories/z9/host_vars/z9-router.sops.yaml | 251 ++++++++-------- inventories/z9/hosts.yaml | 1 + 4 files changed, 294 insertions(+), 263 deletions(-) diff --git a/.sops.yaml b/.sops.yaml index b517a43..bcb30f8 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -48,6 +48,7 @@ keys: - &host_light_ansible_pull_age_key age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q - &host_waybackproxy_ansible_pull_age_key age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j - &host_yate_ansible_pull_age_key age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22 + - &host_z9_router_ansible_pull_age_key age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp creation_rules: ## group vars @@ -241,6 +242,12 @@ creation_rules: *admin_gpg_keys age: - *host_yate_ansible_pull_age_key + - path_regex: "inventories/z9/host_vars/z9-router\\.sops\\..+" + key_groups: + - pgp: + *admin_gpg_keys + age: + - *host_z9_router_ansible_pull_age_key # general - path_regex: ".+\\.sops\\..+" key_groups: diff --git a/inventories/z9/group_vars/all.sops.yaml b/inventories/z9/group_vars/all.sops.yaml index bc4c3f1..f5aed04 100644 --- a/inventories/z9/group_vars/all.sops.yaml +++ b/inventories/z9/group_vars/all.sops.yaml @@ -2,213 +2,225 @@ metrics__chaos_password: ENC[AES256_GCM,data:seOU504dZ9K21+NK1MBf9isee2L2rueP6Bl msmtp__smtp_password: ENC[AES256_GCM,data:FAih8FghRYDx3QGFCjKoJ8Zq0TkeCIx4n1jTx4/sASgECqvucg==,iv:8NDn3wj/bXsbHbuce3ycJTBVWde6XAVxv4NuMUkMbIM=,tag:jeE2b0i/8JPtguLYQvdV1w==,type:str] sops: age: - - recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1VWJQWnBhcDc3VXh3TnMy - RFljQU0vNS9iY3AvTWFraUxneHIremlDeUZvCmdzd0twWHZEdTZSbHpLbEpRRDNX - aGI4ZlczN0tFbC94TzJ4bm9aUjkwcVEKLS0tIHRGSGdkQkN6ZEVTUjl1cGhMZzVI - S2FtSktoWmF2TjZCZnNlYWpWYzQ4MzQKeK7f+UPSanQsOIXNjzZa9B5FafNFsN3W - sjssDdbNQ1OEn2CLWRVQl1umKrADuvd85fMu3gUZrycZRDCCfsBzVg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxTzAzaVFSRDQwN2llbmdl + alBBVDZwTWhWUkV2L3ZLZmNDUDRyTitDaFVzCkNRTEN4ODV5ekxRVlBZT3ZIM2pj + Z0JxYUlobHZCeGxxNE9PcENkR2h2VDAKLS0tIFZiVXJHSU5naXhSSEFobVZBN1Rl + NnVDUVRyVWxlUnMydVhiQ2s0bGMzTGcKh97/UOPxrKieK5dKdGyRqCRi8Sm5UNcT + I9jLCPqX8Utt0e2EEp+ivJwFxgo7QuNCYWu6jtPCO/Zmc5Q/2tJQ9Q== -----END AGE ENCRYPTED FILE----- - - recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q - enc: | + recipient: age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkSmVEVyt3OCtvUUNqV2FR - QW5WaDBFcnZVMTV3QWdSLzhxRENCdGNaVFU0CmxqM0xIWUVCSUwvY1pBVjQ0RCtq - T0psSG84VWdpY1dYa2doeFZXd2RKNVEKLS0tIGNFeDFRYzBDN3NWcnpUSVhEWitY - RXhLRkp3ajdlNGY4R3hRcWVSUU04T0UKdprDhBpp0aMc733Wx/K7hS/nLVohvlft - N9aSQdcRoqT3/iMGu/6xdqbeq0/7a/U+6JvhYyWLkLsrzw2mlVRoIw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVUtpb0FmeUduNW9EdHJw + WEY0WllWdE8vRlVhODU1dUcxUnF3WE5mUG5vCnBQRlNkblNHbUFESXhvQ05YdGVW + UkhjdjdvclRmTk55UXRGRStXREFiVVkKLS0tIDlkMHhxVkxEK1BjV2orQUtndGc2 + Mk8rZm14SzFWTjJTanVXaE53UmViS28KQmnPfzLhgLasSuu1Aflp/JDWo1hqvYjb + BijruPUZ3NuoZ4Wuo56FLlTLrch051fI3ottzy85FfX3lRnWZ2IK8g== -----END AGE ENCRYPTED FILE----- - - recipient: age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j - enc: | + recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQWWM1WFdidkY4a2hLNm03 - TGdNNE9ZK2lvelhYQndTYy9sUzM4TkN5elRZClJwQU1qeCtwUlFzeVE2d0FSSCsz - WTdzQWZLYXpqUHcxc3VEWHZvNmZibU0KLS0tIElCTWdraXRLcHNHMjR2eDVxVCta - bHhVdFpOdDB0eUR5d2hhdWJlcmJDMjgKBbVkm7LNwnoUVrUF3NPI7d25b6tAIr1t - HelMjQU5YFM7DvRYFOlNpgO7WmddNSq3C6WYa8AZDGpsjc6GypcLVw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQSm9FZ1VmVWhadldRY0JU + c2R5d0tNMDV5U2tzbVorai91RTFyZFdUMWo0CmxLVUJYdVFUN296U3Q3MTJQM0JW + LzNTYlVVVitRYmk3azQ4VXBLWTZiZjQKLS0tIDhXdFZaK1BWVFp4M09jbk0zdGpF + dGxmUUZkQS9sMXZoeTJETGpvQW5VQ0EK9Y/trD7VhjQnqY+KryPfEv1J/D4NCWsx + CHv0R1ps6A0qoRJzS1UNxU5bLXDX1RGQiU/arhJ7LXFxHrNOdObsZQ== -----END AGE ENCRYPTED FILE----- - - recipient: age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22 - enc: | + recipient: age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzTmRaRXorMzBQZWwyNFp5 - VHdUUElyd1V2dUcvQ3k2STQ0d1QyMytsRG1BCm5CVCtRWU5FVmErQWl2N3Y4QTc1 - Mnh3K01QUnk2MGpSZk1NRVJWUlhFYWMKLS0tIEFOM0pMa3RVNUppS2xOakFVM1lR - cnlBL29XQVlsL1ZCenBIYTQ3S3JxQjQKq09vbn1XOC1jIXDpv+ThFMk9k7SyYknr - MBJRBp/0PrKBo/Xk+RCSWSLjgali5Cc8KTjDTJyBG8rFzzvLIazBRg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBreTY4bzJ3T1FHOVdhS05v + dG40VWdVeWRpamdqd2ttajFJUjdYVHB0ZXdVCmk0UUJuRHdsUnE3ZThNakpwY3po + b3dtWXNNSUlvbzVHcXVIclNlaVNub00KLS0tIEMwL2FYcEZ1dkZ5MFl0S3pWSWFJ + NGdXVXA4UGJIOTN4UnhoMjRYaTRNWXMKGJNomXuB5TqXZKWk3Ub/rEc69CrfYABw + bBBidbCQBrv7cnsvjsVpHHGaTwyP9Nk1ceF/gbv9fD9gZ7dwt3SA1A== -----END AGE ENCRYPTED FILE----- + recipient: age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22 + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrQWhjNHlDU0RKRmdKTzh0 + M3dhOGcrc1N5SnozMHhSQWNUdERPSjRrZ3lZClBpd1lrbXY5OEVnMVgwTGl4YmUw + bWpJR0Z6RDZubG9lS1BIVnEvMWhEdlkKLS0tIFhSbVFhVnZIN2xETXlWNlh3TVVG + N1VTSWN3SEU5U2Uxc2lRUmwwaWc0L1UKfPWAEs93dF10GZdlQt3yeDltk/9Djmuh + 3ZeGLgkOjcJPXO2hFQMZoJY7a2ZRIxN5Oa8PGwuy7DEtmQ9PdP/mbg== + -----END AGE ENCRYPTED FILE----- + recipient: age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp lastmodified: "2026-05-23T22:10:20Z" mac: ENC[AES256_GCM,data:JbnKG1qyAkvFDXr2iHu+gk7nRjedmm+dEK8vBFW5YzndWE4QKoYWeaqRHBk7wdWO9kpZgU2rFiu4Be+ikotoMS8jKAcd5wWSrWtSreaZxxiD2TWMWX8HwPtETnYe0rjrEZ3kPcUj4QPyNTphfbH3ARLjthedRXNF70NDc+DIpAY=,iv:4LN3oslWUWqoY3rQNVDSmlJn1o0c8JQELzsWd5btn7Y=,tag:c8X1q9XMMUkXed93j9C6ww==,type:str] pgp: - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxK/JaB2/SdtAQ//VIMBtLL8lhncJeItw53fQW4Lia0hs84yuKLuSBucNXhy - x3LT5r21C5CZ+JnucrGPxur4clsLnDnng2CgyWhksJNknk6smQIq3ZhyBd/OJzS4 - zNGUJIbitJsDaKjTrYDCdsQ3KVcRBDMu3ow7vzeP4wnL4qU5fUuQ7S2rK6a1hfMB - eTQmn4wD/Rl+Q0AWEo2V/X8UgchwGPeuOXfju2t9+1UVE0kUJdXw/JIrGyR8XrYM - 6ZGXB3mPnlZTZjqhXVSFSSOUTRYu/0g+s/JuDLpgl8gVP+oDvSCPrB2pDNK+o2Oo - VbQbJMg6lMbIuewd0ZTTeCv/TFU9O51RtkFyxHIEW7dVelDrNkuciAG1mDUHFUUw - MHeWDjngeCzr1hj1Z78P1bvR7I2pqBQiWT+d/e50S5quNRVjtLVEjuU7r1eKiPDu - pL1lYJZZu5+uY1nWE4qeJiI1KambjP9/C+RUCF38yT1wNvxrbwsM9haXGbI3t2cU - X/RRpK5VKKKwbBqyQmkZX7xaDR13hLF2vLtdVw6L9nYVVactfnFr9HKDV95HUnhO - uevmzu+ShtAt9FMXz86dLYmBx90A2BSWxb6sKvZkG8UDY+vVT1K0gNK4kwxR9rKt - LFzCq1a3ftx3UvrNMCwaboGQZLpRtiKr0lNQvGLpH/SRDZ2HksinV16FNVuN74HS - XgG5HnRO9/lkL2Bn+ms7Q6+ki9QmC21FlLGJOBQIi+VHNVwy6J8XQlrs5NZPy6Ib - LmWIV6BdIRejCAITlVeBRBpXymdUBicPLa/VQMK2s9L3SS7MUcv+4j+vje9YR5M= - =IEFm + hQIMAxK/JaB2/SdtAQ//cayg/ELKtybgayA4z+xOUK10zQJDE/U43BcPRMrBN0+x + VLu/C96Eom/dJN62SM2QamThHu454HMZj1PjDynMUzgfVqXEg/eG45bBBweWrI65 + s0tuzLmsqpdt9TJ5t0znliL2DYS3MPfmYRNbAsYsCbQd4I0YpxdzQwTvURdzjpUG + nVBUfzfcYH1Yqq8BVtR40MKfa/DbOsJGENHtpkQ9UDAa3gwVQs0NyZRQzg5w364C + UvItYlU77ZCKPkyOQuciLn4sM5poihu3UNWp855QsDK6fZVuxPTS4Cn54cfwdOTe + rL/ZQjLcHJ7PRmZUiWR6GVNDrY55u7zhORD4b8BgrpWW4hhxpp/ENjnRmNt8jKR2 + dJ/5/uC4HBX0fM3mbfpUn19BxCk9+gFPmNUOUZ93UxpQ28l1lZxeiLBOHAw1srEs + 7ZfFrJ0osedPGHu8rVOe93DCAtb/oNxr1xvGuDK/licRkEh8t8cvuoVsVhYFjNBc + UKXIPrhvuSj69c3OiHa+u9fNZJX2XAi0oOcZqGp+sQCCgUCA15I5QiqTpalCSTKt + /Stoj9BsmlSiy8YD2XBjmzHHVxJHfl8XHcuONKc3e4UmVjKlzkzc0bI73Y6XiEvt + zRIUmWxfvAvqP/zPcMSwaZke5h7N7ywKcjM+RHB4NqRUVYlBNwIWXvi7f5BdLhrU + aAEJAhBcA//3NJxuDzlf1zoXGKOhGIwNv5/Qb1n13OKIT2s0nfbqEHgAUm+tX3gk + VKKMqFuVmq2mkAaxXWFq20VC6djTJJS1QOaNsc6x3bJ6iDtYV19Ddn/20jbmbqmn + XbCDvb50nubC + =ZByJ -----END PGP MESSAGE----- fp: EF643F59E008414882232C78FFA8331EEB7D6B70 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQEMA1QflAioE8i3AQf7BB0RdJbe8Ro2Fv4Phw+VaR0rUIuQKWOb7zf3/9YCbV2w - rICGVIx7V1vJF5R5RgSfk0RDrLN3Pfoq/7Jfkq6bMoHIVCHSFdryHfjG5Dgm49Xv - gDZ2CPAHPn15mG0Rr/67YUWsC2Jy4y6/JY478wzYu4Og9IkxkeBd6ufBFB6bTn4H - qB7B2hfkyQzA66zoxc0r2O1mchbJ3A4pVJw0v2I/sWCiZoJQKmt8ksoEK8BAQCWC - E8sozb2opRzFaUCZSNEdhz/rnbV8u5wW378kd8kHSOlWxaFZNkWUP42YQiNTkd9/ - YpxxGvwCTIpHGAYFtU7CV7QfQHzTuAOz7ZElPZsYkdJeAZCwUFO24nzwpxYS43AV - 29IHXvlKAQkjJunix0bPGcE3D6T8CUs0wXL2sUSDcvgOOQZSezRn4UNEqFCftjJ4 - Gmldo/baMO2Y054/iA0jvNmHRk6sJCY8aRYv9m5Fqg== - =n7Qb + hQEMA1QflAioE8i3AQgAm+iazJdcOXiq08MvSGMQ9/NAvrgcDav4561Hew23n4Ms + tKC5VLXf3l1f6yjhBZy6mnslYOWWdJ+X4XK0OqWkRr/t7zxEK4M6PC6g1W5hkaFU + +9DrkBLKss8atz3EhexK6GeljTuRpVWM629BtvMPBo/41eyue78TLf81vCkbUJkC + UpeB4alsETvD9Oz0ZRT8fipuXzdpGSjobOIgQa9bKwFMXXGY2fwBuKW8gVtSgbXP + mKwqvGaSdHz30BxQExmLne5ERKHOvzac2woG5tOmKPaihg8pbvuq/VjS2K0mzS5q + cbwyq/u4d5fGEFQYqMARW1aiyo3NjYk4xWDcGo5Ql9JeAdwhj3Wgm1wccULt2Hj7 + z/V1utNINoB0bPFb8ZQMmPpwAeH6nnoqjWmmoRSW0tL/EaPh5xQXdEuU+DloT5f+ + k8c2KQC+v4bh6BMUcycAeIG/h4vKsgz/Jc6BWKKD2g== + =G51B -----END PGP MESSAGE----- fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJARAA4zyDJtNqK5w6QPYMyEtjuoAmva91yLA4oAU/diRpFXHx - D4UzksW8moYqmaiWblFy1HeQJFwZWrxnXeqg9B7PFOkhriIG7al4DpV2wXoCjami - DIkewGoeZjTbPNxsDVl0SbDafCARQFnQ8LNTmM2hi2X/ACg+c8mSM7eK6C3mh8yG - Bo2EsuCnIqzwzV6XbGCKnfOUh0QekWM7Jc/e3oYGSgCP2N5wb2PLVsW1220qdPvo - 8D1l5cDVj2Pgq7fnfbxZGJYSfdgJb1YweH8mjHk3gHU68AGeeSkV+VwcBGV2HObg - hKSbVWcyGAHrP1ppCNyXr5ZkBgyvdB/EjxjLqTLq7sdTnqjLLbMLgi9CCI0NuDMI - jfgMjOdaImjUvvr8lCl7dOMyp9wc6ks0bwRbfG3AMLGKWeR+un3uaDYujD0bQLqZ - m0g5mx1wHxNCJIb2ZQ6UVjDlnatTYGBnxEupqxr9PFyny0MRhaiYkuDIh4tHW3nH - xyCHN9QIO2/EktLkM4wcfhOeVgdpfvKgT+cMG9kS/yfInZ5ZAGvXznzvfNZZtKDL - fLvvF5AqYbN05c0h56WJa65tIT75P2wI6ZBncCSLqSAzyXWlZFV6UBP+5QLEkQaE - WtY8y2907OAx1v8g6vc5v5oHMqfwfWC4nuFbkoJo/ZbfvtDWq4eFZfkUKY3Au5LS - XgE/l6NTtWknF4nPYIRaibum4527ke053JdD/50eqfuRv8MFIHbRPfWE4lE6lgev - +/j0Ef9sYRu726Sv3wAgT7K6PmCFsLN1319OmjkZpBAJiNsxx9qwXyqgTpTvb34= - =Hr9J + hQIMAz5uSgHG2iMJAQ/+NjXRTghMiYErsXenuJRaWdwHZ+6DkkG8nC5b+Aigljgu + OJg5UQgYtX5W5T79uUuEh5BWKO5bMHBwDNHQC7Hn1FseYgrOxcoSYOsewlb8t2QH + fqGLLhv82nRnU0nTs8W/yvrBH/ub0kAtuko1jkPSAWnoonmeEW970iLVIF9lCVYJ + idF+DDSiic9RDpHd4Csuxdv+1Q8OcaOW1HVAUrfrKOvC17sawd1Cat2DWC8EcOVD + clNn6A91FBCTxVnxwM4j2J/NXP1JRIGnlxaa4lATQMiX8lfheu0LyEpsFZai55RC + dq20HWqPgYHiamp6eGQ+Uqe5edx6F5YX/25S2Jfrx4D5vRh0PFx6blY0kgZJp16a + ywNiMtLPh7HjOMbB1v7bcWtIDWrIhWDtyJ7axny8sMamCLCPOwPpPvdL/B5YOntm + +0wMXHXCLCaljzsa5GFIyVYj3pTY/6O0Fgkv+6ow08ndPjsViHNikufCSW0ueIFF + ehv0V2+AHhedoHChFZI/DEbGzIKVcr7JAA+GHAIWcklg7O5hss+/rr7nYxVB0A+t + Sfp5kVMInLpCPLRm2retun3zPF8+R0kN/ZrkLy02K7z4rrD8wVE5QUvSCWbpKdfS + deWIy4lp9wRXSunag1/CxqvrH3ZszlxSZPEQkC4hez+xOS//L/5QsiP52SavB9PS + XgHvkL3slXXsdnIgm3cYnHqEBf2rXLQR/ZTzusXMLEBaGCd9JB33T/Lz+TUftCUI + xxLwzFvm+dEvQ6bOB6/OvSMBIsvVzMZxaIblwZRdIYfQovEdKLCRc+F4lTqV8fE= + =1lXS -----END PGP MESSAGE----- fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DsZXvxFXTXoQSAQdAp7TsXm2MaBAh0qB3eOjtFuegcEsmtdQHsMP0rs0N/m0w - bbbzXLwq1TGL82l5Qon4NnX9Jg5gXnKydWOiKWhxCsQ0iHJ7eupJLxyfDD/kzga+ - 0l4BRUpbBFslWWa8Fb7zfNA7kslhkaQIJAmN92Yh/2NdkpmNEpMMaIrx2p2jK4Iz - mwGUQlUz4ZkK10xy+9LMaAtmLhBJgBhDTKKzw7OAsRAnASq2gXA/4wqEVgBU9BxB - =tBBK + hF4DsZXvxFXTXoQSAQdAJAr+RX2f5gW5PpXJ/WA+1qMPFjuWuDccIk1ecWzc4kEw + sNH69jVC0JL7l5RMrJTAaY0GRTMrJffoz28JxpVbUVFEpeHsd+myGCcD1jZyS1MX + 0l4BllCKEsOVnEKKxOscOIctaIw8/MDNnLSoP04JI2xVKKThor+UwUhRzg+fVwxH + uEiHsx0xA/q0HVXhTNIvIWn0CKx/4uV8JwVa9JqjSSyQVm8PBwU+UTfXMQ5VcuHv + =uxSy -----END PGP MESSAGE----- fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAlBZhTjLL3YPqorSXq0jet/0CXmeZeLL8inGvm/HgmgIw - aplmjWHB80err0ffZeRfcvqx9DGujpwlgoFGDxjqn4LIqoNg6YK/VfFb9pXUvIOv - 0l4B9xQ4DlaYOX1egCQUBw3KcdcnNlcEZwTOwTKn0Hg3gXp0u3TYlJFZAchw2G+l - XJjlWiwJN2gKfEG7hrtZ7MJkYJFsqMFa1aC1oWHduxU4jmdRdQqdIaQDsqkcqJc3 - =KNVY + hF4DerEtaFuTeewSAQdA2k3VLlMvCocHQ1ULFwTJKqscSb2FScq8A2I1TIdlfXAw + jWLzGphdsfHuNBEsocoixm4nKAdhjgBsud2rfYkuwxpqX2MlBr6ikpN73dXlHtt2 + 0l4BkUvmqlioN961OV7nssbeQLzb49C9Gzm5S1dQqBQVCt/7qGodTHHiQON7bYJp + +OgUaI6bKZjd9Lhm/u98dTH2cdPm1B5bUQPDzptWX5vG8euzBQxXc7OrGsTFyYME + =e/rg -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fARAAhSBdgW04fKM8tAU8sC6h8/4e0Io3W/D2l6P7nZiD9WVR - 2pUqS12mlNCoRt1I2empyJ5vm1wjor34BCuSCiyfLQ1WIlBJlDro96ygpsHZGmam - tNcrgwc7y6rg4ycqUWr+H+WVZ0kw1IYYKbfAjMAJF5lQqzz+VMvET9BbmvA595MO - l/dnMColnjxxBiYBIzO7mnli+uqRHB79rM2VVlrqoT+C2s9zuPfpJfY0PJaCbbdg - BlffAMqs9m2JZdDr2r0lrN/jyLUB2d3l9NCcF6UYP6tjgZsKmHv/JxSgXLf6IklE - wolO04qgDRK7jeO2UGEniweVQNi7hqA4vkp2TskGbfVsS10PyLYKw4N19GedLS3c - ZxRGde42Fze/PrccWq8bGdOfWhPBo2/MEyqVW4lgTeCCwrFRO3UNyYcWo7cmaN1q - lz7uaV6ffqbUDJSkjkphvxnJtuX62x9Uv/wcwrJuZUarSNclQ0nQV/e5wc7SzPgM - B+GLeR4tnconDZGFq8q+KKuHe7MSx2uwiZsJIVXohcZwhkd9wk5YQBPc8i4aP0NQ - wsb+QptuM8VpCEVAwKOUjp7IRRfUyqAIlmIRDkTijmHknSmI9HZXPyCvTLoy1Szf - KDrN1MAma6b4gsru1fFnVizXQyZozl5RVZFP2Uv+ndugdvRE5sv5aevlzgaWFg3S - XgFqaFwId78UDNTrxcs4EzjHmlwg4E05G9pUqbA9zBDdCqwlD4+6CfAgQ46A6ptY - 5p2QQJ3KXgJXrtlJySq8piReyq3mpagtWZJfAazovJA/ZF4o/xs9ZIu/q3qxHSE= - =nR8y + hQIMAxjNhCKPP69fAQ//VLyOILC6lpvlq0W7NeYfUzL7KtKYXVDF7aSQ/b6Vn7Of + ggc9n40n6FkMJqknhbvSnhhlFdzVOCZkLy/hinNk+jF2POBlLbzBjCuzQSP+ZDyC + Dll2UJ/khITd+tQ4zwrFLpixr518Fgcj8NOgtljUovxR1bGIzYogpmiVFJEd0cT4 + k7ldv5WbZtB2UprhPPpNe+98BaUvuSvA9RWCogaBbuQpY2p3g9t9Zo58spOawbP4 + ccz7Pu03Esy3cenlnCt3G7gl19viIh+wHKrIXPa8dGO6TEsrRMPT0tNEs8iUJyDO + TNEgo6+yxQ2p+08EzAh0BCRwljqnPLjS/h2s2s208Z5rBOCpLY9RuoXz7JRvZ06p + gBgPFSIH12VBGjfqCB1uZIatbtLQLjOo6+UU0evM65WhKw3//tUnLrox1reoiRzO + ro4JuytP+f4PylQRsr3jOYKRKCBzoZOOPZbVEpwQeBOe9zzxDgVQqHgVDDZQzCcw + VTHCrs4XVHxPH0aRMlS4A80xbH7VncYbcbf8a6VrTpnPflv0OryWMWDqLBzmIPgM + W1Bz/hq/o6br+g4uAKjt4GTdTwWYxptA5L84aMoihpXRu0MaPhG+7MRsXpEa/+Ll + +ybl2DLpm6zm0iixkJuxwtOdQOGjqJqC/GLw/EZJTt2aO+ZUb8dLrChNmR7HJAjS + XgGBpFYao1AQqLZU3c+5B2/9/3rtOoVX1DQXhUsji5NkaHyYO8usauj9evPUf4qx + FAQRWua5/zp/cTlNWU3GknqtJ1G0g1mrkiVeBZCRxIK2Iyvyav7RALJ1jlkyW5c= + =meb0 -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA46L6MuPqfJqARAAjpM3MO83b2EUtzyZs66HWH6Kd60rl3QODTqs4PQm1cH5 - HdzfVJ2IDo1y+FMTMmfJov6xBqnlalNaOvg8XFAkKTUkZgUHRW/q1WXP4FywTWmP - aJV47x4dOQXQgj/i/ykMspUgsxA5049/nG1y06Wsm2agLO3KjL6KIJAx0LI28XPU - qA/NFtfNuEAv7DGS2LGz1+X1hnRYcBX/oUgpihzActWmMORD6VS7xZGcMdF2/+Ex - OCDAnwT0cBSAihBSLTmEMJ4xfmMG228nbLqm9r/gELgVIsIL5hXWz0CtxaewwLQQ - XFMm/ZV/G6bZKRJzKPOR9EcPMF7Z+nnBts9wKNlE+WA32p7zu7hjvEFZhLiDKYlN - +nFcx/rvyWB6sbFK0xn2x5MonxWNVUy58PnqGWmPi2VtXT1al1zSAoKAgg8Xdw21 - PQENtxqeUSLXXb0SZXFptMmYStwqoaFusLOCLW42DogFU246o14veDDtsS619T5G - RrszsNg543i3ra7MIm99YRXyniUaDp5VlKufPkWRexIT5YZYalOLtdLcaTTzfr7J - x4PNVOK2ddtmlKbbakvvmPWS3iBEUGMqw69dPhEdpY8yy7HJ2jpXX7TiezNqGJ9w - XqtI9RJmWrr0/zSoim0EpHDwXZhSf7YVcwTs0XCtwrXcQT6DLaZJr8cny/G1ErLS - XgEdnUqFpB1D0bacmRpfHA3PLZJd/x0QfwZ/b7gzz3f1xRfMXgnsM4iYu1S8+VAW - Dy21iVFZledWfrmuXh/PkLFftLipYK6tc0n922kFFxCn/xSP0yx9qKlNwzyduNI= - =4+Bv + hQIMA46L6MuPqfJqAQ/+NK0D10olgDK4KcArzoMtrJR7qwbrceSeKwaQGsUB1+RZ + xv6pZJ0zyw7McTuUV2I4bLYHy/TffSyJk5vLSSTGFXgHVdfKmjvm7VDEp5d2uKku + GW3Qh73quldfhd5GjO+F9V/S3rCysrNMpTmPnR5ha877FKGtc8168XRhIpe/1+mP + mvlE6h0Xizbx9myGR+ie17nHpoH+tjTtQFH640s38+xDgH6AozwWGUe/g5TdLaLJ + 8SKHyQnS8hOHQDkttvhWRbyhKa8WuGyOKSjuQ81HIv+/UPxh1fs7vovPHM8rtIyy + xGcWPzUeoKQiV2nyXUP3BqglhOhD1vokh3ejDcxwWWKuyASCSXhhvW7KMsV3Stdd + E3O1nyOi4+2I2E4TQo0NLt5mTJonPbvSn4IvV0LuatrG902UeNNZRRwQv3ZrVp6f + G2ZJ9HNSs+Tp9H8cJzBGjDBYjC6/d3GGWi7N/5G/n6C7T6W81BgO8UiQOleEDF1c + Bi6NPNeoGL8fivVGlGTHpLcpPpbYz+1ynsFs1ho4+v5bHS5w+UfvVvQC7dlDKmR0 + fUAkllcxLSnzKkpKis1HF+Gp+lSNc75/BzOeTA2gS3c8H9jMuncRolndPX1rVJA3 + mrLiQE/Mja9NaYHzUROKIHDEUOQ1ZzvpcRduggvfj6Gb2wzNdUdR5QrXnLeI2jbS + XgHO7Jr0HrHzr/+p+w89U+uH4b7onseYDiAjfLjAZpcYwkzuy7b2ZUmpLq1BjZRo + zs+rSqv4BP0Xa7LNIFrHj4OeL9ivwP7Kw/Tb36hU8DJ8xDfilx81n69Fer/cJ8Y= + =BNfm -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdActtZQL4KWrCP8UUZa/fLeDltuNV9JjxTYiI9upoH12Qw - 6n8EBLgKKNw1Hsb40u9M5Ro7Xzbys7zwZsL5CxEgFGDBxthtcdaI/ykjU0W3poLE - 0l4BcMpLoCyxxwIn49GpFxHiv84Q9xhouSMmCTe2p3bn5zCRBnKsetVHtEti4iRF - sY9FipGcyiNHfkp8KsWeUxD/j1QUIkGODXt2RqYkO8ltA5QS3kUCPErmWYymEAEu - =RFaD + hF4DQrf1tCqiJxoSAQdA7az9ylWMB3fWHwSVRmU8Gu4Qnd6HIyMuiG46weuS/Cww + QMCknkfCG06HtMrOcroNigaj7G6FEvDm64sUkpW/ggWkHUUEMuwi5jcKIdx7XdbJ + 0l4BDGUF81uOghQUq/JqDtiYPD8IzRHMXbJmXiO+4y6DE5b1t99wBUt3C5K5H91D + U3blcYO6GROPSkVp8ZIzfnWLvyVoWInd1ZiRs19n9MN6Yf8uWfx9/3xvN2kKQyvj + =4X+A -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DzAGzViGx4qcSAQdAoNdta1fDVjzrPWeSfKrmslkoFi86I2nWplPOli/gFXsw - 2Cx+wmejLlc61RE5sqAaQJc+0ctRezwXzBJbkuqznZ2jWPCK2A1EQ7r3Q7USCCca - 0lgB6XOo0ByOj/W4TrrGn7VmwLvEqIiWCt5zk4BEUSVc62Ffv48dcwL3hsB3HlRw - 6FXyR+2zwyEU5fuddFO4nMi8AXB6cfU6F4ugFgwn92lCgTom7IULY1D7 - =Czq/ + hF4DzAGzViGx4qcSAQdA/+jZ9/0jHioWKE2TK24OFDKjJ8futm2TP8z6Xat3uxww + DGwSznxagIkVgdTNKqAWmzGvOum8xDBqzP232CM8B/oxmwIjuIV8+FXtJuFHA/4b + 0lgBN9loSuX5uL5O4uWzPulEhqjFElrWRZXLHZn7uIWipW/7mP8CGu02wwV/lme5 + jvtJ6EjgopmHrxyaJqRk+e65gxBYKvxTQ1H1iETCUq8lOnxSBZVY5m5K + =7H6g -----END PGP MESSAGE----- fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA2pVdGTIrZI+AQ/7B7h5br3PMgum71smOTJMBfl4OaxkQAirJeG/z2fjqbAG - l9q62H1cutGKS/IYOFLE0OQaRwmHtkdTkrdmf9yIuAktcdAGAeqwnYW3LwM3t7U1 - nfZRJH5Hi4xcSVVaWHn5mX0QpxzrCye1EIjHvPRx6/bWHD5sW9qnkZAlAvEJS3/K - jdyBLLlK8AITpsX4eeVnmVLZBjbVEXPlXfFCh9PFyqrl+iyBBY9bO2aMzWldbQIr - j1551Xe1wKAOn5SJTg2Mrm5ehBKfH53HY6ubCy9acbv5ZTe6JuStseWordtRNNXY - 9eVmR3MRVoFWgK4Ccb9Qq8l+uEHRuQfG9K7dSnxQIJpHCOAQO9oi3/ykDt9Vgvo6 - WKPpvyuJpWc5Tn+WF1qhz5wDTRX6XY+cUoHkUqZXG0qMTIfMLIAFZ6MuslHU9f6J - PlY0FTnwp5/v9rK/rjXZkfIxKjQtSWZwkZCszZ0WtNVuaY3KO6KYrd9rolFFYjqn - I2xFGnTNZwh3tjG/3INoMwilOkIUNXr18k6FsPqVCAhj1Oo0iNxb3j+3pGJsH9iN - ciTLeM8MsFW9MYXG23i65a5WVXi8hMTcyqCy9GyxLeFprt2DaH2HaBahF3RIWPop - KTNsvW1aawy+lDUyr4mBy9F0TA8Z1/db3l950Gtuz5s9/7D6bbmRn72O++W1RD3S - XgE3QuksqaIh7ZGt8tVPREEHpBWmPCskh35vLoqeO1QxGxzJcjrcuNeHtOH44EEj - mHzYUydn0e1jwKZkATG23DiBCyMpcNAWmsMH45wmk0fgNLdQhuslhKLqOUDLpN0= - =Ygd+ + hQIMA2pVdGTIrZI+AQ//aZjaPgcAM6RSG6QCnYJgn8EDEhG7HDvXmb58G7VfxArr + m+K4Hc3hW0Hh/c7/bzu2QWniN1ie4apqFSvQmAIJ3zQZSyOsqhzvbmyTFRAyzpzO + lOAo/s0xMu8s5V055vC2KWnKuqb9+WtWgJPotkpOf7wQM3aqtvXKFnPa74ihjXdt + uuopRsOsZPiG8MLcqkCrTy+pd1PywrqwjKeva+mfgbM8zpypw4kwLwrljsxCThkZ + To4dH+K8oesvSeyVOKWtAwnjQsPa3Zn5CFWXNwPnn2kpjyMoNRo07xuRkfHYI4L/ + 7D8zz07XdN47kJbEj2BYjChURtbxkFbAxq+IUDgbNDW+M7VQCKZW+vOFjwmFJAlT + CCco2I3lmrVX1j9BTMRr/3aQNbY/OzOxk0qjYZGnPqV1bH4IazaDFUB8pOdmit2t + KBzDt1L26V0Ek1CpOp1dcJxneITXX1j5IqjMbl0TzyoJ9CxsSaOWfZ6XsBBSXZNZ + VnDENbBAOGcJgatjmC2qH5FCNio7vMRRncX5j82sytDRWbj/7XHENFpfXyGPIuYg + AaHyxSVegFCeRUHpzXo+qeFpNFR4407v+otVaEdxbfj6MQfMZ7tDUOde+97NNRow + tAMUOAN9yhGuEPMPr4stQUz4lHseGMX3VdpJH8UQH+BxVdJhzKg0H/+6bAmnRi/U + aAEJAhAi7DZdrKpPPkDijPKnXCPJB+IzdAJdOCsnIhZFzaiDUo+RLvP9bEpoqv4m + ZFMtiF7P7bXyeNIObCCsgKhdX0thXI9lZvv7k9M4lAbFhPS9vlmDwf25t2Nm9Um8 + 2tbINg+K23jp + =syE6 -----END PGP MESSAGE----- fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 - - created_at: "2026-05-20T02:08:49Z" + - created_at: "2026-05-25T17:17:13Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DKKbvh61jX5USAQdA8qtjYHoUe+GUdy3obbF+pNmvfuKQUqkMHa6V5ZXOpXAw - M/kx52Vu5xOdynB3NMBXsfTVH7KXh0f06HcehTREOkhlwVMYPcvDQQdzgJ3Xodpc - 0l4BdYtmbmk9ETTqr+wXvf+6BMYIuvyhsLLSqyWyCxJv7blQYsxsc3EAHZ4LB0ZS - /lw6gQ5lmQyvVt9PQZayt6Iku0+WMJcgrf9xykOAm3N2QrtUnr4jHV3FydvTiUwR - =snV0 + hF4DKKbvh61jX5USAQdAHw+hxKofus/fR32ThZOHfkL+8TIPvWeYnTYe5UUCC1ww + AtCE+MfZvMgRx7gUpVPcdWtch6nlFzun+r84QfPopFk4S824JFEkK8jG0scYCpy3 + 1GgBCQIQm+g/LWX0T3Do0NXrRGIuw0fiKrQiOpEhbO6a6ez/pES0zKKBdlH+scQl + +nLZoz6Mw5mkwhY6zIKsrikuQ/+sciO2fIq9tI4MR6cvD5gmVrGEjIyOZ4xgl3X9 + nX6OVR9w8cR7rA== + =voeW -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted diff --git a/inventories/z9/host_vars/z9-router.sops.yaml b/inventories/z9/host_vars/z9-router.sops.yaml index 89f18e1..33bd3c8 100644 --- a/inventories/z9/host_vars/z9-router.sops.yaml +++ b/inventories/z9/host_vars/z9-router.sops.yaml @@ -1,3 +1,4 @@ +ansible_pull__age_private_key: ENC[AES256_GCM,data:TlMDo9sUTYznxKOGityGLexk54mM7LU9+U4ln0YYhO5fhXXmwvySxyMLHlaKzSlpU2/mRRy/0v7AIOuRVZx5XqV8X2JJsv3/NeY=,iv:r66g2UQ663KvWyAISitbHBRaLBlJ0gB2g/TW9JiL0Ls=,tag:VEq3Fqj+t40uBo9g4Icfew==,type:str] secrets__secrets: - name: ENC[AES256_GCM,data:gt9BarzsfE/GJ5gQeelgePquW6KAgE3Exv4=,iv:IPpUQI+zkf8O+ej+ZxLFyWUOrxGGlZvmDRG0ut2cNsA=,tag:GP66MvcKyCqyKV814+uMYg==,type:str] content: ENC[AES256_GCM,data:2ljp324rAsF2zk2631TI7bV1xKxdFr4u4NxrsPYnjWsL0PX0n0KhJ1qvJCs=,iv:0+DxsTTiNLOg5iH83bFT/d+0uW2rn6bATSm3xc5PEdE=,tag:XbBDrrjriXPedyT4+sBBwA==,type:str] @@ -18,180 +19,190 @@ secrets__secrets: - name: ENC[AES256_GCM,data:ERsggezMBbs1YwbIgwzKSAEHWWOWYxap8IDdn2YtEKvZexqu,iv:XbObLp2QERgt57tc/Cpha1CWXi+GttcIU8hJFGSp8e8=,tag:FqCuSbvLRERpVnQTzQsfpQ==,type:str] content: ENC[AES256_GCM,data:QPoZA71CwE8EFE0I+6z0z0O1bUCMQDDDG7wGNoxXKt3ovLkFt21r8WG7VhA=,iv:InX6A71f3DGTg1wO4G0ECf488+FnKgTHffVwvJ9hHQ0=,tag:EVxwJlneN1CbMLXto7uLFw==,type:str] sops: - lastmodified: "2026-05-25T16:29:22Z" - mac: ENC[AES256_GCM,data:zxtV1xgjQuKNMvh6S8oAOxX5J6+iBRO6k3vGw3vWNlhah4Gu3S/lt+5v8lQHogz1Vyc+Zff0yMj1cn6RstDDj5AuOCljRQN0FYs0fjCo4Yrxx5sMMwcwBYquC77skEiZhRnqdXKkjiOM7EGE8qj8O3DJ29borIjm5NAsflH/qkA=,iv:7EUElg+gu8mk2Gq32JQMTf+A1+ZhZufoqt5bk4+Ca1E=,tag:XG+F/zlXizsc2B8THoXj4g==,type:str] + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxallVTFdueHBucXBVNzIx + cENqanlOOUticExzVnlERS90b2hWQ2VldUE4Cm9SVmhZejVzanRDTkJhQzhwM3BM + MGcwTEZ4YVQvdjc3clBHei93VEN5SkkKLS0tIGI3KzRPbjlNTFFBL2huYlZSVTZh + OVdXYVRkVVJwbVltSHBXRktIY3BYL2sKe+eqKzYeCUWx0KmT0+aM+TwWRj+P0Ecp + tnFHmQgnEPypIhVvZtzL7i64kL6sHizTmNhbw+hlnCztvsdEV5T0cw== + -----END AGE ENCRYPTED FILE----- + recipient: age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp + lastmodified: "2026-05-25T17:15:30Z" + mac: ENC[AES256_GCM,data:IW9eN5H2J5cnXUHlK2aD+yd2ORx+weSFKBGWd7pIolFb5txg0WlGVp8UpD4h+Tv0SJ9NkQOT6KpcXDez/L7r7xNYtmgf7AdrdGpy3IOkEYzHJ+oHUMd/aL+h5w6/RahrpxlPSrNKAC+AfpY+l0iodwQ09iuLp4YXFxRaRDGpGZw=,iv:6M7RkDN9D9Zlyq1MCRoiT4f1bd6OBZNg+C65oEuSWn4=,tag:wRsq4lt4mHVyY6ruGkYNKQ==,type:str] pgp: - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxK/JaB2/SdtAQ//bbr0oza/X6GG43ay9coZbb+0aptj3pGzQqT1ND6nsI34 - iY3IZaMZIti+j/BS5kEfmRn56WZSx6EcbSrlbiyL5NZw9R4/bGRd848rOLwMvuYO - 8Usei9jHdpHiPvKBZnZXaXGU8E27L0Y/LCxSIFOXbyHzHogjz3JmtJQsYpSC+ue6 - mIRrSAJPALrqEL+DZ2bl5UYlBIRXdtIe/jL1CFCJhULt+EjJw72T62DZK/jaNZTj - eint63+IFZSxx5e5vrAeQB+p2EDsp6c5NbDrlgQWb8/J1q/G5bG4KxBs/0hum7OW - /sSsIDb4Qb8U/axt5LduV6AkMXXsclNLQU/LbFAbBRcV8Lvh11f0U3V/UnqUdmvp - efesb5VQh1x0uWjzobxaioLEV/YYbWx8binvuJ3MBHKp6E2xj7IrBTVl0MWgjEou - ZbQDF8DvxA49xEnJyOviL2/zjnV1kXy+Q+BKZga3pr8AnBHA8Ftbsvmk6CyDEM0R - i4FAUOVa9VWiszoOaqyn1Fl02YlweFmgzuFjd3wi74Tbi6RE37rN/vBKySbnRQYl - rFUU3SQlztxd4UBAXBo6gQKTz5B4rehvKVye2mmqEE9bas/lCWAKVJ7+3+0NQdA2 - lp/X7h7DRSD2Qkd35SzxkJz7P86rd0LM1aOu87psxYavEWw6vFs2ErDkSeqDn1DU - aAEJAhDb1s+jpDUa3GvVZjoiiCyutI018jfJU1vi12PGktg4KJcXBx66R/nLItO2 - ba6o66scIiAJZ+jYymW6RbJTI7XRHJp4Cs8COhpMRQeOGwEHFGGL2rpGd3KrOLQe - 0/C6EmrJvGpl - =atNE + hQIMAxK/JaB2/SdtARAAlyJLMDlT4FLpMKaC3ygn1cfA2390Dz24lzKlHmwl5GgE + yS9bdTGMpcM8zPOQoqaoy/my3kgx2/U3q7WiCTMdUyYePAWuJFh8ZRZjw/hPpv6n + GwYgK3M2C1I9++zmZD5LlR4TaTTpr99+hctYrrp79QJddgozUzAQ44g7WvDm5VhI + bb2UVSo0MpWvLEMXHqH9YZcjkQyVg/DL+IaU1rM9pmpZxoN7+0jQY4ci1ZeHVo9e + DbYcjMazBLakjZxxdtHrqx3DjZgbYCancMy/dUKVuvDF/lN35WWSxslv14BNHljL + +/9YBDRgIr11x9j1hq241UwBW+6mSFxWF3qQ5esdR5xlLEqbm27PYGtqC4LIdzRX + ZUvdujuQ2PHCYJY/jKWSf0cdfXKEGorc1ZGOV9FNq9L+aKvfmRLWfzX4D0Hp47H2 + d3itVuA9KYOdzmk6O+8FZv/VK1042L90tOPJhrtE287KhcJ2CvfT/Az4Qot8xg3c + tXmO3cWQpigXxJPfKRPjmmLJ9nq0BnBXj5ngkVz7d8R3FR1J/+TWG0F1VU7YeW2+ + Z04RAbbKf36xUTqnaV34EDum4QLLdTMra6fPYPy0KiQYIKDcRSdHeM/hEs7JXP1c + zbUX4xuBOXl7kWYR0e3MUTzxYiQBr9BvSDY+7sGQCb+fPw+AKvFxig1grjsnZvPU + ZgEJAhAUE/ebqBa2nGimcAPn3PfeihehcmjLg7HmyWBPkHHMt/TIOztjkbGiQSC/ + jBP+rhjmFxm0WKUGM4dkh14JkMgz7DZ9fozzLfo8zN8beuSDDzX1BndTIMBQJj8P + Q/rk1NL6pg== + =UXJ9 -----END PGP MESSAGE----- fp: EF643F59E008414882232C78FFA8331EEB7D6B70 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQEMA1QflAioE8i3AQf+NkUGCBrTCkkyl+iBb6P1IWLDGqAY8s20mBZ7G3plKE/J - UrIe947letj/8EA+yoN0uzjwEkh3rDLtZrOLTSgflq1GMpdVhdaTbS71fD3kghJQ - P9tz0zDQEgXHBi+2q7iRrEETx/cu7UDNkSCNvQbWvDmo8MfbSBy+VFCknfupdQxj - 9hlq4kBA0pckPCY8V7E05nDhQntS8wpXIEO1SWiSuiGg+p4yFlvNzWNfhLyEFHxL - BZHVVIU/mzyClMajjLJWjKI1LSgHXXIa28tgdrtiBZOsF+CWveYqJlRJh9NUepJI - ZSeFNhyWmnS9ZkQu5BUyb7+oRxfq2NY51T76Xbo8gNJeAZWwyr1sj1wjubuVeNMF - aU6FiynYWr3I35JRVghTMJ93CnPl+NTpWnQuHpq1bzEGe2u8BMFhgrTu2yMD23VQ - eGien6SqfEbA/wAiz9ZaUgTQH8UyHpliteZ8/SQgkw== - =UJvq + hQEMA1QflAioE8i3AQgAg+PBxAqWTfRhxP7GxDfQBPK3d52zshP9xhutqANzszhs + nbo3nHWj/vjvHlEuD+Rr/lr9qxsE3qS4ON7FG929RoB1YFHJnQl29Xym2Q34T0Hy + Ih3dibykm0t/NE+fuxsU4iU0imtjqhqA6P0+8FNF3UeCg60brcqlrBTXM9jFqlZ2 + 9nuvk75HkM1FoHiKx837qAd+RjNNO7xKUpn+EX0l0l9tScuPqUkWNQxLrbHrcO5M + bcEC1syZHQKCiucsesS1pJ7TFWOJsnamZyaqhzANGwWdhYwGQv37bWKr6dYTCy3q + rsT2NxQK4/N9CxmP6xWeAZbX00BDhNMfEQVtTlYLgdJcAS433Hiw+DSEwGu2zvTa + pHtQlGlaoOZemNnthw0NO6JQWGhz6Bx5QqYmbrshtVKNPh87vNVV0HhL/fQ7qwLp + uCgnMi3P59r8EKDZqTSp0YGfE2bx2hpBDnyJ42A= + =rOz4 -----END PGP MESSAGE----- fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJAQ/+O5JOJfDp/BuBCuXDQVUgJagspQO6LZ/MLrl9qH282AMf - MdgN5M/WjbOv6WZDCMg4nfXps1XgzUEiaA/1m4PxHlMmxjEoQHAE51GMcxsXg+B1 - lM+8uJ1+js1sdDX4xsZtJpbVxJKIbPuhF7oM950oDlL2+UKhUbPlCoxeOihlkVGa - RqHJ/M74xkyKH281oRI5bllJaAroBnXVSFIvbCxA7ts/O7YJPKBowTIj62Kye9Ra - aHC11bPy2RlJCcFZJjPSdnXvzUMpfzEd6O72VUtMBBQZn/in7efutC8FwpRYuUW7 - vSofxUN5n6Mtb8A1XSMFD/nfXVc/pM6Cu7kdtHSwSKgbKKf6mrCeVgaM9xcG0t2W - 9yEtWvkdvOOSqz/vd1vkftbBWcCejX7bktfmD408CJAs1bjzz5CyrDoWcnYmbxFY - 6N4rhMDRMTe19VH2UQ4EvSjQjmmYCspnUW3/78zi5kU1ijyQy13UpbgwulU7tSGc - KKtBjPoy6mLIVl0YhnEJZWD/XPIRWyW+0s+7m70YXCWSVipvCelEE8oPWjf8PLaE - J85crlZGkSRcRO7yOP/YtB9ZnajgaF33zJU3ZWr0C/IXj2TeepZp/JUteD2H/LRf - 9YJzOFYDOFIWcdmaTzJLBEaefWcDjT6wkIf6TBqQRMLsu8JUwy9VwFcsi/d5aMXS - XgEQqSxYb1B39OR0sS1Xpw0/CFe4imBPuG3w0tOAyM3DbPWYY1kZYIRZenV1ZIOS - aRZJh086kuWgHYB76VoNzDK3QperWvHL/8CT2g3HuPiVGSrrXwxCYXk5+UXB9bQ= - =Xx91 + hQIMAz5uSgHG2iMJAQ/7BOewbq1xQgTOruTFebugbSrodtfUlIDpCez+FZMw3Gos + uwfp6jslBKXHidsA39CRktJ40EYqygmBgcxGTvHGC94VwSl7OfCjHsyfD/93L358 + XsjpTHXBO/mOjQmJ2smhZx+q+iMLpJnq2QA8mGUI5uzPTjXD19sD9QdYdHF2p8D6 + mdpVWED2gRf/sDoN+y3c/iZvMTN2HeDCx5d/wIgl3mmoHLvWRO8pNBV3EUg3ZBiv + fc0Y7m/0KOqW1itE4yg9IoPBWJg2jYSZTkRnQMPEkKEEHNtbx6dq5tLOYUIIwOwC + 5JlL76BRoaul6ousBSHV8OWCAvS2N8OC+l0ATzk99p/h4zY7PCG7NhkKAOgYfWFa + /z5u6J6TMrmeLZjknFXepuVAzNmDU0CmuhMwZankGKq6lmsQQnHvdq8+ExGGWhfK + m6I8nPvG654md9H7Y3HusHa6y1rkf9gZp1UFzhvXQgZdvc7K5pJrhxjGUnEg6sS0 + m4daDRuNLW32PXiwoWTtTJfOQFv0t1f1eEKI9DO/O8/4fNtIvmI/8HDcdF1XzDnt + lGnyD9cZ5jKsKjGrT9DcvJhyTGWDFeBDTY+rlt52E8NbrzWUjX4J7Gyz8QRY9j7m + wRi4uaVt5KBmB8Ibo2bMTUXU3Db/0p8nCAg/89D1fP6FF4izg3GU4oD3vJyl81XS + XAH8tGT9wbjXuhomyhqemDYb0QdTRfpAznm4AS36qbeU/Tvj4M+Nm64qLpj7FFtK + aeDas4lzgeQf6/cdd5ItLlRHhlBOJEmjHVzRR4npabCWZojP8PTac1IlBgvS + =OH/y -----END PGP MESSAGE----- fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DsZXvxFXTXoQSAQdA0rZTVdySF9nUiz7ZyFJgq1tojyLojGTgE4UIEJzFSTUw - 9y4kbGn1cWMpAqr+sE3WHV9p7v6kgm/XdUjXGN4DadpUbiYx6sQW2Jov6Km2EYhq - 0l4BawupjX25wi7c2yR5iGdxYS8oCYVmGgcAB3T96v8VsXpkAOYQAOOh7B9GQIxm - hB3cFQLCy2un3VvBsiKGFMA2FhZYBOuaEwP/KmWnPv0IPIRH4by6LDB0xgq8MUNz - =xoVE + hF4DsZXvxFXTXoQSAQdAIjnFVslIKlmP0X12z6AdWNqxkpVBDFvf03ToWQEQv3Uw + 8ka0OYl32rH6UiiSE1Vve1wZ/iVvK9/il6UhTpeAt8bIiCq6gEGR9Ba5NJnm6rSG + 0lwBwzEtaARPJbbcWu7Jl+dAQ0quP6uVS55OYBuSannlaPrQ5qBuS14AtuQ3UEVz + EbcLJ0b4lGL7hgyAf2E6nuDTkPGPChAJ5H5DfrB74ZB30GcYBTzwj13+jWx/VQ== + =Hxuh -----END PGP MESSAGE----- fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAgcGcZ3BT6lsJ8FxkMghxg5/PZLtIzNeJaEUbxN0EFhsw - uM+Lec3k9BJSUJK8GeVmesYxQh8vP6Yi/+m2LnGjHXzkQg8Bx1HJzuC/Ap36rC6N - 0l4Bxj1URTsRD4yILEA3TY4Dn9St9uOtodJcf5YdAKvmeb3Uwy//huNnA1eK7b+v - WRHcU2K+GgkSzLiRLZTc/nMrrCQ/P5HzwYHmP2rypFX7kxXlPd3K6yMZWTiSgYZd - =gZLQ + hF4DerEtaFuTeewSAQdANsYlCeGhhqmBgnqcSuNdQBUwYKpucDrb6aR9Siyukjww + 72Gin/635k9bYXwknA1rPyTMvG00giQgjUr/QK6PSD/eGi0QOtMZLj1JRi8f5EU+ + 0lwB+MIM9+EEzHJ96ouzL3bu0e++NvRY1Qjyx1Xi43bM96eBeLZ5DAc1eTSdWizQ + EWTorcmXffkdfOQx1zrlGZo/qvfj5F706VcwX4aZwok/ASRmSeCfEXLgGLCwqQ== + =ccBm -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fAQ//YGOLOFtORNbOu+KFCtGcJBXQMy6Ej3/tePVuDi2vmqLD - 3Dz6stB9D+BmBbcgbFlDA+g7Vi6DD+zcze9wM10iuc9t9ucAuQ7B/ymSvJc4MrYn - MJFvQv5IYgWJmzXLYEFYYpmZPGG3hSHSgWIPs+574wEA/L867ktguW6ZD3ZuMn3E - yjCTeT/ZkGjuIpGqMu2/o9Wvc+RYgWlCB69D8kTHtnbFzbqEzvKU5/zte5ThchA+ - QZwFd/gk3o1G/7WOYJJ6CbBSOQaSrfm0mnb6sppNPdOAQtqHVSFVX5vX96gXsht/ - AkrvD6/2R5eNzbqRaU83cg7c5far49xoBbL6czreWY3D56yK4BJbrrg9mK7oCEfO - GaRDFFD7R4LJPfVx2xDoIQ3Hyp4E3dz4nyJx0Kg7NSEt7soOb5MnZ+04LLAiHbaT - qZr618V530uw3qaCsYcgHy+WsZXXlqXQey3A7jphi3u9Kvn9UjeegjNvpOrMk6g1 - RhGzv72G0wjZnzjTjPlzeROHaQ6RPgfpkZjEcVZNZkfAgAbB3XPgCFGKz4qvx9MP - 4eHIlBSJizLzSi519o+0i5PwrZdEf9L4RUVxgQgdJXMh1JaydVh5DOU+xomdStD5 - Maymkt8fSgYgDaS953YA2e04PrkXCH0EHZ62T9EMxreEoU3nYTmw/TGx7RfU+wzS - XgEuQkLWSToJ40/Ir3obDA246yv7J2FpmPwG4oFypkM5xe1WjlMlk90b9RBhUgXk - ylRXXLBzau6mtbPOa7LGdVyVs2DClWQo9BoK+dxEsnW+TR144O4UmZEfifJXvgQ= - =ympd + hQIMAxjNhCKPP69fAQ/+IRYUQhf7zzIZy3AKAtQgyMKRINOUUqOEv6IKmNQaaQP7 + K5JXnVi2gjgBuG+2gH9iCEimIggnWxFhHerfOps+NkAI6y7kFz5hnMtOY2Qf3vxT + Hoyq4l6Yn+gG1HSLozVr9dTQPjyGOKJkm36ZKpM7gqSuLNP2ijKARzay4Chg3i+p + E1TVTVoEczrPdLg3O2fd5mi2UT1k3E4QREti0k6K4juMWqMz+5iJ5X98qCdmE1eX + L5dmW0QSUChzBVw+7NEcxeNx5WsbhWgPA5m2+bng3V8tHqAwrRUCoxn2+yabnsZB + Z0Z7TgcLk0Xnezw+BkT3bOsKgv+atE5lm2rBiRUHRDR3S04j0Ju6fJHf24CNy5ES + xMF7BE23SgmqUq0BrvdJB0ToNKYGMM0C5Xg4vGRiE61+18TiFIeC3mF9suvFFKc+ + houq6Cy7q3O5PEqEbu6t5vXAZHwL9Th+ZatIIe9jSToiZiLEOIEmiYptR009/OWq + v6ADzaAE6+i6HZ62xBYQuZFkiUrRKxYzTHFn0A10QUJrJgbWr8QjS76oKi8feEDC + BJAOwE/0aK+l46hI6mlh6rgeSy8XdOPLEnL4+1HjlshhTTiW1rE2cr0ZiTTA6UFX + UhABIUi6jiLnM13L+auulU1UZQ8wxp73okrcuu6g2bPT/l7zO9YNOCocWVPQa5vS + XAH7qrW533ttg2XAczCdALMulV2N5GHl7TbgRQBkdoBAKL+6oKfxbOZeQM2nrfZT + arytZbnjgCcy5ygnjeziRvWwLk7sysEpAQqQNRm50m2Cq+2ccedRP6zFzUhc + =4hCA -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA46L6MuPqfJqARAAshm2x7wX/9g3XJtSN0AnSeCwSHO1I4+ebLKOsB7zcXh8 - hrVO3694jQcU9L01H7jGYw4lNNzBd61/uVE5AvMq4Sqn9iH3MFNESbAEOWVV+TRf - 53JMg9C/aZfde8gHgHPaiVXlCBVEVY9CqHpUXUKDmEE7iRb5P4DuMxOmybDYZGzY - 4c5Ke1MFMkGRmAtsT1qLrT2vh+F0CX4JwpMkxCmOzSWAXbwrVOigJ35l5zM6vme4 - 5EQu9jI8FApTxVchZbr0v3UOKxp5OebqC0jGeznZNf4qb0qnsvuowY6IIw5Tl3/q - H4TLq5EUOVqTC1voIWY/gMjieiW1gtr6vASy4MvbswsZLc26YVE9IbHzAOUWDN2o - f2iQ3aZYuINvniD23XtM0TKepDXWq5eF+AJpmyP/LL8sYvSnWFD+muK3O657djEu - yGZs2EFTrkiUvhBq3apOOYiU0eOi4Aq6UeEbOsLENnQrBRXuHEm4KUSwzOitVwJ1 - ByxQTu7wzY727SOR2hzjMC0LI602WGpEQU7ech5L4uWqtMFwaBP9HnUamcofKqqt - 1vI2BevsJfQ0rtTE6GWseHt702lllTGe3RnHWc6YsMWLwUfRdBPggMW37hAPPcfO - ytbU3RJIxx4vImRtXhkI5yvbpFQrooz1zSeXWaitPE5jmmiKe9IRStLnfiq9E2TS - XgFVuQM8K0LgUYEoAipvafhnC3ohfGsM2AYd36EoaMNLeQ2ZZEiV06/Y3EWoI0iM - aqRLwyBvTuDOc5BK32nCbAgUbbPJjPhqWaoNp5ymCBV76oW613gApkzoUF+OIUU= - =KKaI + hQIMA46L6MuPqfJqAQ/9G5pRNmw775xCYA+foCx9rM7eLXJFl2DjaI3a/O0yVc6t + 32xtPuaHwTnP00Pbbo5Vc9QG7k0Fr3Rgy+ep1lGzeCMoHwF9xk98LspDtYZoKopE + 6/L6KLldSauRv0rPVhCQHpZFsnx1VxaJiXn9vAW17+imC9SgqLYGWyrxAtLCOOqH + N68RnTsEDquXixEs82ao0EmQXPquimJgSx+xVSF4yitYYLLLHyUL+drMNuVb9q9Y + oAIdEL1svDIieTbTKGQUqZ8Alf8f/0cqPWpEkDwYIyB/i9KDkH5Oj7uBBRtVLGxQ + VxE32wO1xpXvKgUY2PhWD2rOBVDG8dW/hyqvc1WgIeo1A6FTq34b5dGC2lmTRngB + 9mBjUd59zeOvdXLmoGwXgbjVhpgnm/5wlUeiIC3xR9MjW3znRBT6ujCaglpAdXBC + 0AIugssGcuXbP9Tj5zMVlbdi2dj6Ylc8S1Tj/OjwxHCCj6AWRqpxN5vY28RiLFGy + +eAsryzPk6UTCPIydiWwsrP+w8EhbllFxzZM+Sn+fshAHdRug+EeyT3h5V5JF+Ko + BZCrZkwYqAcVkJjEYlukjvxVFvo+T6tRMz4F4yNgjqFjneUaeLCc6RllaT696H0Y + 8+lw5rK+XpcXBZqso6vsLChRdZQJjoj9lkjRDbmhOkaRglikC6Cx+mpY1/XnGvDS + XAFWOuNKjN/xIRtaDc6tmeWsKkuqghjHiMeRqw10/kTBjniMLLJIN9ssj4HjYqC3 + CsqyHqZmrbITUMr718gX1kkAvzF/fVAXT8YshOcK7rQbiMQJCZqeBp3fY7FC + =5yPR -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdA8YKD21h5POTLPf04KvGN93omFgkYO+Y8Kc0jM0vdqm8w - 3zYRaLsDjdh8Zd89/HhHJUfLrTp/IJ0n81sK0ZjznbXKxgkseGthMzof+L7BnPAp - 0l4BnAs9iZS4q2LZVS7ySBP89xLmF97qhK2jagMNSAwq8Afxbcw8oQAVQmeyYfxx - X59irIHjI1ugO4o1WnTN67nTQjU5msbVBs0eALrw3jobzFHRL67fS0a4Soa59LTY - =ZHIU + hF4DQrf1tCqiJxoSAQdAfLqKILCrCv2s2V7bLntk5lHI6Dc1FQlCg3LAefc8oTIw + a3UZU3OajQ1CCIhhu02JSlTKZm2z+pZKVHy+s5EgCqwAWTfPNAnyPT0ZGrhIdcah + 0lwBdg2Tq3+Nhix1ZuA/mUgcrbRBcFKlHY+IGEgOHKLJld9UPF2xEjTX6nmLyuTR + 6x+HW/7vVuc/jcFeQEmokhQw/SICVdyD7NQua4k1agLkty3hGcm1XCsfyKfj+w== + =Bxf9 -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DzAGzViGx4qcSAQdAN7rRlv3dMoFOfj9eHgf+0H8521b32nWqySUdriEy6Tcw - gjuReMBpKQOgUfuhIiWkHIKNtNgMrYWiC20ESOXX5b9uYZNpqHCgHQPlX0lEeGim - 0lgBOieL7mSEq4wkWLCSv4sBAmkQA+dnugBeF+TrlqKQTZsbe/Z+jNG4ZrHRvdqi - 4I5It+uaRV9Vrul1c6H7fNreRPUd4hNyJwU7gZQ+vU2WyAmgqerxE1Wb - =gplT + hF4DzAGzViGx4qcSAQdAr2tfPiCpUkxFj4rgSiLf7y4iyKbsgEY87iYH3GAZTVcw + vK2YpjSVgFRoJNx9s3bFr+9UG0LFmKvDZEP83ThQizYs2I/N7MSU8ERRImshaQMH + 0lYB4At0RHC1mp8eKqhRgXenOtpfCiBACtlIdS9m1aqcU6i9Drgt86Bk/LC/HSvJ + MUOit2PP7QZVRWV6F8wAHlUFd6bdTKv9eOCZLSB6mY6DQmkp93FIMg== + =lQcB -----END PGP MESSAGE----- fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA2pVdGTIrZI+ARAAjWK8mU99VcnM/Ckzm+YsZFTwnz4PDAenDDdZ1OOz5IXe - tS4SQPcQlSSOuXEkFLJMmm8QVxtUC3Gh4nF7o+7OygT+0ZXOrB7jFgg10+v/KVA9 - hSlqBdsMxcC0OzBtkGyAOXOxqnTVubuHEGyGpIryHt1/lthUUZHBbjgw7P0Tw2/U - sYK5j5YbqhyBl20gyZorkTTq7pHfVXDVtpe75+ZkqbOg4S6HgW3/dl+v6N0TLfRs - GVl0fUlWIK/akGCB71zdwJs2I1qTeMTlL6v+XSUdXj0YV+5fjh3wf8qzN9geIjQK - ybxGFWDKCAgTMnqoFF5BCL23hFtnCbTtLN1wQT7/m7zpjaBKHOBXZOGXYZCMGZui - sBsUvPANgNdfOse9H2aABQvUQh8WqFw8S73GasvrZHAwEmvnXzocMJd+kUovzmQu - 9FBk5UkcgXfmxeamoP8C700vh4zI+sKz6uEW0+AuVtLlLVqlb2w21kTc+ArZW52n - HLolH5q3Wj6pKuuFCWKr6UgLFcq2w4QngB2p+UABHU3RbwXIra7prDXCUcNC5iCn - ElRFY7OZ3nbHOf9oaW/MitcfszVLyl0ueoay6qxdlIGdXKRGpqxHqqr+92INV/iz - 6CRoAsTqVq1a7ZuAaUdJPvfKVAHHEHjPwlrOc9cXvykG0iQKsRzgqiOtPiGQShnU - aAEJAhDSqCwywHDnQ7X9ZWIzPjwvqyHpEVez8zYh3vpgKpsLb9uL+JizZjV02HMe - nhiL+4o/aNjJgGJWph1uPFhU4wO4AavnNBsHbJSiL/1yTS96hdf8d+gB41yVLU3e - kBkDFLKkIBkU - =aRLd + hQIMA2pVdGTIrZI+ARAAjNHCArTtU9D8zw5yJzvf0KSwQoOaQWHui7AqQkvQ8mJv + 8+Vo9sb+JoSuFHQqqDbOU+VFpmc9CZ6HCJaWqO2gZVgjxrsrPgyfq795LBd6GhX5 + 6zwUH2huxv+n7XkfjN4HHJAlSj0pRyL3fyojdOdtXCTuBGbofLIBJUbuD1wro1K+ + nSHLvdBEitn8afKt5/SaatB8Prwyet6E6J4HluXFQjl+KdrRHHvXImmhNSR4yfIr + yQt2s8qapSvLhrUw9/GFXqM/jg4ZlDhPUhCAKI2Pr5PbsRMBqwdkSrDeB7MHdsU6 + tI4uyb7j8m3VMbFKNVpuluwgk47V+W/h+jtZetSR6ewYsXJjgHNmX6JX73XzR7R+ + q4EBfSAxR7ByZ/HHuumUH6BKBj8IcNJQwtEkLIZmLZ3OdFtJP3YY0esV+gEhG6K7 + m2Zl9C7axuYmvoLrqygaChmxMhMiebTPNkD/dH5Ircwl2cXfHC+bvF2WO73DTk9G + emHzrkniEtuUs+svMhT3NKM3/mpOJTiNezdH39HZADzkBwZ5Mmkfe4mbXByfRN7F + AEJWmnOcpXwXE9//sRbkRr+CGmB86raZE22wHPuk6U9IyVFJm8hJbOzFc7rwu1Eo + 0YWBCsc9dA+jH8hIKrIfXwqnfhYjTrX+oZJeK/8McOwfF7I2G9YrPAgwbokQmtLU + ZgEJAhC8ryOvXwp2kP9sv6nbXIEcwrX8lRjkEWduf6ZAWAfQ5FGBSPzR8WnZWGzN + PCxjg7utA9AHBChF1duwOV2Qr5XW8HTUGAx4fc0T0rjC862vSwf8yAY89WWJyUfk + n8qhhdw1uw== + =KgOe -----END PGP MESSAGE----- fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 - - created_at: "2026-05-23T20:58:22Z" + - created_at: "2026-05-25T17:17:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DKKbvh61jX5USAQdABId/P8ozRgJ4ItF1zvxp98aH+g3LZ6UGnxjYjtDxjEIw - VmyerznjOLnpz0EobXRRoot1Lo82Va64HQmXt26LG3gFY1HVp0WOnIZXa/CUoUb8 - 1GgBCQIQloFxKcgFTiRidaJfN7hSeQLleiEe3aifZUyJj8niTmBaY29t+CSoA46N - xZzX1AlxVjfmputhYdTyOYSJtGrj7otmnUN2P+55pjz4L2qCYAEKi1+ibqgpmJh/ - bETQsT6WKJ8FXA== - =Ci7L + hF4DKKbvh61jX5USAQdAYrtySnoCK7k4ZZIyllSAr23fozsiZb9Nf6Q+r56i3lAw + 7IxBdJc2ipMxafy1Ntq0wfAYYk7nY6Vz1XtB+ekVeYLOjDmHRnJWq/Jw0K8wLvWT + 1GYBCQIQ/0zDLdFOrMNjVPMutGVJOkpm7mbD30GpgRugzEf2NZePGtptqnP6i1t1 + izBqFRByftV1MUw1uWgTFgB8zEVDh6gG0QAYeRuu3NS9QhwR71Wlu2J4eu+VhZi7 + AKabk3T3Z00= + =A2ad -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 47dbec7..01cdbee 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -75,6 +75,7 @@ ansible_pull_hosts: light: waybackproxy: yate: + z9-router: secrets_hosts: hosts: z9-router: From 20e8423e6082eb5248dff89642d6ea33934f7a53 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 19:50:01 +0200 Subject: [PATCH 05/38] z9-router(host): fix some spelling and a wireguard peer address --- resources/z9/z9-router/nftables/nftables.conf | 4 ++-- resources/z9/z9-router/systemd_networkd/10-wg55.netdev | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/resources/z9/z9-router/nftables/nftables.conf b/resources/z9/z9-router/nftables/nftables.conf index 842ca04..f639689 100644 --- a/resources/z9/z9-router/nftables/nftables.conf +++ b/resources/z9/z9-router/nftables/nftables.conf @@ -108,7 +108,7 @@ table inet forward { meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access" meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access" - # Allow clients and managment to most - iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "allow clients and managment to lan_ifs" + # Allow clients and management to most + iifname { $if_netlan_51_clients, $if_netlan_54_management, $if_wg55_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces" } } diff --git a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev b/resources/z9/z9-router/systemd_networkd/10-wg55.netdev index b3e41a6..f2de509 100644 --- a/resources/z9/z9-router/systemd_networkd/10-wg55.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-wg55.netdev @@ -5,7 +5,7 @@ Name=wg55 [WireGuard] ListenPort=51820 -PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_privat_key +PrivateKeyFile=/etc/ansible_secrets/wireguard_wg55_private_key # WireGuard Peers @@ -75,7 +75,7 @@ PresharedKeyFile = /etc/ansible_secrets/wireguard_wg55_peer_langoor_home_psk [WireGuardPeer] # friendly_name = lilly-lillysLaptop -AllowedIPs = 10.89.214.16/32 #,2a07:c481:1:37::/128 +AllowedIPs = 10.89.214.16/32,2a07:c481:1:37::16/128 PublicKey = IBsI+N8qUNpQnDc5HnqQ2Zo/1graFM0RMIecHmAF+Vk= [WireGuardPeer] From 151b6c5bf73c250eb103f3c7cdf1fb12adf2b01e Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 20:13:29 +0200 Subject: [PATCH 06/38] kea_dhcp(role): some fixes and removing arch part - remove tags from tasks - remove archlinux part - use debian default package for kea --- roles/kea_dhcp/defaults/main.yaml | 1 - roles/kea_dhcp/handlers/main.yml | 6 +-- roles/kea_dhcp/meta/argument_specs.yaml | 4 +- roles/kea_dhcp/tasks/install_archlinux.yml | 8 ---- roles/kea_dhcp/tasks/install_debian.yml | 39 +++++++++--------- roles/kea_dhcp/tasks/kea.yaml | 10 ++--- roles/kea_dhcp/tasks/main.yml | 6 --- roles/kea_dhcp/tasks/stork-agent.yaml | 47 +++------------------- 8 files changed, 34 insertions(+), 87 deletions(-) delete mode 100644 roles/kea_dhcp/tasks/install_archlinux.yml diff --git a/roles/kea_dhcp/defaults/main.yaml b/roles/kea_dhcp/defaults/main.yaml index 409f0a1..dc6453a 100644 --- a/roles/kea_dhcp/defaults/main.yaml +++ b/roles/kea_dhcp/defaults/main.yaml @@ -1,7 +1,6 @@ kea_dhcp__stork_agent: enable: false prometheus_only: true -kea_dhcp__version_repo: "kea-3-0" kea_dhcp__dns_servers: v6: - "2a07:c481:0:4::2" diff --git a/roles/kea_dhcp/handlers/main.yml b/roles/kea_dhcp/handlers/main.yml index 5b44d6e..d06aa1c 100644 --- a/roles/kea_dhcp/handlers/main.yml +++ b/roles/kea_dhcp/handlers/main.yml @@ -4,19 +4,19 @@ ansible.builtin.systemd_service: daemon_reload: true -- name: Kea_dhcp4.reloaded +- name: Kea_dhcp4.restarted ansible.builtin.service: name: kea-dhcp4 state: restarted enabled: true -- name: Kea_dhcp6.reloaded +- name: Kea_dhcp6.restarted ansible.builtin.service: name: kea-dhcp6 state: restarted enabled: true -- name: Kea_ctrl.reloaded +- name: Kea_ctrl.restarted ansible.builtin.systemd: name: kea-ctrl-agent state: restarted diff --git a/roles/kea_dhcp/meta/argument_specs.yaml b/roles/kea_dhcp/meta/argument_specs.yaml index 995b838..4d0d594 100644 --- a/roles/kea_dhcp/meta/argument_specs.yaml +++ b/roles/kea_dhcp/meta/argument_specs.yaml @@ -37,7 +37,7 @@ argument_specs: interfaces: type: "list" elements: "str" - default: [] + default: [ ] control-sockets: type: "list" elements: "dict" @@ -85,7 +85,7 @@ argument_specs: interfaces: type: "list" elements: "str" - default: [] + default: [ ] control-sockets: type: "list" elements: "dict" diff --git a/roles/kea_dhcp/tasks/install_archlinux.yml b/roles/kea_dhcp/tasks/install_archlinux.yml deleted file mode 100644 index 7bdb140..0000000 --- a/roles/kea_dhcp/tasks/install_archlinux.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -- name: Install Kea on Archlinux - when: ansible_facts['distribution'] == "Archlinux" - become: true - community.general.pacman: - name: kea - state: present - update_cache: false diff --git a/roles/kea_dhcp/tasks/install_debian.yml b/roles/kea_dhcp/tasks/install_debian.yml index 2ac2346..f897ddb 100644 --- a/roles/kea_dhcp/tasks/install_debian.yml +++ b/roles/kea_dhcp/tasks/install_debian.yml @@ -1,22 +1,25 @@ --- -- name: Register isc-kea apt repository - become: true - register: kea_dhcp_repo - when: ansible_facts['distribution'] == "Debian" - ansible.builtin.deb822_repository: - name: "isc-{{ kea_dhcp__version_repo }}" - uris: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/deb/debian" - suites: any-version - components: main - signed_by: "https://dl.cloudsmith.io/public/isc/{{ kea_dhcp__version_repo }}/gpg.key" - - name: Install Kea packages become: true when: ansible_facts['distribution'] == "Debian" - ansible.builtin.apt: - name: - - isc-kea-dhcp4 - - isc-kea-dhcp6 - - isc-kea-ctrl-agent - - isc-kea-admin - update_cache: "{{ kea_dhcp_install_repo.changed }}" + block: + - name: Install Kea dhcp4 + when: kea_dhcp__dhcp4.enable + ansible.builtin.apt: + name: + - isc-kea-dhcp4 + - name: Install Kea dhcp6 + when: kea_dhcp__dhcp6.enable + ansible.builtin.apt: + name: + - isc-kea-dhcp6 + - name: Install Kea ctrl agent + when: kea_dhcp__stork_agent.enable + ansible.builtin.apt: + name: + - isc-kea-ctrl-agent + - name: Install Kea admin + when: kea_dhcp__stork_agent.enable + ansible.builtin.apt: + name: + - isc-kea-admin diff --git a/roles/kea_dhcp/tasks/kea.yaml b/roles/kea_dhcp/tasks/kea.yaml index a4fd3b5..116c7dd 100644 --- a/roles/kea_dhcp/tasks/kea.yaml +++ b/roles/kea_dhcp/tasks/kea.yaml @@ -1,12 +1,10 @@ --- - name: Include config vars - tags: [ kea, include_vars ] when: kea_dhcp__include_vars is not None ansible.builtin.include_vars: file: "{{ kea_dhcp__include_vars }}" - name: Deploy kea-dhcp4 configuration file - tags: [ kea, dhcp4 ] become: true when: kea_dhcp__dhcp4.enable ansible.builtin.template: @@ -18,10 +16,9 @@ mode: "u=rw,g=r,o=" validate: kea-dhcp4 -T %s notify: - - Kea_dhcp4.reloaded + - Kea_dhcp4.restarted - name: Deploy kea-dhcp6 configuration file - tags: [ kea, dhcp6 ] become: true when: kea_dhcp__dhcp6.enable ansible.builtin.template: @@ -33,10 +30,9 @@ mode: "u=rw,g=r,o=" validate: kea-dhcp6 -T %s notify: - - Kea_dhcp6.reloaded + - Kea_dhcp6.restarted - name: Copy kea-ctrl-agent configuration file - tags: [ kea, ctrl-agent ] become: true when: kea_dhcp__stork_agent.enable ansible.builtin.template: @@ -47,5 +43,5 @@ mode: "u=rw,g=r,o=" validate: kea-ctrl-agent -t %s notify: - - Kea_ctrl.reloaded + - Kea_ctrl.restarted - Stork_agent.restarted diff --git a/roles/kea_dhcp/tasks/main.yml b/roles/kea_dhcp/tasks/main.yml index a3478fa..6fced08 100644 --- a/roles/kea_dhcp/tasks/main.yml +++ b/roles/kea_dhcp/tasks/main.yml @@ -1,11 +1,6 @@ --- - name: Setup Kea DHCP - tags: [kea, dhcp] block: - - name: Install Kea on Archlinux - when: ansible_facts['distribution'] == "Archlinux" - ansible.builtin.import_tasks: install_archlinux.yml - - name: Install Kea on Debian when: ansible_facts['distribution'] == "Debian" ansible.builtin.import_tasks: install_debian.yml @@ -14,6 +9,5 @@ ansible.builtin.include_tasks: kea.yaml - name: Run stork-agent tasks - tags: [stork-agent, monitoring] when: kea_dhcp__stork_agent.enable ansible.builtin.include_tasks: stork-agent.yaml diff --git a/roles/kea_dhcp/tasks/stork-agent.yaml b/roles/kea_dhcp/tasks/stork-agent.yaml index 916760c..0e777d4 100644 --- a/roles/kea_dhcp/tasks/stork-agent.yaml +++ b/roles/kea_dhcp/tasks/stork-agent.yaml @@ -1,55 +1,18 @@ --- - name: Install stork-agent - tags: [stork-agent] block: - - name: Install stork-agent on Archlinux - when: ansible_facts['distribution'] == "Archlinux" - tags: [stork-agent, archlinux] - block: - - name: Create stork-agent user - ansible.builtin.user: - name: stork-agent - create_home: false - home: "/var/lib/stork-agent" - shell: "/usr/bin/nologin" - system: true - groups: ["kea"] - append: true - - - name: Install stork-agent with aur_pkg_install - ansible.builtin.include_role: - name: aur_pkg_install - vars: - aur_pkg_install__pkg_name: "stork-agent" - aur_pkg_install__git_clone_url: "https://ansible:{{ secret__ansible_git_token }}@git.fux-eg.net/aur-mirror/stork-agent.git" - aur_pkg_install__git_ref: "bf96e34" - - - name: Install stork-agent on Debian + - name: Install isc-stork-agent when: ansible_facts['distribution'] == "Debian" - tags: [stork-agent, debian] - block: - - name: Register isc-stork apt repository - become: true - register: "kea_dhcp_install_repo" - ansible.builtin.deb822_repository: - name: isc-stork - uris: https://dl.cloudsmith.io/public/isc/stork/deb/debian - suites: any-version - components: main - signed_by: https://dl.cloudsmith.io/public/isc/stork/gpg.key - - - name: Install isc-stork-agent - become: true - ansible.builtin.apt: - name: isc-stork-agent - update_cache: "{{ kea_dhcp_install_repo.changed }}" + become: true + ansible.builtin.apt: + name: isc-stork-agent - name: Add stork-agent user to _kea group on Debian when: ansible_facts['distribution'] == "Debian" become: true ansible.builtin.user: name: stork-agent - groups: ["_kea"] + groups: [ "_kea" ] append: true - name: Config for stork-agent From 117b11b773efbcce298ed64e4154e23a7e1eba6a Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 21:18:56 +0200 Subject: [PATCH 07/38] kea_dhcp(role): add README.md --- roles/kea_dhcp/README.md | 102 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 102 insertions(+) create mode 100644 roles/kea_dhcp/README.md diff --git a/roles/kea_dhcp/README.md b/roles/kea_dhcp/README.md new file mode 100644 index 0000000..4071943 --- /dev/null +++ b/roles/kea_dhcp/README.md @@ -0,0 +1,102 @@ +# Role `kea_dhcp` + +Install and manage kea dhcp. + +## Supported Distributions + +Should work on Debian-based distributions. + +## Required Arguments + +None. + +## Optional Arguments + +- `kea_dhcp__stork_agent.enable`: Enable Kea DHCP stork agent. + Defaults to `false`. +- `kea_dhcp__stork_agent.prometheus_only`: Only enable the prometheus endpoint in stork agent. + Defaults to `true`. +- `kea_dhcp__dns_servers.v4`: List of IPv4 DNS Servers in DHCP response. + Defaults to FUX DNS Servers. +- `kea_dhcp__dns_servers.v6`: List of IPv6 DNS Servers in DHCP response. + Defaults to FUX DNS Servers. +- `kea_dhcp__include_vars`: Path to YAML File to separately load VARs for Kea config templating. +- `kea_dhcp__dhcp4.enable`: Enable Kea DHCP4 Service. + Defaults to `false`. +- `kea_dhcp__dhcp4.interfaces`: List of interfaces the DHCP4 Server should listen to and serve. + Defaults to the empty list (`[ ]`). +- `kea_dhcp__dhcp4.control-sockets`: List of Kea DHCP4 control sockets. + Defaults to the list with one entry (see below). +- `kea_dhcp__dhcp4.control-sockets.*.socket-name`: Control socket name. + Defaults to `kea_dhcp__dhcp4.control-sockets.0.socket-name: /var/run/kea-dhcp4-ctrl-agent.sock`. +- `kea_dhcp__dhcp4.control-sockets.*.socket-type`: Control socket type. + Defaults to `kea_dhcp__dhcp4.control-sockets.0.socket-type: unix`. +- `kea_dhcp__dhcp4.lease-database.type`: Type of lease database. + Defaults to `memfile`. +- `kea_dhcp__dhcp4.lease-database.persist`: Persist the lease database. + Defaults to `true`. +- `kea_dhcp__dhcp4.option-data`: List of DHCP4 Options. + Defaults to a list with one entry (see below). +- `kea_dhcp__dhcp4.option-data.*.name`: Name of DHCP4 Option. + Defaults to `kea_dhcp__dhcp4.option-data.0.name: "domain-name-servers"`. +- `kea_dhcp__dhcp4.option-data.*.code`: DHCP4 Option code. + Defaults to `kea_dhcp__dhcp4.option-data.0.code: 6`. +- `kea_dhcp__dhcp4.option-data.*.csv-format`: DHCP4 Option as csv format. + Defaults to `kea_dhcp__dhcp4.option-data.0.csv-format: true`. +- `kea_dhcp__dhcp4.option-data.*.data`: DHCP4 Option data. + Defaults to `kea_dhcp__dhcp4.option-data.0.data: "{{ kea_dhcp__dns_servers.v4 | join(',') }}"`. +- `kea_dhcp__dhcp4.subnets`: List of subnets the DHCP4 server should manage. + Defaults to the empty list (`[ ]`). +- `kea_dhcp__dhcp4.subnets.*.id`: ID of interface (starts with 1). +- `kea_dhcp__dhcp4.subnets.*.subnet`: Subnet on interface. +- `kea_dhcp__dhcp4.subnets.*.pools`: List of DHCP pools in subnet. +- `kea_dhcp__dhcp4.subnets.*.pools.*.pool`: DHCP pool in range format. +- `kea_dhcp__dhcp4.subnets.*.reservations`: List of DHCP lease reservations. +- `kea_dhcp__dhcp4.subnets.*.reservations.*.ip-address`: IP address of reservation. +- `kea_dhcp__dhcp4.subnets.*.reservations.*.hostname`: Hostname of reservation. +- `kea_dhcp__dhcp4.subnets.*.reservations.*.hw-address`: Hardware address of reservation. +- `kea_dhcp__dhcp4.subnets.*.option-data`: List of DHCP lease reservations. +- `kea_dhcp__dhcp4.subnets.*.option-data.*.name`: Name of DHCP4 Option. +- `kea_dhcp__dhcp4.subnets.*.option-data.*.code`: DHCP4 Option code. +- `kea_dhcp__dhcp4.subnets.*.option-data.*.csv-format`: DHCP4 Option as csv format. +- `kea_dhcp__dhcp4.subnets.*.option-data.*.data`: DHCP4 Option data. +- `kea_dhcp__dhcp6.enable`: Enable Kea DHCP6 Service. + Defaults to `false`. +- `kea_dhcp__dhcp6.interfaces`: List of interfaces the DHCP6 Server should listen to and serve. + Defaults to the empty list (`[ ]`). +- `kea_dhcp__dhcp6.control-sockets`: List of Kea DHCP6 control sockets. + Defaults to the list with one entry (see below). +- `kea_dhcp__dhcp6.control-sockets.*.socket-name`: Control socket name. + Defaults to `kea_dhcp__dhcp6.control-sockets.0.socket-name: /var/run/kea-dhcp6-ctrl-agent.sock`. +- `kea_dhcp__dhcp6.control-sockets.*.socket-type`: Control socket type. + Defaults to `kea_dhcp__dhcp6.control-sockets.0.socket-type: unix`. +- `kea_dhcp__dhcp6.lease-database.type`: Type of lease database. + Defaults to `memfile`. +- `kea_dhcp__dhcp6.lease-database.persist`: Persist the lease database. + Defaults to `true`. +- `kea_dhcp__dhcp6.option-data`: List of DHCP6 Options. + Defaults to a list with one entry (see below). +- `kea_dhcp__dhcp6.option-data.*.name`: Name of DHCP6 Option. + Defaults to `kea_dhcp__dhcp6.option-data.0.name: "domain-name-servers"`. +- `kea_dhcp__dhcp6.option-data.*.code`: DHCP6 Option code. + Defaults to `kea_dhcp__dhcp6.option-data.0.code: 6`. +- `kea_dhcp__dhcp6.option-data.*.csv-format`: DHCP6 Option as csv format. + Defaults to `kea_dhcp__dhcp6.option-data.0.csv-format: true`. +- `kea_dhcp__dhcp6.option-data.*.data`: DHCP6 Option data. + Defaults to `kea_dhcp__dhcp6.option-data.0.data: "{{ kea_dhcp__dns_servers.v6 | join(',') }}"`. +- `kea_dhcp__dhcp6.subnets`: List of subnets the DHCP6 server should manage. + Defaults to the empty list (`[ ]`). +- `kea_dhcp__dhcp6.subnets.*.id`: ID of interface (starts with 1). +- `kea_dhcp__dhcp6.subnets.*.subnet`: Subnet on interface. +- `kea_dhcp__dhcp6.subnets.*.pools`: List of DHCP pools in subnet. +- `kea_dhcp__dhcp6.subnets.*.pools.*.pool`: DHCP pool in range format. +- `kea_dhcp__dhcp6.subnets.*.reservations`: List of DHCP lease reservations. +- `kea_dhcp__dhcp6.subnets.*.reservations.*.ip-address`: IP address of reservation. +- `kea_dhcp__dhcp6.subnets.*.reservations.*.hostname`: Hostname of reservation. +- `kea_dhcp__dhcp6.subnets.*.reservations.*.hw-address`: Hardware address of reservation. +- `kea_dhcp__dhcp6.subnets.*.option-data`: List of DHCP lease reservations. +- `kea_dhcp__dhcp6.subnets.*.option-data.*.name`: Name of DHCP6 Option. +- `kea_dhcp__dhcp6.subnets.*.option-data.*.code`: DHCP6 Option code. +- `kea_dhcp__dhcp6.subnets.*.option-data.*.csv-format`: DHCP6 Option as csv format. +- `kea_dhcp__dhcp6.subnets.*.option-data.*.data`: DHCP6 Option data. + From 95aa6e37f167f85f29ec6d9c5f1b6eacfc8d44e5 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 25 May 2026 21:27:25 +0200 Subject: [PATCH 08/38] kea_dhcp(role): fix indentation in template --- roles/kea_dhcp/templates/kea-dhcp4.conf.jinja | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja index 78f06ae..fa7cfd5 100644 --- a/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja +++ b/roles/kea_dhcp/templates/kea-dhcp4.conf.jinja @@ -3,12 +3,12 @@ "interfaces-config": { "interfaces": {{ kea_dhcp__dhcp4.interfaces | to_nice_json }} }, - "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json }}, - "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json }}, - {% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %} - "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json }}, - {% endif %} - "subnet4": [ + "control-sockets": {{ kea_dhcp__dhcp4['control-sockets'] | to_nice_json }}, + "lease-database": {{ kea_dhcp__dhcp4['lease-database'] | to_nice_json }}, + {% if kea_dhcp__dhcp4['option-data'] is defined and kea_dhcp__dhcp4['option-data'] %} + "option-data": {{ kea_dhcp__dhcp4['option-data'] | to_nice_json }}, + {% endif %} + "subnet4": [ {% for subnet in kea_dhcp__dhcp4.subnets %} { "id": {{ subnet.id }}, From 4c802c808185ab03c58759b5708a4386c861fddc Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 08:37:40 +0200 Subject: [PATCH 09/38] kea_dhcp(role): make stork-agent.env smaller and add link to documentation --- roles/kea_dhcp/README.md | 2 +- .../kea_dhcp/templates/stork-agent.env.jinja | 30 ++----------------- 2 files changed, 4 insertions(+), 28 deletions(-) diff --git a/roles/kea_dhcp/README.md b/roles/kea_dhcp/README.md index 4071943..9938cf9 100644 --- a/roles/kea_dhcp/README.md +++ b/roles/kea_dhcp/README.md @@ -1,6 +1,6 @@ # Role `kea_dhcp` -Install and manage kea dhcp. +Install and manage Kea DHCP and [Stork Agent](https://stork.readthedocs.io/en/latest/man/stork-agent.8.html). ## Supported Distributions diff --git a/roles/kea_dhcp/templates/stork-agent.env.jinja b/roles/kea_dhcp/templates/stork-agent.env.jinja index bdfa4d2..75250b0 100644 --- a/roles/kea_dhcp/templates/stork-agent.env.jinja +++ b/roles/kea_dhcp/templates/stork-agent.env.jinja @@ -1,11 +1,6 @@ -### the IP or hostname to listen on for incoming Stork server connections -# STORK_AGENT_HOST= +### Stork Agent env file +### (created and managed by ansible kea_dhcp role) -### the TCP port to listen on for incoming Stork server connections -# STORK_AGENT_PORT=8081 - -### listen for commands from the Stork server only, but not for Prometheus requests -# STORK_AGENT_LISTEN_STORK_ONLY=true {% if kea_dhcp__stork_agent.prometheus_only %} ### listen for Prometheus requests only, but not for commands from the Stork server @@ -14,31 +9,12 @@ STORK_AGENT_LISTEN_PROMETHEUS_ONLY=true ### settings for exporting stats to Prometheus ### the IP or hostname on which the agent exports Kea statistics to Prometheus -# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS= +STORK_AGENT_PROMETHEUS_KEA_EXPORTER_ADDRESS=localhost ### the port on which the agent exports Kea statistics to Prometheus # STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PORT= -## enable or disable collecting per-subnet stats from Kea -# STORK_AGENT_PROMETHEUS_KEA_EXPORTER_PER_SUBNET_STATS=true -### the IP or hostname on which the agent exports BIND 9 statistics to Prometheus -# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_ADDRESS= -### the port on which the agent exports BIND 9 statistics to Prometheus -# STORK_AGENT_PROMETHEUS_BIND9_EXPORTER_PORT= - -### Stork Server URL used by the agent to send REST commands to the server during agent registration -# STORK_AGENT_SERVER_URL= - -### skip TLS certificate verification when the Stork Agent connects -### to Kea over TLS and Kea uses self-signed certificates -# STORK_AGENT_SKIP_TLS_CERT_VERIFICATION=true - ### Logging parameters ### Set logging level. Supported values are: DEBUG, INFO, WARN, ERROR STORK_LOG_LEVEL=DEBUG -### disable output colorization -# CLICOLOR=false - -### path to the hook directory -# STORK_AGENT_HOOK_DIRECTORY= From e649933337b05fbd6b3747bcd1fa80c5812f686a Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:06:52 +0200 Subject: [PATCH 10/38] unbound(role): use existing deploy_systemd_resolved_config role and some reordering --- inventories/z9/hosts.yaml | 3 +++ roles/unbound/handlers/main.yml | 7 ------ roles/unbound/tasks/main.yml | 24 +++---------------- roles/unbound/tasks/prometheus-exporter.yml | 8 ++++++- .../vars/deploy_systemd_resolved_config.yaml | 9 +++++++ 5 files changed, 22 insertions(+), 29 deletions(-) create mode 100644 roles/unbound/vars/deploy_systemd_resolved_config.yaml diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 01cdbee..47254ea 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -18,6 +18,9 @@ all: z9-router: ansible_host: z9-router.ccchh.net ansible_user: chaos +base_config_hosts: + hosts: + z9-router: certbot_hosts: hosts: dooris: diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml index e1345bf..222e8c5 100644 --- a/roles/unbound/handlers/main.yml +++ b/roles/unbound/handlers/main.yml @@ -18,10 +18,3 @@ name: prometheus-unbound-exporter.service state: restarted enabled: true - -- name: prometheus-unbound-exporter.enabled - become: true - ansible.builtin.systemd: - name: prometheus-unbound-exporter.service - enabled: true - daemon_reload: true diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index 7ed42cb..eb88f93 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -7,11 +7,6 @@ ansible.builtin.package: name: unbound - - name: install extra dns tooling - become: true - ansible.builtin.package: - name: [ bind ] # the bind package includes tools like dig in archlinux - - name: ensure correct directory permissions become: true ansible.builtin.file: @@ -40,23 +35,10 @@ enabled: true - name: disable systemd-resolved - become: true when: unbound_disable_systemd_networkd - ansible.builtin.systemd: - name: systemd-resolved.service - state: stopped - enabled: false - - - name: configure system resolver to point to local unbound - become: true - when: unbound_disable_systemd_networkd - ansible.builtin.copy: - src: no-resolved.resolv.conf - dest: /etc/resolv.conf - owner: unbound - group: unbound - mode: u=rw,g=r,o=r - + ansible.builtin.include_role: + name: deploy_systemd_resolved_config + vars_from: deploy_systemd_resolved_config - name: install and configure prometheus-exporter for unbound ansible.builtin.import_tasks: prometheus-exporter.yml diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml index d05b838..b794e07 100644 --- a/roles/unbound/tasks/prometheus-exporter.yml +++ b/roles/unbound/tasks/prometheus-exporter.yml @@ -3,7 +3,13 @@ become: true ansible.builtin.package: name: prometheus-unbound-exporter - notify: prometheus-unbound-exporter.enabled + +- name: enable unbound prometheus exporter + become: true + ansible.builtin.systemd: + name: prometheus-unbound-exporter.service + enabled: true + daemon_reload: true - name: configure unbound exporter become: true diff --git a/roles/unbound/vars/deploy_systemd_resolved_config.yaml b/roles/unbound/vars/deploy_systemd_resolved_config.yaml new file mode 100644 index 0000000..0da57c1 --- /dev/null +++ b/roles/unbound/vars/deploy_systemd_resolved_config.yaml @@ -0,0 +1,9 @@ +--- +deploy_systemd_resolved_config__enable: false +deploy_systemd_resolved_config__dns: + - 127.0.0.1 +deploy_systemd_resolved_config__fallback_dns: # Fux DNS Server + - 185.161.128.66 + - 2a07:c481:0:4::2 + - 185.161.128.67 + - 2a07:c481:0:4::3 From a602ed9f9e035b897b800f9eddf19b98f2466031 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:08:11 +0200 Subject: [PATCH 11/38] unbound(role): add FIXME note to unbound prometheus exporter install --- roles/unbound/tasks/prometheus-exporter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml index b794e07..fba5090 100644 --- a/roles/unbound/tasks/prometheus-exporter.yml +++ b/roles/unbound/tasks/prometheus-exporter.yml @@ -1,5 +1,5 @@ --- -- name: install unbound prometheus exporter +- name: install unbound prometheus exporter # FIXME: there is no prometheus-unbound-exporter in debian .deb exists in https://github.com/letsencrypt/unbound_exporter/releases/tag/v0.6.0 become: true ansible.builtin.package: name: prometheus-unbound-exporter From cfb06cdc9f987160e0fe8f75ca9349faf1324603 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:09:50 +0200 Subject: [PATCH 12/38] unbound(role): remove tags inside role --- roles/unbound/handlers/main.yml | 2 -- roles/unbound/tasks/main.yml | 1 - 2 files changed, 3 deletions(-) diff --git a/roles/unbound/handlers/main.yml b/roles/unbound/handlers/main.yml index 222e8c5..09af699 100644 --- a/roles/unbound/handlers/main.yml +++ b/roles/unbound/handlers/main.yml @@ -1,12 +1,10 @@ - name: unbound.restarted - tags: [ unbound, dns, dns_resolver ] become: true ansible.builtin.systemd: name: unbound.service state: restarted - name: unbound.reloaded - tags: [ unbound, dns, dns_resolver ] become: true ansible.builtin.systemd: name: unbound.service diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index eb88f93..a4a6896 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -1,5 +1,4 @@ - name: unbound role main - tags: [ unbound, dns, dns_resolver ] block: - name: install unbound dns resolver From fb397541e4d20d4eec61c193911c78d149ec2a57 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:19:42 +0200 Subject: [PATCH 13/38] unbound(role): reformat config template and use all vcpus --- roles/unbound/templates/unbound.conf.j2 | 75 ++++++++++++------------- 1 file changed, 35 insertions(+), 40 deletions(-) diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2 index a1e310e..96aa9cd 100644 --- a/roles/unbound/templates/unbound.conf.j2 +++ b/roles/unbound/templates/unbound.conf.j2 @@ -1,22 +1,18 @@ # ref: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html # unbound.conf(5) man page server: - {% if unbound_enable_dnssec -%} - # disable chroot because unbound is the only thing running on the VM - # and because it has issues with how archlinux configures the systemd units write protection regarding the anchor file - chroot: "" - - # location of the trust anchor file that enables DNSSEC - # this file is generated by the `unbound-anchor` command - auto-trust-anchor-file: "/etc/unbound/trusted-key.key" - {% endif -%} + {% if unbound_enable_dnssec -%} + # location of the trust anchor file that enables DNSSEC + # this file is generated by the `unbound-anchor` command + auto-trust-anchor-file: "/etc/unbound/trusted-key.key" + {% endif -%} # use all CPUs - num-threads: 2 + num-threads: {{ ansible_facts['processor_vcpus'] }} # more cache memory - rrset-cache-size: 60m - msg-cache-size: 30m + rrset-cache-size: 60m + msg-cache-size: 30m # prefetch to keep the cache up to date prefetch: yes @@ -25,49 +21,48 @@ server: prefetch-key: yes # Faster UDP with multithreading (only on Linux). - so-reuseport: yes + so-reuseport: yes # disable special large send buffer handling and just use kernel defaults - so-sndbuf: 0 + so-sndbuf: 0 - # send minimal amount of information to upstream servers to enhance privacy - qname-minimisation: yes + # send minimal amount of information to upstream servers to enhance privacy + qname-minimisation: yes - # specify the interface to answer queries from by ip-address. - {% for i in unbound_bind_interfaces -%} - interface: "{{ i }}" - {% endfor %} + # specify the interface to answer queries from by ip-address. + {% for i in unbound_bind_interfaces -%} + interface: "{{ i }}" + {% endfor %} - # addresses from the IP range that are allowed to connect to the resolver - {% for i in unbound_access_control -%} - access-control: {{ i }} - {% endfor -%} + # addresses from the IP range that are allowed to connect to the resolver + {% for i in unbound_access_control -%} + access-control: {{ i }} + {% endfor -%} - {% for i in unbound_private_domain -%} - private-domain: {{ i }} - {% endfor -%} + {% for i in unbound_private_domain -%} + private-domain: {{ i }} + {% endfor -%} - # The number of seconds between printing statistics to the log for every thread. - statistics-interval: 0 + # The number of seconds between printing statistics to the log for every thread. + statistics-interval: 0 - # Extended statistics are printed, Keeping track of more statistics takes time. - extended-statistics: yes + # Extended statistics are printed, Keeping track of more statistics takes time. + extended-statistics: yes remote-control: - control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} - control-interface: /run/unbound-control.sock + control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} + control-interface: /run/unbound-control.sock # configure some zones for which this resolver will act authoritatively # https://www.dns.icann.org/services/axfr/ {% for i in [ ".", "in-addr.arpa.", "arpa.", "root-servers.net.", "ip6.arpa.", "ip6-servers.arpa.", "mcast.net." ] %} auth-zone: - name: "{{ i }}" - primary: "lax.xfr.dns.icann.org" - primary: "iad.xfr.dns.icann.org" - fallback-enabled: yes - for-downstream: no - for-upstream: yes - + name: "{{ i }}" + primary: "lax.xfr.dns.icann.org" + primary: "iad.xfr.dns.icann.org" + fallback-enabled: yes + for-downstream: no + for-upstream: yes {% endfor %} From a0d9fc2e77b1070a108cf87763ab9408204054a1 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:30:35 +0200 Subject: [PATCH 14/38] unbound(role): make unbound thread number configurable --- roles/unbound/README.md | 1 + roles/unbound/templates/unbound.conf.j2 | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/unbound/README.md b/roles/unbound/README.md index 806b9d8..c44805b 100644 --- a/roles/unbound/README.md +++ b/roles/unbound/README.md @@ -17,3 +17,4 @@ The following variables can be used to customize this role: | unbound_enable_dnssec | Boolean | `true` | Whether dnssec validation should be enabled | | unbound_access_control | List of Strings | `[]` | **Required** List of [unbound access control values](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#:~:text=access-control:%20%3CIP%20netblock%3E%20%3Caction%3E) | | unbound_disable_systemd_networkd | Boolean | `true` | If true, systemd-networkd is disabled and the local system is pointed towards the configured dns resolver. | +| unbound_thread_count | Integer | Max vCPU Count | The number of threads unbound uses | diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2 index 96aa9cd..d9b612c 100644 --- a/roles/unbound/templates/unbound.conf.j2 +++ b/roles/unbound/templates/unbound.conf.j2 @@ -7,8 +7,8 @@ server: auto-trust-anchor-file: "/etc/unbound/trusted-key.key" {% endif -%} - # use all CPUs - num-threads: {{ ansible_facts['processor_vcpus'] }} + # num of threads + num-threads: {{ unbound_thread_count | default(ansible_facts['processor_vcpus']) }} # more cache memory rrset-cache-size: 60m From 5e857dd5e7d9194bc7dd45417d1370c2d61dec65 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 10:43:56 +0200 Subject: [PATCH 15/38] unbound(role): move resolvd vars to task --- roles/unbound/tasks/main.yml | 5 ++++- roles/unbound/vars/deploy_systemd_resolved_config.yaml | 9 --------- 2 files changed, 4 insertions(+), 10 deletions(-) delete mode 100644 roles/unbound/vars/deploy_systemd_resolved_config.yaml diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index a4a6896..3b038c6 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -37,7 +37,10 @@ when: unbound_disable_systemd_networkd ansible.builtin.include_role: name: deploy_systemd_resolved_config - vars_from: deploy_systemd_resolved_config + vars: + deploy_systemd_resolved_config__enable: false + deploy_systemd_resolved_config__dns: + - 127.0.0.1 - name: install and configure prometheus-exporter for unbound ansible.builtin.import_tasks: prometheus-exporter.yml diff --git a/roles/unbound/vars/deploy_systemd_resolved_config.yaml b/roles/unbound/vars/deploy_systemd_resolved_config.yaml deleted file mode 100644 index 0da57c1..0000000 --- a/roles/unbound/vars/deploy_systemd_resolved_config.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -deploy_systemd_resolved_config__enable: false -deploy_systemd_resolved_config__dns: - - 127.0.0.1 -deploy_systemd_resolved_config__fallback_dns: # Fux DNS Server - - 185.161.128.66 - - 2a07:c481:0:4::2 - - 185.161.128.67 - - 2a07:c481:0:4::3 From be71af3a2f77400a3ac392fab8164e5f1e863b1f Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Tue, 26 May 2026 11:13:28 +0200 Subject: [PATCH 16/38] z9(group): remove all z9 references as subdomain --- inventories/z9/group_vars/all.yaml | 2 +- inventories/z9/host_vars/light.sops.yaml | 11 +++++------ inventories/z9/host_vars/light.yaml | 6 ------ inventories/z9/hosts.yaml | 6 ++++-- resources/z9/light/nginx/light.conf | 17 ----------------- 5 files changed, 10 insertions(+), 32 deletions(-) diff --git a/inventories/z9/group_vars/all.yaml b/inventories/z9/group_vars/all.yaml index 20a4e7f..5cc3233 100644 --- a/inventories/z9/group_vars/all.yaml +++ b/inventories/z9/group_vars/all.yaml @@ -40,7 +40,7 @@ alloy_config_default: | source_labels = ["instance"] target_label = "instance" regex = "([^:]+)" - replacement = "${1}.z9.ccchh.net" + replacement = "${1}.ccchh.net" action = "replace" } } diff --git a/inventories/z9/host_vars/light.sops.yaml b/inventories/z9/host_vars/light.sops.yaml index afb4c68..76e103c 100644 --- a/inventories/z9/host_vars/light.sops.yaml +++ b/inventories/z9/host_vars/light.sops.yaml @@ -1,11 +1,9 @@ ansible_pull__age_private_key: ENC[AES256_GCM,data:VEGxr8C7RlEhyQhf+to/OrbfPPKkyL7iUU1yDXGAzmmPCQ4VftK71eiyN7OS6pG8J89Mj4Sy/dcY4SUX+rTl/q1csZMn9t4NBN8=,iv:JcrdyFLX5srZfRj9SA+RXf+CRZi5GEcApgyYsHoHTGE=,tag:xdJ4GmK3afZDkXmkrriStg==,type:str] secret__acme_dns_api_key_light_ccchh_net: ENC[AES256_GCM,data:SLUNVJQ4Nkos+tYH0l9ndJI8mrfZFC9i/qQqkcHgfLaNjL1tFuAFfQ==,iv:cc7DsiqzMlc2lh3D63cElMQcOeYT7oNxmRy7irSr9/s=,tag:dBnTAJXvgWlmq5vVGxrykw==,type:str] -secret__acme_dns_api_key_light_z9_ccchh_net: ENC[AES256_GCM,data:m6+Sk533qTRfhrwv7U2RydJh/j7KjJKHiEetyzgvJV1dgWXmE5AhYA==,iv:lAGv4vfxA+DQfwaHiDp3NMel0tjmZl96nKUAN8QGFe4=,tag:h0wM/F9E4dIy+NYLIVUpxg==,type:str] secret__acme_dns_api_key_light_werkstatt_ccchh_net: ENC[AES256_GCM,data:zJ9hQo1jmQ5+d0oU+CD+cQh89HshPpguZCak7Nfjdb2bygUXJrEIIw==,iv:y+FSB/k5LixKJOm9egWsjhByQAdv7TfJHvv3job2oYg=,tag:CmuUqnCI3V/aOOUitzYT9Q==,type:str] sops: age: - - recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSNzBtc3lkZHlqeTFIa2RX ZWgyV0lZQ0wxRm4vZ0Q3Y1d4RTlhYzk0ZUdzCkQ5VjdlSldCc0ZqZlBIOTMrclV6 @@ -13,8 +11,9 @@ sops: azNiRDFuU2V4V25iV3dORW42UGZPRmsKOsa+36+NKjmS8xMAoCueJdhIIUtdhl15 3grlxNwv4axlKNy1ynSSmneyAZ6g+OF80b4YNxzZYcfnECB1VnDENA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-11T01:24:10Z" - mac: ENC[AES256_GCM,data:D7qAgDZX8B0oNdZovHE74sSZI5X3qd8oDPHWl13Q2ohLnp9vJsFxrKntXxeeHASzQceDv2RQ1exwq7ZPor62sLFx+xO1Dc0Awpq1eoclDlHPyKlvT3pgkcB8IxDO/FuO+7hg/bJkmTHhbHTiHLGQDWN2sQev309Eka86lQyCzIQ=,iv:OBCobeUp+GwdDQhrNtTJhiRVMxRJafq5g1rhMoEFhjc=,tag:OSAWMn2NPZnVKcRX+eJf+Q==,type:str] + recipient: age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q + lastmodified: "2026-05-26T09:09:21Z" + mac: ENC[AES256_GCM,data:NGVGI70dGuJS4qMfpy3tE9MTvX9O8Rwt+Nv+gdqLUkleMEe8sWKbAgfFyWIYxroo7AXFEl3jIFQ7pmcvnSTUBprR7mL3//3QcXQXthxW/mVCf4DRtr7fcqAtctTrC2iRZnZ1YrOz/sSO7G0bgmcx43tYDZPZ+udNKO2pvZvclCE=,iv:xvDS6QVfOPcLk0C12YES2CVKCs6pWl7xPReWtgCyMIw=,tag:pXfFkbWWQpMlwE6g6nO2hQ==,type:str] pgp: - created_at: "2026-05-20T02:08:48Z" enc: |- @@ -187,4 +186,4 @@ sops: -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted - version: 3.12.2 + version: 3.13.1 diff --git a/inventories/z9/host_vars/light.yaml b/inventories/z9/host_vars/light.yaml index c14515d..2fb01e3 100644 --- a/inventories/z9/host_vars/light.yaml +++ b/inventories/z9/host_vars/light.yaml @@ -67,12 +67,6 @@ certbot__certs: subdomain: "e59f55ee-9013-469d-a146-a159721b6fea" apiUser: "33e96ec7-1f98-4f70-92be-85a42dabd211" apiKey: "{{ secret__acme_dns_api_key_light_ccchh_net }}" - - commonName: "light.z9.ccchh.net" - challengeType: "dns-01-acme-dns" - dns_01_acme_dns: - subdomain: "3bc9e7ce-03dd-4533-a059-b5d38407eaa5" - apiUser: "c3b00882-ca2a-4d11-9ebd-fccfb8618b75" - apiKey: "{{ secret__acme_dns_api_key_light_z9_ccchh_net }}" - commonName: "light-werkstatt.ccchh.net" challengeType: "dns-01-acme-dns" dns_01_acme_dns: diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 47254ea..237a8cc 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -1,14 +1,16 @@ all: hosts: dooris: - ansible_host: dooris.z9.ccchh.net + ansible_host: dooris.ccchh.net ansible_user: chaos light: - ansible_host: light.z9.ccchh.net + ansible_host: light.ccchh.net ansible_user: chaos opensourcetorrents: ansible_host: opensourcetorrents.ccchh.net ansible_user: chaos + thinkcccore0: + ansible_host: thinkcccore0.ccchh.net waybackproxy: ansible_host: waybackproxy.ccchh.net ansible_user: chaos diff --git a/resources/z9/light/nginx/light.conf b/resources/z9/light/nginx/light.conf index 6217e04..8d90258 100644 --- a/resources/z9/light/nginx/light.conf +++ b/resources/z9/light/nginx/light.conf @@ -25,23 +25,6 @@ server { } } -server { - listen 443 ssl; - listen [::]:443 ssl; - http2 on; - - server_name light.z9.ccchh.net; - - ssl_certificate /etc/letsencrypt/live/light.z9.ccchh.net/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/light.z9.ccchh.net/privkey.pem; - # verify chain of trust of OCSP response using Root CA and Intermediate certs - ssl_trusted_certificate /etc/letsencrypt/live/light.z9.ccchh.net/chain.pem; - - location / { - return 307 https://light.ccchh.net$request_uri; - } -} - server { listen 443 ssl; listen [::]:443 ssl; From 1fbc9031255c4a300f674f99353c59c3c04800ae Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 20 Jun 2026 17:58:25 +0200 Subject: [PATCH 17/38] z9(group): remove all old ip references and change them to new ones --- .../chaosknoten/auth-dns/zones/ccchh.net.zone | 106 +++++++++++++++--- resources/z9/light/nginx/light.conf | 4 +- .../z9/yate/docker_compose/regexroute.conf.j2 | 2 +- resources/z9/z9-router/kea_dhcp.yaml | 25 ++++- 4 files changed, 118 insertions(+), 19 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index 2a69ea8..9151920 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -16,6 +16,8 @@ $TTL 60 ; 1 minutes ; rt-wan A 185.161.129.134 AAAA 2a07:c481::1:2 +z9-router A 10.89.213.1 + AAAA 2a07:c481:1:36::1 sw-rack-1 A 10.89.213.2 AAAA 2a07:c481:1:36::2 sw-rack-2-poe A 10.89.213.3 @@ -41,27 +43,100 @@ pve04 A 10.89.213.14 pbs A 10.89.213.15 AAAA 2a07:c481:1:36::15 unifi A 10.89.213.21 +; AAAA 2a07:c481:1:36::21 ; ; Club-Services ; -xr18 A 172.31.200.21 +xr18 A 10.89.208.15 +AtemMini A 10.89.212.234 -;club-assistant AAAA 2a07:c481:1:d0::a -;;_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de -;esphome AAAA 2a07:c481:1:d0::66 -;zigbee2mqtt A 185.161.129.132 -;light AAAA 2a07:c481:1:d0::16 -;_acme-challenge.light CNAME e59f55ee-9013-469d-a146-a159721b6fea.auth.acmedns.hamburg.ccc.de. -;light-werkstatt AAAA 2a07:c481:1:d0::16 -;_acme-challenge.light-werkstatt CNAME f408acc0-d9f5-4525-bb01-28938e3bb7d0.auth.acmedns.hamburg.ccc.de. -;hmdooris-ccu A 10.31.208.202 -;buba A 10.31.211.137 -;dooris AAAA 2a07:c481:1:d0::1c -;_acme-challenge.dooris CNAME 37caae1f-b77f-4eb1-aa71-dc3f7ed24360.auth.acmedns.hamburg.ccc.de. -;yate A 10.31.208.12 -;staubiv2 A 10.31.210.233 +beamer A 10.89.208.11 +ir-bridge-beamer A 10.89.212.213 +Big-Room-Beamer A 10.89.208.14 + +prusamk3 A 10.89.212.3 +prusamk4 A 10.89.212.4 + +wled-kueche A 10.89.212.33 +wled-serverschrank A 10.89.212.34 +wled-couch A 10.89.212.35 + +laser A 10.89.212.36 +laser-eth A 10.89.212.37 + +okilaser A 10.89.212.235 + +t-mix A 10.89.212.42 +fritz-fon A 10.89.212.86 + +staubi A 10.89.212.232 +staubiv2 A 10.89.212.233 + +hp-color A 10.89.209.28 + + +club-assistant A 10.89.213.22 + AAAA 2a07:c481:1:36::32 +_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de + + +esphome A 10.89.212.210 + AAAA 2a07:c481:1:34::66 +hauptraum-esphome A 10.89.212.211 +werkstatt-esphome A 10.89.212.212 + + +light A 10.89.213.28 + AAAA 2a07:c481:1:36::31 +_acme-challenge.light CNAME e59f55ee-9013-469d-a146-a159721b6fea.auth.acmedns.hamburg.ccc.de. +light-werkstatt CNAME light.ccchh.net. +_acme-challenge.light-werkstatt CNAME f408acc0-d9f5-4525-bb01-28938e3bb7d0.auth.acmedns.hamburg.ccc.de. + +pi-dmx-werkstatt A 10.89.212.215 + + +dooris A 10.89.208.16 + AAAA 2a07:c481:1:33::1c +_acme-challenge.dooris CNAME 37caae1f-b77f-4eb1-aa71-dc3f7ed24360.auth.acmedns.hamburg.ccc.de. + +hmdooris-ccu A 10.89.208.17 + +dooris-ng A 10.89.209.29 + + +buba A 10.89.212.137 + +yate A 10.89.213.24 + +muzak A 10.89.208.13 + +encoder-ccchh A 10.89.209.166 + +ki10 A 10.89.209.254 + +Ziggy A 10.89.212.11 + +legacy A 10.89.212.12 + +foobarpay A 10.89.212.23 + +foobackup A 10.89.212.24 + +ender3v2-sonic-pad A 10.89.212.27 + +octopi A 10.89.212.31 + +433mhz-bridge A 10.89.212.32 + + +;SIP-T46S A 10.89.212.227 +;SIP-T46S A 10.89.212.230 + +;cisco-slm248p A 10.89.208.27 + +;zigbee2mqtt A 185.161.129.132 ; Old entry probably deprecadet ; @@ -70,3 +145,4 @@ xr18 A 172.31.200.21 opensourcetorrents A 185.161.130.67 AAAA 2a07:c481:1:35::42 + diff --git a/resources/z9/light/nginx/light.conf b/resources/z9/light/nginx/light.conf index 8d90258..18e2a41 100644 --- a/resources/z9/light/nginx/light.conf +++ b/resources/z9/light/nginx/light.conf @@ -13,7 +13,7 @@ server { ssl_trusted_certificate /etc/letsencrypt/live/light-werkstatt.ccchh.net/chain.pem; # replace with the IP address of your resolver - resolver 10.31.208.1; + #resolver 10.31.208.1; # is this needed? location / { proxy_pass http://127.0.0.1:8081; @@ -38,7 +38,7 @@ server { ssl_trusted_certificate /etc/letsencrypt/live/light.ccchh.net/chain.pem; # replace with the IP address of your resolver - resolver 10.31.208.1; + #resolver 10.31.208.1; # is this needed? location / { proxy_pass http://127.0.0.1:8080; diff --git a/resources/z9/yate/docker_compose/regexroute.conf.j2 b/resources/z9/yate/docker_compose/regexroute.conf.j2 index aeecf6b..0f7bd96 100644 --- a/resources/z9/yate/docker_compose/regexroute.conf.j2 +++ b/resources/z9/yate/docker_compose/regexroute.conf.j2 @@ -81,7 +81,7 @@ ${called}^fo370381tr317349_00$=inbound_fonial ^.*$=echo [z9] "\0" ${caller}->${called} ; log ; test service numbers -^91$=sip/sip:ha@10.31.208.10:5060; called=ha;format=opus ; Homeassistant +^91$=sip/sip:ha@10.89.213.22:5060; called=ha;format=opus ; Homeassistant ^98$=external/playrec/echo.sh ; Echotest ^99$=external/play/tts.sh;mode=text;text=Hallo Hallo Hallo ; TTS test diff --git a/resources/z9/z9-router/kea_dhcp.yaml b/resources/z9/z9-router/kea_dhcp.yaml index d191881..8b9b9fb 100644 --- a/resources/z9/z9-router/kea_dhcp.yaml +++ b/resources/z9/z9-router/kea_dhcp.yaml @@ -36,6 +36,9 @@ kea_dhcp__dhcp4: - ip-address: 10.89.208.14 hostname: Big-Room-Beamer hw-address: "64:d2:c4:db:08:5c" + - ip-address: 10.89.208.15 + hostname: xr18 + hw-address: "34:8d:13:13:1f:33" - ip-address: 10.89.208.16 hostname: dooris hw-address: "bc:24:11:b3:93:9c" @@ -115,9 +118,15 @@ kea_dhcp__dhcp4: - ip-address: 10.89.212.42 hostname: t-mix hw-address: "40:a5:ef:d9:eb:93" + - ip-address: 10.89.212.137 + hostname: ccchh-buba + hw-address: "b8:27:eb:29:bd:77" - ip-address: 10.89.212.86 hostname: fritz-fon hw-address: "00:1f:3f:c9:e5:b2" + - ip-address: 10.89.212.210 + hostname: esphome + hw-address: "7e:3c:f0:77:8a:f4" - ip-address: 10.89.212.211 hostname: hauptraum-esphome hw-address: "e8:db:84:e8:18:d2" @@ -246,10 +255,18 @@ kea_dhcp__dhcp6: subnet: "2a07:c481:1:33::/64" pools: - pool: "2a07:c481:1:33::1:1 - 2a07:c481:1:33::FFFF:FFFF" + reservations: + - ip-address: "2a07:c481:1:33::1c" + hostname: dooris + hw-address: "bc:24:11:b3:93:9c" - id: 2 subnet: "2a07:c481:1:34::/64" pools: - pool: "2a07:c481:1:34::1:1 - 2a07:c481:1:34::FFFF:FFFF" + reservations: + - ip-address: "2a07:c481:1:34::66" + hostname: esphome + hw-address: "7e:3c:f0:77:8a:f4" - id: 3 subnet: "2a07:c481:1:36::/64" pools: @@ -288,6 +305,12 @@ kea_dhcp__dhcp6: - ip-address: "2a07:c481:1:36::f" hostname: pbs hw-address: "BC:24:11:D6:2C:81" - - ip-address: "2a07:c481:1:36::14" + - ip-address: "2a07:c481:1:36::21" hostname: unifi hw-address: "BC:24:11:25:77:60" + - ip-address: "2a07:c481:1:36::31" + hostname: light + hw-address: "72:61:ea:e6:49:e3" + - ip-address: "2a07:c481:1:36::32" + hostname: club-assistant + hw-address: "7a:55:61:c3:a2:89" From 9d5215e6ec30141a9c65e01562bddde5085edbc7 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sat, 20 Jun 2026 18:33:37 +0200 Subject: [PATCH 18/38] z9(pve01): change thinkcccore0 to pve01 --- README.md | 2 +- inventories/z9/hosts.yaml | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index bd980d8..62c785c 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Folgende Geräte und Server werden duch dieses Ansible Repository verwaltet: -* Diverse VMs auf dem ThinkCCCluster +* Diverse VMs auf dem z9 (PVE Cluster) * Diverse VMs auf dem Chaosknoten Host-spezifische Konfigurationsdateien liegen unter `resources/` und werden für jeweils über eine `host_vars`-Datei im Inventory geladen. diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 237a8cc..81c30c7 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -9,8 +9,8 @@ all: opensourcetorrents: ansible_host: opensourcetorrents.ccchh.net ansible_user: chaos - thinkcccore0: - ansible_host: thinkcccore0.ccchh.net + pve01: + ansible_host: pve01.ccchh.net waybackproxy: ansible_host: waybackproxy.ccchh.net ansible_user: chaos @@ -37,7 +37,7 @@ foobazdmx_hosts: light: hypervisors: hosts: - thinkcccore0: + pve01: infrastructure_authorized_keys_hosts: hosts: dooris: @@ -55,7 +55,7 @@ ola_hosts: light: proxmox_vm_template_hosts: hosts: - thinkcccore0: + pve01: systemd_networkd_hosts: hosts: z9-router: From dc29dd8b13bccada97bc2c639fa0a455ba2c6655 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 21 Jun 2026 20:01:55 +0200 Subject: [PATCH 19/38] kea_dhcp(role): fix include wars check --- roles/kea_dhcp/tasks/kea.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/kea_dhcp/tasks/kea.yaml b/roles/kea_dhcp/tasks/kea.yaml index 116c7dd..0d2c5e3 100644 --- a/roles/kea_dhcp/tasks/kea.yaml +++ b/roles/kea_dhcp/tasks/kea.yaml @@ -1,6 +1,6 @@ --- - name: Include config vars - when: kea_dhcp__include_vars is not None + when: kea_dhcp__include_vars != None ansible.builtin.include_vars: file: "{{ kea_dhcp__include_vars }}" From aec4ea4090ef4e002169129f676a1c5ae8df8158 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 21 Jun 2026 20:06:32 +0200 Subject: [PATCH 20/38] unbound(role): fix unbound config template - fix some indentation problems - fix access control - fix remote control unix socket and thrust anchor file (because debain appamour ist annoying) - add unbound-anchor package --- roles/unbound/tasks/main.yml | 5 +++++ roles/unbound/templates/unbound.conf.j2 | 25 +++++++++++++------------ 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index 3b038c6..2cf2261 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -6,6 +6,11 @@ ansible.builtin.package: name: unbound + - name: install unbound-anchor + become: true + ansible.builtin.package: + name: unbound-anchor + - name: ensure correct directory permissions become: true ansible.builtin.file: diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2 index d9b612c..3213f46 100644 --- a/roles/unbound/templates/unbound.conf.j2 +++ b/roles/unbound/templates/unbound.conf.j2 @@ -4,26 +4,26 @@ server: {% if unbound_enable_dnssec -%} # location of the trust anchor file that enables DNSSEC # this file is generated by the `unbound-anchor` command - auto-trust-anchor-file: "/etc/unbound/trusted-key.key" + trust-anchor-file: "/usr/share/dns/root.key" {% endif -%} - # num of threads - num-threads: {{ unbound_thread_count | default(ansible_facts['processor_vcpus']) }} + # num of threads + num-threads: {{ unbound_thread_count | default(ansible_facts['processor_vcpus']) }} - # more cache memory + # more cache memory rrset-cache-size: 60m msg-cache-size: 30m - # prefetch to keep the cache up to date - prefetch: yes + # prefetch to keep the cache up to date + prefetch: yes - # fetch the DNSKEYs earlier in the validation process, when a DS record is encountered - prefetch-key: yes + # fetch the DNSKEYs earlier in the validation process, when a DS record is encountered + prefetch-key: yes - # Faster UDP with multithreading (only on Linux). + # Faster UDP with multithreading (only on Linux). so-reuseport: yes - # disable special large send buffer handling and just use kernel defaults + # disable special large send buffer handling and just use kernel defaults so-sndbuf: 0 # send minimal amount of information to upstream servers to enhance privacy @@ -36,7 +36,7 @@ server: # addresses from the IP range that are allowed to connect to the resolver {% for i in unbound_access_control -%} - access-control: {{ i }} + access-control: {{ i }} allow {% endfor -%} {% for i in unbound_private_domain -%} @@ -51,7 +51,8 @@ server: remote-control: control-enable: {{ "yes" if unbound_enable_unbound_control else "no" }} - control-interface: /run/unbound-control.sock + control-interface: "/run/unbound.ctl" # debian appamour does not allow any other path!!! + control-use-cert: no # configure some zones for which this resolver will act authoritatively From eb186c415253f4c4bc302e870818e23728c9a817 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 21 Jun 2026 20:13:29 +0200 Subject: [PATCH 21/38] unbound(role): fix unbound prometheus exporter install on debian - download debian image from github und verify checksum - setup systemd service unit --- .../files/prometheus-unbound-exporter.service | 12 +++++ roles/unbound/tasks/main.yml | 14 ++--- roles/unbound/tasks/prometheus-exporter.yml | 52 ++++++++++++++++--- 3 files changed, 65 insertions(+), 13 deletions(-) create mode 100644 roles/unbound/files/prometheus-unbound-exporter.service diff --git a/roles/unbound/files/prometheus-unbound-exporter.service b/roles/unbound/files/prometheus-unbound-exporter.service new file mode 100644 index 0000000..d3b4c9f --- /dev/null +++ b/roles/unbound/files/prometheus-unbound-exporter.service @@ -0,0 +1,12 @@ +[Unit] +Description=Prometheus exporter for Unbound metrics, written in Go with pluggable metric collectors. The metrics exporter converts Unbound metric names to Prometheus metric names and labels by using a set of regular expressions. +Documentation=https://github.com/letsencrypt/unbound_exporter +After=network.target + +[Service] +Type=simple +EnvironmentFile=/etc/prometheus-unbound-exporter.conf +ExecStart=/bin/unbound_exporter ${UNBOUND_EXPORTER_ARGS} + +[Install] +WantedBy=multi-user.target diff --git a/roles/unbound/tasks/main.yml b/roles/unbound/tasks/main.yml index 2cf2261..69b712f 100644 --- a/roles/unbound/tasks/main.yml +++ b/roles/unbound/tasks/main.yml @@ -31,13 +31,6 @@ group: unbound mode: u=rw,g=r,o=r - - name: ensure unbound is running and enabled - become: true - ansible.builtin.systemd: - name: unbound.service - state: started - enabled: true - - name: disable systemd-resolved when: unbound_disable_systemd_networkd ansible.builtin.include_role: @@ -47,6 +40,13 @@ deploy_systemd_resolved_config__dns: - 127.0.0.1 + - name: ensure unbound is running and enabled + become: true + ansible.builtin.systemd: + name: unbound.service + state: started + enabled: true + - name: install and configure prometheus-exporter for unbound ansible.builtin.import_tasks: prometheus-exporter.yml when: unbound_install_prometheus_exporter diff --git a/roles/unbound/tasks/prometheus-exporter.yml b/roles/unbound/tasks/prometheus-exporter.yml index fba5090..bbf69e7 100644 --- a/roles/unbound/tasks/prometheus-exporter.yml +++ b/roles/unbound/tasks/prometheus-exporter.yml @@ -1,8 +1,48 @@ --- -- name: install unbound prometheus exporter # FIXME: there is no prometheus-unbound-exporter in debian .deb exists in https://github.com/letsencrypt/unbound_exporter/releases/tag/v0.6.0 +- name: install unbound prometheus exporter become: true - ansible.builtin.package: - name: prometheus-unbound-exporter + vars: + prometheus_unbound_exporter_version: "0.6.0" + prometheus_unbound_exporter_filename: "unbound_exporter-v{{ prometheus_unbound_exporter_version }}.x86_64.deb" + prometheus_unbound_exporter_github_api_url: "https://api.github.com/repos/letsencrypt/unbound_exporter/releases/tags/v{{ prometheus_unbound_exporter_version }}" + block: + - name: request github api + ansible.builtin.uri: + url: "{{ prometheus_unbound_exporter_github_api_url }}" + method: GET + body_format: json + headers: + 'Accept': 'application/vnd.github+json' + register: unbound_exporter_github_api_result + + - name: get prometheus-unbound-exporter download url and digest + ansible.builtin.set_fact: + unbound_exporter_download_url: "{{ unbound_exporter_github_api_result.json.assets[0].browser_download_url }}" + unbound_exporter_download_digest: "{{ unbound_exporter_github_api_result.json.assets[0].digest }}" + + - name: Download prometheus-unbound-exporter deb package with verified checksum + ansible.builtin.get_url: + url: "{{ unbound_exporter_download_url }}" + dest: "/tmp/{{ prometheus_unbound_exporter_filename }}" + checksum: "{{ unbound_exporter_download_digest }}" + mode: "u=r,g=r,o=r" + + - name: Install prometheus-unbound-exporter deb package + become: true + ansible.builtin.apt: + deb: "/tmp/{{ prometheus_unbound_exporter_filename }}" + state: present + notify: prometheus-unbound-exporter.restarted + +- name: deploy prometheus-unbound-exporter systemd service + become: true + ansible.builtin.copy: + src: "prometheus-unbound-exporter.service" + dest: "/etc/systemd/system/prometheus-unbound-exporter.service" + owner: root + group: root + mode: '0644' + notify: systemd-daemon-reload - name: enable unbound prometheus exporter become: true @@ -14,10 +54,10 @@ - name: configure unbound exporter become: true ansible.builtin.copy: - dest: /etc/conf.d/prometheus-unbound-exporter + dest: /etc/prometheus-unbound-exporter.conf content: | - UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound-control.sock" + UNBOUND_EXPORTER_ARGS="-unbound.ca "" -unbound.cert "" -unbound.host "unix:///run/unbound.ctl" owner: root group: root - mode: '0660' + mode: '0644' notify: prometheus-unbound-exporter.restarted From a62d265db82123201f175e09448cbd61a3d6cd9d Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 22 Jun 2026 21:03:12 +0200 Subject: [PATCH 22/38] z9-router(host): fix systemd-networkd configs --- .../z9-router/systemd_networkd/10-netlan.51.netdev | 1 + .../z9-router/systemd_networkd/10-netlan.52.netdev | 1 + .../z9-router/systemd_networkd/10-netlan.53.netdev | 1 + .../z9-router/systemd_networkd/10-netlan.54.netdev | 1 + .../z9-router/systemd_networkd/10-netwan.400.netdev | 1 + .../z9/z9-router/systemd_networkd/20-netlan.network | 12 ++++++++---- .../z9/z9-router/systemd_networkd/20-netwan.network | 4 ++++ .../systemd_networkd/21-netlan.54-management.network | 2 +- .../21-netwan.400-fux_uplink.network | 2 ++ 9 files changed, 20 insertions(+), 5 deletions(-) diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev index b951ecc..6baf687 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.51.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netlan.51 Kind=vlan +MACAddress=BC:24:11:BD:D3:F9 [VLAN] Id=51 diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev index 1f345c7..48cc3a5 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.52.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netlan.52 Kind=vlan +MACAddress=BC:24:11:88:28:15 [VLAN] Id=52 diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev index c6dab81..b65d406 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.53.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netlan.53 Kind=vlan +MACAddress=BC:24:11:3C:3C:BE [VLAN] Id=53 diff --git a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev b/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev index 6271e6c..4ea5ec6 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netlan.54.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netlan.54 Kind=vlan +MACAddress=BC:24:11:D2:65:B4 [VLAN] Id=54 diff --git a/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev b/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev index e0b6afc..a66dc79 100644 --- a/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev +++ b/resources/z9/z9-router/systemd_networkd/10-netwan.400.netdev @@ -1,6 +1,7 @@ [NetDev] Name=netwan.400 Kind=vlan +MACAddress=BC:24:11:C3:27:45 [VLAN] Id=400 diff --git a/resources/z9/z9-router/systemd_networkd/20-netlan.network b/resources/z9/z9-router/systemd_networkd/20-netlan.network index 3aed715..7fab501 100644 --- a/resources/z9/z9-router/systemd_networkd/20-netlan.network +++ b/resources/z9/z9-router/systemd_networkd/20-netlan.network @@ -5,8 +5,12 @@ Name=netlan RequiredForOnline=no [Network] -VLAN=netwan.51 -VLAN=netwan.52 -VLAN=netwan.53 -VLAN=netwan.54 +LinkLocalAddressing=no +DHCP=no +IPv6AcceptRA=no + +VLAN=netlan.51 +VLAN=netlan.52 +VLAN=netlan.53 +VLAN=netlan.54 diff --git a/resources/z9/z9-router/systemd_networkd/20-netwan.network b/resources/z9/z9-router/systemd_networkd/20-netwan.network index 89a8494..b42b95a 100644 --- a/resources/z9/z9-router/systemd_networkd/20-netwan.network +++ b/resources/z9/z9-router/systemd_networkd/20-netwan.network @@ -5,5 +5,9 @@ Name=netwan RequiredForOnline=no [Network] +LinkLocalAddressing=no +DHCP=no +IPv6AcceptRA=no + VLAN=netwan.400 diff --git a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network b/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network index 2396da0..e1bf0c8 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network +++ b/resources/z9/z9-router/systemd_networkd/21-netlan.54-management.network @@ -12,7 +12,7 @@ Description=Management IPv6SendRA=yes [Address] -Address=10.89.213.0/24 +Address=10.89.213.1/24 [IPv6SendRA] UplinkInterface=netwan.400 diff --git a/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network b/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network index 1657c40..4ac0b8d 100644 --- a/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network +++ b/resources/z9/z9-router/systemd_networkd/21-netwan.400-fux_uplink.network @@ -19,8 +19,10 @@ IPv6SendRA=no [Address] Address=185.161.129.134/25 +[Address] Address=2a07:c481::1:2/64 [Route] Gateway=185.161.129.129 +[Route] Gateway=2a07:c481::1 From 724d537cd586acc3f57de2a150030fa362795966 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Mon, 22 Jun 2026 21:09:43 +0200 Subject: [PATCH 23/38] unbound(role): fix systemd unit of prometheus exporter --- roles/unbound/files/prometheus-unbound-exporter.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/unbound/files/prometheus-unbound-exporter.service b/roles/unbound/files/prometheus-unbound-exporter.service index d3b4c9f..523badd 100644 --- a/roles/unbound/files/prometheus-unbound-exporter.service +++ b/roles/unbound/files/prometheus-unbound-exporter.service @@ -6,7 +6,7 @@ After=network.target [Service] Type=simple EnvironmentFile=/etc/prometheus-unbound-exporter.conf -ExecStart=/bin/unbound_exporter ${UNBOUND_EXPORTER_ARGS} +ExecStart=/bin/unbound_exporter $UNBOUND_EXPORTER_ARGS [Install] WantedBy=multi-user.target From 9b8da29cae8d4d56467aa085247a79dec10469f3 Mon Sep 17 00:00:00 2001 From: bitwhisker Date: Sun, 28 Jun 2026 14:24:28 +0200 Subject: [PATCH 24/38] auth-dns(host): update ip of xr18 in ccchh.net --- resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index 2a69ea8..1dee1b4 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -46,7 +46,7 @@ unifi A 10.89.213.21 ; ; Club-Services ; -xr18 A 172.31.200.21 +xr18 A 172.31.200.29 ;club-assistant AAAA 2a07:c481:1:d0::a ;;_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de From 3e0fdb6074d77f4e08ac3722ae62044caa1012a3 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Sun, 28 Jun 2026 17:02:05 +0200 Subject: [PATCH 25/38] Configure transmission --- .../z9/host_vars/opensourcetorrents.sops.yaml | 7 +- .../z9/host_vars/opensourcetorrents.yaml | 92 +++++++++++++++++++ inventories/z9/hosts.yaml | 3 + playbooks/deploy.yaml | 7 ++ .../files/update-transmission-settings | 13 +++ roles/transmission/handlers/main.yaml | 3 + roles/transmission/tasks/main.yaml | 23 +++++ 7 files changed, 145 insertions(+), 3 deletions(-) create mode 100644 roles/transmission/files/update-transmission-settings create mode 100644 roles/transmission/handlers/main.yaml create mode 100644 roles/transmission/tasks/main.yaml diff --git a/inventories/z9/host_vars/opensourcetorrents.sops.yaml b/inventories/z9/host_vars/opensourcetorrents.sops.yaml index 1be8403..e7d56e3 100644 --- a/inventories/z9/host_vars/opensourcetorrents.sops.yaml +++ b/inventories/z9/host_vars/opensourcetorrents.sops.yaml @@ -1,7 +1,8 @@ ansible_pull__age_private_key: ENC[AES256_GCM,data:QB0xpxP8pLfE2ExpCRD4joQzoEcbQZTiVEJbX3t9GyFEseZUtnUCO0ysFUc6hRs2BC9hoPXz6k/dZ0vNkniBmqcN5zTofZ8bg94=,iv:3NVVsae+pgbriTNzgT6rGCEzJjw368WgAKfQCi2qsmQ=,tag:AQSIxJCZOZ8dtlvcu4WMuw==,type:str] +transmission__rpc_password: ENC[AES256_GCM,data:PPEIdI/OcuvX8Mh+zNFSOw==,iv:AgHwT6FGmE9sY3H+MQQc291ILbpNKatEoK8W09wrtr4=,tag:M1E0iS8TTNvu2MABboqCSQ==,type:str] sops: - lastmodified: "2026-06-01T19:05:50Z" - mac: ENC[AES256_GCM,data:ms4yaDEY/2DxC56rxagBRgfkHuy2/AGhZ0om3+gTVfG8/1p7v+qWXuWrNlDjefjhLKVCaf5yl749JZIjs8PP6rTKyTcteqVfoKwx+CFaEA9OmPOaENBV8Kpy2Rrkw8J4UBBKSoTKGFDAGtyysmqbS8eqDuEpb/TbfbbybJUNfe4=,iv:g4IHNmQELptweaqRE7P3LlBTwV+7jt6AfrPowzuziv4=,tag:YkBnOJA5IN1xDhI+umYSow==,type:str] + lastmodified: "2026-06-28T11:50:14Z" + mac: ENC[AES256_GCM,data:c03dDTwriK3lk9HYK5h85ESxC3nvVjBZVIva1ZAbeFu1n8u1IfazBS3NN4NSEZ+TkSW1WdQVKXFiQ9WBawLwLzXSKcmxaOPZuIvxcmbsYGuHAMpO1ODNgvuPP6D6vFl/C+Ew0yRVd72MqlvQKrg46+x6uD+1cvi9w30+EkzV+UY=,iv:UlSDF/0aF0dWYaQc9KAv3pXE1DUflQfFrHIlSt5stJU=,tag:Uj0W//Du0TOugByNFHFf9g==,type:str] pgp: - created_at: "2026-06-01T19:05:22Z" enc: |- @@ -177,4 +178,4 @@ sops: -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted - version: 3.12.2 + version: 3.13.1 diff --git a/inventories/z9/host_vars/opensourcetorrents.yaml b/inventories/z9/host_vars/opensourcetorrents.yaml index 6bcc86d..0df26e6 100644 --- a/inventories/z9/host_vars/opensourcetorrents.yaml +++ b/inventories/z9/host_vars/opensourcetorrents.yaml @@ -1 +1,93 @@ # add /etc/transmission-remote/settings.json here +transmission__settings: + alt-speed-down: 50 + alt-speed-enabled: false + alt-speed-time-begin: 540 + alt-speed-time-day: 127 + alt-speed-time-enabled: false + alt-speed-time-end: 1020 + alt-speed-up: 50 + announce-ip: "" + announce-ip-enabled: false + anti-brute-force-enabled: false + anti-brute-force-threshold: 100 + bind-address-ipv4: "" + bind-address-ipv6: "" + blocklist-enabled: false + blocklist-url: http://www.example.com/blocklist + cache-size-mb: 4 + default-trackers: "" + dht-enabled: true + download-dir: /torrents/complete + download-limit: 100 + download-limit-enabled: 0 + download-queue-enabled: true + download-queue-size: 5 + encryption: 1 + idle-seeding-limit: 30 + idle-seeding-limit-enabled: false + incomplete-dir: /torrents/incomplete + incomplete-dir-enabled: true + lpd-enabled: true + max-peers-global: 200 + message-level: 2 + peer-congestion-algorithm: "" + peer-limit-global: 200 + peer-limit-per-torrent: 50 + peer-port: 51413 + peer-port-random-high: 65535 + peer-port-random-low: 49152 + peer-port-random-on-start: false + peer-socket-tos: le + pex-enabled: true + pidfile: "" + port-forwarding-enabled: false + preallocation: 1 + preferred_transport: utp + proxy_url: "" + queue-stalled-enabled: true + queue-stalled-minutes: 30 + ratio-limit: 2 + ratio-limit-enabled: false + rename-partial-files: true + reqq: 2000 + rpc-authentication-required: false + rpc-bind-address: 0.0.0.0 + rpc-enabled: true + rpc-host-whitelist: "" + rpc-host-whitelist-enabled: true + rpc-password: '{{ transmission__rpc_password }}' + rpc-port: 9091 + rpc-socket-mode: "0750" + rpc-url: /transmission/ + rpc-username: "" + rpc-whitelist: 127.0.0.1,::1,172.31.200.*,172.31.201.*,213.240.180.39,2a01:170:118b::1 + rpc-whitelist-enabled: true + scrape-paused-torrents-enabled: true + script-torrent-added-enabled: false + script-torrent-added-filename: "" + script-torrent-done-enabled: false + script-torrent-done-filename: "" + script-torrent-done-seeding-enabled: false + script-torrent-done-seeding-filename: "" + seed-queue-enabled: false + seed-queue-size: 10 + sequential_download: false + sleep-per-seconds-during-verify: 100 + speed-limit-down: 100 + speed-limit-down-enabled: false + speed-limit-up: 100 + speed-limit-up-enabled: false + start-added-torrents: true + start_paused: false + tcp-enabled: true + torrent-added-verify-mode: fast + trash-original-torrent-files: false + umask: "022" + upload-limit: 100 + upload-limit-enabled: 0 + upload-slots-per-torrent: 8 + utp-enabled: true + watch-dir: /torrents/torrents + watch-dir-enabled: true + watch-dir-force-generic: false diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 0c6e16d..6044154 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -44,6 +44,9 @@ nginx_hosts: ola_hosts: hosts: light: +transmission: + hosts: + opensourcetorrents: proxmox_vm_template_hosts: hosts: thinkcccore0: diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index b7ce104..d111321 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -156,3 +156,10 @@ - knot tags: - knot + +- name: Setup transmission + hosts: transmission + roles: + - transmission + tags: + - transmission diff --git a/roles/transmission/files/update-transmission-settings b/roles/transmission/files/update-transmission-settings new file mode 100644 index 0000000..d51730a --- /dev/null +++ b/roles/transmission/files/update-transmission-settings @@ -0,0 +1,13 @@ +#!/bin/sh + +# +# Update the transmission settings.json. For the update, stop transmission, +# put the new file in place, and restart it. +# + +set -e + +systemctl stop transmission-daemon +cp /etc/transmission-daemon/settings-ansible.json /etc/transmission-daemon/settings.json +chmod 0660 /etc/transmission-daemon/settings.json +systemctl start transmission-daemon diff --git a/roles/transmission/handlers/main.yaml b/roles/transmission/handlers/main.yaml new file mode 100644 index 0000000..781f442 --- /dev/null +++ b/roles/transmission/handlers/main.yaml @@ -0,0 +1,3 @@ +- name: update transmission settings + ansible.builtin.command: /usr/local/sbin/update-transmission-settings + become: true diff --git a/roles/transmission/tasks/main.yaml b/roles/transmission/tasks/main.yaml new file mode 100644 index 0000000..f927ef6 --- /dev/null +++ b/roles/transmission/tasks/main.yaml @@ -0,0 +1,23 @@ +- name: ensure transmission-daemon is installed + ansible.builtin.apt: + name: transmission-daemon + state: present + become: true +- name: ensure update-transmission-settings is deployed + ansible.builtin.copy: + src: "update-transmission-settings" + dest: "/usr/local/sbin/update-transmission-settings" + owner: root + group: root + mode: "0750" + become: true + notify: update transmission settings +- name: ensure transmission settings are deployed + ansible.builtin.copy: + content: '{{ transmission__settings | to_json(indent=4, sort_keys=True) }}' + dest: "/etc/transmission-daemon/settings-ansible.json" + owner: debian-transmission + group: debian-transmission + mode: "0750" + become: true + notify: update transmission settings From 8de361d223d99e277b6680c381c64e4be1cf65e7 Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 30 Jun 2026 20:47:35 +0200 Subject: [PATCH 26/38] add dooris.ccchh.net entries --- resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone index 1dee1b4..f598988 100644 --- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone +++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone @@ -47,6 +47,9 @@ unifi A 10.89.213.21 ; Club-Services ; xr18 A 172.31.200.29 +dooris A 172.31.200.16 + AAAA 2a07:c481:1:d0::1c +hmdooris-ccu A 172.31.200.17 ;club-assistant AAAA 2a07:c481:1:d0::a ;;_acme-challenge.club-assistant CNAME d50ad73a-f82d-4244-87f0-6f5195b37d21.auth.acmedns.hamburg.ccc.de @@ -56,9 +59,7 @@ xr18 A 172.31.200.29 ;_acme-challenge.light CNAME e59f55ee-9013-469d-a146-a159721b6fea.auth.acmedns.hamburg.ccc.de. ;light-werkstatt AAAA 2a07:c481:1:d0::16 ;_acme-challenge.light-werkstatt CNAME f408acc0-d9f5-4525-bb01-28938e3bb7d0.auth.acmedns.hamburg.ccc.de. -;hmdooris-ccu A 10.31.208.202 ;buba A 10.31.211.137 -;dooris AAAA 2a07:c481:1:d0::1c ;_acme-challenge.dooris CNAME 37caae1f-b77f-4eb1-aa71-dc3f7ed24360.auth.acmedns.hamburg.ccc.de. ;yate A 10.31.208.12 ;staubiv2 A 10.31.210.233 From cf98c9df3098f5246c59ab939628d660c0cfcc8b Mon Sep 17 00:00:00 2001 From: lilly Date: Tue, 30 Jun 2026 21:14:21 +0200 Subject: [PATCH 27/38] configure dooris to write ssh public keys into file --- resources/z9/dooris/docker_compose/compose.yaml.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/resources/z9/dooris/docker_compose/compose.yaml.j2 b/resources/z9/dooris/docker_compose/compose.yaml.j2 index d16c8ad..e81b233 100644 --- a/resources/z9/dooris/docker_compose/compose.yaml.j2 +++ b/resources/z9/dooris/docker_compose/compose.yaml.j2 @@ -10,5 +10,8 @@ services: DOORIS_BASE_URL: https://dooris.ccchh.net DOORIS_CCUJACK_USER: "dooris" DOORIS_CCUJACK_PASSWORD: "{{ secret__dooris_ccujack_password }}" + DOORIS_AUTHORIZED_KEYS_FILE: "/srv/state/dooris_authorized_keys" network_mode: host restart: unless-stopped + volumes: + - "./state:/srv/state/:rw" From dea6bfe68bb129224c7d580f0b8e664f17bdddf1 Mon Sep 17 00:00:00 2001 From: Max Date: Tue, 30 Jun 2026 22:19:41 +0200 Subject: [PATCH 28/38] update keycloak to 26.6.3 --- resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 index 8db3526..75c94e0 100644 --- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 @@ -22,7 +22,7 @@ services: keycloak: - image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.0 + image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.3 pull_policy: always restart: unless-stopped command: start --optimized From 94120337aa1824cd40bd99636af3056f914c83c0 Mon Sep 17 00:00:00 2001 From: June Date: Wed, 20 May 2026 20:33:07 +0200 Subject: [PATCH 29/38] forgejo-runner(host): basic setup --- .sops.yaml | 7 + .../chaosknoten/group_vars/all.sops.yaml | 469 +++++++++--------- .../host_vars/forgejo-runner.sops.yaml | 187 +++++++ inventories/chaosknoten/hosts.yaml | 7 + .../auth-dns/zones/hamburg.ccc.de.zone | 1 + 5 files changed, 441 insertions(+), 230 deletions(-) create mode 100644 inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml diff --git a/.sops.yaml b/.sops.yaml index b517a43..849749b 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -39,6 +39,7 @@ keys: - &host_mjolnir_ansible_pull_age_key age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj - &host_diday_staging_runner_ansible_pull_age_key age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf - &host_auth_dns_ansible_pull_age_key age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve + - &host_forgejo_runner_ansible_pull_age_key age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf external: age: &host_external_age_keys - &host_status_ansible_pull_age_key age1p546j6whqsyfkjuf674lawrnk2ex653fuvwhcwt46gkrspkq59sqzm5y87 @@ -209,6 +210,12 @@ creation_rules: *admin_gpg_keys age: - *host_auth_dns_ansible_pull_age_key + - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner\\.sops\\..+" + key_groups: + - pgp: + *admin_gpg_keys + age: + - *host_forgejo_runner_ansible_pull_age_key # external hosts - path_regex: "inventories/external/host_vars/status\\.sops\\..+" key_groups: diff --git a/inventories/chaosknoten/group_vars/all.sops.yaml b/inventories/chaosknoten/group_vars/all.sops.yaml index 5b3f4dd..5b4b6c1 100644 --- a/inventories/chaosknoten/group_vars/all.sops.yaml +++ b/inventories/chaosknoten/group_vars/all.sops.yaml @@ -5,381 +5,390 @@ sops: - recipient: age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0SHFlOFVSbisycXk3em1N - V3RvaXNNOFIvdDJobk9kSVBmOG0ycCs1T1E0ClZ1NnVGK3VNNVplQkxjVUw2dUxu - SXU1RjNLTE5mZm5yUVBDa0NTTkVhck0KLS0tICtpTDNmeFhWazk1U0FQd21wM1FZ - RkdwVXBSK2xySW5qMDg3TzhVeG1Rd0UKXfj3aSYJWBn7EhsUgHnreeARsjWfjs6T - 79kvBkQ+Ovn9zvUZZ23I72rtEjab3Wt9gK2FdmEWVkHYS0ZvA8ymbw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvalUzeDFlWDJpaFdxYzZU + SzNLbFNiMTMreGhkaUZMN2hZS1dONFRzeEM4CmR5VjVKSWloQzc0NnM0bGRHR2RE + YkwvOWZZZXczcTR0cFZvb1hjMEVMZW8KLS0tIFVEVTd6UG53K1loNDdEeUhVTW5W + dFYveVdnZFptWi8wNEtIL2VEd1pPVVUK51kCjHeK/neGrtcsgvMsPifCKQflPn8S + +E3oHbvSvBWW5ACR+X0My3FF6F5qTyzeo8OqCdwHJJci8wD4lO0ykQ== -----END AGE ENCRYPTED FILE----- - recipient: age1gdfhx5hy829uqkw4nwjwlpvl7zqvljguzsnjv0dpwz5q5u7dtf6s90wndt enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5dTdXN0xPaWliOGVqS2NU - aCt3OWl3K2FXcTlYU3NDOXhGc2paRmZnMmtJClN3L0JJRXZDeWloaGJqRURWU3ZT - Sk54TGZHdFF6OUkrTVU4RDF5dXpIeTgKLS0tIGM1Z21TZW96TjA0Mm1WUGZoZnpF - WVBJaTUyQWpyY2ZZeHM2VXhMZ0VvSmMKTfmZnaNx7jz320cco7HThAsOPsnQOtCZ - MbVNfu7iltvgQDhoYwhSrnHlqFV4ogeacT2KXS5mO2M7xZK7N/IegA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSHp3cVdjbURhQWJRb3FN + ZmxSajRNSzFib2lRRmtVcmVzaWtjZmpibkhvCncrNkNmUmFKMkhLWG8zWjMwcUlI + dElPd29uaEFaeC83citIbC9sZjVhcEkKLS0tIEsycHZ3UnZ6YU5uSVZFUU1VeVQ5 + aUQwZUU4NFF3cHpoMTY2aUFMT3R3K1UKBMzOLiQreRutPycBG3ripOeKOlz02Hxu + nWkfVy4eJc+zRrwICmil/v3VcyKH72AvuUfnBgFkCTg+lGZY/GDfAg== -----END AGE ENCRYPTED FILE----- - recipient: age13nm6hfz66ce4wpn89fye05mag3l3h04etvz6wj7szm3vzrdlfupqhrp3fa enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySnZSb1UvOFJGZzFCWmZl - MzgwWGxTOTlIM1lJVjBRRmpXc1YwUHQwcmtNCmRFSTVFUGFJQ2dSS29jNWJ5QWlP - RTIzcGpCWmEzVUc4dUZRVy9uSEtBQlUKLS0tIGUzQm5GZ2EwZDY0NEoxME1ZTTll - Nks2Mzk0M0pCZWZ6ME02dWovSktMMWcKgHTs5kzaIpuobI6KbjzWB9W2VOh50mB1 - Y+Z99tY96p47nRKOrYCNxkPMytxZEPZYg2hkz8gXH4UKC2eHJj6+Dw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0STVTd3pHV3BCTTkrOTdy + RXBweU5OM3RkWFA2T1M0RzJWNHVYdVZXWVVBCm00M2hQdlphRkxjU0VOUEladjl3 + a21QVEZmMHFoM1JxQlZXaXlVTjRHRmcKLS0tIHBwN3pkRGExV1d5M3J3NWo0cHNI + M2IxRjNHYmFPSDB1Ly9xSkRHMy9ldVUKdrGJ2HS5Kfyyw+0bCMlFs7DJ3+JWKLtq + 7YCoqWskZauUv+cH2VL/oghttdWQXonlVINkhKbeiQ49BbhPTompJA== -----END AGE ENCRYPTED FILE----- - recipient: age1jtusr294t8mzar2qy857v6s329ret9s353y4kuulxwnlyy4dvpjsvyl67m enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRmpQTVVqTDNTYnZRYW0z - Q0VWcitOR2VYc3QzbUdvbVQvamptaDh4Q1dvCkhkMWNoL1JPcVozVWE3VTBtU0R1 - L1JwdTd5WXNEam1KeXFBSUVaeFUyTVEKLS0tIFNmWkx5ZWVtUGxMcGl2dWNWSnpy - WWhVSzIxblJsNHZRZ2JseFUvNmxLclUKh8akajMIkvAdYhwG9AAIB4br8EKJvVng - Nc4E/bUm5t6xxw7SVfxJ3HXWHYT6O5zC2sOspGi39oodgUKtQdwiGw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Njd0ZDR3M3JuREJNTjdl + RDRDd1BXQ1F2Z3NZYVFlTGhsN0gxTTdOY3pBCmZReUF4SVRBcXpkQzk2d2xDRDBP + cXNNUGxXWkVFMTBNUkc1Q1ViaHpYZFEKLS0tIDFNVnlhQ294bHZhNTRUNUx4c2tT + MU1od1U3VG42cnBJSXlEQTl3MVhwMnMKFK43XRLZKQoouvCcGqHt/13LW+KMG4Gn + WvnkZz0m3WUM1iu3WLYqT+QOR8RnNPk669JE80rpxKZmbqRNsIdazw== -----END AGE ENCRYPTED FILE----- - recipient: age1a27euccw8j23wec76ls8vmzp7mntfcn4v8tkyegmg8alzfhk3suqwm6vgv enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTejVEYlEwZE10OGt2TTFn - cDdVV2VXeGpIclhCMCswTGY5UHlld09RSmdvCkYvdzJJTGVYYjZSS0xtWk05MWtr - ai9tQzhJTE92d1NzQ3hpZEY2Z0xzTUkKLS0tIDhSbnR5UzJjNjN2SXlWUlJubU9a - bEVNK3Y1c29DVXBCRGQ2Y1dOejZ1WUEKh9ehZCtmNeErAPbfFdjkE2Bs5Y+CuLtL - bgoUrGv8rBt+rmtgRLSBAj3frYRsR7kA5TsYtcVF3CBGqsZuCn/8/Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrd25sbHdPbkovMWJXaFdp + S0dYMmdoN1I2ZFA5SFk4VlBSelFWd056eXljCkdCdFlSMHdUdE1rd0MwSUdpTWNp + Ymk4Mk5kd1FZMElGTktiZ3djRXNENlEKLS0tIHJQWUtqTFZabjdidWlMbXVmeUlm + N1JBZm9jdWRtdXp0YWhTTVNGZnFQcUEKcrOCOyDG/dJocsR5ZLyv42PX5cTBdgvi + aNYAq+SnBEMQebUlPBfOapR3tsdjBRwMPvDN3cBtky77SGAg0hZ49A== -----END AGE ENCRYPTED FILE----- - recipient: age133wy6sxhgx3kkwxecra6xf9ey2uhnvtjpgwawwfmpvz0jpd0s5dqe385u3 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2dytYNExPdFFVWmF6Y3RP - VnpySExpMURISnVhYWFtR3Y0bksxN0JLOTIwCm1JU3JiNldCZW40b3J6cGsxd2g0 - c1RMVG1Mb0FURlN5QXZzL3ZMK3JlVUUKLS0tIDVaV2IwcUQyTlBENnZWeC9BMkpH - eDZ5aFFHZWd6VnNGSkgrcjR6Q2hxTXcKush+dylamXtpu6XB3nLjXYW2KbOymCWj - C4uK7OTmOyNXobQh5k2S120J581BihmQpef5LMhxM835VNEFoQ0G2w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxM3V0RFd6Qk9JbzFGdi9q + ejZxMHBGdmhDNDloVVNpMkNrQStKUW5aNFRBClJtMGVJN1h0amJPV3RWY1lIQ2ow + LzYvR1dpSFpwa0c1Q05Bc3NXVWNrQjQKLS0tIEdNTXEraXk2N2Q5UWhjUUdvUXA0 + clhMUFZPT3JRZjFHeDBsd0YyVUVnZUkKYMO2fwqDXeuKVVgL2KKDWfTAa+5y0P0f + gFrlyEqbIrcr66fy66zHlVw3FjHoUfOsMDm4GRjWNn4KOTGSjIImjg== -----END AGE ENCRYPTED FILE----- - recipient: age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0TWg5UHp2cHIzeDZtOE5j - bGg1MzFxQjhnTUdFc21kbVJxa2JYOTA3MUVNCndDUXM2NHRqOHFWN0VzdVdUYzhX - ZFZEelRVbm52UmZYa1BMeE1qU3RnL28KLS0tIHlNd0VNblFBQ0ZlbUtxM3dXbGJr - TUFTZ2hTbnU4RUlHU0Z6bzZqK3hIdlkKpxlcZipq7aBCHc9DDqCmOFlER+ed+LY5 - LBBSsL6ReDgJDFOVx2XGEuMO3mRP1vSOXnro/pa6oP+qodW8fJjCPg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZC96YVlTVm5xM3M4ckYr + MVNZZ1dISHNGcnNSOEVjUk1JZDdVcXdKeEhjCnhUa2dMOEdBenNxcWkrRnY5RFdD + bXpCQk9KZFZmVWN1Sm5FcnkvaXJ1clEKLS0tIGhsUTd4a0tnWHJZdTB2VktEbGxw + eVZVenJRQXNKY1FNVG5yZXdHTVUrc28KAeiaqGRCZ7tjMaxKrlDOTj96WcoxlkxX + 1P+DXm44FAlEU/o9YCun5CBDMrBI8qBt5VUxFaqyA94ixSKXZQeUAw== -----END AGE ENCRYPTED FILE----- - recipient: age1sqs05anv4acculyap35e6vehdxw3g6ycwnvh6hsuv8u33re984zsnqfvqv enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eHNmWThRcFA2VE9qYnkr - YkdDU21palBseEZOUCtmNkZKZE1ncEdtc0FrCnBWMXBKRHhBUitMZGt3c3FIeWFS - ZVJMNXdpUTJsTG0wd09lLzJDV25pOGMKLS0tIHlib0YrU0xKRUJHN1dZRVJDN1Zk - QVhDS0ZrU1A4NUFIekphZjFvT21TNlUKviQt+DZlmp5ZFxdlkmdlfqW2+BTotYJU - j/St6J3Ibt0nnflz+oiRunndHsaeZG6xBY3ueRThcjlInF2ycYsJoQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHTmtYKzA1d3Y4ZkRyNzg0 + RFk5SzQ2bGdDSG1LS2FkNkYwTUFXUjZqMngwCkhrLzEzUUhYQ2VkMEI1VmdidXA3 + RytrbXV4MUcwanNVaGc5NDBrSWxwRVkKLS0tIFBYSjc1Q2N1a1UzQTV2czdxaDNQ + ZmJGMFlNdUxrZHBtbWppcU9kelFTbE0KE90J1IodfxqYl3De2qUv8Eu3Uw5PKeQ9 + j5SPAw+1xvnB6q9iHAOhXwtER3bOsXOs8RnPTqKCV5RtEa6su79Kfw== -----END AGE ENCRYPTED FILE----- - recipient: age18qam683rva3ee3wgue7r0ey4ws4jttz4a4dpe3q8kq8lmrp97ezq2cns8d enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJRWlVS0o2ZC9sOGd3S1JI - RWdPZ21Hd016WlE1QjBONlVLTUMxWFA5dERNCjBtYXVMajBDSnhMbUlFY0ZQQ0dr - YitraTV5ZUlDbS9XMWxKSUQ5QXFpU1UKLS0tIEk1Z05NUDB3enVvNDdNRkpnU1Q3 - R1RnWWFaSmRtdDFVVW9jaGZUdUFQWFEKCE1osno869cTyuxQhQC3TjIfo5becoQk - ItN0+DrfbJtIs51+gu9sv92TFOWgdnvkCI0M6wzYnYCT6hH7ibwfrw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbnJGdk40VVlQVGlhRVZy + M29YdWFxRnBRdlNsSVdTWnBWMGI1N3N5SjJjCkw3RzA5cHlBNVA2NlVlV2lJSThG + K2RXNm4rWkRtUmhHZUNBWUlUbTBIQ2sKLS0tIExyeFBpbnlRWittc09mVjkvY1ps + S0tjNUx3anVqL1RHVmVsR040S2VmdG8KEihK9BPXXLd0XQZB111NJuOdJGnCgBHP + KCuVczzyMx1lAyh0NlG0xgyIMKuWAXP0PBGgf24jerGbp/5mIx+sgw== -----END AGE ENCRYPTED FILE----- - recipient: age19rg2cuj9smv8nzxmr03azfqe69edhep53dep6kvh83paf08zv58sntm0fg enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3OEtZYSthRmZVbFY1dGx1 - TFVTRGh4QTVUZU1VVWRpU0FXMlVyQUhTWlhNCmZRdjc0ZGRGdFJCYk9weXJjSU5P - WE1GbWprT3RHeE5KbzNMNk1lYVdaVEEKLS0tIHJ3ZWdzbEVrNWJFZUIwSUplQUFm - WmpuWC9QWjdmUkxzSmhMa2R0K3ZYZ00Kl25L6Ya5bV4mPgq/OPxYq/D2xqszFVr9 - FkdgDr1VfbvU5wdA0QjIo+gVaJI7EazUcy2UJerS+uvL0dIn+RwsWg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVTU0eWFMaWhIK25ESUQ0 + ZklzVEhOeDBtSWpINDVVb2o3QjQ5VWZzSUg4CkRpMnVGU3ZOWVZCRnpHT0J4TGhY + ZHNDekxuRmZ6TlIrUmhkYzlFb2NFM2MKLS0tIGNveGhmY1FsRUE2c045U2NjTi9r + ZjN2TEc2TGtIV093N1lKRjNqa0NrZTAKv72ItPWyFHxKxT1xQIu2sA2SzR3/1/Hf + WiZjpE7QXJBxhFVeYEcZgPKOZ7HdubchjSTCGTuX9oyi4/GI7yRPUg== -----END AGE ENCRYPTED FILE----- - recipient: age16znyzvquuy8467gg27mdwdt8k6kcu3fjrvfm6gnl4nmqp8tuvqaspqgcet enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYTlVXVlo2Ui9ISTY5dnNS - UFNzZGVueXA3dXkyb0NFNzlEVTcvM0Iwd2xzCkhsRGxRU3NBNURBR2FGay9wMlk3 - M3ZBTzlRNlRCVTFQNGZndEJFeDZzZUUKLS0tIDVGcWJWSUlnV3dSWkdzMjdZQkJs - dTNYQlJiNmwrbGdNNlRxZnBKcGNJV2sKBw6OlaoIcb9hoJQY6i5tI2ln9ug8KySE - 4jvaInODSz1eLaF/W+wxgiDxqgiB7cgeBxeCQiqNe8ZZz/7Mxhg6qQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTzhrMGRsTHhCc2hlTkhS + SGxENjN3R0lseHgvVGJBdEN5L2RqTWJsMm1nCkcyVHJoRTUwa0U4VFFINXNmcFow + djBVZ3RjMWRNMzNnVGQ2SVpnbkZyOUEKLS0tIG1sZTE5ajc2aU82Yi8wT3djTk90 + cFFnNU9ZT05VTVJyVEJIUzNpRjhRc1UKZuDdPv5Ii+1ErBYDGxkaF0U/T9jKRI1X + Ov56TSpl0nlUB89dLPg94bICrL6q/Gv1pFBGx03xe/bHyxaHTEvGoA== -----END AGE ENCRYPTED FILE----- - recipient: age1azkgwrcwqhc6flj7gturptpl2uvay6pd94cam4t6yuk2n4wlnsqsj38hca enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbXVyZjBsdlNOZS95ZkhN - VDZZQkxybTh5NGR2ZzI4VytMeTlseG5pdlhrCmdsdWY2cnZpa0xJaklvK3Z1bWRN - OWhCaHMyT1dLNmo0blBiU1g1Slpoa0EKLS0tIG42QUZuZFNVS1E2REV1UGVvRjI3 - WnplM2ZKVkVlZ1FIYStzYnl6T0xtcWcKiUfgJWlz6dwyFg0ln5a9MwZuQwwHv9f/ - AV4QcSWXR0rh8oV4PWw+EYYmtmX7GICNVjqruHmokU83xpcqu1g40Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLVWNnMjlsUFZNa1AvVXFu + OXZQQkozYWxkZ0wxSUxZZlM2WGtuYU05b0dFClloZkxTWld4cEI3TWhaTEpCdkJJ + T0VLTkpsRnluejg0YWNzTGMzUUtRTFkKLS0tIHZ0U1lDRUxpYkdXaEl3OXBmVDZ2 + SmxybFFncFpjL3FuZ2dFaWM4dnFOWkEK+EqXlNZkn+oe4YecCwqJ8fLvXSo81A7/ + hBRU6LQGrSwf7lWW1qXNi/wtlNJMKE0nWFsJozrPFwoEjjysFDZy3Q== -----END AGE ENCRYPTED FILE----- - recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VGFBSTk1blRwM0g0Vnhp - ZnNKOXJ4V2MzRllqL1NNV2VSK3JsZHFTMlhzClpHYXVqa0ZmSGFVWVpjSitmT0pn - K0txWHpPcDVKNGNTZjR6bEowSWo3Q1UKLS0tICs4dEZQeGhIUFYvRHZlU3pQTmdB - a05lTEZ6My9jM28xdUVTOTdqSkRHMEEKjdhHDpQl8hkRiHheD9sxDZHnIeJmCjXU - GBpbbTjAoVcJDyK9YH43/jNr5rT4mxTogArNtk+cvUlV1Ryy+PED4w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDejRnM05CR0ZHbUMya2ps + OFlBRnBueTdBc3k5VFhpelg3ems5NHZ3NjN3Cm9sRVJXQnZjdWJVNHdLSzFlZGly + VDNTUCtlV3dEK2lSRFhkNmQyUGpCcjgKLS0tIGdSd3dUb3B5Y1ZDSG9PODhNWGsw + RVJ3SW54T1VpNUlhUnhnamFRalpnTE0KL2JiKsiWp+06NN3paFVt5ZDfZBDP8i9u + 2vwztiFt8WdDKqJtaz2HxPutj+LtQIOOmZWatKTQRS8ALNtLZOeZgw== -----END AGE ENCRYPTED FILE----- - recipient: age1wnympe3x8ce8hk87cymmt6wvccs4aes5rhhs44hq0s529v5z4g5sfyphwx enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBscjRHQ3lGaDJBOGxGTHIz - U2JmcjhyOVF3cEFCWXFFMU5Nc0hUU3pSWENRCm9vWXM4Rm9iSFZiTTNjeW1aNE5K - RjVoYUE2S3M3d0orVjFIcWhrVVgyUzgKLS0tIFpWeXNMWXg5Z2FTSkVDYytvdStU - MVNCQzVBSGIyUjAwL2NYK0ZSdE9kS0kK8Mo29wZlV/t1hixFL95NSyCvHfB1nUk3 - m/z5yh8CFwozb7ovd6MkAlqXB3bYAmMOiL+TPlvtqKkzcuQ6DRmjeg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQ2Fld2ZjcjhoUVNmalpo + eFNZbFM2UzcrdHZTV011Ni9YeXhzUlRrcHhvCjV0cVMwenhOeDZweGo3YmsrcGRl + U3pBYjUvSTliT3JiK3dKWDdzYzlJUTQKLS0tIE1hb0RPbWoycjhTYjE3K01HdWY4 + cDBTVlVOZGFTWUkxM2pIWkhrK3ZWZmsKEk9Q/lXxWEkDt+xJyhmrnkqh8tarYY2D + UyJQofhowqP1gKLHlH0OVK2SGOXK1A762+aXDsSAb3cGvxQ+p06qkA== -----END AGE ENCRYPTED FILE----- - recipient: age172pk7lyc6p4ewy0f2h6pau5d5sz6z8cq66hm4u4tpzx3an496a2sljx7x5 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Q3pRZWVSZUF0cmJDUVJj - bmY5T3RhSmMvVGpoRlBOU21jWDZ5elI3ZVFNCkVUWXQ1b0dlT2JLK0diZUZpU2VJ - RExZQkpBa2t4aUxiMndpeStCUmlQalUKLS0tIGtEM25qenNSbmpGMlEzc0xvSW1t - ejh5dmtBZ0tsL0lIMzhmcjg4TmozL1EKRKzgHd2n9OqFd9AYsjvu4mk2IOOgFeF3 - x1toWH7frbK9/wyQ+jDJsWIthsvvGxOrU/bmiWYsFraEey3+8fJ3dA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuUTlRU3V3U1VmKy9hOEhr + SVlObkVjaERRcStDd0Jtd0tXbUhuVWx5em5BCmh0aVkwYlZ4OWRGMjVwV0M1RGhk + dFhqOVFadG53dnNvemc0UmpXQlRDZ1EKLS0tIDQ4TE5SU29zeXdUYVR3VzdicVRY + NTI0SnBYZGlRLzAwc0p1dExXVFdmVnMKEFkjz2qpMXRqwmZ4YCxs8iwZpHk/CSit + G4+EjH9oMEFBYqPkgdsYw2stIs7yPncKtKHPIHD93OlXCqKoqNWGag== -----END AGE ENCRYPTED FILE----- - recipient: age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpM1lUbGhIWmRIRnlJbEJa - NDRpN0QrQ0IrYSs5RG4zWGMzZUhoSjFqRW1rCmtNS3Z6N1d0WmNKM3VvSms1Qk5M - cTRjTFJnREVzUSsyN0N2K3NpMWFTTEUKLS0tIEhBZGphNVhuTkZVenhZcm9kejU3 - bXdLWUV6elhUcWo1dTZOODB4Wm0yQ1kK0K3NSYoxjIdHt8mkfZ6/phTc+yDEbjOd - +23I/LtmUeGLDYbFMnUVrs6IHdt0Wf6XiHihFeAYBzJ+MZJiBGA/pg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSTWY5eWkzS1FSNHlWL05l + SU00eUl6K1VYcDJoSFR0UEsyU1pHcE95K1FJCmEvdEVUb2xJdTRZTUY1bHI2YmRp + RUtrSGJsUFpRazZHVzdhQlZxbmxKMnMKLS0tIHhxVzFvVktXZ1lhazRyRXNLM1RQ + NmNLRnRDdkJiT3lXL2s2L0tNbTJLdUEKz1y8nEdzEmbqb8V9RoZWrKuLbz/as/4a + 8z/+fyoRWhuugN3bP1XIw7tyg7abW4/fMQaJi5iEcguKbDnfZ5G5uw== -----END AGE ENCRYPTED FILE----- - recipient: age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHYVh0aXlGRzRzVUtpcktG - RlNtUC93VjFYbzFDTGh3WUF6eStVNGpzOGpVCjM2dGM3ZXlzeW1hQ01SQlhIOElw - V1RaRG5kTDNHUzdSVm1WTEFaNXROVEEKLS0tIDdRM3IwRURrMWpWNlhPNFRMNmlu - UG10azZmL2J6ZTI5WXFjaFlhUWdzT1kKDiBjafMxI4hH5vXwYU0oKXa6N3VwwSh3 - SYOWwZrrXzC2XEB2btqWxuPOu4gH9qVJXjIM4dS7AaHJM0DmrzBj1Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdExDdGlMczA3cG1RQ2dj + cmlycUtFay9GSXZTY1ViR1lRMnZEenNXZEc4CkdhSUJRd3VmUzFGYXJJNStCMFFi + MGgrWkZOQUFqYURsUEVtblVnS0lHM3cKLS0tIE1YRjFuWU8yeWlJOHJJNDdBaDZP + VnpYR0RhS3ZLS2xlN21mNEdWQUxENE0KA/4UnoYY7p/6/KyK/OF0xkK/RNTtvb1A + uw+8pfLPlY4OKcq+yhCQEkIJOUzNvtoHWcvQf7HIzq/3pXc4b7zIkQ== -----END AGE ENCRYPTED FILE----- - recipient: age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFNjlSQTE2SFJVUE9pTXFy - NHo5czVPWjJYWFo4ckhDeTVQU1lFdDhQc0IwCnV3VWx4U3Z1cGFKdVl6ajJJRU5J - bWc3dkFiUlJoQVc0bnZvNitHV1g3ajAKLS0tIHEvNCtmRjRHRzE3Y2oxRnpLRHNQ - dEtZOGRkdTZIYVJrRE1Xaks0NjI0T28K9y8wk3WVv0SpnWj0FK8U4cRHYeuXIHw8 - tWL52iwJTf1Jm1uKw99S12ixhZIuNUM9J33EqH6PVQxDRCzM8/jW8A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZHZwK0wrdGpGMnJtSWVW + ckthVU5xa0syeU1EYWpGUnExSEdVNUQwTndFCk5hSkdDQVQ4ZU9ORXVUbWN5OEtX + Z1Bod3UwTGp6T01GN0JYY3NpUGRZUlkKLS0tIFBCOGFnbWRaZXVieDNYWFUzOHYr + L2J2UFZlUG1EK2E0MktDbGlOS1VmY28KA/Edhl661RwszbY6wdttE/5e91IYM2Z+ + NHPgNq9ePb0DqAtNozYk8lA9D4Y20cx+7gTPzSwYKVW1iITarI50NA== -----END AGE ENCRYPTED FILE----- - recipient: age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UVRZNyt5QVdNMThiRlds - Z1ZjVWZlVlpMRzBrV1M1Y0k3M2xCRnVUVzNzCmZxVnlkMWNPNTlkOU1IVXVHTWJ2 - MjByM09LTjR0UHNrYkwrOS9Uck1EY0EKLS0tIG9PTndzTDFSY1JzWXA4Y0l0QWFr - enA3QVpDZGwzaHZ6ZGpmK2JmMm5nVVkKrjkYCDyXtf4QMmC4IWh3ealGGFE2qsT+ - 01mAXWHGETiuezKRxJahSqWBk9JL8EvAPNGhi3o7B++H40U4G3dgLA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzOS9kOVlMR2lXVDFWcUYv + cWtTZFdMMHdoQzdUbEZmRXlITHRrVFFKVlJRCjl1eEJmSUs5ejBYdGl1Y3Z1ZkNL + Ymc2Q2VVclRKdzRiQStBZGozRmlDM1UKLS0tIDRhTUN5aVhYTG9IZWdPY3hVQitq + ZHFGVzhBbVZwV2F0VkJzazIzRCs2TzQKK+j4kdCrNBQpEMIl/qBdrVem2880XnMd + /gHCkOmjcCJwbawN7ddB/+nxNp59M2MwednrXt+O5clTuAseUoa16Q== -----END AGE ENCRYPTED FILE----- - recipient: age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJU3AraDJyc1dPTlloN2M5 - UGp5a3Z2cFpYWWJLaXFMdVByY3ROQ3ZDY2lvCjN3SHR1MjRTdTNERU16aGFyT0VG - NXVpTk9KVHp5dDdwNkQ5RDVsMzRsQWcKLS0tIFBjaVVZUTNzVDZJVlBQdGxZbG1L - MFh3MFVSS3lKK3NWdThGMzIwdUNoSzQKSREBS5WSMieyjWjuBN/faxsdF0Gv29OA - s5MLSR4YXdoENtBYJLl2NMU8+Qz/F1UlnuUtCzcW686Dy11T/CDnRQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbWgwQmZEcmw3emVJN294 + cERib0xuc3Y5UWJiRElRUnhjS3JScHc4aEU0Cm0zaDlzOU5sL0J0MGE3Ujg1T3ZS + cXljVFFVZDhxWEdkUjdndmNlNkxrQTAKLS0tIENwbDlKTVRLSVJ2elZCbnhtY0RH + Vkdhb1Vld2NvWlpNTFNyRFRQRFhsVlUKRihJgoaFsgfByXfoWA728AT+E9bQu1ju + tYpn7wL00VA/xwLyb7WVcrIJY2Q946UTUE4b9Isx6rv3NDKeWYUEPw== -----END AGE ENCRYPTED FILE----- - recipient: age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjd0NpQjFVOHAyUkdYMzZs - VUplU3hpbzc1YVRzS2lMSExHb09uOFFRaFJ3CjBqZS9rYXl3aGZkdVVUM0FuU2Jv - cHRXdlNFRnYyK2dXaE9EbytOTXhxTDAKLS0tIGlEU1RpQWlkZGovR3JTOUNTck5N - RlJWZVJ0aWlHSngwUmRhUHpYNUNlNDQKX4jKugCpD5usjuQkSimKhEIPbvq6cTT+ - DcVYEw1hNRieZ3hrjMIqcoCjPOlXq0+hkQmAkZvrMvO2e1CAlm/DZQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpaFFlQWpoaUJFVEIvb3Vw + SzZyWmlMcU1RMXFnMmNHenJNTDJnN3dYbVhZCmNFRC9oRE1ENHZWc2ZYeUFMOEEr + ZjBUbjlaNlVvMkdaUkwwUmlWd3luQVEKLS0tIElEQnltd01ZU3YwNlFjc3RBcUNz + TVFtc2czRFdoMDhyVkgvVXduQTNHNU0Kiuni5O8zpUHcxSD/ifv26sgGa0CcztsT + jp/zmougfaFAy7UOLnkaCEu7gruoesZY3fxPhiCyy+jSCLe9mzxSbQ== -----END AGE ENCRYPTED FILE----- - recipient: age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTc2ptTGlGU0VaMnVCb2ly - dzNUUldEeVBIbnpEdlM0QkI1Zkhua1IzNmhFCjBUQk1lanFWVGNjeDVGdG55TTVE - Z2lIWXNqY0Y1YUEwQjI5dC9UY01jSE0KLS0tIFVlOXN2cThQdldjWEs3b2pDRHNB - cks5WjFuMTBCMVhMYnJjbkpFclgwNUkKPh/RpdUCKYn76fm5MG47ePBmNHLATnFp - rrN+PHxj85vL/3u00j2kNY28dM7IH3qymMYKu1Dm+BO2RFI/4hPFsA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNFVuV04rTnpXRGthQjRY + ZmZ1Y0JQUG45dDhoYUVOeGF0YTJmamliT1FvCnFPS2NXbFliejg4Q3JpVmY5c2xm + U09HZ0I1dk10RGh4Ull0dTc4OEFGVHcKLS0tIDdSOGhySVQvUHlLNllnakc4RmhR + N3VKRzRvNW1WeVBhN0ZtUXF2UzZHVlkKl9roQWqZWohR8MnoMCXWNggWJZBHfZJp + 29pKxeqp4KV0c4oQMgFYcckrw13ynMQ1O9cgYVMPl/qtViun9jr6XA== -----END AGE ENCRYPTED FILE----- - recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYcHJaVExSbFl6anlLd2do - QlMyNU9zT1lJM3NTeThjYVlibTh6VVMweFQ4ClFrSDRXaTlDME50WlNJNG52SVoy - NEFvdko4QUdYRDNJSkIyTHo2aVlWTncKLS0tIHAvRlNISVd4WU1WMGZGcVk3aEhh - SUo2QWV6bEZGNFdaLy9BU3ZsQUY4eXMKaW/0KSpGic5BDOdmWmCHJ3NzBNC/+3/K - I9GEF07iK0tvIFupQToFuZ6uV0BdLmpHPfNBnSKY2+Q3r7siomPTIA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4c2VyQmxSWW1aMnRwMFpk + bEluV3IxWVloZjNiQ1hubGhldENWZG5kOFRnCjFZMUFGRWFiODBDaFNGK2pCRlJB + QzJCdisrd1IyY3B1dDFOWW9QeW5ReTAKLS0tIEFJODdCKyt1NERlbk1NNjUxWWU3 + NXNkQTZ4Tk4zanlRdHJJc2tJWmdNMzAKzifmbegg6BO7RBg+BEbdq+wqWHRIa9JT + RHUWaCkaX/uKndvNzjrDITLClAw6lycFFFWkCzFidT6nzz2omfJkPQ== + -----END AGE ENCRYPTED FILE----- + - recipient: age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxa3NmdnoyRXdkQUNBT2xv + ZmRkZk1kcFdoRER0ZG1NelN1TmpmWXlPWlEwCnQvSWtuY0NiT3dkN1g3SzhhTmVm + Wkd0KzJlcDh4aEtFMUhCaUJ4dlJYV0kKLS0tIFVnNzJXQVh5U3d1b2c0VVVkV0JC + SURxZWNTNDcxcEd0aHA4R0VRYjZhak0KNsB6lsd6OK9lCdzHJqih9uZ5xExf6z4J + IqH/PN+F84tTh29QxvZRd07qQwVBiXdwDcQjBzUM4S+a2c+TVxf/qw== -----END AGE ENCRYPTED FILE----- lastmodified: "2026-01-25T18:06:26Z" mac: ENC[AES256_GCM,data:plHNLOgGWwNWbakKG6X5EOxwERE3rvYO4EOAzY/sz+uM7cZBEnqU5LZwjlD8B75hgRHqpnDBF0JbHgsEwVxfJJRL1phkeMJFOapQMjZVWMz6j7eb1hOwpdktd+bpuimy4XCD1aOxOoInKpFSK33usxLfyqSxjFDM5+i6D22qBTs=,iv:/iOIfNuSIDsa/UKLP0d63tpOrYMFO3Bk1qPssY0AzuI=,tag:k+824MXD+r0lNUcuvisudw==,type:str] pgp: - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxK/JaB2/SdtARAAgG60jnqSqxqyG5tpmOyODv8QP5CQ+2bhDUg9gZtaAn6R - CLseD2MGUkOn0JzJfDbLFNr0yCkNCq8hiCQl/4IuX1eCV1Yskbo0N9VS6aLVeN2H - GLkOkVBnA0/ipckcnqBk2kvxJLy39N4k5n6PAopen8rQcIuEN9Ljso8ItB1BJhKu - 1AQqZLw41aCyXFnK5fvT0s6U77VOjwO5CA/c3Cgz4HzR1cmZSr65a6oBBIOBkQCH - J3SSSGCJ/SgAAduQy5eHMLtCm/J20NYzLDCadwHTgGJMHkTaL49E7/JbYG3t1aEO - Le4mG9hXz2vC5CbZSaXzmbwv1APQ9PWRzjqeBsJFZx3rkmj8xhRdZcU/nqCXTvls - l+yG0rbMz1vHPW65nzKw+6AU974Mt/55TRxpdCQGg7EqlzS+JnbEGxnqtSHd46Sq - a7apnd0rbaZpUD94tYcUkG3MePslarCcv5hBPUD4hGjC5yfkkCdcRES2JnNDcCQy - 40mknB95dXomQf7Rf3bOpbXp/zagaFaWw2X/n3eEQZwXl6UCQQf5n1VriKMbCTJo - vlJsDGSsaZgA4c3O9Fa64hECnp5Uj1jtBbC4xxjljZMUjDnAokzWbJPpWh2wS6rQ - EKndLx23h6gHEOS+Qa3EixF+yVRHCSZs1WTWPlOEsXWJf3gduvmXY6FzLN4MPWbS - XgG8DyR91pv5Uj3/2V3eDExA0m+HyXhZZEo3j+0Fda9HZkvQERsE2lvkTt1hyB+f - cBU+7eXEWzOrulWpFFtKetk3lNdGEhSWXomGZ8CRCHrmu37settg4QqWZlUwXWQ= - =4FYu + hQIMAxK/JaB2/SdtARAArIbXCPqNo+EajbWjsgzQAt4jtyUSh7zOy1URyt5XPEUj + zJUFkS8SUfL372esuA/KjiRhE0Ztq2T+zHF8sBT5E3GCTEiLnKvGNGik2w2OX5MG + CDmKZosfuhByOFFubsI76fbicb5euGq1QSlBony8fqPtvJ1LpY2GX7Ob58TXii9f + ESLesimUT0T1sxG22w7RFOFPHRgqD7q8Y9gAsJduj9QVIr6bBxehbu80/b00irk4 + SVFM7lkvEWij3LXHYBBx54lwT5vaM2lNzQzBRJDljzD5bJkqFFc5HZAtZXI+g7fP + UmKZQWD74Fi8boYE9VNKW5jtEHAIgWHAVNEZPb02zmNITH2BaWYQFRseYeILdjaE + zdnw087YhK88BHZYjgACY1+yMHaxrlwyj95D2m27zk37JBo5F52L9Lo7uKgF7rtS + sAw+VGqscEwyB0mmTeidcV1talvieHgdbJiCFH/hWcNksa/EZoMclp8HscKOjWjj + bq4qZSH0BPD740CLyIhh6LFLpi2wEdEY4MyMkjP1vM/F7yPondEB5vNjk7x5V1hD + bK/WthCeN2Q34uCBOnnqzFlbrFAmHXQvq8NgzEDvsJmfY1wUrNsdW9wy8fti+g2w + L+s5Eqr6BgvqCIPz7e6xtZwekvP1p8tHyUqPcdXLDfFoBayeMd1/So1mV6nXzs7S + XAG+LzP7X+B2u69GSkJZjgpmwgiOXXQDIlVE60O8bENLeMRbXLpkBwQ0n8XIs6pr + +FX4YxPsf7IWRpMjKNfLN07dSSkjhlVK6+qfyBAuucuikWsmqY6jgiS8daSe + =voHd -----END PGP MESSAGE----- fp: EF643F59E008414882232C78FFA8331EEB7D6B70 - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hQEMA1QflAioE8i3AQf9GnjRfyFcHOBCSMvAQTzSH1u68A51lgK8wPyxHhEvwipc - 6ZwTJi/V8tLJQzsgYq642dCRwHwvz0c0s8xNv0EyTjxLL/ituxcsGf3UeoigaQGN - 053vxufwSCuglWCgSVGy2nBXMw/v4oj+3dAl83cmmZFDaiMfN3i+cs8un/fkHLCD - IPDhDgvkfYfHAkezQ0mwQbiTtZGLURFMefXxdXcDTmgRJ4TsKER16uLwA8wOVe46 - bV4QzGY3+s1VJGuIXmYpsb79u54vch6M6SDy9VT7k0T3KA+tHYxB2k1WbgvHRZ+r - KNyITbqa6Vvwbd8LW9TvAdkmye3p/StlOD4DJH0GJtJeAVDkJ6Balsd1JEsHQqzX - 8iYRNCueqLorWncsJerH95dBvV3DZ7Cba9askEaIxNjtFTBO47ZyK7C/MwaTNDAr - 3qEh+mGsMC7ONl8erx1MheDoN24A9qUPQc6eJE97gg== - =6ciM + hQEMA1QflAioE8i3AQf/XZSfNxfryND2BGfBPyJBkNySVUZpRPqWg9hi+7n6oCp0 + FZXUynfrtWLTdFF6A35OsnpdLEVwrQqfuqcrK6OkAYUkV9t50YVw6nAAmETc9faB + BV7RVGJf0OD79LHI/Fl8a+VkkMqG56BoBySQ+2Vb/eh8w0PKbB0oWN4yXBihkXAS + DKjEKf7x4OrTdHKa8GiKxsA9C+P0oo92Ygy98TOXQPb3MSQhWfnCFm+7beXIfInu + EpOtSFM+2X0y70Wz+X2/lw945qm+d+JXjvLpqpE+4U1b8LYuue5ddHzJjYIHK8Br + lQrdanIJw7CAeyKUtq5M63k5CZG2GHMxNGngWUGtm9JcAScF4QdywEzoq2NBf/lF + eP6/u7Kn8MTJ+gFOWxmlT8+VA+rhCp40EccQzbeftNI9ojI2YrYl4Qkb9CzlFXhN + uCtLLlRakB6CQWGaTxxlkN97h55s3A6l1hsF5qc= + =YG2f -----END PGP MESSAGE----- fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJARAA0ojb8p8uQLivFc8DCYMeolgJa2APcE674herpCNDFHqF - bqwTiXFlfwtgHq8MEXW9ZzmLjGtv1xefNyV7FcsWIxLARTlm6vD7lXhbACVzDEt6 - NArvbZ7S9DNOqjmWMPZMBw+isSp49IWL6su4ayxDylX5T+lCtCt11xDVehkwThyn - espWaTTxePfEhvfa2qV/KlUNg0bUM/D2hGtccwoN9o6PKZ61XJXs22xRsAUAvIJQ - qVj5KzxtFuuMQoYpWKL/pbI5yTyyDxnv4hBiRm5c00Jh/pt+C56gOpHMFyoZz5Qm - Hs/Yx7IIExMJv64AcXxWSXVSUPwi6/5N4kuQNUyF+IGyP5ChiBANZG/1b77sSay0 - YXLp0s59NcgVk+qwokBnWjlM9SBvVSYe8UCKP2fmcGsX8z8BnRSLMgv7Vf7dp0Vz - 2Tn8KPORJOvl4AM5PrPLyGB22enBfNCwKNFnrc7vrxR6FRjY6ev3H3KfGpOFhFyW - niz419fK7suqzHealm0DW9bfW+/5DqQvhqhU6D+yaL3f258LGa+3xM3fKNxE6SKi - aoUo75/ejnVl0vdT53vS9WMERdCuuN2ye0EGsU/k+Ir92ZOV7wan8P62Sz5aE/sI - x9buFx1Mem7amIoAPLJ0iMjt8znoqguPMxI7nKp8PYJ+sv/z2oaBZf2ZpO6k64LS - XgE80imgQYw0LP02tolznROVwYUL4zKYUrRvU7DK/dj1ymXWePdfvBQ7QCJ8C2d+ - O1K1y1Ym0NusWbxz1sG85MTnANYwzHlmzFhJwsoJvdzs8c0SUxgsL7+m5/++qbc= - =HerR + hQIMAz5uSgHG2iMJARAAyLt6nBeCDKG9P76zUoweIw+m0aXbN1XFSIPbaq+ymq3n + /DDhqswh0xF2Ng4mD8uYrFI7CdEyVH2KCJAsa4QRKadryBxNtZqPOsHz5JcVgnlJ + yKnIYWbG7UZKfjAJy6TlpQR79hj7EvCNVQ7i4OYiOSJHxrqrRmAenyP0h6KfjIWA + Csx3y1O4SiE0llGYUO7K6t8p8mvx7nek2rXcL4KMo+4mKWSPaYP6XkBYteRTjfA8 + 07iU1TOmO5Fh5KgtWYkyAcQco71aefG6ub/NjJ9UYpSq6Q/I14DVpC5IrcgxbcRQ + SXAaK8L0iQPQ3mN4lxKokD5FKmr1et51GjRfvmiLCxY9rooB2/Xc2oiCHP8cB4xq + kxxoRUYRItBYzYbXqIYPJ0m8T5o6QQePbj1zfFLfpW33ZFdsRVyOdl5WSis5Y0Su + zA4A75KPlB6lK4qBa3tbWC9lOa35uAEk0NNOV2HNA7BAv5H5AQkoItaYMqElaoVG + PUrhuR7/eC5kRXoqothzv2H5BVGDqgqqj3ctv45hqrR3CylK5M5c8cS1Orfp9NGl + 8WWv55c7bWMW7dj4TOms+O58MwrOBla7C65U2krbsjm0piFoaEyRVgrypV/zR8tX + LIk1jJpNcLkMgVE+8593RlRlpCKbnk2qfqd4AuoDWdLh8Qq9H8lB4s2F4v8g6FbS + XAFw18E38CdoNdj/bjcM7uCOTGAfR+p24k7c4LPP6AcC/FV0QinPGwDiwEdd5a9N + rXyvsFxfSzrF+CJ+B2vefasL7SxDCVkM44dY2BUxOmYxNRmH5g2R73sLKJ7P + =wIGB -----END PGP MESSAGE----- fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DsZXvxFXTXoQSAQdAozv/NDuwLWMHca7CXMS6eAyeIspdNr0G8Vrt1qUohlEw - O3zOGfc5EKGNAWremAO/cvqY1lBiftDKmn+nhP/+ODde0QyIMuZesTKW/RjqsHK5 - 0l4B51zXNybVL+WK0eHXdR9jBsJt2ml+B6Dm8Vrc09ivjy91rKh2fkE57LWpQYHN - Bzs/9tL3Go4cDKmm4ziiw6Gisw7dMJPI2Ys5goheG7KBoGtCzyX1qUZHElyiGHtK - =PEO7 + hF4DsZXvxFXTXoQSAQdAFCMxmEEeH1EbTjXUOYwa3eR8KnSPneB9kueCkfQrnyAw + 4gq47KXBaGPHp0Z8NYWmSFBeaYjCkwo2Ofb+j5/Va36ky+AnSysGIwcUrWMaVa9C + 0lwByKgj1RSU/BsybtP3tyPw1YRqadlp+nR/5agxBYhK7BC/jbhSN8rlkpfycuH5 + 39oQYmE/jRSAIgAfsj77Tfb2WRBAdv/F5u86fO/bgHd+MgPqPU4hCCJi5Q+iPQ== + =dW1/ -----END PGP MESSAGE----- fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAh75Enh942cD3+HgiJEtjw//W7OV37U0rZvXi0y/Mxikw - 0XNYiOER3IIwoFS7a8eiBSZe1bbfnFD/0qOfbpD85orDiJzrnWAU5bq+NMHlBgzx - 0l4BXAmkkumjh0ZeaSRUayYmvaa/sKVnNFlbI8ieU7qb3zNUaC4mqU2MHQ0KHRJE - Aa4eqVFhsLEh+ULUmeXrbPYo8q3+IQZteQ4bpEv4c7vh92h2mw/bj8XphSxN5q8C - =Dvky + hF4DerEtaFuTeewSAQdAYdMU1XTUDpkZslHRIczB801Wxg4+i6AMXuV8ev4/mHcw + xyg+Sisom1gLL0VX8Gd8YYsRTZiDSSpurQNqwXy0Eyx7+WJ8txxo/GFw3ZLMRhI0 + 0lwBSwV8FeBs0tuvTFa4zqWZ9wklzk7lfiDdVV1wc/Q12SznvMes1KZtqUDEbkaG + lYg2b5Cl4xMd+QP9MVcQgibGYw5mx/xZ0oJpiVJ9JBw6MrGBJYChGOqf0eaD6A== + =h0ca -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fAQ//ZHA6fVzyT2n4i4AHHMXii+pJPEJN/8QRdAnxZYNZ1n8k - G8T/0a0l5xb6o9WmsqE2OYU554uzoHkyMIlM1kZqKZBeBXle7r1De/T10fv2pwBr - 1wclXJjP8NwyTECASKR10+iGoc0d7R7RZ74dnu5cE8Loj48oZqbZjIedNrQk4YBY - PhTyeGsRLpxVSlL3T6aHmw1MfcIQ+P8NVLlSP/61IM4GF5/mY1zl3XAu/GUg7hBS - L0mpLwSNHJ0frMKQpTwSSfg9Pi++0NqTSBgUh/ZoikPGmGQl1eFxQ5tFD811mHMo - w4xFTzt89pD6Q2cv4KAH7qWdrWBdEvx6O4uTLdK9Pp9zKzB7CEujco8sZWrRmwEz - apWI1Mq238fCEtmOvWos0dKZie/dHgYEkPkECcUtDD6kAMP8Y/b1XQ3HZcwuDRi2 - 7LyplVyZ7Qu24vSqK3JuMUghoJL+fqsfKcNAmUBq0ELI1HY1P6ad3PvjrMkHPNpM - 5MhxpBk61YUc704GFEZK13KNbJLcygA/d8KUB/ouDR/uRjN0xw6cSN2VmTHpGA0A - 98+3hrzJ3ANmLFxX7eoGKrTltk1m7sIPACw9pkj41z1goPiK9sFawGUN2M6o/7W5 - UXPL0GfBMTI1Jbgxvbnq05lNDAM7DkahagcmR+Rr7CJdmmQw1ovjFnt4knnC0k/S - XgGQM9gT6th0CGAJ3DHJm2yoY2GikeoLhDTzaksgCZM4d00WC21yD8dNPv66KuUh - +4pxu8xvyQpPQ2Lr+H4yvEgf8s6CINgYntbmzZIyWTu9mOKJD0iHpBQM3I+3iYs= - =zdup + hQIMAxjNhCKPP69fAQ/9HuQg6KvEarCQfT/piWAuXtufmkCcj5dQK+U3j8ezmRYf + gvXqxd616jO72g94RlwO1MKwH8oukRTzvVe7TdPf0WtcuSVn3qeUY94mOwqscMSp + +GPSoPDqBZ4V4eg15vAAsTK5U2T/tx+5W3k/J0v6O2CM8b/ng8r0eP3MwlJiN02+ + ya7zS2A1OkxME6fa3758P6P7t0VdQRuhK7XA3F/Gv2dDqBEu0z+mFZDg007sR8bw + BNTZKMoamlDDkpv3HZ0qLy5FcocTL+/z/RK3GB4CB09gpznU7iGbM3QTkNVdNS7r + u7qaKuXKY61lIaho2SCgM6miA4h83DfHnxR0Vkcw8oPfENls5lPN8hku+swMFnYK + 9KR9ntk/Beo3RoqS/iIRgLlgHpP09tggdfUhi1gPdhdmTH5E2TIG9v7S4ltKen53 + aLqrNIiHy5S1Nr05Of0g4Ff/OxaI45lmzXAWQ7oVax8DSA+5ubUj1SHmo+zG5fyh + tTAdVh9oyBzX2GlpbWoKCXKPEhlu2pH75w/WfZLZYtjh927Mog+d+PAK24Kiz3N5 + cTd5EETuZC/nBku3WWN6y+gbfUpIJMFTtLKdNY++ebWaqfK9aZ1I0Q1g2pfZXDb2 + X1bzMdDdGAaCFNW9KWx4woB6FZEQvDLEKvxqZ0G+4DcfNj83sGOqE5oguLJhPyTS + XAH9x6T+VjGRFT0rN2MUMl4n+z5K9ZWA4OJcC2PGi5VGlVyK48hD0B+ygP6GBwKP + 2LJeG7ANB9eNeGsHmxEE804DdcuuEL8wtEomKU+14Qp4sFwXJEn0zqmgOPd+ + =DxEt -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA46L6MuPqfJqAQ//ZRYrl3A0QNnXXnK9u1yOATNq5DlbIPpKNo7KeX8HL12k - km8LM4s2mLyruJkdoGfEWY0THpGhUGrnXMx2QDxVYf47BWxmBvGinQTw3FAHEpt1 - fl5PACh0g5tqGkwLHIowAPMjjmTNKn5pCgNC9NGfuco2yx8tZUfdUNWej+/ZFtu+ - Y14hn4nOSIvl565qT2T62uuPdaRa0pT3gu2Pr5Z1Tn9hGl47swnuq6b81IeqaPu5 - ukbT0S8UNcW1AxgN+pXfQiLg+Iro53DDxKyZ0usMKSi9eBl7uayf/063RIAZoYl7 - PkdjaUuhflsF6RFKof8qC2vDHRnQNtIW31u+gNxk8852uuJtYspDR6ke3LdZru7K - QpmendFKZUC+9EtUJwahLSeQQJ5Q/xgNuIxCCPIlDftfX6kY3Oi55rl1t7J1lu2N - D0cRIAszEC9thcyGlzg6g/C2LyqeHbHdPxpFePN4MOOA5FuATftxwxd248jnEJes - wuX6PdaZ0LrcLBdSMSmpgBoVgv8bcyxD3K0SmqfbpZbtFCkDiXIe00yy0KtStjx+ - b6YfVpojcnXuWEN+lZQDFU7bvMZnruo0L+Z8MFrUb+wLZ9Pini20M3QhH61VSQJP - O+s0gEKwaDYp8125iW+mV9o9nw3fMEE49BMjlOxTXCHZk7RVKADzbpmvZ8rWHnbS - XgG7HFzmVNeECKLtbVO4rgjLqDw+q9aJ/wFyXNjxuMJKa5FGgl8/g38KpfbDq7jV - ogBSYhLpr2cSsQ/sLoLJZZyfjYTmvmSLZpFPqzSRofUUTrBs8/jKtzSCCd36AfQ= - =Aa7t + hQIMA46L6MuPqfJqAQ//VgmB8grK7tmBerMubQu9x9/ig086RG5IjAq+NqDZlwVu + fnRRhTb97/js/JdIXn+to0/pGwk2vzI2rWhcX9cLbRXVWqiLlWdDkpQwh0hAkHPD + U9CBm03TBJbsf6t9rA4ec+UGuMHBwKymw19c3TQpUtwtMxQpwUWsQemoCrzyayfD + ZhzVBL9skq0rGk2WQ3Z+qolGcFPokwwmh4Lu7gDOJyHUJYQdDXlZfbeNMv1/Mq/6 + atWzd9WrEpO3un7yu5wNzcUYtrCJuMEqRpwxf3fz1jNim6fYkmj7EMZcvZAEOU0v + qn+wBLVe5y19/W1KxLQ2hkUMhxsPHztOnvsYUNAiVNTfmCRlQlBZ+HvayNzMd81L + YIULOV5p7UnhOlPQhjwuX2LCOzkDRl4MKrbC4XNLYFwphPAn0v8SJ5mcb6a3w/5N + Zn4pzJX0+lT3D6Hv6231TVx5/AvtGYPs4YToM7drjl8pK8e1UHSdWxpiSJ87REvh + XyeEhvUoJkVhMc4pKWIMvlk5MkW0jDVCIiY41qnPh3CIF7NOOZiN5YpkPtl6kFJA + GkxS2bcLmuX/OnYkF3nsC77toEp0ffb95AyfGkcHIypN/bEE9P4DXIo98TZJCIXN + nq4HeDZVV9WmRQfpwEbYuGqxfTpM6LGl3KhXj+LJnktpMyYoEyX1bc5fB8cYDzXS + XAHhVdt5/wjsKTv/W8Nv+taOK2R+AD1QY5h2Bl97e3UoR0Ug3VdjPoLwZ/gFV/dO + ac1FMQhoA7P3Nlza1t+cSY8LvbiU30zurJtl/46JGreFseVpe0zjOKPMFutE + =2UZs -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdAFAf/+8TjczYTVpr5nrNKG2VHhOGfhHtswIg3pBbEsTkw - 90waRIH7AQb7pYgaqkfHZc1pfuA2EunAvEL8VsRUxrpueiWH0Yb1AoosjWn7VRuJ - 0l4BqsK0RFro18Q0xtIh+AEEYkFVJxPS2yJMD9e8Oc9uiRe8JCrBOa/inDGWHHVN - o4SY8heM7eWYW4qw/RnTayq4jqsA6vXJhgZHCSTC056RzELa4+WrtF5IVpv0lARf - =iTIp + hF4DQrf1tCqiJxoSAQdAOVINvFeDv9ENq+KtuvoKb+CBxyMbcKUWlBtOZLV/Xx0w + GXeCnAwIAB99wxr4ewLrFq34yabVnNfJYB9uD4zcIgevZAnB1Tji3FGMll0gGryq + 0lwBa3Pm/dn0ypFFcNW9xksgwE2oCaGLZq/D+bJtW6UJC5tBZm3Y+MbqiwKljJk+ + lmzzX4rlSnx4jCma8peyAb8RNqpMO/ezo1jgNyGZpsjIGvQ2i1n4YHi0VqEUEA== + =JMjm -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DzAGzViGx4qcSAQdAt08Be192JdaBTk1XW0dqa20rDfFtMJh7lJhFLMXW0mAw - ff13W+ZxJ2AJAVOnqiza2lHqE0nxTC/TZwvxXmmIbZKjxpzjoV2f5HcW9FBkrZZy - 0lgBlVtniohqUAz7vbbfyqi/t/6Un/8Z32Cvr060vIvBSANX+Dd4J6Gel4ZA7F6m - 5rSP4eipg5yhlGyeUhbXzT8l/NcGytbEAGjwMA4olC4dnsdRkrCiZY14 - =bhCX + hF4DzAGzViGx4qcSAQdAVm9Q6YBrTtT6g6yuAa06+nPtYICDNtrxUgjNCcOkJ2cw + Pi/c9CTwfEiU2iWzYygpCslJxs3UouBu5nxzCFTQRImltBjVQymDwaXvS99HU2sm + 0lYBG9hfZH8Icjo9n4MlbnbC5WBLRooyQJWDnFpZ85n9C7vLY2AH2a/IqnRiwB69 + ufWmB/r3Z2Brez/XvJdWJFCybuShL+Wyr+v5uelxI1u4ztNxmKeqXw== + =9vzq -----END PGP MESSAGE----- fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA2pVdGTIrZI+AQ/8DjyU67Mch06O1rnBp5UpDTJYMsTL9hqfjQcxpsZG1gLJ - t5fCtwSgJaxVfx3BfegWuwpS2jNQvuH/oNs6T4yBeN6GpLOzwQGXUe+JBV+aXSEb - 5J6jyJ7UKwICyE2kN8iwsKMNy/NXa0hhkAt1GIYb0CgEJ6/FOAGxEh7D1lL4WpYx - iiNRtmWqJAiTKGE8jnMmFamddKc3wkh16Z7mu2tkdaODNwrzqXhlIrukUAnn/plc - NPTws9gsnnOw8pYydQcSDYkKnM3z20pUk6fAfIWZ6JSH7Bt3WJ/Ftrhwixr9Ld5a - TXgiyxzfJMo9eUb/GMh1NpRJjLMBflfA3DsoD6dlvUEQAhCpO58xz94dEMrzb1wI - mNPwFPMgtWesCzJqXZwVLrtFbU9+e+ZlJL4n/BtgPoe9qhPQpb+hjIJLL6P10vG4 - YTx0M0v03vHsNy57uBh+ukV0jkm6kcQR8cVm8i1HcX4T0b8UbGyh+FXuMbLPahMF - CAPexpw4Ai+lAQm9jpRdhxX4xkXleNfo5WKNjrM2VUxiayi4EElQ71y4MuYbLPgM - njYLEwwyRKUjMegOrTBnEsPwxDi0NpKrZ6Wjy/G4h2b7PZNWrOCKE/2MiCcVUm86 - V+9ZMhpMWfpnAV3cez5Xyj6juR4nL3bOTb4KH+R1hB5yCN9NSKxoZ5+iLBHKT/LS - XgFfJrAwCBbD4KBR1uzbo9qcu/VP2/dRTUODxZESpX6sdycg7mrPxhFDDULCR3cN - swfbQqfinaD8wI+dwaUOUwKnO2hiXj0wbnt1J7Bh2C9uiyPP7bVMSizO/rAJE/Q= - =xcBs + hQIMA2pVdGTIrZI+AQ/9FNudV+zztNHNUBER8At2+bo1n6W+fbF5bTSbudOXGbvV + rdSTWxFuslVh5kzXJYP2a+iYh/o815lzQuVtn+PmKuWCzLEYB0VmkbeM9YBEOxKu + R6uVUbI8xOLFLLErR5E1d1l4p2KRqEEfc9m3tzDa+i3PVOCYhD6qTuKhb6ImDIE8 + 3MqbXRnBBWgK14IivA5ouGJfeHbsYmeWjt9y5gy25T++Mdq9aPoHjjQ4P38eDT5W + 5lK0KcoAPAsrGkjzIgF6NBQr/Ut54RuHdjaBST2tyHP0db9fHwQZj7vfylHJfj6h + yi7rdjX9Ldppw2dnatVKlmpQATS8lLX1vAkipa2H/8kz3oYOJNPf23+8AfyhMs/X + XTXkC8Zw2Auz71TxFcdUXrO3Z9/BgsaS3Ec1TRqfzKbwficT8QP9est79XDxF7WM + 7WXTvCQJVofRquCWR+1h1EwSTiMRGRNV/Uag4hJI6OUwBN2fKbVS94S1jNkxCOX/ + DIHhijMVXvfNWPOkTjuaeXJPem/XwjjCVif2+gPbjYhuXySrlYJVQOrKzPROYIZ/ + uDKqhGZOE0Ng4xNyD/KZTBsoJVeY9xI1IBfMh1c4QA6vJNqU1vQW5pnyFr+N0srQ + kEGBc9dwNom2BjanosbnRORW6+r6BwwI1uPOQPlYUpumHM4o9jGu4bbBSPewOxLS + XAFBjjWtkZS+WP692phQxnXz8+gLc0RXD0UZ9+Gyho+X7/R8BV0x/zDoUgfVwOnY + OZeyd9YDL8JkL+K6EZgS9u+E1XCbRkbVVES06QNVxYHnEO5VbU9YuG29KZ14 + =nF2L -----END PGP MESSAGE----- fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 - - created_at: "2026-05-20T02:08:48Z" + - created_at: "2026-05-20T02:10:23Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DKKbvh61jX5USAQdAWSpHk+R/CKDaO8c1UPr6fOMnivWMuIrBzZh2Q2JPPXww - C0C8VLfIorI6P3PbgbJi+BdKIPx4Vi8n/4t1y5fcPk/1NfALPaF2T0QuwhWiMpgT - 0l4BPZ5BAMvNLSuAiSIloGO59jHpsRNCxBcVQBPIYqMVCTZxwMy+gBki64+ypavz - UvHyj3/0Wpy1tHL/V9QSMhWW06S3jHMKS2040LYEY+WWW2+pmV+WJz94zL7+tw31 - =YBfK + hF4DKKbvh61jX5USAQdA4IyNdJ9IPWLBxwtMROgj+/ZlnMLCdnjXBMmtyrkRxFcw + JLp+UagV5UWX1KhddjhiAHbAa5OrIQsBZrJ75XIObCzlVMmj07CtUpYgLNsTiLVS + 0lwBrQz/Ogp01HETxMoMuGc6VdNvYBrRFZE94pK/KsMP3DAca2MXGokc0hOnk4WT + /mNoOxwCE8ph7H2T//TM0lS5DO1S6ytRxm6wrT7jLu1qkMm9EjW73Nr7Mb6HDg== + =9XH1 -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted diff --git a/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml b/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml new file mode 100644 index 0000000..c0e1b76 --- /dev/null +++ b/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml @@ -0,0 +1,187 @@ +ansible_pull__age_private_key: ENC[AES256_GCM,data:fEly3EIovZ4n5xMnD5Aqtbn1+DUszR0MvBHcM383G40qfHxrbF/lqc8iftshInoHSU77Vugignyb0dTSCTS1cWmEg8I/+ZFjgwc=,iv:Y1XunCfdIUC5nTu+vkr0Q0LUBWeIwP/bGNkbnDb1cpA=,tag:6UrkMx6yEGB46VVvtAkDMQ==,type:str] +sops: + age: + - recipient: age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcFhwNmRXTnptOUMrN0dZ + UnN0bFdCVjJQamNvTzZmMkxRdk0zL0E4bm4wCmRIVmVrVW1Jb3BKOVNnNnM5MXJm + SXU4ODdwUTVaSE9oSU1tWm5ZZUpLNlEKLS0tIHVUY0pUUlg5SDhJZjd6ZFhsSnBQ + VVI1TnN3UkcxUzdOWjJQTzZLOHNlaDQKx/HqW9sEYmNYIMYvLVF/9eJfcgRH/cJv + YqcDNZc8L9Rap2TfwsiJZourqDTe/8sWgQ0yHC4mcKS1HJOTUMNwqQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-05-20T02:12:09Z" + mac: ENC[AES256_GCM,data:QgL5PSrG3yVeJQgDJ3/VQhGwF7WpDb0+w7oxeF0KeNt3m2YqUsS1qKwK4gJAbmyt/RPdRErTiPs6NdAouowjZg6zcd+Trags/GIBKcaIyJqQa4lw3J3Jod9GTkol70c0H/X76kQx+bWzuXnJy64Dm3t2h+/ytD45+yZJ/959FKI=,iv:JnR8ZRgCfsr7T7L0NLCncH/6q1EGErOCzYjZWrazDh8=,tag:HHH6MrP1bFU0j/Hb6crEZA==,type:str] + pgp: + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxK/JaB2/SdtARAAjLRV2OOq9LMCn8jfeXXeQV14nliYJW51ry/lyAAT0mK/ + UrZFjXJon1HibzvpKVscCN+8i75RamsEp0/iKOoQKORUNZMWvaURPtzkzEFwZxja + tLKzraEl38y89UCP6XzM/D9gLxbGjioz8eSZ7InXowHFGS5HykeZQpPKN939l+lV + 0fxZH/yl0uDVOdjWb5NWVqK0xhVToi2u7uiwQiL/PdfvglCEsF+a7Q0bBRJIko+k + DN/rfq0xhb0bMo52lZvHrqOAod0Kj5ROebvwqOpXCSTFi0JcrVDiE+jq1wdqofni + VkL+V2Lu1Wi7zGQ/gjkLWWfd6IqKxcepsmtedy5Fs3ZcGKQ7jBw0fqvVRXE7FUFc + H74QWr5JSSjQxJFCugBTFgeOU3t4VcYeVt32FhlmfKsQ9I8B4xPuvTvmM4S5uELF + Sj2CHzR7D52mmWykUKx3h2f4AgQDv79IPLKOcRpLbJeOkI6kdDV/KfQeLcL3/RDA + FIHQDa27n62os11WmcKSqb7dI7W5SYKd0eGHfhynjQlV4LKRvrI//vYsIz1bY+Qm + 27eKe6KodvijhR/aok9fT9vhRpD8OyeLw/1f46azuxdxPUNEdQ6HYSu/w0sLhqte + OtM7q+NK7G5I19KP7+e9tJBxou7zpm+poseNQCl2j1nBGjahSYy4zhct5fQfKLHS + XgFZVUiV88yP42Jd+lxHZ/bs2RJ+RuQPvPj43c5jrBiRNEqKRcEXViHrJctwKHkZ + +6j+LuEKKszsWNGN9cOpdyVBcL5PUJ8mRribr3SnsEaFk+swutFm2sA5gLSYdB0= + =IxLP + -----END PGP MESSAGE----- + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQEMA1QflAioE8i3AQf/cKHMPmpFsvqyJJWZsgNB1tWeNh/aiKkCIS4Paf3hBeur + Ca4WElrH+M9feFH7qR3zXHviJXB0zt8oyUUNiR/xg1GNGw2wfVh3EGUWbZ7THog6 + sqN/2KxP7tIk74mjlaMBmIpyr7xd5OkjhQy4IkAFr0PBRGunVVa8d+73uUDsZBdI + XLpaDUZXpANOxZbXxBGzeYgG55yBs2LiXKLcjOkIi9G9w7Rtk2gdH4tI1miRstGS + jSB9xDCtszxm3kWmcDAG3nAORDCgYnlpeZrPGUhTqh7JzLhTZo46EHSKY1ThdVnM + cbbx0CNfcTCDWVxZEv6GHogAFSELn/gzFiWXjlcHoNJeAUNMxzW73TD7mB7he4EG + Phlz6+l5XbcSmC42QaLG7IIMNIpg1pai/fyBpKTYoHAGEGuDRcDgjKGOPTQH3N+0 + eIMu44nYPUh69kvzeMLCCbzFgDRyu5J4pbCDEiY/8g== + =VDJ1 + -----END PGP MESSAGE----- + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAz5uSgHG2iMJAQ//cTX8KOVgAdIQNYMKP3pDK5tpjUV+idiMr4Y60ny0UNM9 + SlNHmG3RLkZwyBaHdeJ1eTQYSIaWasUUhCcI6sA5A7SYPhMDtYU5lsNgmiue9J0T + Z6SrCe9T15Z4bDCS8M/fli3NlkImkGUN36Ou6BXzAVKAKfglzVnPAT2+J6JGBHbs + z9ailkVGBonU2QQzJ262FZYY3a+Rpw8w4mDCoIsfbEwxHrB8lLyf7AX81qtlcaHp + ib90CCk2aqifudBfLKRIsmxBDkD+hffF6HSX6t3q1Tvw7Cg8Hpc+LWs+ZNPkmf/a + 0/SrMUTBey28gDoDloRfd8wdPzm3Adxsy/bTRkAX0Gzm5W+sZAjeUyqi5MfSefgR + yr0aff6D0oWRn1geLdcNJmWfvRM35K2b3KU5uxqshT7WjA0i/rJCHu5pjpsEVypA + itPmVt1BPDSHcaQddaXOSpSMqYUOltvHN8pV6zGBAAsUzSor7GugClnMHCdp251T + som8Nsb6IziKWs4dPPR8DHYMFVFrLrtfkBi3XO8fWVncwcEofmYsRQotsHLUAkjV + 5exEu0OwSKVzlbqmDuZ3z0RByrPpfZWsJWshBIug9Br6PL17RauFY0cuCF0FPA9J + FGlNHH/XG+YqFEj6kcVYzQFue1fL4gD7HP9u5yOQ/D8JoBgtei9r42xetlBCFyjS + XgEoIc4qDC3aPKBB7jhGV6Sc8x/4fdjpDWMA32pzKR8n/BlQzYv8+b5X1m3ngPhf + bhGiZMIv3HgEQm2M1PP/x3ViqkJAa1EphGG5yOlm9dGq1ynreGxWVdaqEWWHhrA= + =W9zk + -----END PGP MESSAGE----- + fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DsZXvxFXTXoQSAQdAR75j7EdRO8U91jSZn9RGZLZmVHQ2wt6dEWWE4lZU+Agw + GKy5yFdG4ZfWxZ3QQUllIqA5Mn1Tapbz7XigK9D5/hF/oF5gedq8EmzyX6FWZYCn + 0l4BBTyZdlsWswCeE9zCvKkfm+L08kmnNrm9I/F8cOXx1BrxS5zXdhtNTGvGZ3Ww + hJMt6Rw4rmX2Mwm6dbpcjpZPjRp19Fb2nwnTwQ8YTRCSNulDRtJj3FQ8P6IT9HKN + =/5xR + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAQNCm56yr/4kGtjRJ0rM1tUnRTHXRPmGul39NNGiJdQcw + J3EOCTeg1HPR1CoC0FQ0qSAHQQymkcjttutY2D/oU2tLdqc1UsW01+ycscZ7XLwn + 0l4BQ8s8gN/6oIkFPvsN+oUP5Zs1izGsc0yozg42resT6qlsML/jFBvP9LLGBBlJ + 0VCK22OPMOXSHnCofSbYelhyahw7+xdr38juIxuQaYS4Lx5TPZ8HaKMkzXzduBt1 + =4xwZ + -----END PGP MESSAGE----- + fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxjNhCKPP69fAQ//T8mW0sDkD6e2hWSxIkhVYRE7l8bsFbDcbHkz47ahUrfK + lUDnvzEnX/MEt+PZJxzuzfLrRDmm0VmOmskJrpguwpY27AWyq9zKqHgxLtB9EkJt + MP3I8oNL+scjhX3cr/HogtIdaCpb9+JSCxZ+idABYMjyDb7+csFpHzyK/G6rToMr + EpvWD3BduP/tr+frVmRH5zxUku6jt/GfkiIq/a8mEFyyLzqsxG5FofzDCx01MbYA + DU3try5vX8HYUeuYFHhU7qOHIk7G5xen/92m35P8LlllNTjTcgz9oqxGuHrfA2Rz + K/RS9FoI4v/NNKHqUjI6Rd530/zezfWCOi4QdEdXLwUs8YyTyEhS3jTwIops70bt + Diun8OQ+TIE+iQopjBCoX4IH5M05N9KE1dVURzWQAy/F9tZj9GEhRRYgo43k7Zd7 + BpiFFAoC3uVDYCCznjd9IuupO4WnKnLGEWenWvxcdXkTxXvzO6KfonWq4GUKmXja + n4qu6pYIAi9ZYhXqKhHAm4+kgbsvhAM09Es6LX5718rJrfkYiYM9aIxVFO3pz7CQ + PI2fknrnw4TXKrKEvej5q6XYlKu7nSuSoMSv8P+NNPEivpVVZ+KPU+pbsNKRqEI4 + vfUYuAdg3t1isEtV+kI5CS3aIg+uU9RGgSGfF4Di0WTog2MZ5tyelvtAa+e82i3S + XgHGXuiPatmZyu2mXJZv2kWxp9UjKkDaZttKNAbTGWEtWAE0uyjmfuvMLt7r61/a + yjWDzQCMST8+v3jjjzDV40B0kOJ9+6vzAQcmoPtnA5vf0dW803OifUB6nWcVKtA= + =lxsO + -----END PGP MESSAGE----- + fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA46L6MuPqfJqAQ//RXIqipr1bcZkBfjokXOnulmcTCZkhv28NuxQjwYHWa77 + WYZpBwVTN0SqtGArF+E6yFvOdzoDwNeA11nB/AguU1NugROg60nP/169gCb6ydE+ + mHtTmO3jU2GIj83i82GVDnGNji8/TIh6ccz1a3pQeaygFnFZnDLwx/DJSy0CTKTs + SjnU879teK3CiFCG4A8f3RvB2LxvXkYWYEQ9ky72zUxTFVij3GdbP+fXsrZQHQ/7 + WrbdROvoTdtd4nAsFQVtiRab1Y+TCcHQdxxjWFoY0pI4pOcjHtbVh/fTYCwxmLez + s0hm9aKI/xS6WNXna6CGOjN+oFO70EBNUZNZutmDUf7kBXPSlgINBy/HPXgspOAk + Ww9D7JwM1uMOFYdLclbP/DVkUk8X6nVYTnJR44SwlHoZEqYSs0qNVosjWQWVi/Dq + D5LO1Ynek+u4GSK6guiCdj/arUaiKjlTQOXgnk6P0Pu1Y1F2kgzR+Kv/AkRTokmM + xFXpHCXVMA0ZrQyZCX8Z7eNrV9vzEfNhwm7hNrASxEnORxHRZP4Kzc4SNqiWeikU + f/2giFZkTjQoKjGwvcRgtPRDRYuS0EVG34Ha5LOQ/ViAsvhu6eQD2EZhEYENhmIP + TO9jeZZY3GMwRp/lwHaKFfiLRfmed4kVG2I/YDnaGeQv6dU3RGx5XDBW/ifBBeHS + XgHyN3Ys9YNg2DB4RXwQfkTSTNwHO8EUwuhvnONlSUFlPBe5pDTiTqJChIFGRui4 + AE6m5x79h1L+s41eMJfXES9THlw0H1Ok5UbrRgdFeqDnFxrbPga7ZY3b2UlU5BM= + =je+P + -----END PGP MESSAGE----- + fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DQrf1tCqiJxoSAQdAFK4dMZNE3rBCTZx4vpomMP1tdAAdb9lBOcY2S9Tz3zww + 5c0ioplBR3Z+vIGfczw7RPCCqUwGU2VWdhCcagLXWa+YEQcTRN8h2jZRWg4p8hNW + 0l4ByPozkxL+sA6XX9YvGxFAt1TwCoceMlDgqP3gX/olL18Jj0EcIkGTnrzQYNBD + Hq0zbuJdJkQhWafgE4g/BL7v6ERsPQnMyt0xAv4o+MW5T2I+9zBhOKEeh59RWrsx + =cptl + -----END PGP MESSAGE----- + fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdAkilW27qVaY9/x/Y1IAQbMtDpkSt71uM1N7WXEnX0oTcw + RK7MpWp9JsdqLhAr4kxFzjupxRuyrQzyBn/3Tczm6Rp46l0VIbkuWwcaDQbcjqSh + 0lgB4jPzEE8CvDBh10D09bkYyDjMi5SRj4NGZnULrXK+nOMRcvS3t+yDHYVf3VbI + fmqRKisWCVt0WB61n3VoSE3E6nKVi8crUu0PLbbPP1PdRWlihdKb2wWK + =yR2L + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+AQ//cQEQIceF4S9yhIaAs5ZHR1sHAp5nN56yNuoWHU+BxfWd + IDk/0JS/2oyPIviCmN/BjzaBBz33mptIfUVrk4W7V7SWCjo1SOAbDLm3L4+xz9eF + pW0a90ZoCIr31ZzQWn+mV4c4+tpaz9pO119PZdAiWDbmv2aAG1Dc6vEP31V3gt8j + OFXVrRtNKar9j+8v1/ZjOwZYgH5r3JQRcjflD2gLEoDec6QXVzpkG3V/8F1SPOos + M+tHloplQMWkY5frhgv1qjPCYFf8pMAs1bwO0o3FubTgXWepbtJ3Y4SAiOuXgp5e + uZpo3M3pP+uqzUGak/G2c850bgDJFb8tTYYYoDQ+EmADfXYN2rts+vye0qNmkDit + +4hjiIpUnqI/2xR/V1dnInBysGRNgOyWLrRJ6qBTso+xxjF63DTraPxX4dTGQyhQ + uW0R+d57Uinc1C+lqNwbacptqQ+d0a5lKLkq1xJWsZyAM7xDwFECTZNlBCavwRlg + e1lCPBcj6oBwVyYLGatlx/lYpnYqoL8bOGa8YjHdfuUzDfZJoJMgnm+EaYfPXbsR + alUXvkuK5F5IXGkTBEwt+ilKFh+LMUREBvzsSsQMOM3eYd5leb+y5qYciejJtrUF + /cvDR1mu6Gv5eDBAIxgZqBAZsJTk4MCB9qChJijiLREoYOWccKIxkhYwx31KiyHS + XgHzZBEa37fzigfWlSCSjiW/Mb0BzMZknv7ecEMwV3WJYNH9ixmGzNiBp7QOA68P + 21DbV7Slj3zZrX7K4KWSU0mHcPmS1V7OkfGB1+yurnS40cJy7qv3TbuQYjQ/1OA= + =f07d + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-05-20T02:11:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdAsrS/gPOqsUf5SSdki8Tz4YB+EH1W9xDU5XZZrnWZZ2gw + E/ceAF8IlHAXh5QLAfbXiaCq1j11t3jHpkSdXO8JJtkeFuGLfMVNiMGf1j4doEhi + 0l4BAJGJ/3Y94vsOSiC9Sku9zjjaB86XFUxJChgdPzfbqhcKHtnBLMW9sm93qE6C + 0c5EoyKBvBoJPUYm9nv3AGHmCjhZ006Iybvm3xtrWcmFfQ1IUdm2qOVtoTn3xs2J + =tlQa + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 + unencrypted_suffix: _unencrypted + version: 3.12.1 diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 4e968c2..0ec4875 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -93,6 +93,10 @@ all: auth-dns: ansible_host: auth-dns.hamburg.ccc.de ansible_user: chaos + forgejo-runner: + ansible_host: forgejo-runner.hosts.hamburg.ccc.de + ansible_user: chaos + ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de hypervisors: hosts: chaosknoten: @@ -122,6 +126,7 @@ base_config_hosts: spaceapiccc: mjolnir: auth-dns: + forgejo-runner: systemd_networkd_hosts: hosts: router: @@ -234,6 +239,7 @@ infrastructure_authorized_keys_hosts: mjolnir: auth-dns: lists: + forgejo-runner: wiki_hosts: hosts: eh22-wiki: @@ -268,6 +274,7 @@ ansible_pull_hosts: spaceapiccc: mjolnir: auth-dns: + forgejo-runner: msmtp_hosts: hosts: renovate_hosts: diff --git a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone index 33f8a31..61efdb4 100644 --- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone +++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone @@ -514,6 +514,7 @@ www3.hosts IN AAAA 2a00:14b0:42:102::15 diday-staging-runner.hosts IN AAAA 2a00:14b0:42:102::16 public-web-static.hosts IN AAAA 2a00:14b0:42:102::17 forgejo-actions-runner.hosts IN AAAA 2a00:14b0:42:102::18 +forgejo-runner.hosts IN AAAA 2a00:14b0:42:102::19 ; acme-challenges _acme-challenge.sunders CNAME a5ee8a99-3cdf-4212-972e-c0b6fda1242f.auth.acmedns From 7d7cf455eb02e002f776f61d54e00d494c30df28 Mon Sep 17 00:00:00 2001 From: June Date: Tue, 23 Jun 2026 21:32:50 +0200 Subject: [PATCH 30/38] forgejo_runner(role): create role for setting up Forgejo Runner install --- inventories/chaosknoten/hosts.yaml | 2 + inventories/external/hosts.yaml | 2 + inventories/z9/hosts.yaml | 2 + playbooks/deploy.yaml | 7 ++ roles/forgejo_runner/README.md | 9 ++ ...114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc | 71 ++++++++++++++ .../files/forgejo-runner.service | 19 ++++ roles/forgejo_runner/handlers/main.yaml | 10 ++ roles/forgejo_runner/meta/argument_specs.yaml | 6 ++ roles/forgejo_runner/meta/main.yaml | 3 + roles/forgejo_runner/tasks/main.yaml | 7 ++ .../forgejo_runner/tasks/main/01_install.yaml | 96 +++++++++++++++++++ roles/forgejo_runner/tasks/main/02_setup.yaml | 46 +++++++++ 13 files changed, 280 insertions(+) create mode 100644 roles/forgejo_runner/README.md create mode 100644 roles/forgejo_runner/files/EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc create mode 100644 roles/forgejo_runner/files/forgejo-runner.service create mode 100644 roles/forgejo_runner/handlers/main.yaml create mode 100644 roles/forgejo_runner/meta/argument_specs.yaml create mode 100644 roles/forgejo_runner/meta/main.yaml create mode 100644 roles/forgejo_runner/tasks/main.yaml create mode 100644 roles/forgejo_runner/tasks/main/01_install.yaml create mode 100644 roles/forgejo_runner/tasks/main/02_setup.yaml diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 0ec4875..4fbc03d 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -282,3 +282,5 @@ renovate_hosts: renovate: secrets_hosts: hosts: +forgejo_runner_hosts: + hosts: diff --git a/inventories/external/hosts.yaml b/inventories/external/hosts.yaml index 5d0f9d4..efcf5f0 100644 --- a/inventories/external/hosts.yaml +++ b/inventories/external/hosts.yaml @@ -24,3 +24,5 @@ ansible_pull_hosts: status: secrets_hosts: hosts: +forgejo_runner_hosts: + hosts: diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml index 6044154..38e29fd 100644 --- a/inventories/z9/hosts.yaml +++ b/inventories/z9/hosts.yaml @@ -63,3 +63,5 @@ ansible_pull_hosts: yate: secrets_hosts: hosts: +forgejo_runner_hosts: + hosts: diff --git a/playbooks/deploy.yaml b/playbooks/deploy.yaml index d111321..7a14440 100644 --- a/playbooks/deploy.yaml +++ b/playbooks/deploy.yaml @@ -150,6 +150,13 @@ tags: - eh22_styleguide_dir +- name: Ensure forgejo-runner is setup on forgejo_runner_hosts + hosts: forgejo_runner_hosts + roles: + - forgejo_runner + tags: + - forgejo_runner + - name: Setup authoritative dns servers hosts: auth-dns roles: diff --git a/roles/forgejo_runner/README.md b/roles/forgejo_runner/README.md new file mode 100644 index 0000000..ed53e8b --- /dev/null +++ b/roles/forgejo_runner/README.md @@ -0,0 +1,9 @@ +# `forgejo_runner` + +Ensures Forgejo Runner is installed and set up. +See: https://forgejo.org/docs/latest/admin/actions/ + +## Required Arguments + +- `forgejo_runner__config`: The configuration to run the Forgejo Runner with. + A configuration can be generated using `forgejo-runner generate-config`. Also see the [relevant docs](https://forgejo.org/docs/latest/admin/actions/configuration/). diff --git a/roles/forgejo_runner/files/EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc b/roles/forgejo_runner/files/EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc new file mode 100644 index 0000000..b18e74c --- /dev/null +++ b/roles/forgejo_runner/files/EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc @@ -0,0 +1,71 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- +Comment: EB11 4F5E 6C0D C2BC DD18 3550 A4B6 1A2D C592 3710 +Comment: Forgejo +Comment: Forgejo Releases + +xjMEY3T/yhYJKwYBBAHaRw8BAQdAVxqCQrSbpDNrx8CiTM8PUAVqdCyv2UmBDhpP +HZIpoIDNHUZvcmdlam8gPGNvbnRhY3RAZm9yZ2Vqby5vcmc+wsB+BBMWCgDmAhsD +BQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAhkBFiEE6xFPXmwNwrzdGDVQpLYaLcWS +NxAFAmSc08VBFIAAAAAAEAAocHJvb2ZAYXJpYWRuZS5pZGh0dHBzOi8vY29kZWJl +cmcub3JnL2Zvcmdlam8vZ2l0ZWFfcHJvb2Y2FIAAAAAAEAAdcHJvb2ZAYXJpYWRu +ZS5pZGh0dHBzOi8vZmxvc3Muc29jaWFsL0Bmb3JnZWpvMRSAAAAAABAAGHByb29m +QGFyaWFkbmUuaWRkbnM6Zm9yZ2Vqby5vcmc/dHlwZT1UWFQACgkQpLYaLcWSNxDM +2wEA6bOel3R25z3YUXL4hI2S8jRkJbOQawq0vgUnYNgS9hcBAK2zq4Zt4ctvSB+x +TqhR6Zi6aqSD3QrRnUVvV1xZhdkEwsCABBMWCgDoAhsDBQsJCAcDBRUKCQgLBRYC +AwEAAh4BAheAAhkBFiEE6xFPXmwNwrzdGDVQpLYaLcWSNxAFAmScz7JDFIAAAAAA +EAAqcHJvb2ZAYXJpYWRuZS5pZGh0dHBzOi8vY29kZWJlcmcub3JnL2Zvcmdlam8v +Zm9yZ2Vqb19wcm9vZjYUgAAAAAAQAB1wcm9vZkBhcmlhZG5lLmlkaHR0cHM6Ly9m +bG9zcy5zb2NpYWwvQGZvcmdlam8xFIAAAAAAEAAYcHJvb2ZAYXJpYWRuZS5pZGRu +czpmb3JnZWpvLm9yZz90eXBlPVRYVAAKCRCkthotxZI3EBJ1AP9UeN1HFGz90r34 +PGrOj1225HfJzdWgamEUkEKEwShcIQD+K/o7sLJM+C/mJXaCixAZgvRd9/rYq27T +9Y2rTQybSwnCwH4EExYKAOYCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4ACGQEW +IQTrEU9ebA3CvN0YNVCkthotxZI3EAUCY3spkjYUgAAAAAAQAB1wcm9vZkBhcmlh +ZG5lLmlkaHR0cHM6Ly9mbG9zcy5zb2NpYWwvQGZvcmdlam8xFIAAAAAAEAAYcHJv +b2ZAYXJpYWRuZS5pZGRuczpmb3JnZWpvLm9yZz90eXBlPVRYVEEUgAAAAAAQAChw +cm9vZkBhcmlhZG5lLmlkaHR0cHM6Ly9jb2RlYmVyZy5vcmcvZm9yZ2Vqby9naXRl +YV9wcm9vZgAKCRCkthotxZI3EC+hAQCxsUupyqMChFMqk/74PqzSlmCd6RXtbezP +W66YostSbgD9G+N+c9or1cBkcSejREOSy7TFrDrvek+ZhdZVhCp1UALCwEcEExYK +AK8CGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4ACGQEWIQTrEU9ebA3CvN0YNVCk +thotxZI3EAUCY3inA0EUgAAAAAAQAChwcm9vZkBhcmlhZG5lLmlkaHR0cHM6Ly9j +b2RlYmVyZy5vcmcvZm9yZ2Vqby9naXRlYV9wcm9vZjEUgAAAAAAQABhwcm9vZkBh +cmlhZG5lLmlkZG5zOmZvcmdlam8ub3JnP3R5cGU9VFhUAAoJEKS2Gi3FkjcQNV8B +AJfcHBzskW78lJVJeQwCI70qorOhC/QUp80jjNzs5lO7AQCujYgrae3vZb/476sc +wM33ufSpBguNwTLbCI6C5g8+B80mRm9yZ2VqbyBSZWxlYXNlcyA8cmVsZWFzZUBm +b3JnZWpvLm9yZz7CkAQTFgoAOAIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYh +BOsRT15sDcK83Rg1UKS2Gi3FkjcQBQJjeKH0AAoJEKS2Gi3FkjcQC5YBAKwCGFDD +SpX0JwBrzIP8W8ElwHvdBz2XDg8LwyQgr722AP9r01rbFwY4axDxpNj+BUFxwD5F +hza1cE3932eTsSOPDsKQBBMWCAA4FiEE6xFPXmwNwrzdGDVQpLYaLcWSNxAFAmN4 +k+kCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQpLYaLcWSNxBHrQD+PFo/ +ii8p72HP0KsJbHPGnS/Sk9pFGd16fs1Hd88JHj0A/10XNyGQgwbe+X+K/a97vWW8 +vAzA1EtFIMfCGhIO8EoIzjMEY3UANBYJKwYBBAHaRw8BAQdAKvAs2Ij2RamYUzz4 +sBgsc2J+4fEwvSMcTp6rPZizRhfCwDUEGBYIACYWIQTrEU9ebA3CvN0YNVCkthot +xZI3EAUCY3UANAIbAgUJAeEzgACBCRCkthotxZI3EHYgBBkWCAAdFiEE98vwIJTn +Zl4X7WxE44G/PlDVNwcFAmN1ADQACgkQ44G/PlDVNwdIlgD+K15nuEec+VTFdP7Y +Y3SxM8Rjg2EtXk007+LM7XQfN9sBAOLjBTzIdaaKOpoAkGQ9Th/IphSUOnPYZVO5 +a6cN+wAM458A/itf3urQehI5SbKtbRqIDhqQZQVAcEeG2eQFunuofjDWAQDt/gE5 +XgTiQgnkTcqAX7GQeE74O/Q5vDtX10NjbzV7D84zBGeOav0WCSsGAQQB2kcPAQEH +QI2JXHjIx25g9WZHNyjkdUiRBPl5Y1JjjJCPvXM0/9RjwsA1BBgWCAAmFiEE6xFP +XmwNwrzdGDVQpLYaLcWSNxAFAmeOav0CGwIFCQO1OAAAgQkQpLYaLcWSNxB2IAQZ +FggAHRYhBA9SfPk6PQ0JJdPFXtCoIAUOFgnlBQJnjmr9AAoJENCoIAUOFgnljUwA ++wSjU/mk4xGIlwzJdPnnNzIsiMeqtuYokbSrOIxXIhP1AP93qtVr+kOu3pDs9JC+ +8CYG0DK1QD1LmlGP59WRGevSCXChAQDy6SCfnfcr5P4fYaz04+Tl0CDUkFOGP+sV +S/isPTssbAD9H2hKJKEmwuAd2MeFA3Bo3z5rUVWkfAcnv7Oy7u+OWQfOMwRlfHnh +FgkrBgEEAdpHDwEBB0DGoKPPOOx7rnqT318eykUkMJbk83MhcBqrecOADO3i2sLA +NQQYFggAJhYhBOsRT15sDcK83Rg1UKS2Gi3FkjcQBQJlfHnhAhsCBQkCx+oAAIEJ +EKS2Gi3FkjcQdiAEGRYIAB0WIQTfMxnqNtWZwdSmg9SzsfYKxXfyogUCZXx54QAK +CRCzsfYKxXfyoocRAP48OQpiBTkwC7kLLyuqVlP1t0hBQddr4i4rIV8Ug5tHzwEA +pl8Q+S4k/ROQS5FOhy7GBC337SncJFJYDD0pTcSecw+J3AEAn4qax72Oyfb0vaPY +m+WdqsfVBd2Hd2vJIwCjglp55B0BALIJE6nvACcKzTRUj7AQSLGvELGfJfM320xX +E0ZVBZkKzjMEaUFtxRYJKwYBBAHaRw8BAQdA1AZR9j6PksmArHjaoqOHIOQ4H1iw +0KZyLKLgu1onR8fCwDUEGBYIACYWIQTrEU9ebA3CvN0YNVCkthotxZI3EAUCaUFt +xQIbAgUJAsfqAACBCRCkthotxZI3EHYgBBkWCAAdFiEEO/ToE/hIEkEdoB5bxBht +9m9LZ1AFAmlBbcUACgkQxBht9m9LZ1DQHAD9EUEM23tJJUae0L1DbGnWEp3GnZOQ +G3Z34uWv16wRV3EA+gJuHa9Zr1TXAEXXBwQzZIrAFby+7I5smWPVM84c7xYA/qEA +/2dQMMZcRelFC0fIPvGQMGfYeBr8bkHKlJBQOTdukeSPAQCcd9rqJT7NNZlPtJ1T +wNAfAa3L23bdp/dEtKhE+d09CM44BGN0/8oSCisGAQQBl1UBBQEBB0CZnRfIHxTV +hOF8kdhbe4YJsePyVFi8USfuDXy4HgIHRgMBCAfCeAQYFggAIBYhBOsRT15sDcK8 +3Rg1UKS2Gi3FkjcQBQJjdP/KAhsMAAoJEKS2Gi3FkjcQdroA/jHFqt7y/r/5zdK4 +TYYp+5jlOgM5ZI7pNhWhtIFbqmx9AQCKSJf2YgPBLNJSL/86vpE9b6IvTE/8ENR/ +7xYaIA7oAg== +=D+4T +-----END PGP PUBLIC KEY BLOCK----- diff --git a/roles/forgejo_runner/files/forgejo-runner.service b/roles/forgejo_runner/files/forgejo-runner.service new file mode 100644 index 0000000..0e33bcd --- /dev/null +++ b/roles/forgejo_runner/files/forgejo-runner.service @@ -0,0 +1,19 @@ +# Source: https://code.forgejo.org/forgejo/runner/src/branch/main/contrib/forgejo-runner.service +[Unit] +Description=Forgejo Runner +Documentation=https://forgejo.org/docs/latest/admin/actions/ +After=docker.service +Requires=docker.service + +[Service] +ExecStart=/usr/local/bin/forgejo-runner daemon -c /etc/forgejo-runner-config.yaml +ExecReload=/bin/kill -s HUP $MAINPID + +User=runner +WorkingDirectory=/home/runner +Restart=on-failure +TimeoutSec=0 +RestartSec=10 + +[Install] +WantedBy=multi-user.target diff --git a/roles/forgejo_runner/handlers/main.yaml b/roles/forgejo_runner/handlers/main.yaml new file mode 100644 index 0000000..3234eb2 --- /dev/null +++ b/roles/forgejo_runner/handlers/main.yaml @@ -0,0 +1,10 @@ +- name: systemd daemon reload + ansible.builtin.systemd_service: + daemon_reload: true + become: true + +- name: restart the forgejo-runner service + ansible.builtin.systemd: + name: forgejo-runner.service + state: restarted + become: true diff --git a/roles/forgejo_runner/meta/argument_specs.yaml b/roles/forgejo_runner/meta/argument_specs.yaml new file mode 100644 index 0000000..5c7570e --- /dev/null +++ b/roles/forgejo_runner/meta/argument_specs.yaml @@ -0,0 +1,6 @@ +argument_specs: + main: + options: + forgejo_runner__config: + type: str + required: true diff --git a/roles/forgejo_runner/meta/main.yaml b/roles/forgejo_runner/meta/main.yaml new file mode 100644 index 0000000..cb7d8e0 --- /dev/null +++ b/roles/forgejo_runner/meta/main.yaml @@ -0,0 +1,3 @@ +--- +dependencies: + - role: docker diff --git a/roles/forgejo_runner/tasks/main.yaml b/roles/forgejo_runner/tasks/main.yaml new file mode 100644 index 0000000..281f665 --- /dev/null +++ b/roles/forgejo_runner/tasks/main.yaml @@ -0,0 +1,7 @@ +- name: Ensure Forgejo Runner is installed + ansible.builtin.import_tasks: + file: main/01_install.yaml + +- name: Ensure Forgejo Runner is set up + ansible.builtin.import_tasks: + file: main/02_setup.yaml diff --git a/roles/forgejo_runner/tasks/main/01_install.yaml b/roles/forgejo_runner/tasks/main/01_install.yaml new file mode 100644 index 0000000..cb309a6 --- /dev/null +++ b/roles/forgejo_runner/tasks/main/01_install.yaml @@ -0,0 +1,96 @@ +- name: get latest release info + ansible.builtin.uri: + url: "https://data.forgejo.org/api/v1/repos/forgejo/runner/releases/latest" + return_content: true + register: forgejo_runner__latest_release_info + +- name: set latest version + ansible.builtin.set_fact: + forgejo_runner__latest_version: "{{ forgejo_runner__latest_release_info.json.name | replace('v', '') }}" + +- name: set latest version forgejo-runner binary path + ansible.builtin.set_fact: + forgejo_runner__latest_version_binary_path: "/usr/local/bin/forgejo-runner-{{ forgejo_runner__latest_version }}" + +- name: check if latest version forgejo-runner binary is installed already + ansible.builtin.stat: + path: "{{ forgejo_runner__latest_version_binary_path }}" + register: forgejo_runner_latest_version_binary_stat + +- name: download and install latest version, if not already present + when: not forgejo_runner_latest_version_binary_stat.stat.exists + block: + - name: set download url + ansible.builtin.set_fact: + forgejo_runner__download_url: "https://code.forgejo.org/forgejo/runner/releases/download/v{{ forgejo_runner__latest_version }}/forgejo-runner-{{ forgejo_runner__latest_version }}-linux-amd64" + + - name: temporary directory for download + ansible.builtin.tempfile: + state: directory + suffix: forgejo_runner_download + become: true + register: forgejo_runner__download_tempdir + + - name: download the forgejo-runner binary + ansible.builtin.get_url: + url: "{{ forgejo_runner__download_url }}" + dest: "{{ forgejo_runner__download_tempdir.path }}/forgejo-runner" + owner: root + group: root + mode: "0755" + become: true + + - name: download the signature + ansible.builtin.get_url: + url: "{{ forgejo_runner__download_url }}.asc" + dest: "{{ forgejo_runner__download_tempdir.path }}/forgejo-runner.asc" + owner: root + group: root + mode: "0644" + become: true + + - name: copy key for verification + ansible.builtin.copy: + src: "EB114F5E6C0DC2BCDD183550A4B61A2DC5923710.asc" + dest: "{{ forgejo_runner__download_tempdir.path }}/forgejo-runner-key.asc" + owner: root + group: root + mode: "0644" + become: true + + - name: ensure sq (Sequoia-PGP) is installed + ansible.builtin.apt: + name: sq + become: true + + - name: verify signature + ansible.builtin.command: + cmd: /usr/bin/sq verify --signer-file ./forgejo-runner-key.asc --signature-file forgejo-runner.asc --signatures 1 forgejo-runner + chdir: "{{ forgejo_runner__download_tempdir.path }}" + become: true + changed_when: false + + - name: install forgejo-runner binary of this latest version + ansible.builtin.copy: + remote_src: true + src: "{{ forgejo_runner__download_tempdir.path }}/forgejo-runner" + dest: "{{ forgejo_runner__latest_version_binary_path }}" + owner: root + group: root + mode: "0755" + become: true + + - name: ensure symlink points to binary of this latest version + ansible.builtin.file: + src: "{{ forgejo_runner__latest_version_binary_path }}" + dest: "/usr/local/bin/forgejo-runner" + state: link + owner: root + group: root + become: true + always: + - name: delete temporary download directory + ansible.builtin.file: + path: "{{ forgejo_runner__download_tempdir.path }}" + state: absent + become: true diff --git a/roles/forgejo_runner/tasks/main/02_setup.yaml b/roles/forgejo_runner/tasks/main/02_setup.yaml new file mode 100644 index 0000000..c83c057 --- /dev/null +++ b/roles/forgejo_runner/tasks/main/02_setup.yaml @@ -0,0 +1,46 @@ +- name: ensure runner group exists + ansible.builtin.group: + name: runner + system: true + become: true + +- name: ensure runner user exists + ansible.builtin.user: + name: runner + group: runner + password: '!' + system: true + create_home: true + groups: + - docker + become: true + +- name: ensure the configuration is deployed + ansible.builtin.copy: + content: "{{ forgejo_runner__config }}" + dest: /etc/forgejo-runner-config.yaml + owner: root + group: runner + mode: "0640" + become: true + notify: + - restart the forgejo-runner service + +- name: ensure systemd service exists + ansible.builtin.copy: + src: forgejo-runner.service + dest: /etc/systemd/system/forgejo-runner.service + owner: root + group: root + mode: "0644" + become: true + notify: + - systemd daemon reload + - restart the forgejo-runner service + +- name: ensure systemd service is started and enabled + ansible.builtin.systemd_service: + name: forgejo-runner.service + state: started + enabled: true + become: true From 2e50226b9450ecfea65449721d55090e9b697777 Mon Sep 17 00:00:00 2001 From: June Date: Thu, 21 May 2026 03:02:38 +0200 Subject: [PATCH 31/38] docker(role): provide option to set up gVisor (runsc runtime) --- roles/docker/README.md | 3 +- roles/docker/defaults/main.yaml | 1 + roles/docker/handlers/main.yaml | 6 +++ roles/docker/meta/argument_specs.yaml | 6 +++ roles/docker/tasks/main/01_repo_setup.yaml | 49 +++++++++++++------ .../docker/tasks/main/02_docker_install.yaml | 9 ++++ roles/docker/tasks/main/03_docker_config.yaml | 5 +- .../daemon.json => templates/daemon.json.j2} | 9 +++- 8 files changed, 69 insertions(+), 19 deletions(-) create mode 100644 roles/docker/defaults/main.yaml create mode 100644 roles/docker/meta/argument_specs.yaml rename roles/docker/{files/daemon.json => templates/daemon.json.j2} (59%) diff --git a/roles/docker/README.md b/roles/docker/README.md index b7f38e1..befc005 100644 --- a/roles/docker/README.md +++ b/roles/docker/README.md @@ -16,7 +16,8 @@ None. ## Optional Arguments -None. +- `docker__gvisor_setup`: Whether or not to set up [gVisor](https://gvisor.dev/) (`runsc` runtime). + Defaults to `false`. ## Links & Resources diff --git a/roles/docker/defaults/main.yaml b/roles/docker/defaults/main.yaml new file mode 100644 index 0000000..351f397 --- /dev/null +++ b/roles/docker/defaults/main.yaml @@ -0,0 +1 @@ +docker__gvisor_setup: false diff --git a/roles/docker/handlers/main.yaml b/roles/docker/handlers/main.yaml index ada2426..6c37581 100644 --- a/roles/docker/handlers/main.yaml +++ b/roles/docker/handlers/main.yaml @@ -2,3 +2,9 @@ ansible.builtin.systemd_service: daemon_reload: true become: true + +- name: restart the docker service + ansible.builtin.systemd: + name: docker.service + state: restarted + become: true diff --git a/roles/docker/meta/argument_specs.yaml b/roles/docker/meta/argument_specs.yaml new file mode 100644 index 0000000..6549387 --- /dev/null +++ b/roles/docker/meta/argument_specs.yaml @@ -0,0 +1,6 @@ +argument_specs: + main: + options: + docker__gvisor_setup: + type: bool + required: false diff --git a/roles/docker/tasks/main/01_repo_setup.yaml b/roles/docker/tasks/main/01_repo_setup.yaml index 63bdb91..6105627 100644 --- a/roles/docker/tasks/main/01_repo_setup.yaml +++ b/roles/docker/tasks/main/01_repo_setup.yaml @@ -1,15 +1,36 @@ -- name: Ensure Dockers GPG key is added - ansible.builtin.get_url: - url: https://download.docker.com/linux/debian/gpg - dest: /etc/apt/trusted.gpg.d/docker.asc - mode: "0644" - owner: root - group: root - become: true +- name: ensure Docker repo + block: + - name: Ensure Dockers GPG key is added + ansible.builtin.get_url: + url: https://download.docker.com/linux/debian/gpg + dest: /etc/apt/trusted.gpg.d/docker.asc + mode: "0644" + owner: root + group: root + become: true -- name: Ensure Docker APT repository is added - ansible.builtin.apt_repository: - repo: "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/docker.asc] https://download.docker.com/linux/debian {{ ansible_facts['distribution_release'] }} stable" - filename: docker - state: present - become: true + - name: Ensure Docker APT repository is added + ansible.builtin.apt_repository: + repo: "deb [arch=amd64 signed-by=/etc/apt/trusted.gpg.d/docker.asc] https://download.docker.com/linux/debian {{ ansible_facts['distribution_release'] }} stable" + filename: docker + state: present + become: true + +- name: ensure gVisor repo + when: docker__gvisor_setup + block: + - name: Ensure gVisors GPG key is added + ansible.builtin.get_url: + url: https://gvisor.dev/archive.key + dest: /etc/apt/keyrings/gvisor.asc + mode: "0644" + owner: root + group: root + become: true + + - name: Ensure gVisors APT repository is added + ansible.builtin.apt_repository: + repo: "deb [arch=amd64 signed-by=/etc/apt/keyrings/gvisor.asc] https://storage.googleapis.com/gvisor/releases release main" + filename: gvisor + state: present + become: true diff --git a/roles/docker/tasks/main/02_docker_install.yaml b/roles/docker/tasks/main/02_docker_install.yaml index f2ae880..b7334e1 100644 --- a/roles/docker/tasks/main/02_docker_install.yaml +++ b/roles/docker/tasks/main/02_docker_install.yaml @@ -9,3 +9,12 @@ state: present update_cache: true become: true + +- name: Ensure gVisors packages are installed + when: docker__gvisor_setup + ansible.builtin.apt: + name: + - runsc + state: present + update_cache: true + become: true diff --git a/roles/docker/tasks/main/03_docker_config.yaml b/roles/docker/tasks/main/03_docker_config.yaml index 639e8fa..88ee96b 100644 --- a/roles/docker/tasks/main/03_docker_config.yaml +++ b/roles/docker/tasks/main/03_docker_config.yaml @@ -2,10 +2,11 @@ # - log to systemd journal # https://docs.docker.com/engine/logging/drivers/journald/ - name: Ensure Docker daemon configuration - ansible.builtin.copy: - src: daemon.json + ansible.builtin.template: + src: daemon.json.j2 dest: /etc/docker/daemon.json owner: root group: root mode: "0644" become: true + notify: restart the docker service diff --git a/roles/docker/files/daemon.json b/roles/docker/templates/daemon.json.j2 similarity index 59% rename from roles/docker/files/daemon.json rename to roles/docker/templates/daemon.json.j2 index d55e4cb..b6f6025 100644 --- a/roles/docker/files/daemon.json +++ b/roles/docker/templates/daemon.json.j2 @@ -1,7 +1,7 @@ { "log-driver": "journald", "log-opts": { - "tag": "{{.Name}}" + "tag": "{{ '{{.Name}}' }}" }, "ipv6": true, "ip6tables": true, @@ -10,5 +10,10 @@ "bridge": { "com.docker.network.enable_ipv6":"true" } - } + }{% if docker__gvisor_setup %}, + "runtimes": { + "runsc": { + "path": "/usr/bin/runsc" + } + }{% endif %} } From 0acc56b238da7811e4c76da5f35eb933a9cd2732 Mon Sep 17 00:00:00 2001 From: June Date: Thu, 21 May 2026 04:44:16 +0200 Subject: [PATCH 32/38] docker(role): document gVisor issue with user-def. br. and provide help Document issue with containers on user-defined bridges and using the gVisor runsc runtime. Also provide a helper resolv.conf as a workaround. --- roles/docker/README.md | 2 ++ roles/docker/files/gvisor-helper-resolv.conf | 9 +++++++++ roles/docker/tasks/main/03_docker_config.yaml | 10 ++++++++++ 3 files changed, 21 insertions(+) create mode 100644 roles/docker/files/gvisor-helper-resolv.conf diff --git a/roles/docker/README.md b/roles/docker/README.md index befc005..0a28265 100644 --- a/roles/docker/README.md +++ b/roles/docker/README.md @@ -17,6 +17,8 @@ None. ## Optional Arguments - `docker__gvisor_setup`: Whether or not to set up [gVisor](https://gvisor.dev/) (`runsc` runtime). + > Note: gVisor doesn't work with the embedded DNS server Docker forces for user-defined bridges (see the [relevant GitHub issue](https://github.com/google/gvisor/issues/7469)). A workaround would be to bind mount a `resolv.conf` not relying on localhost DNS (note however that this still doesn't provide local container name resolution). When enabling this option such a helper `resolv.conf` pointing to Quad9 gets deployed to `/etc/gvisor-helper-resolv.conf` for bind-mounting. See the file for usage instructions. + Defaults to `false`. ## Links & Resources diff --git a/roles/docker/files/gvisor-helper-resolv.conf b/roles/docker/files/gvisor-helper-resolv.conf new file mode 100644 index 0000000..f047a80 --- /dev/null +++ b/roles/docker/files/gvisor-helper-resolv.conf @@ -0,0 +1,9 @@ +# resolv.conf pointing to Quad9 for bind-mounting into containers on user-defined bridges and using the gVisor runsc runtime. +# Example: docker run --runtime runsc --mount type=bind,src=/etc/gvisor-helper-resolv.conf,dst=/etc/resolv.conf,ro=true --network your-user-defined-network -it --rm docker.io/library/debian /bin/bash + +nameserver 9.9.9.9 +nameserver 149.112.112.112 +nameserver 2620:fe::fe +nameserver 2620:fe::9 + +options edns0 diff --git a/roles/docker/tasks/main/03_docker_config.yaml b/roles/docker/tasks/main/03_docker_config.yaml index 88ee96b..8c145b2 100644 --- a/roles/docker/tasks/main/03_docker_config.yaml +++ b/roles/docker/tasks/main/03_docker_config.yaml @@ -10,3 +10,13 @@ mode: "0644" become: true notify: restart the docker service + +- name: Ensure helper gVisor resolv.conf is deployed + when: docker__gvisor_setup + ansible.builtin.copy: + src: gvisor-helper-resolv.conf + dest: /etc/gvisor-helper-resolv.conf + owner: root + group: root + mode: "0644" + become: true From d44d84ae2a8eb3ac68692b0082d51fc9c85e8e77 Mon Sep 17 00:00:00 2001 From: June Date: Tue, 23 Jun 2026 21:38:11 +0200 Subject: [PATCH 33/38] forgejo-runner(host): configure forgejo-runner setup --- .../host_vars/forgejo-runner.sops.yaml | 11 ++--- .../chaosknoten/host_vars/forgejo-runner.yaml | 1 + inventories/chaosknoten/hosts.yaml | 1 + .../forgejo-runner/configuration.yaml.j2 | 43 +++++++++++++++++++ 4 files changed, 51 insertions(+), 5 deletions(-) create mode 100644 inventories/chaosknoten/host_vars/forgejo-runner.yaml create mode 100644 resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 diff --git a/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml b/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml index c0e1b76..ba4e1ee 100644 --- a/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml +++ b/inventories/chaosknoten/host_vars/forgejo-runner.sops.yaml @@ -1,8 +1,8 @@ ansible_pull__age_private_key: ENC[AES256_GCM,data:fEly3EIovZ4n5xMnD5Aqtbn1+DUszR0MvBHcM383G40qfHxrbF/lqc8iftshInoHSU77Vugignyb0dTSCTS1cWmEg8I/+ZFjgwc=,iv:Y1XunCfdIUC5nTu+vkr0Q0LUBWeIwP/bGNkbnDb1cpA=,tag:6UrkMx6yEGB46VVvtAkDMQ==,type:str] +secret__forgejo_runner_ccchh_git_token: ENC[AES256_GCM,data:5igicsbBCLvsWI6YSFN2A/XD4An1l31YBe7Ngm7nHopWR/Ge266I9g==,iv:sVXBSeEWNs7GIXasZdbIoiaeXFTJMkM6T8vZCNX5Tek=,tag:aVIX3+8pr1lyEy1pcu1UNQ==,type:str] sops: age: - - recipient: age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcFhwNmRXTnptOUMrN0dZ UnN0bFdCVjJQamNvTzZmMkxRdk0zL0E4bm4wCmRIVmVrVW1Jb3BKOVNnNnM5MXJm @@ -10,8 +10,9 @@ sops: VVI1TnN3UkcxUzdOWjJQTzZLOHNlaDQKx/HqW9sEYmNYIMYvLVF/9eJfcgRH/cJv YqcDNZc8L9Rap2TfwsiJZourqDTe/8sWgQ0yHC4mcKS1HJOTUMNwqQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-05-20T02:12:09Z" - mac: ENC[AES256_GCM,data:QgL5PSrG3yVeJQgDJ3/VQhGwF7WpDb0+w7oxeF0KeNt3m2YqUsS1qKwK4gJAbmyt/RPdRErTiPs6NdAouowjZg6zcd+Trags/GIBKcaIyJqQa4lw3J3Jod9GTkol70c0H/X76kQx+bWzuXnJy64Dm3t2h+/ytD45+yZJ/959FKI=,iv:JnR8ZRgCfsr7T7L0NLCncH/6q1EGErOCzYjZWrazDh8=,tag:HHH6MrP1bFU0j/Hb6crEZA==,type:str] + recipient: age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf + lastmodified: "2026-06-23T19:38:01Z" + mac: ENC[AES256_GCM,data:3FSmib8bQgi3sf5OSZvKOeXNgPphCM2LtUEscXD1c916UC0l6WSJsB86CpwPolInL79o5148ond7u0lDiM+/yLx4QUmxLkJXK5hi0KqMmUCp8L/oVslO6Q1rAJnhKkfcPpnVUwk6lRvcb+4NXIG+3w9EBPSWXL2yBLhRMXmtiBA=,iv:sVJgqoNMZY9jwdq6eJJoTZ7rAqBBmfxsiDXV9yFhPws=,tag:NQwpxfBGwAoW83CMl/mitA==,type:str] pgp: - created_at: "2026-05-20T02:11:43Z" enc: |- @@ -184,4 +185,4 @@ sops: -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted - version: 3.12.1 + version: 3.13.1 diff --git a/inventories/chaosknoten/host_vars/forgejo-runner.yaml b/inventories/chaosknoten/host_vars/forgejo-runner.yaml new file mode 100644 index 0000000..28bc4ab --- /dev/null +++ b/inventories/chaosknoten/host_vars/forgejo-runner.yaml @@ -0,0 +1 @@ +forgejo_runner__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2') }}" diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 4fbc03d..30072c8 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -284,3 +284,4 @@ secrets_hosts: hosts: forgejo_runner_hosts: hosts: + forgejo-runner: diff --git a/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 b/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 new file mode 100644 index 0000000..eb3bcd3 --- /dev/null +++ b/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 @@ -0,0 +1,43 @@ +log: + level: info + job_level: info + +runner: + file: .runner + capacity: 4 + timeout: 1h + shutdown_timeout: 30m + insecure: false + fetch_timeout: 30s + fetch_interval: 2s + report_interval: 1s + labels: + # https://forgejo.org/docs/latest/admin/actions/configuration/#choosing-labels + - docker:docker://docker.io/library/node:lts + +cache: + enabled: false + +container: + # Leave emtpy to create a network automatically. + network: "" + enable_ipv6: true + privileged: false + ## Something like this once gVisor can be used. + ## options: "--runtime=runsc --mount type=bind,src=/etc/gvisor-helper-resolv.conf,dst=/etc/resolv.conf,ro=true" + # Leave empty for default /workspace to be used. + workdir_parent: + ## Something like this once gVisor can be used. + ## Add /etc/gvisor-helper-resolv.conf to valid_volumes to make the bind-mount in options work. + ## valid_volumes: ["/etc/gvisor-helper-resolv.conf:ro"] + # Leave "-", so no docker host will be mounted in the job container. + docker_host: "-" + force_pull: true + force_rebuild: false + +server: + connections: + ccchh-git: + url: https://git.hamburg.ccc.de/ + uuid: 8f2a39a7-0c58-4c57-a272-01893b2f1a6d + token: {{ secret__forgejo_runner_ccchh_git_token }} From b9a5fa3ce58a76c99bfe61bbfdaea97822176640 Mon Sep 17 00:00:00 2001 From: June Date: Fri, 3 Jul 2026 03:39:10 +0200 Subject: [PATCH 34/38] forgejo-runner(host): configure some more labels for more images Provide the ubuntu labels similar to the images running at Codeberg using the catthehacker/ubuntu:act-* images. See: https://github.com/catthehacker/docker_images https://codeberg.org/actions/meta Also provide convenience labels for Alpine and Debian. --- .../forgejo-runner/forgejo-runner/configuration.yaml.j2 | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 b/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 index eb3bcd3..7463ea3 100644 --- a/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 +++ b/resources/chaosknoten/forgejo-runner/forgejo-runner/configuration.yaml.j2 @@ -14,6 +14,15 @@ runner: labels: # https://forgejo.org/docs/latest/admin/actions/configuration/#choosing-labels - docker:docker://docker.io/library/node:lts + # Provide ubuntu labels similar to the images running at Codeberg. + # https://github.com/catthehacker/docker_images + # https://codeberg.org/actions/meta + - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest + - ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04 + # Alpine + - alpine:docker://docker.io/library/alpine:latest + # Debian + - debian:docker://docker.io/library/debian:latest cache: enabled: false From 81b16a04cbe6c769755221f0f68b04bc8b01b9a0 Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Sun, 5 Jul 2026 10:40:29 +0200 Subject: [PATCH 35/38] Explain why this is necessary --- roles/transmission/files/update-transmission-settings | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/transmission/files/update-transmission-settings b/roles/transmission/files/update-transmission-settings index d51730a..27cf1c0 100644 --- a/roles/transmission/files/update-transmission-settings +++ b/roles/transmission/files/update-transmission-settings @@ -2,7 +2,8 @@ # # Update the transmission settings.json. For the update, stop transmission, -# put the new file in place, and restart it. +# put the new file in place, and restart it. This is necessary because +# transmission is constantly rewriting the settings file while it is running. # set -e From dd1cd6f529125e9e12d67452bdf986050d92bb58 Mon Sep 17 00:00:00 2001 From: June Date: Wed, 8 Jul 2026 00:20:02 +0200 Subject: [PATCH 36/38] forgejo-runner-external(host): basic setup --- .sops.yaml | 7 + .../chaosknoten/group_vars/all.sops.yaml | 606 ++++++++++-------- .../forgejo-runner-external.sops.yaml | 218 +++++++ inventories/chaosknoten/hosts.yaml | 7 + .../auth-dns/zones/hamburg.ccc.de.zone | 1 + 5 files changed, 556 insertions(+), 283 deletions(-) create mode 100644 inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml diff --git a/.sops.yaml b/.sops.yaml index 849749b..ed5171f 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -40,6 +40,7 @@ keys: - &host_diday_staging_runner_ansible_pull_age_key age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf - &host_auth_dns_ansible_pull_age_key age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve - &host_forgejo_runner_ansible_pull_age_key age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf + - &host_forgejo_runner_external_ansible_pull_age_key age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76 external: age: &host_external_age_keys - &host_status_ansible_pull_age_key age1p546j6whqsyfkjuf674lawrnk2ex653fuvwhcwt46gkrspkq59sqzm5y87 @@ -216,6 +217,12 @@ creation_rules: *admin_gpg_keys age: - *host_forgejo_runner_ansible_pull_age_key + - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner-external\\.sops\\..+" + key_groups: + - pgp: + *admin_gpg_keys + age: + - *host_forgejo_runner_external_ansible_pull_age_key # external hosts - path_regex: "inventories/external/host_vars/status\\.sops\\..+" key_groups: diff --git a/inventories/chaosknoten/group_vars/all.sops.yaml b/inventories/chaosknoten/group_vars/all.sops.yaml index 5b4b6c1..dcf4eb2 100644 --- a/inventories/chaosknoten/group_vars/all.sops.yaml +++ b/inventories/chaosknoten/group_vars/all.sops.yaml @@ -2,393 +2,433 @@ msmtp__smtp_password: ENC[AES256_GCM,data:xcBVBTb6mfr5Ubyfga9ibKWKhrfrEEaDWD98vI metrics__chaos_password: ENC[AES256_GCM,data:al234VSAH7oxka8X0hTvEJKVLD6O/WCrCKfVLLvm,iv:+TmA+0hXMV4OxvK7RH2g1dIzm88Lpm3zevxSZxK23QQ=,tag:txCVr5SEW3dVHgNFInR94g==,type:str] sops: age: - - recipient: age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3 - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvalUzeDFlWDJpaFdxYzZU - SzNLbFNiMTMreGhkaUZMN2hZS1dONFRzeEM4CmR5VjVKSWloQzc0NnM0bGRHR2RE - YkwvOWZZZXczcTR0cFZvb1hjMEVMZW8KLS0tIFVEVTd6UG53K1loNDdEeUhVTW5W - dFYveVdnZFptWi8wNEtIL2VEd1pPVVUK51kCjHeK/neGrtcsgvMsPifCKQflPn8S - +E3oHbvSvBWW5ACR+X0My3FF6F5qTyzeo8OqCdwHJJci8wD4lO0ykQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArVmdjZ0ZqeCtBMVZDQXRa + T3hJZXhDZkRYOUpXTHBydWtsSXNnZVZYckFvCnVHWjQ0dXdwWjIzbFpkWmRoa3cx + TlJ5amhrOExBaHowb3BqNjlpaUxPTW8KLS0tIDF3NGZIUWs0aEU0TlcyZmZSa1Z6 + dUdSUVowYUh2bkZZL1F0eVBwekQxbDgKkhdASE+YCLmk1o1/m4thUG0snNX2HIeP + rNLk4ga516qNBCensSpN8N9jNgupOTMbCXHDOL4j3DbMklk4oi/07A== -----END AGE ENCRYPTED FILE----- - - recipient: age1gdfhx5hy829uqkw4nwjwlpvl7zqvljguzsnjv0dpwz5q5u7dtf6s90wndt - enc: | + recipient: age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3 + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSHp3cVdjbURhQWJRb3FN - ZmxSajRNSzFib2lRRmtVcmVzaWtjZmpibkhvCncrNkNmUmFKMkhLWG8zWjMwcUlI - dElPd29uaEFaeC83citIbC9sZjVhcEkKLS0tIEsycHZ3UnZ6YU5uSVZFUU1VeVQ5 - aUQwZUU4NFF3cHpoMTY2aUFMT3R3K1UKBMzOLiQreRutPycBG3ripOeKOlz02Hxu - nWkfVy4eJc+zRrwICmil/v3VcyKH72AvuUfnBgFkCTg+lGZY/GDfAg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSVJ5S2pZb0c4SlpzV0NI + aXRvUnZDN21KN3NoeVRSMkNFNDVpRTIxV3lBCmRhSHdBYkJZRitndy9vTUhTRzNu + b0RqWkloaFhaOTFuemJES1ZkdlZVZ2sKLS0tIDdvaVgzcE1XcmR3cUJKNzdFSEhV + NzJ5emJtOTNDbDIvUG4rc3BXcGM3SmsKEzinKFMsJwNByhm0Z1fZGqGHuHOzkbcQ + XMRtfnncFH1AY4Ameav0+lqZ0eXyYb+Z1xpCV+V5yQ3mJQnbnnMqMw== -----END AGE ENCRYPTED FILE----- - - recipient: age13nm6hfz66ce4wpn89fye05mag3l3h04etvz6wj7szm3vzrdlfupqhrp3fa - enc: | + recipient: age1gdfhx5hy829uqkw4nwjwlpvl7zqvljguzsnjv0dpwz5q5u7dtf6s90wndt + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0STVTd3pHV3BCTTkrOTdy - RXBweU5OM3RkWFA2T1M0RzJWNHVYdVZXWVVBCm00M2hQdlphRkxjU0VOUEladjl3 - a21QVEZmMHFoM1JxQlZXaXlVTjRHRmcKLS0tIHBwN3pkRGExV1d5M3J3NWo0cHNI - M2IxRjNHYmFPSDB1Ly9xSkRHMy9ldVUKdrGJ2HS5Kfyyw+0bCMlFs7DJ3+JWKLtq - 7YCoqWskZauUv+cH2VL/oghttdWQXonlVINkhKbeiQ49BbhPTompJA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNzFDcC9rcVdaR3kxQnlI + UjhxZXMweFIxRU1lR3ZyY0JIVTlVcmZIYUdrCk5SV1RRT1lqcm5lU2h5c3NvZHBG + ay8xN1NPSkZ1UHhUazJmcnRrZkE3UTQKLS0tIGh2SG9NN1YydjAxTE5CaWNrbnZa + NnpkVjBJNGhCaStiakdMN0JFZFA1MGcKVqrFb6S+InLLQWqC8/RwrrysAf+3KMLJ + 1Y+4u3VdzA3BlU6cPNbeOYvdCnOo/qO6a0omHnrtls8e9ZVFB9Wi/A== -----END AGE ENCRYPTED FILE----- - - recipient: age1jtusr294t8mzar2qy857v6s329ret9s353y4kuulxwnlyy4dvpjsvyl67m - enc: | + recipient: age13nm6hfz66ce4wpn89fye05mag3l3h04etvz6wj7szm3vzrdlfupqhrp3fa + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Njd0ZDR3M3JuREJNTjdl - RDRDd1BXQ1F2Z3NZYVFlTGhsN0gxTTdOY3pBCmZReUF4SVRBcXpkQzk2d2xDRDBP - cXNNUGxXWkVFMTBNUkc1Q1ViaHpYZFEKLS0tIDFNVnlhQ294bHZhNTRUNUx4c2tT - MU1od1U3VG42cnBJSXlEQTl3MVhwMnMKFK43XRLZKQoouvCcGqHt/13LW+KMG4Gn - WvnkZz0m3WUM1iu3WLYqT+QOR8RnNPk669JE80rpxKZmbqRNsIdazw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQaThDV3YySWkwcG1Ucys5 + V3dLZGpKMUV4M29kTU9PWjVDa0E1Y2JpdG5jClZJTk1McWFFU2EvdHdTeXQ5RTIz + bVE1WHJTUG5lc3hjZG05ZkM5OG5QMmsKLS0tIE9qbFJYTmJIeC9NeU9yUFJRZHQr + eiszNk1LQnZyVmhFUGdva2ljSW9ndlUKx1ba5S/jCXTiXIa+6uOzgbarXNYZ8BeQ + PteQmwTk68ic3WiEHi0BTGW/Fx/vVEPAgBAZZd3Ea6gByKTmeRFKIw== -----END AGE ENCRYPTED FILE----- - - recipient: age1a27euccw8j23wec76ls8vmzp7mntfcn4v8tkyegmg8alzfhk3suqwm6vgv - enc: | + recipient: age1jtusr294t8mzar2qy857v6s329ret9s353y4kuulxwnlyy4dvpjsvyl67m + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrd25sbHdPbkovMWJXaFdp - S0dYMmdoN1I2ZFA5SFk4VlBSelFWd056eXljCkdCdFlSMHdUdE1rd0MwSUdpTWNp - Ymk4Mk5kd1FZMElGTktiZ3djRXNENlEKLS0tIHJQWUtqTFZabjdidWlMbXVmeUlm - N1JBZm9jdWRtdXp0YWhTTVNGZnFQcUEKcrOCOyDG/dJocsR5ZLyv42PX5cTBdgvi - aNYAq+SnBEMQebUlPBfOapR3tsdjBRwMPvDN3cBtky77SGAg0hZ49A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBad0dONG0xaXVzSEx0bVc2 + Sm5Wc1h0cXdBL00yTUpSWHNxWUczdDdibEFBCnAxekx6dkJJNWFjMVlILzZNRkdh + dDRWVFovVitsZVI5WnlBanZGZU9yRGcKLS0tIE9zM0ltT3h3RGZnNDB0QmVCVEpD + di9PWXpLc0ZCK28wL1V3NUNNN285VzQKqY3LelUaCtWM9vl0eLEVgtn65+Dfch1o + IJssAkB9pSSyUeLAs9hrFdLYjwKG+S8XB2Suw9Y7XXdYqE7dSLMiEw== -----END AGE ENCRYPTED FILE----- - - recipient: age133wy6sxhgx3kkwxecra6xf9ey2uhnvtjpgwawwfmpvz0jpd0s5dqe385u3 - enc: | + recipient: age1a27euccw8j23wec76ls8vmzp7mntfcn4v8tkyegmg8alzfhk3suqwm6vgv + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxM3V0RFd6Qk9JbzFGdi9q - ejZxMHBGdmhDNDloVVNpMkNrQStKUW5aNFRBClJtMGVJN1h0amJPV3RWY1lIQ2ow - LzYvR1dpSFpwa0c1Q05Bc3NXVWNrQjQKLS0tIEdNTXEraXk2N2Q5UWhjUUdvUXA0 - clhMUFZPT3JRZjFHeDBsd0YyVUVnZUkKYMO2fwqDXeuKVVgL2KKDWfTAa+5y0P0f - gFrlyEqbIrcr66fy66zHlVw3FjHoUfOsMDm4GRjWNn4KOTGSjIImjg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQXlLT2Z1L29zUzgwY0tW + RHYycmtyM21BMjd5QUNvQUV0TkRsWFh2QlNJCmprSE9lSnh0Vmhkb0hSenNIamlC + RTBlTFVvUkVMejBobXlvTlg2Wm5TY2cKLS0tIDdPK0VlckcweVdCeWdQbTJoMDE5 + RDJNYkUxZWZhWnptT2U5a1pYR0FtaUkKqhBidpla+0NW7dq2FnsYUoW4T4A8fmFy + cUMWuQBYM2QAxZRguyFXJ3dkUAxo7mIhUjKQuTIMOCRTyxqRlTW4SA== -----END AGE ENCRYPTED FILE----- - - recipient: age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd - enc: | + recipient: age133wy6sxhgx3kkwxecra6xf9ey2uhnvtjpgwawwfmpvz0jpd0s5dqe385u3 + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZC96YVlTVm5xM3M4ckYr - MVNZZ1dISHNGcnNSOEVjUk1JZDdVcXdKeEhjCnhUa2dMOEdBenNxcWkrRnY5RFdD - bXpCQk9KZFZmVWN1Sm5FcnkvaXJ1clEKLS0tIGhsUTd4a0tnWHJZdTB2VktEbGxw - eVZVenJRQXNKY1FNVG5yZXdHTVUrc28KAeiaqGRCZ7tjMaxKrlDOTj96WcoxlkxX - 1P+DXm44FAlEU/o9YCun5CBDMrBI8qBt5VUxFaqyA94ixSKXZQeUAw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZDFQMTVPb1F1aGo1VE1O + bE1IUitZRkVMSlNmclZHMC9qaWJodUEwV1IwCitzWTRKeEpodVpwaE5UbnkvTExC + Z3VYYTlqWndEOXM0MkFTZDRpOERFVlEKLS0tIEV2RGszU29MUCtONzFsWG1aZDZJ + WDhMeFdqcVZFWHlVVDRtbmErMUtlS0EKkrK7s5d8GUqX9PvOE3clrqoHVpmuXbai + dm3Bv+pUbNMjHFlx4sXVAPVlWahN0noo4fy69J/m6F7/DnuoDHEq3g== -----END AGE ENCRYPTED FILE----- - - recipient: age1sqs05anv4acculyap35e6vehdxw3g6ycwnvh6hsuv8u33re984zsnqfvqv - enc: | + recipient: age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHTmtYKzA1d3Y4ZkRyNzg0 - RFk5SzQ2bGdDSG1LS2FkNkYwTUFXUjZqMngwCkhrLzEzUUhYQ2VkMEI1VmdidXA3 - RytrbXV4MUcwanNVaGc5NDBrSWxwRVkKLS0tIFBYSjc1Q2N1a1UzQTV2czdxaDNQ - ZmJGMFlNdUxrZHBtbWppcU9kelFTbE0KE90J1IodfxqYl3De2qUv8Eu3Uw5PKeQ9 - j5SPAw+1xvnB6q9iHAOhXwtER3bOsXOs8RnPTqKCV5RtEa6su79Kfw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiYUM1a1NlVmRlZGJvNld5 + NWJMckRXVE11RzRmdWVETXhwYW5SdCtzRUU0ClZJQm5LL2swT21TaUYySnRuNHFz + Z0JHUTdRNkwrRkdJNGVzK21uZzJ4MHMKLS0tICtEcGI2b2xkY3RKaDNQVmN4OTQ3 + VXBrUjQ0Mjl3czBXbFd1WE9LN2U0WGcK1BvTUqw/41CzYUbaJz8C4q4hZ23TFOtd + g1NuSfsJm1BHN8vPk0QUOb+jw7J5YyFplFLHTFIf6kslMXP4WNc1Rw== -----END AGE ENCRYPTED FILE----- - - recipient: age18qam683rva3ee3wgue7r0ey4ws4jttz4a4dpe3q8kq8lmrp97ezq2cns8d - enc: | + recipient: age1sqs05anv4acculyap35e6vehdxw3g6ycwnvh6hsuv8u33re984zsnqfvqv + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbnJGdk40VVlQVGlhRVZy - M29YdWFxRnBRdlNsSVdTWnBWMGI1N3N5SjJjCkw3RzA5cHlBNVA2NlVlV2lJSThG - K2RXNm4rWkRtUmhHZUNBWUlUbTBIQ2sKLS0tIExyeFBpbnlRWittc09mVjkvY1ps - S0tjNUx3anVqL1RHVmVsR040S2VmdG8KEihK9BPXXLd0XQZB111NJuOdJGnCgBHP - KCuVczzyMx1lAyh0NlG0xgyIMKuWAXP0PBGgf24jerGbp/5mIx+sgw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGOGlPOUVlaU5JVWl0TlJL + SVFIT0gxdGhTVENzZTJiMEtkZnpMVHFCdUNFClF6cU8rdENSODdQNzd0MFV2TGFW + bHM5YjJJeU1UMVp2WUpCL0U0T0NCNHcKLS0tIGpKN2prUEF6QndiQkk4RExSRUtx + OFg3QUFjOERJb29wOTd2dXpLYW11c0EKK/R3LPiTDBvFRM3thWaaepKeOnF3Zt7u + 6IGcJPDuo6uHVcUMS7qE6qBWNH8ZBtMtNQio+BHx4s6G5DR2XszdBA== -----END AGE ENCRYPTED FILE----- - - recipient: age19rg2cuj9smv8nzxmr03azfqe69edhep53dep6kvh83paf08zv58sntm0fg - enc: | + recipient: age18qam683rva3ee3wgue7r0ey4ws4jttz4a4dpe3q8kq8lmrp97ezq2cns8d + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVTU0eWFMaWhIK25ESUQ0 - ZklzVEhOeDBtSWpINDVVb2o3QjQ5VWZzSUg4CkRpMnVGU3ZOWVZCRnpHT0J4TGhY - ZHNDekxuRmZ6TlIrUmhkYzlFb2NFM2MKLS0tIGNveGhmY1FsRUE2c045U2NjTi9r - ZjN2TEc2TGtIV093N1lKRjNqa0NrZTAKv72ItPWyFHxKxT1xQIu2sA2SzR3/1/Hf - WiZjpE7QXJBxhFVeYEcZgPKOZ7HdubchjSTCGTuX9oyi4/GI7yRPUg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5bW44eElOWEs4NlV5am02 + d0ZNemdBRXBURmd1ckVxelQ1UkJadTNxUFY4CkdRa05vSzlCeFFDTjFna3RoQllo + aThrNXB1elhSQWUxd3QxdUZnbUlmSnMKLS0tIGdWZ2loUENBTmZXc1R2aWdyMEsv + cW8wLzNlUjYyazVxZ3ZrZ0RpUGZ6TkkK3a9IoujcGL2FiOf3zGCF4KvUfGeh04q1 + QQR+xlzqe6iMepeD0fPZvYedc1Yo2wXbWS/j7ehJh1jnWcB57NSsew== -----END AGE ENCRYPTED FILE----- - - recipient: age16znyzvquuy8467gg27mdwdt8k6kcu3fjrvfm6gnl4nmqp8tuvqaspqgcet - enc: | + recipient: age19rg2cuj9smv8nzxmr03azfqe69edhep53dep6kvh83paf08zv58sntm0fg + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTzhrMGRsTHhCc2hlTkhS - SGxENjN3R0lseHgvVGJBdEN5L2RqTWJsMm1nCkcyVHJoRTUwa0U4VFFINXNmcFow - djBVZ3RjMWRNMzNnVGQ2SVpnbkZyOUEKLS0tIG1sZTE5ajc2aU82Yi8wT3djTk90 - cFFnNU9ZT05VTVJyVEJIUzNpRjhRc1UKZuDdPv5Ii+1ErBYDGxkaF0U/T9jKRI1X - Ov56TSpl0nlUB89dLPg94bICrL6q/Gv1pFBGx03xe/bHyxaHTEvGoA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSTR0WStKTmRHMHJiYzhn + d2pjTmVzVVhtZHJncHZWZUVWOU9NTjNoZkJZClQxRVpudnE1bWNUV005TUpCU2Rq + RHhRc1IwMHVsZzhNd1JNeDRRM3VlbU0KLS0tIGQvdUEzUlEyRFl5aHM4V0daR3Bn + M3AvKzRKZ3VzMU5oekRiZjRnUWlwa00KoajoQ1ZSRoUL38OzNEG6TX923corR3NX + QRm1o1Qj4WPwuqY6cFXVnnvrU460qkxDGyrqsl9VpfQMiDSW1mdVUw== -----END AGE ENCRYPTED FILE----- - - recipient: age1azkgwrcwqhc6flj7gturptpl2uvay6pd94cam4t6yuk2n4wlnsqsj38hca - enc: | + recipient: age16znyzvquuy8467gg27mdwdt8k6kcu3fjrvfm6gnl4nmqp8tuvqaspqgcet + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLVWNnMjlsUFZNa1AvVXFu - OXZQQkozYWxkZ0wxSUxZZlM2WGtuYU05b0dFClloZkxTWld4cEI3TWhaTEpCdkJJ - T0VLTkpsRnluejg0YWNzTGMzUUtRTFkKLS0tIHZ0U1lDRUxpYkdXaEl3OXBmVDZ2 - SmxybFFncFpjL3FuZ2dFaWM4dnFOWkEK+EqXlNZkn+oe4YecCwqJ8fLvXSo81A7/ - hBRU6LQGrSwf7lWW1qXNi/wtlNJMKE0nWFsJozrPFwoEjjysFDZy3Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBZ2NvN3dOb1FCUlhKcFg5 + OUhGV2x2TCtuVkY5VWZMbHNFTW1wU2pSdWlVCndYczJRanhPZVhONWxLRkREdzJP + UnlZQklhejJrVkRudzh3YXpqZXpVV0EKLS0tIFUxWWducE9zcFlLWEdDQ2orbXQv + NDlCZmFsbFlYZ2VockpvdVlIU1BmRTAK8BQSeOPpe/CD37W8l9zc7oZikpDV1jE8 + cU9m1jnN2qE0FnZTRLITQhPJhYSj/GIGmCq1HTsPNA7K1AyJsg5vCA== -----END AGE ENCRYPTED FILE----- - - recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq - enc: | + recipient: age1azkgwrcwqhc6flj7gturptpl2uvay6pd94cam4t6yuk2n4wlnsqsj38hca + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDejRnM05CR0ZHbUMya2ps - OFlBRnBueTdBc3k5VFhpelg3ems5NHZ3NjN3Cm9sRVJXQnZjdWJVNHdLSzFlZGly - VDNTUCtlV3dEK2lSRFhkNmQyUGpCcjgKLS0tIGdSd3dUb3B5Y1ZDSG9PODhNWGsw - RVJ3SW54T1VpNUlhUnhnamFRalpnTE0KL2JiKsiWp+06NN3paFVt5ZDfZBDP8i9u - 2vwztiFt8WdDKqJtaz2HxPutj+LtQIOOmZWatKTQRS8ALNtLZOeZgw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmQ0xLQjZLdnd6TmlZNW1N + SWJOU1RabDJ1TGZNNjM4UnhlVDdEWkNwZW5nCmV5WWFUM01YSTRRaU8zOUlRZFpz + Ritjb09LemZNcjUyRnQ0c2FGTUpWajgKLS0tIGFvWTU4NDRMbzgrRTVGaGExV3Jr + c0Q2NlhqYyt2Sy9vVHNVZTRIZzVSZFEKBagWqZgGM7L/4OvX7k0Mb16uDdxOneXU + V4IkEFxmVGavpUNWir77VnIX7WUThAmF4B2fhXB+qs0qlea4JbG7Tw== -----END AGE ENCRYPTED FILE----- - - recipient: age1wnympe3x8ce8hk87cymmt6wvccs4aes5rhhs44hq0s529v5z4g5sfyphwx - enc: | + recipient: age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEQ2Fld2ZjcjhoUVNmalpo - eFNZbFM2UzcrdHZTV011Ni9YeXhzUlRrcHhvCjV0cVMwenhOeDZweGo3YmsrcGRl - U3pBYjUvSTliT3JiK3dKWDdzYzlJUTQKLS0tIE1hb0RPbWoycjhTYjE3K01HdWY4 - cDBTVlVOZGFTWUkxM2pIWkhrK3ZWZmsKEk9Q/lXxWEkDt+xJyhmrnkqh8tarYY2D - UyJQofhowqP1gKLHlH0OVK2SGOXK1A762+aXDsSAb3cGvxQ+p06qkA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvSFJmaDUxT0Z1amN2SGR6 + dHhPUFVCdTk2cVlUYlp2KzgxZEY4dk1sN0dRCnAzWURSUkdia1c4aTZlWUFzUENC + aG9nUEVlaGdHdU9MU0VJMVF5ZTBSL0kKLS0tIEE4ZEZmMVhqZWdQNnBzNVRJNTlF + cDhJaStiRzlOOFQwc2h6QkRrUGQrTlEKHTekoVeaGKeZL9k7FKroHReRuQwBeHnG + Qjbib+9Qk17xd11q/33Lb1srn3FnaaLCoQhl+YufI67jdfluqVl5UQ== -----END AGE ENCRYPTED FILE----- - - recipient: age172pk7lyc6p4ewy0f2h6pau5d5sz6z8cq66hm4u4tpzx3an496a2sljx7x5 - enc: | + recipient: age1wnympe3x8ce8hk87cymmt6wvccs4aes5rhhs44hq0s529v5z4g5sfyphwx + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuUTlRU3V3U1VmKy9hOEhr - SVlObkVjaERRcStDd0Jtd0tXbUhuVWx5em5BCmh0aVkwYlZ4OWRGMjVwV0M1RGhk - dFhqOVFadG53dnNvemc0UmpXQlRDZ1EKLS0tIDQ4TE5SU29zeXdUYVR3VzdicVRY - NTI0SnBYZGlRLzAwc0p1dExXVFdmVnMKEFkjz2qpMXRqwmZ4YCxs8iwZpHk/CSit - G4+EjH9oMEFBYqPkgdsYw2stIs7yPncKtKHPIHD93OlXCqKoqNWGag== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUclY4MDRZTjNDSTRLd3hn + Tmo0ZThiZkVuWSsxTTB1c1hyWXovV0kybmo4CjB4Vjd5R0NoNjd3RHhyb1NJaWpH + cHVQYm1SL2ZPLythS3drUkFBcHVmQ2cKLS0tIFhrdFRMOHZ1L3hWRmswZzNLOUQv + NDFxMjJBZzFtRFRZSm5QeER4eUdVcGcK5sYxXaa0VJrbPDlns9AT3qOlI+DrRtza + b9bWBYrN2nFMNud4vZHyTdHXp/VZj/x5Ezo29ZHI+QDXOG+CopIL+g== -----END AGE ENCRYPTED FILE----- - - recipient: age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen - enc: | + recipient: age172pk7lyc6p4ewy0f2h6pau5d5sz6z8cq66hm4u4tpzx3an496a2sljx7x5 + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSTWY5eWkzS1FSNHlWL05l - SU00eUl6K1VYcDJoSFR0UEsyU1pHcE95K1FJCmEvdEVUb2xJdTRZTUY1bHI2YmRp - RUtrSGJsUFpRazZHVzdhQlZxbmxKMnMKLS0tIHhxVzFvVktXZ1lhazRyRXNLM1RQ - NmNLRnRDdkJiT3lXL2s2L0tNbTJLdUEKz1y8nEdzEmbqb8V9RoZWrKuLbz/as/4a - 8z/+fyoRWhuugN3bP1XIw7tyg7abW4/fMQaJi5iEcguKbDnfZ5G5uw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZejZjbVBuTXN3TG9SWGZ5 + cmdYZE0wbkpTVFAzd2dFQnRmb3krMHcwdEVjCktoMURmYkxMbk9iRFVTSnVMc3hl + QzVQK0lzdEdML0lkYXdqLzVOY1cxUEUKLS0tIFlWSDNTcWlJdVFsMHVYZnRZU2pP + a3YxQUhZcGE2UEpwWWRzVTVmWmVHbUkKZyuOLv3ri9WPN3gwuTesRr01plmgN+8k + fdfgPALn/peSFeuG+2mDBZfqaYphZvMq+l6USkbenkzyMh7o4pUNfQ== -----END AGE ENCRYPTED FILE----- - - recipient: age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs - enc: | + recipient: age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdExDdGlMczA3cG1RQ2dj - cmlycUtFay9GSXZTY1ViR1lRMnZEenNXZEc4CkdhSUJRd3VmUzFGYXJJNStCMFFi - MGgrWkZOQUFqYURsUEVtblVnS0lHM3cKLS0tIE1YRjFuWU8yeWlJOHJJNDdBaDZP - VnpYR0RhS3ZLS2xlN21mNEdWQUxENE0KA/4UnoYY7p/6/KyK/OF0xkK/RNTtvb1A - uw+8pfLPlY4OKcq+yhCQEkIJOUzNvtoHWcvQf7HIzq/3pXc4b7zIkQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPQ2lIMDVIbkZJNEhvanNy + T2pLNjk2dXA2VmpNc29PTVFEcE9DbC9saUI0CkVJanlBMmpHN1ZtL1BnTUVPUnZI + U1VUcGpyUWtQZ2FJK3JxeEsxL2J3UjQKLS0tIEdxUmZrdXpDK1o0VjN3YXlqdGpH + QW10WnJrd2d0WlBlK2JIbWZqNXZVYWsKg/a9TdHoCkmkcnZnyvXc+sCxZsQVpJnh + R9r+2qmmQZDtdlnpPcemQhoAHDLdU4AkQgKNThX5IY74v2LhJgrPAg== -----END AGE ENCRYPTED FILE----- - - recipient: age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg - enc: | + recipient: age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZHZwK0wrdGpGMnJtSWVW - ckthVU5xa0syeU1EYWpGUnExSEdVNUQwTndFCk5hSkdDQVQ4ZU9ORXVUbWN5OEtX - Z1Bod3UwTGp6T01GN0JYY3NpUGRZUlkKLS0tIFBCOGFnbWRaZXVieDNYWFUzOHYr - L2J2UFZlUG1EK2E0MktDbGlOS1VmY28KA/Edhl661RwszbY6wdttE/5e91IYM2Z+ - NHPgNq9ePb0DqAtNozYk8lA9D4Y20cx+7gTPzSwYKVW1iITarI50NA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvRUlzMmFDN0lNbXNIOHBD + Y2syV3FheTVVZ08yUFkzenY0dytMckFrT3pnCjRiZkErOGtYdVZUbEpBdm84RklC + OEgycEMyZjgyRVhmMEtoc1hOVnIxMkkKLS0tIG9ZR29BaEcxTUpvM1g0KzF2N0tp + cndqYi9aakczMWV0R3RIbmZMMjdBRHcKh9bEatt+Of89OK2v5zigcLTrLg2Od4fb + Wb8DR3ek8ysfcHCDIfAce/bBRX4nKbhZGB/2XYv7qJ/XVCaYWprKJA== -----END AGE ENCRYPTED FILE----- - - recipient: age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa - enc: | + recipient: age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzOS9kOVlMR2lXVDFWcUYv - cWtTZFdMMHdoQzdUbEZmRXlITHRrVFFKVlJRCjl1eEJmSUs5ejBYdGl1Y3Z1ZkNL - Ymc2Q2VVclRKdzRiQStBZGozRmlDM1UKLS0tIDRhTUN5aVhYTG9IZWdPY3hVQitq - ZHFGVzhBbVZwV2F0VkJzazIzRCs2TzQKK+j4kdCrNBQpEMIl/qBdrVem2880XnMd - /gHCkOmjcCJwbawN7ddB/+nxNp59M2MwednrXt+O5clTuAseUoa16Q== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGOHdwUWhHODJHeThNTzdp + OTZ2b0ZxZlVIbHRNUExXS2lnaldrVTFMT21ZCnJiTk5UVlF1dFJndE5qL3FUZkUy + UzdIQlJuNlFNSThTYjRIN1V4QUtEbTgKLS0tIC9rejBHRmJqelNrcFFpb3M3OXBw + L3RmNVdERmdtaUlOQTBZbFFHWU1BY0kKyurS+2zWqwi9RpG7N+0Wpc+ubFpLprin + 59q4E5PXsUDZ91R1MqbHbf8yjb8/I3vLn6QjUK4KPE/9CQCp2pNw1Q== -----END AGE ENCRYPTED FILE----- - - recipient: age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv - enc: | + recipient: age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxbWgwQmZEcmw3emVJN294 - cERib0xuc3Y5UWJiRElRUnhjS3JScHc4aEU0Cm0zaDlzOU5sL0J0MGE3Ujg1T3ZS - cXljVFFVZDhxWEdkUjdndmNlNkxrQTAKLS0tIENwbDlKTVRLSVJ2elZCbnhtY0RH - Vkdhb1Vld2NvWlpNTFNyRFRQRFhsVlUKRihJgoaFsgfByXfoWA728AT+E9bQu1ju - tYpn7wL00VA/xwLyb7WVcrIJY2Q946UTUE4b9Isx6rv3NDKeWYUEPw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4MXFHc2VtMzdFbXUzd0NO + SlIxQ3FsSjZMT3UwMjkwN3JBVURPNHdxSnhRCmxINTF5N1dzL2V3c2dSemxpWkto + ZmE1a0MzWEFwb0REdzBJQ2Q5NkRyaW8KLS0tIDBGOU80aFExd0lHS014OUlJMldF + Y0I2RUhOVFNDMVRiRE9kTU9xUklBZG8KuNx5K+rdNXkfhRgn66VGLc2yfC9YuwhB + N1XaxkKu71rJ5ZsuCoFtzqSMyh4MManh9CXIwlMNAok7VfU1qtmtBw== -----END AGE ENCRYPTED FILE----- - - recipient: age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj - enc: | + recipient: age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpaFFlQWpoaUJFVEIvb3Vw - SzZyWmlMcU1RMXFnMmNHenJNTDJnN3dYbVhZCmNFRC9oRE1ENHZWc2ZYeUFMOEEr - ZjBUbjlaNlVvMkdaUkwwUmlWd3luQVEKLS0tIElEQnltd01ZU3YwNlFjc3RBcUNz - TVFtc2czRFdoMDhyVkgvVXduQTNHNU0Kiuni5O8zpUHcxSD/ifv26sgGa0CcztsT - jp/zmougfaFAy7UOLnkaCEu7gruoesZY3fxPhiCyy+jSCLe9mzxSbQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnRElTWUV1RXd1bGxSZzI4 + b0l6aUsxa1EyTW0vTmtyOGlRazE3alZXaFFNCjhQNUo5Y3R3ZHVPbnVrUEpKN1g2 + MVRzVXpwWjd5Y1R1VENLVUtlNnAvWWcKLS0tIHRualVOd0g4cE40UEpseDFEeW9I + aGdBRW1TazZZVlE0cXlZSzNrTTQyZ0kKZdUpkVXkeAkHkIv7W4/ZQVU+uS2th92P + e78iITFOJlrw2L3ZiAh5asnv3ee1ZH62eKLJVnCrEprmR+hhlUVhmQ== -----END AGE ENCRYPTED FILE----- - - recipient: age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf - enc: | + recipient: age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvNFVuV04rTnpXRGthQjRY - ZmZ1Y0JQUG45dDhoYUVOeGF0YTJmamliT1FvCnFPS2NXbFliejg4Q3JpVmY5c2xm - U09HZ0I1dk10RGh4Ull0dTc4OEFGVHcKLS0tIDdSOGhySVQvUHlLNllnakc4RmhR - N3VKRzRvNW1WeVBhN0ZtUXF2UzZHVlkKl9roQWqZWohR8MnoMCXWNggWJZBHfZJp - 29pKxeqp4KV0c4oQMgFYcckrw13ynMQ1O9cgYVMPl/qtViun9jr6XA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1TmlwblRNS3ZiaWQ5anVj + UFBVYlcyL2I1Z3VZckRxV3h0WWxPa3VtMWkwClJ6aXJnQnNQeEtPZFdKYkM1THpH + V2h5S0tXenZMZWUydVlld3hhS2cvQlEKLS0tIHZMbjVJVXF5bE80SU5JbEF1K2I4 + Y1F2NWdia3MyeTVNZFhNWkZlSS9aSXcK9bCrSomL8gY54AgeT6mUr4vZ8VCt8S9K + yEMGDls04Ab6a5U4PAM2ytzyqilJ6agE7t5Tfpz1PvdL5lTTQrx5hQ== -----END AGE ENCRYPTED FILE----- - - recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve - enc: | + recipient: age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4c2VyQmxSWW1aMnRwMFpk - bEluV3IxWVloZjNiQ1hubGhldENWZG5kOFRnCjFZMUFGRWFiODBDaFNGK2pCRlJB - QzJCdisrd1IyY3B1dDFOWW9QeW5ReTAKLS0tIEFJODdCKyt1NERlbk1NNjUxWWU3 - NXNkQTZ4Tk4zanlRdHJJc2tJWmdNMzAKzifmbegg6BO7RBg+BEbdq+wqWHRIa9JT - RHUWaCkaX/uKndvNzjrDITLClAw6lycFFFWkCzFidT6nzz2omfJkPQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6ZHQ2R0Q0UWhwbFdNOUFh + S2xPRUJ6ZkpoVy9ucTlHb0JUTGZ0a1dXSTNvCjZFZ2RLUEdUWTV3QUtZY3YwVjhj + bmpib0VoMEhVZ0Jrb2k2WmQ0SGtDb2sKLS0tIGxYclJ5cVBic01oRGkwbGpkUW0x + T05lT1M4RlN3Y3AvUURyTEwxUDRkUkkKLJ76ju/Mqpc0MS4J5hk+hEOONA6ignmt + nh34vnEKBg20p6CfsrmJf3yAnXuEeWsERm5k5KsGzbxzWV7I++mGlg== -----END AGE ENCRYPTED FILE----- - - recipient: age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf - enc: | + recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve + - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxa3NmdnoyRXdkQUNBT2xv - ZmRkZk1kcFdoRER0ZG1NelN1TmpmWXlPWlEwCnQvSWtuY0NiT3dkN1g3SzhhTmVm - Wkd0KzJlcDh4aEtFMUhCaUJ4dlJYV0kKLS0tIFVnNzJXQVh5U3d1b2c0VVVkV0JC - SURxZWNTNDcxcEd0aHA4R0VRYjZhak0KNsB6lsd6OK9lCdzHJqih9uZ5xExf6z4J - IqH/PN+F84tTh29QxvZRd07qQwVBiXdwDcQjBzUM4S+a2c+TVxf/qw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMOU9YVVZIZDRHejd4aHpO + azZyOE10bmFJT2dNTWxYSFkybE9NS2pkYlNNCkl2ekczYW40TVhjNXBGOUdlQTRT + aTlaeWcxMlBPS0h0NXNiWDlJQXZMR1kKLS0tIDZBb2pUb0J2MnA2SlFsNTJYdjA5 + a1BwNHRma001NFd4YzJ4OUFteFlvM0UK0tVTZmK1h6yC+aVwg6Pr/y6uaB12wj8B + oJx+p9Ty9NTSM5THBNt6paR+xHzCP1kRYNulV4PABq0IsGSpxFk+wQ== -----END AGE ENCRYPTED FILE----- + recipient: age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IDNXK2UrZlFH + a2tGRTMzdXJKWXhOeFo4QWdwV1A1Z1hnMHJ4VTlPMlN5Si9IS2JQQkxHeGFOdVB5 + Y1pwOG8wK0V6OGZjcmRNalFJaGczbGozV2djZGw2Z2hkN21WeTlPSEpFUkl3RXJU + OXloNktubldBa0g0ckptSzVBTmg5OW95cGlGOGlBTG92YldDV3Q1T3RhN0RudXN2 + UzFUZjhtaFlGSWtLd3ZPL2NKeUNYMWNYcDBRQWtSbE9FTnUwaFRIQnRSVmczT3Yx + alNOWU5UQXVWNGtTaFZxbE95dTFOOC9mMFhwUTJ1N0FSR252VHhrNGRYRjlXMWxT + RUsraWhXK0lhdHo1bzZDRy9mellza1RRNUtyYVkwT2doUWhBeEpvTDdKZS9WWHNs + U2QyN1RaWitoUDJkY2d4SysvOEhGR3NnY3A1OXhVR1NhdUJLdWJ3bGkvdnNPZERV + OEdjbW5FNEpSOEJRTWFtem4zU2x2bGp2V3lOUStIMU9ick1zZEQ4V0N1QUM2UHB0 + TzVGZ1pKZHM4c01FblM3N1pnV2NENmltVVNISEI1bzZTRE9LUW9oQk5qMkJ4Z2Vt + NmZHWWREKyt0a3NJSXo3VFBiQWJWSXQvY0F5bCt5aktGTTJTc1R1eEpCSjRwRDhS + U0hpQ3BOT3g5NXFMSVZsQWphN0IwSjJkOVhHbHlhMHdzSFcxQW0wQUJEbWlZYlNk + di9HVlYzUVZDMmNzSnRLOUk3OC94Yk5GK0lESGduRDZRc2JabHk5ZFd5cDZrL3FC + eFBSQWU5NE9uR05IeDNrQkJOMW4zUjlyaWdPYXlqMitpNGJ5YzNZK0NISGx2Vmxi + VXNOc0JSMUxuSUVVR1NBTE9kZ2NvUEloTW5Mem82T0NPVHFVU0Qzci8zWDdaWkEz + bG5zdnZZNUNITXM2K1gyektYdTkxZHhXU2tmd2tLVTN1NUt2WGR5aDh0Z2U0dVhU + Ynh6VUNuemx0ejMycnRIWVZxdzBzc0krV1RyMjlveUpGdnZQb1RSbVdBY3R6ZkM3 + RUFXNFVYR0pScU5NRjNIUTFkeDZFKzhtTFlNdVpzZDBSeHRuaDlWNHYybW5qV2J1 + bm1Zd0tPZGxRRXRTVjZrN3FLZDlJL3B3Tk5iT1pUbmg3SU5xSEdqeWNRZmQxS09s + MTNhZVBZSmoweCtkVEhEQzlnVlFtWk9xVHMwWngwck1xWU9hL2d4V1VvK0l4RURQ + QnpzWUhnZjFOa1JvZWJFVklJd0dma0diYzBmVk9YZlZURmo0U3MvRVJOek1iTzh4 + SVN0UkdQYkx3YWZMdnVibklHRW5RdGhIK3RqZHBLZ3drWEdaNDg0cmVhdkhocCtX + aGVQQVlFOGdkdHhXZkZ0YkZYaWFXR2hkK3M4dy9GOUZSQmhDVk5RUmpTSStRTWxt + aTNsNXJyL3g1ZjhzLy9RdkwzdER5YmFSWnFDV0ZDZCtTV2V6RktXNHRtbWVPc2ha + SzdSRGNVRWJTTG5KVm5LZHRzRFdrMGwyRWk4d0hpN1RoNFRFUnM5ZnN6Z040dXNT + ZkdqQUR0MGRMUlV3cmxmUTJxRTZVVXF0YWtOUThibEhLM2FVcXJqeUNDOUtVY3M5 + ajNJQ1paRzhvM01tZElqcjFsQnFtQkJTaDFIMFA2MVZQNjBYZnpWN0FJMkZRcXVr + WW1uQUJtUTNDcVo5Mm9kYmxSUGJqd0thdGV3ZVlxMS9SNVg2eGhMRm1UaGlWekRu + bFJkaGNFbytPb2REZ3JUWlp4NjhxbU4wTzlTOHN2TzV1blJCMTNTNnFuWThqdXds + K094Q3M3UGE5MVZyUVYvZDNrZ3Jmbm4wNkJMS3JqR1lKSWpCZ2IvUk9ZRWFmc0Z0 + b2xVcm5ZK2NtbmVscUxOM3laZnBUYlRLSnR5L1g4RW1zMWxYQmFjZm13YloxNjM4 + bXV4ZllJdG16UDR3bTY4UWVJeVZOSjArU2pGS2J5elRJVXNCdm95bTFsenNLQQoz + MFlJelE3N2gyS2JPZXNpOGFTMWpiZWRvSWhsMUJxSXh3VytBZElQaTZnCi0tLSBN + cnNUVHIrZWd5THhhaFpQZmRQVUpEMytJOTFHeG5La1lBc3Fpb01XNE5zCsXR7ibA + urENnyvOwCOgW9OosPDqhjsC1wElMtNf9W/Th+20h8S2ApNTMbINUbc/7KPZpIKT + KQKilX08+r7RAw4= + -----END AGE ENCRYPTED FILE----- + recipient: age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76 lastmodified: "2026-01-25T18:06:26Z" mac: ENC[AES256_GCM,data:plHNLOgGWwNWbakKG6X5EOxwERE3rvYO4EOAzY/sz+uM7cZBEnqU5LZwjlD8B75hgRHqpnDBF0JbHgsEwVxfJJRL1phkeMJFOapQMjZVWMz6j7eb1hOwpdktd+bpuimy4XCD1aOxOoInKpFSK33usxLfyqSxjFDM5+i6D22qBTs=,iv:/iOIfNuSIDsa/UKLP0d63tpOrYMFO3Bk1qPssY0AzuI=,tag:k+824MXD+r0lNUcuvisudw==,type:str] pgp: - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxK/JaB2/SdtARAArIbXCPqNo+EajbWjsgzQAt4jtyUSh7zOy1URyt5XPEUj - zJUFkS8SUfL372esuA/KjiRhE0Ztq2T+zHF8sBT5E3GCTEiLnKvGNGik2w2OX5MG - CDmKZosfuhByOFFubsI76fbicb5euGq1QSlBony8fqPtvJ1LpY2GX7Ob58TXii9f - ESLesimUT0T1sxG22w7RFOFPHRgqD7q8Y9gAsJduj9QVIr6bBxehbu80/b00irk4 - SVFM7lkvEWij3LXHYBBx54lwT5vaM2lNzQzBRJDljzD5bJkqFFc5HZAtZXI+g7fP - UmKZQWD74Fi8boYE9VNKW5jtEHAIgWHAVNEZPb02zmNITH2BaWYQFRseYeILdjaE - zdnw087YhK88BHZYjgACY1+yMHaxrlwyj95D2m27zk37JBo5F52L9Lo7uKgF7rtS - sAw+VGqscEwyB0mmTeidcV1talvieHgdbJiCFH/hWcNksa/EZoMclp8HscKOjWjj - bq4qZSH0BPD740CLyIhh6LFLpi2wEdEY4MyMkjP1vM/F7yPondEB5vNjk7x5V1hD - bK/WthCeN2Q34uCBOnnqzFlbrFAmHXQvq8NgzEDvsJmfY1wUrNsdW9wy8fti+g2w - L+s5Eqr6BgvqCIPz7e6xtZwekvP1p8tHyUqPcdXLDfFoBayeMd1/So1mV6nXzs7S - XAG+LzP7X+B2u69GSkJZjgpmwgiOXXQDIlVE60O8bENLeMRbXLpkBwQ0n8XIs6pr - +FX4YxPsf7IWRpMjKNfLN07dSSkjhlVK6+qfyBAuucuikWsmqY6jgiS8daSe - =voHd + hQIMAxK/JaB2/SdtAQ//VbqnkID+k4jUtKcBe3yZ0Wp59g/oqpBjxk/XfVDH8cWf + qUm4lOzoHGvaJXBOtTqaQh1q9oHhKkAdb6gC0+Upo9t1dY1ewPUYlnV/bh1Zqu0Z + 531H7vQL3k5378SnuUmPMZ2oizYd9AF0klGj58blmJAX97df1DHDdUtXXUhl8uVz + BqiMJN3lkC2h2dhgiZyHxMcpFhfcpJ6pkyghVvg7ldnLsvydRIfjQbfqHgLCOq/t + OI0VZoaemOU5n8uESyiFAoQsCNSG8wQVO91MOu9XtUobaBKpi8YS2d3CjIRNALkH + ObSi8OBJ2EDL4xcyBFoRq6QJfi0bTOx1a3RcRpA9gYMz9L3TxWN6F5H6g2oSgyhq + z+jFE42oMMr1afrUyufvIhxfNmweYb15wRtBZMTTTN+GRZUePHet1yCwoYTgcIit + u7bzoNS+BtCbMmfmntXRgB80SlzTT1CofIwXL4gPjBGt0iSwh4nn0rytQSuc8lmY + Wk+JM0Wdgh9v8v6tyiBFOasEkwXuiLevHOnXv3q/tK5mpJsXAT8IMpyTJbuFYxkl + VlpvGyPjweFrbpdZAFuai1kfx+YTsekremyG9gM7ZjMjiOM3Temeu3VwgnmSHmw+ + UyvNk+Hbs8/2b4IW6c6bGLGgz37P77E4njMIZGUCW1IKjAEB978+UDGPMMmNoB3S + XAGM4ogMXRll3TJ0QKwxG88CCUYuJE+TBawBoOZxMLCQWdAiR1rW/HYNWQszvezm + zVx3EYVkci80sY5nobfqDd7w47klBti3+f5yfC1naelCyfPsIquqHMtA+U7e + =i3K9 -----END PGP MESSAGE----- fp: EF643F59E008414882232C78FFA8331EEB7D6B70 - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hQEMA1QflAioE8i3AQf/XZSfNxfryND2BGfBPyJBkNySVUZpRPqWg9hi+7n6oCp0 - FZXUynfrtWLTdFF6A35OsnpdLEVwrQqfuqcrK6OkAYUkV9t50YVw6nAAmETc9faB - BV7RVGJf0OD79LHI/Fl8a+VkkMqG56BoBySQ+2Vb/eh8w0PKbB0oWN4yXBihkXAS - DKjEKf7x4OrTdHKa8GiKxsA9C+P0oo92Ygy98TOXQPb3MSQhWfnCFm+7beXIfInu - EpOtSFM+2X0y70Wz+X2/lw945qm+d+JXjvLpqpE+4U1b8LYuue5ddHzJjYIHK8Br - lQrdanIJw7CAeyKUtq5M63k5CZG2GHMxNGngWUGtm9JcAScF4QdywEzoq2NBf/lF - eP6/u7Kn8MTJ+gFOWxmlT8+VA+rhCp40EccQzbeftNI9ojI2YrYl4Qkb9CzlFXhN - uCtLLlRakB6CQWGaTxxlkN97h55s3A6l1hsF5qc= - =YG2f + hQEMA1QflAioE8i3AQgAuNNo/As0/3bo7DU8/LliUdKkI+58Z2bxREFqdogWnTxg + 913DRwLpd15NsLx1zaSf8eqYnGeHkpDFEFThstxMNpKXPwa0qex5tiv33Wvf1gkU + hH0Volh2HhauWAoBw2vdOqZo0+P1TtVR1i8uTXtCg7SnjdF2Ftg7JWpmL8DkNtl9 + s7DAAG/aPo3h2wGGDCzgWkQHnfR+lC645DZOJ2Dgrmcl6EOC8u5TlrpK4KsU9ivg + J1zQxvm9znExcZHwwOZOnFWRUWBGmBkE4fLKsTsVko3KWmx6mQatVF/wsUW1bFIg + Z2+EkuBPmsvRBhhT7JQGVWkp4NX0RBlDlaBjRGS5B9JcAe0NXVGCq9+ObHZ7ybIO + ZlMvZHikbwhj8HWpK6jC9cIe5CiPdEhLMbesH1Cc8nffXW2HUeMAU/0/AnkzHSEE + ipd39CzvlT7HQHtrTizdydox13MUYFfUZfFvlRY= + =jnhj -----END PGP MESSAGE----- fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAz5uSgHG2iMJARAAyLt6nBeCDKG9P76zUoweIw+m0aXbN1XFSIPbaq+ymq3n - /DDhqswh0xF2Ng4mD8uYrFI7CdEyVH2KCJAsa4QRKadryBxNtZqPOsHz5JcVgnlJ - yKnIYWbG7UZKfjAJy6TlpQR79hj7EvCNVQ7i4OYiOSJHxrqrRmAenyP0h6KfjIWA - Csx3y1O4SiE0llGYUO7K6t8p8mvx7nek2rXcL4KMo+4mKWSPaYP6XkBYteRTjfA8 - 07iU1TOmO5Fh5KgtWYkyAcQco71aefG6ub/NjJ9UYpSq6Q/I14DVpC5IrcgxbcRQ - SXAaK8L0iQPQ3mN4lxKokD5FKmr1et51GjRfvmiLCxY9rooB2/Xc2oiCHP8cB4xq - kxxoRUYRItBYzYbXqIYPJ0m8T5o6QQePbj1zfFLfpW33ZFdsRVyOdl5WSis5Y0Su - zA4A75KPlB6lK4qBa3tbWC9lOa35uAEk0NNOV2HNA7BAv5H5AQkoItaYMqElaoVG - PUrhuR7/eC5kRXoqothzv2H5BVGDqgqqj3ctv45hqrR3CylK5M5c8cS1Orfp9NGl - 8WWv55c7bWMW7dj4TOms+O58MwrOBla7C65U2krbsjm0piFoaEyRVgrypV/zR8tX - LIk1jJpNcLkMgVE+8593RlRlpCKbnk2qfqd4AuoDWdLh8Qq9H8lB4s2F4v8g6FbS - XAFw18E38CdoNdj/bjcM7uCOTGAfR+p24k7c4LPP6AcC/FV0QinPGwDiwEdd5a9N - rXyvsFxfSzrF+CJ+B2vefasL7SxDCVkM44dY2BUxOmYxNRmH5g2R73sLKJ7P - =wIGB + hQIMAz5uSgHG2iMJAQ//V5uDlJxHej0+edePUQwy0WK4UOtV5Q4xp/fRrW8y2SKJ + jHAYe2S/W8qcTtvjAz1Vpf7lXAO8Bfu8IjaBuctvs+xZoK9fYi1BUsvPjrguR77g + yVN8rUGwsWFJDP1Yi5wS7vNqcS81YcUc0/4ALQuSgr5DRYusMJs8tZClqcJB+IOl + vrvI1+0H/1E35VW1El1+auWf2wBDfTCdWjCBStW9eGaQ6ooNuqI1ki+p02dEiCHy + WtSFoZVLgEe6BIhseWScfEnfOSO5xgfvG8gsq/sPY81uBDvnZYp3cg7ZaIr7jfcm + k1qh42nEt+I3fKQmXu+WFD79MYVxd9SqR1s5f+Z071KLjcPVXnbhVP/d/2te4rWu + 9CJyxO0FvIwd+ijqd13T4H3e8zOjaP9oSXwAfsyuOFcHtZCgFdUkiDyQ6/WlRlxx + FyefuDqagwBl7tXEjsoYT1ZZKB/fd/rdJiEaCYsfcVgxyZXxiQBVcNTW69UgG8gv + /4ADaNILKRp6PzUcyPd9t4OIV90lyPZbpXOw0LUKbBakpp0ge1KagjhAY3YHblPo + ubtyEDmOhgRRc4pdAg0PXRmYmgPqAGr71qlVN6JttXOF/QnhEt/43tXsQIU3X9lN + h7aw9s2jrtlzikYZd9UBq0eZjDcO6p9HjyQJB8bSlZfQTnfER0OxYgRmcJb2L9fS + XAFGBLxy6n0C4EP32T/lLqOCkfQ3RKi1PcI4KozgtCLSXcbCuIDLl9s/xHG3LyOW + 6uGRG3LsAmFrBVbf6fQh0O4EERjBM1DBdxpuECPGJxqjsmCWXH0kckjx5U9r + =ZjWJ -----END PGP MESSAGE----- fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DsZXvxFXTXoQSAQdAFCMxmEEeH1EbTjXUOYwa3eR8KnSPneB9kueCkfQrnyAw - 4gq47KXBaGPHp0Z8NYWmSFBeaYjCkwo2Ofb+j5/Va36ky+AnSysGIwcUrWMaVa9C - 0lwByKgj1RSU/BsybtP3tyPw1YRqadlp+nR/5agxBYhK7BC/jbhSN8rlkpfycuH5 - 39oQYmE/jRSAIgAfsj77Tfb2WRBAdv/F5u86fO/bgHd+MgPqPU4hCCJi5Q+iPQ== - =dW1/ + hF4DsZXvxFXTXoQSAQdAHGNsY5+ISnGYSlHmBXBqayFgTl7ILhbTdVrCynRsDjQw + UcVUj1P6ZjgfgxS44x4e2blQQTgEIfrmB/8W28d/i60ebMIQEuQC4iiyX8ioDaCs + 0lwBbis/tlst+O2gS5tWCJ97fuAbIF8zrbBUmkxR5C/ojgfrcCa4e4Zqz252bInw + rxxZrSP8Mw+RDqI7baKLKrRDoaRZRFvN6Uj3aHR+yj6ZDdidjU5e5Rnff09uOg== + =Mf4l -----END PGP MESSAGE----- fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DerEtaFuTeewSAQdAYdMU1XTUDpkZslHRIczB801Wxg4+i6AMXuV8ev4/mHcw - xyg+Sisom1gLL0VX8Gd8YYsRTZiDSSpurQNqwXy0Eyx7+WJ8txxo/GFw3ZLMRhI0 - 0lwBSwV8FeBs0tuvTFa4zqWZ9wklzk7lfiDdVV1wc/Q12SznvMes1KZtqUDEbkaG - lYg2b5Cl4xMd+QP9MVcQgibGYw5mx/xZ0oJpiVJ9JBw6MrGBJYChGOqf0eaD6A== - =h0ca + hF4DerEtaFuTeewSAQdA6qEEGHwoDODsqCiBNsSxYW/mr23EYieH89un7j/hox4w + yP08OBYxBVep1/ep77aFnVfHqvPibcDjmC3ee3zEjXcYDnTiUaDWr+nxq6K7wvS6 + 0lwBqfbYxJF43dLtXmK+Wtmxw1fT2/ha1pxogiEGwyF+3M8Dz2plpQSswq/tGYOB + p+Pkb7ULGTT5rmUxBjjtJF0h1RKadMwiHfxshcGYOQ6flvBn9r4dZlLHHVBl+A== + =I+Rk -----END PGP MESSAGE----- fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMAxjNhCKPP69fAQ/9HuQg6KvEarCQfT/piWAuXtufmkCcj5dQK+U3j8ezmRYf - gvXqxd616jO72g94RlwO1MKwH8oukRTzvVe7TdPf0WtcuSVn3qeUY94mOwqscMSp - +GPSoPDqBZ4V4eg15vAAsTK5U2T/tx+5W3k/J0v6O2CM8b/ng8r0eP3MwlJiN02+ - ya7zS2A1OkxME6fa3758P6P7t0VdQRuhK7XA3F/Gv2dDqBEu0z+mFZDg007sR8bw - BNTZKMoamlDDkpv3HZ0qLy5FcocTL+/z/RK3GB4CB09gpznU7iGbM3QTkNVdNS7r - u7qaKuXKY61lIaho2SCgM6miA4h83DfHnxR0Vkcw8oPfENls5lPN8hku+swMFnYK - 9KR9ntk/Beo3RoqS/iIRgLlgHpP09tggdfUhi1gPdhdmTH5E2TIG9v7S4ltKen53 - aLqrNIiHy5S1Nr05Of0g4Ff/OxaI45lmzXAWQ7oVax8DSA+5ubUj1SHmo+zG5fyh - tTAdVh9oyBzX2GlpbWoKCXKPEhlu2pH75w/WfZLZYtjh927Mog+d+PAK24Kiz3N5 - cTd5EETuZC/nBku3WWN6y+gbfUpIJMFTtLKdNY++ebWaqfK9aZ1I0Q1g2pfZXDb2 - X1bzMdDdGAaCFNW9KWx4woB6FZEQvDLEKvxqZ0G+4DcfNj83sGOqE5oguLJhPyTS - XAH9x6T+VjGRFT0rN2MUMl4n+z5K9ZWA4OJcC2PGi5VGlVyK48hD0B+ygP6GBwKP - 2LJeG7ANB9eNeGsHmxEE804DdcuuEL8wtEomKU+14Qp4sFwXJEn0zqmgOPd+ - =DxEt + hQIMAxjNhCKPP69fAQ//exw+ncdkKqlY35AxDJUclAoN/QYhpjX4GiQkO7v8/HFB + T9h2VNBQNX4oDbYosQWI1Q5f7DDnCeWyJl3sDFcxh2DzL4neR28p4xb5MNT3rO0J + IrGIPVx+abib+f0T4RzcL+QLZb8ou1/odzGVMLoNq5q5SHOuskDODg2SGjXRSI2H + yqRGVG+N5D3JVoo/waiCA1CtUpIhStjeGNKbtLfM7LY4jshmU5n9MZEDF+7GMl8R + 7dhodAgWcGM1Fqyi/xDaryKgP60Tu8mFufmlcDGJiXR9BOmMo2z2JDBhVGU+LeIH + Favb7qJVwRLJKcFRPdIRJFHaq5eOLEVhRm83Uk06K0MpxLZNC4jiXQKVEPjEdcZ8 + CfEQ/x462LtI9Z5ArfF9H56gMSFpT7t+yPEKXAllY1K0E1mCy2m9NzkzjSHx6y+k + dAsL4xkIbw6Q+Zkaaes3GQ9TkR7vxx7RMk1BXjQp2vjkkeu73EYnHU26XyrL4xJi + slVkxCvbEORr9ju/I8Ysxsva3Bgz067v7q83LOl09kKen1VB5/9Cgxjt2W0xOBUn + WtxLorWU0mHm9BB5WtTQy+KnqLN0s2SeSyT2SPMRXZKF3T+Wwf/Azoc6vrB7m9Th + WnQVbpwooys5/Y8jZYat534b2jiUh2JeYB6lFSp3C2i7JsKxGSxND/DVSJ60vH7S + XAHSLkAKOu5hgnUAIxdCghjAIUx7MHeFAcb8S1QiFXenqUI8OWaZ/bI4RHQuBoZV + aC6dAObpp79LnuoCNCUEhgR9APh37mvSnKnqk8x3R+hIxTl0PtL1eyYpRsZS + =lMvc -----END PGP MESSAGE----- fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA46L6MuPqfJqAQ//VgmB8grK7tmBerMubQu9x9/ig086RG5IjAq+NqDZlwVu - fnRRhTb97/js/JdIXn+to0/pGwk2vzI2rWhcX9cLbRXVWqiLlWdDkpQwh0hAkHPD - U9CBm03TBJbsf6t9rA4ec+UGuMHBwKymw19c3TQpUtwtMxQpwUWsQemoCrzyayfD - ZhzVBL9skq0rGk2WQ3Z+qolGcFPokwwmh4Lu7gDOJyHUJYQdDXlZfbeNMv1/Mq/6 - atWzd9WrEpO3un7yu5wNzcUYtrCJuMEqRpwxf3fz1jNim6fYkmj7EMZcvZAEOU0v - qn+wBLVe5y19/W1KxLQ2hkUMhxsPHztOnvsYUNAiVNTfmCRlQlBZ+HvayNzMd81L - YIULOV5p7UnhOlPQhjwuX2LCOzkDRl4MKrbC4XNLYFwphPAn0v8SJ5mcb6a3w/5N - Zn4pzJX0+lT3D6Hv6231TVx5/AvtGYPs4YToM7drjl8pK8e1UHSdWxpiSJ87REvh - XyeEhvUoJkVhMc4pKWIMvlk5MkW0jDVCIiY41qnPh3CIF7NOOZiN5YpkPtl6kFJA - GkxS2bcLmuX/OnYkF3nsC77toEp0ffb95AyfGkcHIypN/bEE9P4DXIo98TZJCIXN - nq4HeDZVV9WmRQfpwEbYuGqxfTpM6LGl3KhXj+LJnktpMyYoEyX1bc5fB8cYDzXS - XAHhVdt5/wjsKTv/W8Nv+taOK2R+AD1QY5h2Bl97e3UoR0Ug3VdjPoLwZ/gFV/dO - ac1FMQhoA7P3Nlza1t+cSY8LvbiU30zurJtl/46JGreFseVpe0zjOKPMFutE - =2UZs + hQIMA46L6MuPqfJqARAAhPGILMoc6wjvefVN6MY1wrTnc5cghbic3mQl/81Td33a + 1vb0u2E3mU942KLI4a5/DL0FHsCOsuaO+HPgf5zPViGGrkAP+ze6Zll5SmMCu81U + /GIEZq9gkhy2mmtJ1OVSGVz7nG8Yvd4LYHaklAbveJnpj7+voR/mztZd5i7t5ISB + HTren/1TV52ZzUV9vaESugzd/Fb1iVnxvZDbuYjIpCpeGEwAvZ/UfFI9vbXUkugT + krbHRJfq7UPE9S46QVrtfZ2BBOo22U6+3gCzQtNZ5VySTrEksaP+PMl0V7OG+4+z + ih6NRN+4lZMeMvUZITz/kP8nvU6xuOXZ+ueRBi3SOySB3MH9txsA/avin4i3/JH/ + +axLWdkiGzvdWpHIKdtGh6knQWHKMjbkHyu09ml6YLsSdFWPtfOpOwtBI8WumWqY + S7qepU9X9Rd4c0152R1nSO05U4dhlnOxt84e8vLdOd+/tMZdCl2iEnWcHyvsI+6C + Rt7AIVrwumf5LYtxyJWQzBIcR6AajKv8OhzV39kGVFxuUue6RdJlXVjynZF3Zcp4 + 7MbEBjWZwvyTZYGF/tmvy3piNlhMvbFR4thJDZFbz7OD4Szva1XQhDmMYMO/B337 + I+vd/iG3rV+K1uZa14nCUn5tPc7ykGnuBMr2swTdvu8MUts18CEGml3rv3ox46nS + XAG3Gx179+MRrb0PppuXr6lNLtBqja/Zr90MM41bpIjzK7/iYYeX2i8DZfcymfQP + cn+KZK3Krk3R6TIn1dJP5UuKsb7WWsZVBXXsiUtixBH90Ygtoju+g1JIzDAu + =ZQbw -----END PGP MESSAGE----- fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DQrf1tCqiJxoSAQdAOVINvFeDv9ENq+KtuvoKb+CBxyMbcKUWlBtOZLV/Xx0w - GXeCnAwIAB99wxr4ewLrFq34yabVnNfJYB9uD4zcIgevZAnB1Tji3FGMll0gGryq - 0lwBa3Pm/dn0ypFFcNW9xksgwE2oCaGLZq/D+bJtW6UJC5tBZm3Y+MbqiwKljJk+ - lmzzX4rlSnx4jCma8peyAb8RNqpMO/ezo1jgNyGZpsjIGvQ2i1n4YHi0VqEUEA== - =JMjm + hF4DQrf1tCqiJxoSAQdA0t7VkYBD9+Z0hwHrW0OvjyminASVE/BrCcOD6i3t/3Ew + cKKiH6zB7qmCNElnd9lfGWCZ++67afh59mq4/MUH/bWzdE00TPqF7l5DhqdYOEkI + 0lwB5QrtYGtWddT1n2xiTSELkQY6EgwB96CXS7IEqCL4ab9J2mlM/NGo7Nq/UoKd + EzyZGlTbEiOvBnaP9razjSYWMVNlTAew7q5fTNXFyI3iXTbRumsxV58XC9DviQ== + =13df -----END PGP MESSAGE----- fp: B71138A6A8964A3C3B8899857B4F70C356765BAB - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DzAGzViGx4qcSAQdAVm9Q6YBrTtT6g6yuAa06+nPtYICDNtrxUgjNCcOkJ2cw - Pi/c9CTwfEiU2iWzYygpCslJxs3UouBu5nxzCFTQRImltBjVQymDwaXvS99HU2sm - 0lYBG9hfZH8Icjo9n4MlbnbC5WBLRooyQJWDnFpZ85n9C7vLY2AH2a/IqnRiwB69 - ufWmB/r3Z2Brez/XvJdWJFCybuShL+Wyr+v5uelxI1u4ztNxmKeqXw== - =9vzq + hF4DzAGzViGx4qcSAQdAs6OThibGPTtEdwj47cmmpL0vqA2NYrxbWzBILN6oex0w + LFQ37sijoSOWkTppVZPWZnDfF76A31ZrOrXqZJCzBGX6MjaHl9qSUX8Ew/318fKx + 0lYB7b7sU1scA6spas2j21e7hu8fBRWu0b+bNto10762aesfjOEAYtSBgd88PDbF + 0mEbs+9MFGkGeBVFg1HczJsR3KyvM+MMzsH+hQfg4Le9NoiQ7tB++w== + =W83v -----END PGP MESSAGE----- fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA2pVdGTIrZI+AQ/9FNudV+zztNHNUBER8At2+bo1n6W+fbF5bTSbudOXGbvV - rdSTWxFuslVh5kzXJYP2a+iYh/o815lzQuVtn+PmKuWCzLEYB0VmkbeM9YBEOxKu - R6uVUbI8xOLFLLErR5E1d1l4p2KRqEEfc9m3tzDa+i3PVOCYhD6qTuKhb6ImDIE8 - 3MqbXRnBBWgK14IivA5ouGJfeHbsYmeWjt9y5gy25T++Mdq9aPoHjjQ4P38eDT5W - 5lK0KcoAPAsrGkjzIgF6NBQr/Ut54RuHdjaBST2tyHP0db9fHwQZj7vfylHJfj6h - yi7rdjX9Ldppw2dnatVKlmpQATS8lLX1vAkipa2H/8kz3oYOJNPf23+8AfyhMs/X - XTXkC8Zw2Auz71TxFcdUXrO3Z9/BgsaS3Ec1TRqfzKbwficT8QP9est79XDxF7WM - 7WXTvCQJVofRquCWR+1h1EwSTiMRGRNV/Uag4hJI6OUwBN2fKbVS94S1jNkxCOX/ - DIHhijMVXvfNWPOkTjuaeXJPem/XwjjCVif2+gPbjYhuXySrlYJVQOrKzPROYIZ/ - uDKqhGZOE0Ng4xNyD/KZTBsoJVeY9xI1IBfMh1c4QA6vJNqU1vQW5pnyFr+N0srQ - kEGBc9dwNom2BjanosbnRORW6+r6BwwI1uPOQPlYUpumHM4o9jGu4bbBSPewOxLS - XAFBjjWtkZS+WP692phQxnXz8+gLc0RXD0UZ9+Gyho+X7/R8BV0x/zDoUgfVwOnY - OZeyd9YDL8JkL+K6EZgS9u+E1XCbRkbVVES06QNVxYHnEO5VbU9YuG29KZ14 - =nF2L + hQIMA2pVdGTIrZI+AQ/5AbMQlNWfcfRPPN139Rn4J8d+2tC4ict5PsauE388LLx8 + BDycTpjR3nyp+Jg95PEuP5WBngofjwHrn6b0u//T6wqAgNIYFbZRQzOzjRI2Ipgk + 201sV5YLK8P/TfYo8I032r9PIlc6xK9kR6OCjVrgfTPveNrNDstPvrlZHWe6RLuu + kVPInCHKWXppL9noE8r1OUpRPe5cXNlAWULrFE9MoxwEnn9GPRqj5HK2dpOM1Jvy + kEo+XNoqGK2ZBRoONRJwQ03FF/LeorDlEHS6RMuCgJxNHzX+JacJJOAH8f1bRRcd + 4dKvRZGLI472d04sPz8QtGl9LCBk6CwjLSSiuQI2r1vf00HSx/zDWRGKNJyjzyfr + 1eGZRjZdbEBQqyP738jfSGbHNkH/Io+uVlUTYXrifPBdc6rAACu7ExVkc6/+Zq7e + EdVv95GXUfvll+k4OSH9/zqF5io5OT5e2wei6KEghm0ZxaWcEtJn97WAQDM0TY4Y + TsfPoPagFRTbBWtw6oMy6POV+g+efjxPsg2KuY/ovsJ0/vbsW5DlC/t8/DLKyPgT + CerSNLwr7EzmUfMUZD55PBMIu1rCja+UJ3mrXTYUhPr0G2NPBynl3O+BnVQl8iTC + 19H5aH/TZOxPqhPWzjXRCpxVLSUd2VTN3myfslfQfO3NXt43OS79wnoet43ezuHS + XAHzLeUz6Zs8YD2YpYwbAPlarFRN6S4s5WhMY3/YPsLsrWN9eH42KuYpvLDemRyn + dJG5YT+0dOE4ZQxz5Lwc+xKPFrbBKHbak5pykDO+Q4LS7Eesog1NEQ8So3k4 + =HMER -----END PGP MESSAGE----- fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 - - created_at: "2026-05-20T02:10:23Z" + - created_at: "2026-07-07T22:14:48Z" enc: |- -----BEGIN PGP MESSAGE----- - hF4DKKbvh61jX5USAQdA4IyNdJ9IPWLBxwtMROgj+/ZlnMLCdnjXBMmtyrkRxFcw - JLp+UagV5UWX1KhddjhiAHbAa5OrIQsBZrJ75XIObCzlVMmj07CtUpYgLNsTiLVS - 0lwBrQz/Ogp01HETxMoMuGc6VdNvYBrRFZE94pK/KsMP3DAca2MXGokc0hOnk4WT - /mNoOxwCE8ph7H2T//TM0lS5DO1S6ytRxm6wrT7jLu1qkMm9EjW73Nr7Mb6HDg== - =9XH1 + hF4DKKbvh61jX5USAQdANgMJk05gSevKHsZ2rKCnIvo7E/8a580pWclaJA+kWRYw + PE//9dr/VKmnZhWCLwSDM54NnIMgfMwxr6POS4wibOLExW+nvm38ZcKyQQJlRHrg + 0lwBfTonVmBXBQuVieavjwu0rTn5msed8esmOKrC0mzpmu8juFijhzPMelW8z7Rj + uW0zM32lrpoRvASz3Oa0dS1dbN/vjYXGhP1wIwnpTZbsOzxPPsmkBPyegoHaaA== + =hfXP -----END PGP MESSAGE----- fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 unencrypted_suffix: _unencrypted diff --git a/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml b/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml new file mode 100644 index 0000000..9c05b12 --- /dev/null +++ b/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml @@ -0,0 +1,218 @@ +ansible_pull__age_private_key: ENC[AES256_GCM,data:moFPOIyQyFs7Js0sNjlV2Qdr24DdEYJsngDNqsiVJEIiu8mJS9qE9xdXozUympR99NF/dOgcsiBXmSSb4Bhv99OKZp8Kfto/s4eUSx4=,iv:biRudbCF5mdXnXim1p2N+5w9F0z3M9titSVBNJmDXwM=,tag:ESOBA5urjeLdUvTkUyDDOw==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IG1sa2VtNzY4eDI1NTE5IElJdEwzbTdB + dkRDR0NsY2sxNm40aXcxTFVGYVNZQ1QvZXhLK0dWcVR1eGJHZDV2UjQ1M0tmY3ZO + NWdCTUFVNGZRcXI4SjJzN3c0OURKcUc2RVI2VW84dUFrY2gyQVVVZ0ZncUxrZkZ0 + WkhtcmRwUHc1K3JaNjVHQ0VOYVpKejJWNXV2SzlKS0lnOTcvNkg1am56RUdkS056 + dnRtL3lSSEVRMmg2cGJKcjhZRTRoVm1jbVFZeE00VUd2dTlBWXZVZmw2VE5DdEtj + eHRucXZHYzgzcVFJQ25iT0h5WjF1bEI0Zm90dEtTRWU3ejRmaXI1SGtQK0tsY0Vy + T1NCU0FrbG1Eam1FMktQWndDckxqOGErTXU3UjRJM01HbkEzKy8zWC9Ld2lldUhV + MVhIM25rN0tpNGp4T3FITU5MVUhjclM0S0ZTaVVrR2hOanB2YVZWdS9TYU1ESUgv + SVd2ZmJkS3grYmRCaUZrN2xvS2xnZlhiclRoVEFOaHB1RE9WT2pwLzJKbW1XYlF4 + TStkbk9HRXNjczNDMThUM0xXelRGcmdwRGxaNThjbE1Td291bmo4TjVEZ0dWSWNK + SStBZTlISGNlU0Fib3dmTTJyMDZaNGZYVG13ZWlMWXpuUEFQQjBUa0VJc2ZhQjZV + bktYdCtKYm1QVXJaL3JvOFlDSDgzNG1EakpsMkcvSFg5anV4Tk5GcHl1S2hWRnFW + NjFFVjJMM0xMYTVRTks0UUR2ZWZuYXlDcElidURTQmVFalB2WHNWd0JnN01XajVN + SUs3dWZSTUhZZk40NXNEdk9KM3RrNHYwL3pyRzg4eXVuMDRVR3JHNWMyTVE0QVRD + dHFzTEJxMmJUMmNrQjRKMjJRVVZGdWV5bnc2TTFCbHBleEtBVFk3dFQ4cGhlaEU4 + eG5KN0VBRVAzKzFqb21QWEZhVlNENVBDRkVoT3F1c1ozalpyM0RDQzQxc0pRaWVh + bzd0ajJobVV4bDllT2hDRTViQ05wMktXSzRReUE1LzRkMWU5VFIvWU4yT0QxY1NF + SjZaRzZOU2VVUnlNWklkRHlTNy9oc2ZyczdkVSs4MUx1ay9xMTE2WjkzNDlybGN5 + YS9KUHNiek0xMXQrekk2b21hK2U0UGEyc2YrRE5jdmZDT2JIVkVpeEpEMnlZYWJO + RFM3SVFwanJEcmpZNnI4UGV6KzFHKzluNUN6KzRLRlBBRFpoUVFJdHpFMVBUdy9l + R2R0VTg2QTJRNk9xZmZ2Rk9mSGwyaW1NVElraUVJOHlaT2NNMlNNaGtpc3FVQzQx + RkdkMEpoYjZsYzk0bUU4c3lpREJaZHV2NlBqWjNzL2ZNZmljazdCZzRlZWxmR1VN + eFlnQWlVbnhza01ZdVZRR01jelJZWEx1NExXbkVKVUthZndtVjI2TzFDdDZpbzUx + ZGlLSHJCV3BGakdlUENBZDRDUzdRTW1DSnk0TkYvdy9SY2FjcVB3TDJZc2c0cFBP + bGFTZEhkOTM1ME9vdmZ0YjA0SlR2ZXlwZE0wKzJQbFc3M1ZOUEh6OVVsM3AxS01E + U0tid2dHMmZnV3NGaUpISHBVTHU4THZSejVUTkN3dk01Y1RMUG5KTkxvQlV4eTVw + c0VGYlRGbHZQRkRnR2YreS9XVmVBbHB4V2llNTlybVVlcy9XRzB2aFZLYzJobGN5 + Ym1TRHo0WVJjaHpsTkRuWUN4cURjcmw2ZEZBdXZYWE1rZ2Y0SDU1K3JML3ZDeGJJ + NDhka1lHN1lKWkVIbWwxd2VWWXc5ZTZiTFBCTGtITnYxZVF6WjBOQUhrTFhXWm5E + a2xCZ1ptVWN4dkF5am85bGovMHU4NHcxczMrR3ZiSU9lRUZRNkpIVGRJaGZ6c1JO + Tmk4QysydGJISDVzNHRiMnJXczFXUzFqRjVCTGRkNnBIS3h4Z01yeHlHODJxRzZj + d21zMlljOThZTUQzdGsweE5wSDlRNlFPelp3dHZFd045K1ZOVWd3YTBrUHFBUQpt + dWdxc0lxK0JqOE1lMTMxb3AvOGcxd3Q2VHdtaGtHMW5FZDl0VERZenhjCi0tLSBL + a0s2Rm9SektBejY2bDR0aHFvekQ1MXk4ZVJ6ZzZLNFljN2g0QXQwM1o4CsinD2qM + T72KtziBIb8L/An7xABTWPsNSKfp2n6ypnqy0XZ65jEZ0Xe8B2my6PDk7vihbLAi + 1U7Q2Eo+C+Xq7OM= + -----END AGE ENCRYPTED FILE----- + recipient: age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76 + lastmodified: "2026-07-07T22:15:31Z" + mac: ENC[AES256_GCM,data:CrH4s1yeMfK52Ltl2mnECvC+bzcedGX4FKV49shX4agp4xB3cNaIvp8++qjmJaJMMcC1Ab4ZGEMBniyRoS/e4tJwSZ0zos+MIwgEHLxP/tCrsxdSsrSobQuuFj1bOvTYO9USZ706tGOG64tpJSM5WpR0FZ98kPRxiQyY0TNiXWk=,iv:JyZB2ko+tJLw9TM0ozXh7r4j4i2eUz18QGjvxVCxOPo=,tag:7fsnFkGV608dscAAoc/nFg==,type:str] + pgp: + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxK/JaB2/SdtARAAlBL/0MsCmwYp6yV/9kMP5+zlMd+RA5wqX9t7EYhHHEoa + klhscRh7m/417PHAyPKoFY/6z4AajhssiaLS5pJ5nRYT52EEjHqGKCaUREKKqeA4 + DbTfTwWoVre+Fs8ukT+/rE5el/w0O0vX6/G2dGXZH8VgvXW2CpYKFmm3gqVWM97d + Boma+FBZ9QV3E9GUwCG1oYdpdWAE73MCy0poXkclWHwDNFgxh930GjlSry3aB3i/ + EprRQZ5VAN/aaWznr7eewpITVkWTDCtjeXLbgLhk56Fday5VOSMWRhsiDLOEc7c/ + h8YxDMwtUrlRZdAy4uXt1O9oPBKAalZ1XU6Fi89mA30jh865RkPL1306G4qAv8xp + qS2NQ5c8ZgQ2ZmRWgtBUae/zcRl31Wi5SpUUWAC8iHYYOECo+21fHGpipGBEjTTK + bWuIyjq9mzJsIGCPkV7+jgIxQ/HSh2ZboHF8cVJA9OXXsNhMIiip39fzjpPHdgBS + 6/g48mzcmnaWX1VEJBmR4BnEcnPQTOlZuXSldnl/RMLCntONBRhDUk3kn0gfvbO2 + VRXjwUTgHTHb2+gfOiAloqvugOsCnuO5tUF7JUae+cPYBaP6hzvc/8rQ6181nq7W + 039OmzD6sT3ixZap3qv3KkfCP2Xurg/OXxDadxRToBP/N6V2+yge0rtBUV94fYzS + XgEFrlQ/wSncX6szebjJXXBWHeAIXSW5wRjJkfzmUFexb6M3/oRKIADZ7Q5o8VQD + w1ijdz2dPoDtGfqwu3kUU7q2fls8hAFeC1muANnz/dMoZZTFzu+OdHvQLn7knZs= + =FzvD + -----END PGP MESSAGE----- + fp: EF643F59E008414882232C78FFA8331EEB7D6B70 + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQEMA1QflAioE8i3AQgAl7ei2+TDXC7Nu7hxpC02oVrL6I94x0z97nR/K14QELwr + zuwV4LBIlkBcALKtpU70ywvaqfraSEnbax1CXtTVdYojnZ22NO0FmetnNFCr5zT1 + YFyMMsgsGx/+RVkhe+hPv7Jm7zHAusHwyip9q+ZcvMKuVmjBV06QmGPkd9gFKS98 + EHQbwUhC7rrySo7ctHT3/8YSzV98zJZHh/VFmEDWRO6zNfMmsQV+IkX2IXqxvsK7 + CS/c+ugKLDHXYKJMVmqvNuyVr7mzsE0cBuuETEGawBZwk4jXzJxQY4yHlshuyQjk + PkdSlH3UUArwurhvZvjWyywRNT/EI3Q2ylBujsD2edJeAeCMOGuP2pLt8fuJcT7g + Cvqrk4jrfqwNrGWblD0Z5o6FlrPXfKDIRIEmgTQHgxplTCqcCqc61l1iEcbuITtq + giFCUZlN2GCG2d/C5opDG+p0dBGcDxq5lQ4KkJ+NSw== + =dCrs + -----END PGP MESSAGE----- + fp: 21C9579E6503CA815A68ABD8541F9408A813C8B7 + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAz5uSgHG2iMJARAAy5wBkzFMf7HhDMBLdmBOPAYcxtDI6KTfvFejY+/26rnD + s8UZX6H25b38vwvsWhc6Qx0+T6imo/qNTgvqaMaL51kJk8hrzFLI7W0iTOMDo0ow + XWUJlv4qA9XSXCNBEvSOfffFYnZ5c1wJp1KiHfbye1yfF40w3kXD21LcogTKjEdF + EOzkIn6KVXfqJXuXVy1d2YdT1dZKguUEoMY+IAT+Blvhm/mbLDlRyX2ibGOSQRaX + pM+/Vy30ioEvCvbka00sycLIkhMpUTHUG2+OGuNxJZPv9lq9FpAaoO1cgJk0NWLa + Q5hzPoEGxA4SPE9SajXLE8IqSop/VI4rcPPxi/JDn/EDUpCGcSJxJV1GVHfs/xvy + +kHcl13Mm42es24008WwxOnGVCJKvWJLPozT29JrGmMqKZN0NYfSAHFUzILBkrIw + Lbukx4E2KVM7aGxm9qJtnc1SIK8WeVgDCnBd1ktzB6IZk2iq5xbLxW9XQ6O7bVSd + Ie0c+vaG9tNIvK0y6bCLwcT1C/8PaEvCvmGhuPVOWq/1bzHoNA6jxyEJEQZqTRlZ + uUgE0wkpuYw8884bnicrRgOZ7UmK/r7WCGs2zLBq+lXkGSCLvnZWuc7rtiPtVtUX + 1uizEERC8Slj7ovt9L7sG6YabCfUPpSevcw4ZFJuPLpotOWt29ES0lO2zLJmxmDS + XgFdSep/pNxa+lXtOF1lG5Y311tIe2bhY+/QBXCXEsl6CCkiMIAXHrflKEawYKkH + /+9Fix86UW9TcQFjC3f0mekxa5OjhtBoVY8y4IqysC+H5neOo7uBBLgTyPiZ9H0= + =1QTh + -----END PGP MESSAGE----- + fp: 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5 + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DsZXvxFXTXoQSAQdAmFbXjxmh1e91bblV7z0ixYgcdsXbNe8OcfCtNuRv+WYw + 8xK7cUl9GEcCpCD9BKVD+bQlcW8SwSKwTzQipZzKJdHtJ0OTf4ytTu3axKCOBC2r + 0l4BMtZZP4eZAutf2JwFEZgNHRBaSniLVBFHgR3YwQnRH11ofqeq4pp8+jHJhV8s + SA2SE8Ph4i9/MSI6dfmZzPCwiitG+/zHb9/68kgYml9NKpIUAHoKbY38GiMy9xow + =KMco + -----END PGP MESSAGE----- + fp: 9633412309CCB83BFA39BA5F2FEF746201D7FCFE + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DerEtaFuTeewSAQdAj+DsoGtl/2lhiGDkDO75FxS4fJiSRWSX+PJJvpVroSMw + 1e9Z6W8eM70OUxXbPc6ZTQADBbWUylmBzr8effZ/j1Tztl7T5GUEHfXdub+9ZZ03 + 0l4B8f+kLl2T6DsmFB5VXIe3WFShVrJAH7qG1Ig1YTO7x7JnuD6/hS8ku/qCt3RX + MBAhv5wm9QpvtZMONFVWZR9ItqUW7jXGPseXzc7OfbZp5VI2grCLKCML7vjrc7bl + =NVUO + -----END PGP MESSAGE----- + fp: 057870A2C72CD82566A3EC983695F4FCBCAE4912 + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMAxjNhCKPP69fAQ/+POtJNVm+mKYT0ghdjM8p1w0yIuRKw8xsGJ0ux7ngRZUB + nAJKI3iPFuSLxTMIuGptE0UCiY59V4C8io2L850CGdYoFMPgE9XblBUmUzeRE/ab + JzzWgjfmxEWJhupKM3QMeHVvpI/BL30/cCFpLfcDfRi5AEJ+TvRcg0e2FSg8VaiN + cUr8A5dgX7KfrBwv+9G6N6n5Dn/LTayjo4Pox7PCvWHqJDVfisWiJQCvdT5Pj5+0 + W59A5C3gt9vdDiBJ5N68CiduGUQ6r3m353QrebvnOo6SJNWW1z6GtXN0+WeT2uc9 + nIzOqXVC3bQOFF31cnX98U8gHau2//1Xg4QZkQUyrZxLG4jufP7qD4sE/Huk7e3e + KonzLo9KDQBMxjrqDT5KAcD2Vb75MCwPpLkWID23lHhPQ6dpRroBKslqU9X5TW4x + M3V5UC09XSVMZccOjChqOL/lE1BTjWDhtUMey9IJ8ob/xNpbmHTEpGUZcA4yteme + y5KmyYEOFhALgNUAepsqr22YH9+mGAAdVoXKcsSMx7ilNWaxY3Zsquum4kyWnuyI + hJtgyb+se1Zj4KqfbSg41faN8k9FQHLYlBpdhYwWpNf6mUJtF84u+BP0NtG58s1J + 9iSVwg9g1RjVj9NVr0vhi0LWxGCKOdE0xZj0bkpd3a6OnhVKiil0u/ZwwwyZxCXS + XgF+dZtHIg12bB3kwQWkvlHRRdlWWWjTrzQFm6fxZ9ln+ZwwrzivSW7P5Iel2dqx + 8gryMssJZYA0B85OKH4tzsxLDvTlJDcdPTneYRTkK+Rhr184PWcFJlwshAvK6sA= + =cTSV + -----END PGP MESSAGE----- + fp: F38C9D4228FC6F674E322D9C3326D914EB9B8F55 + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA46L6MuPqfJqAQ/+MgoNL2xv83PWouyvSxy3oK8W5Ktt3PgRishl6SIUtPu9 + 5787cU+8I5z6WOKJg40BBlsZH4FD9w/ej0HzRJEfWnm4Oy7rAAWyeXHvh2KudxXc + 2hHSHpaRS/hbO9LPgCFZ0fh77nCKigd05Oqav4pbQusbiE40A6Oz0F7Fu/da8jXZ + 4AWeFE6e1s6IAinwGWqU/Mig+h4dLipsjUBN64unS9NXD25Tmg8WcNFl4VH4W9zw + fuszZd8cro7pu/GLIqtUotf8MHSnF3XoZcWOmleiApMJlpTmeCIuWQEn2DCMziM3 + LHzmI5s4y8pZOFSgR+ozszPVPHOhdCDdpTV5mNw8njljEIm/BjYbhaL6EXUaoWuU + 1G1T4CYvCl0GHFRNxpJonigH9vLPKK8H7/c2+FTKkMJNjcjRf9xWUJm9CCShFyAJ + k+19quPL0lHRz+vh1EEqUPuCLDSDvEPkNM5ZKkq2PV4Un6nml+OqLLUWuxWiEzFd + Zmu/+ww7GL7msxgfdIuBm5tqxG03pl4QE5aZDDQYBLYiXXok+3dP3ZTXKLU/iwsw + hdjecaQymqHSTNKN/0cFW+08sKKjlI1dpTsEKC0KtUATwOnc9c/f3Z5cTl78a2Gd + a5Oib9N/yZ9Ec8EWNAQZvZlVvnvirujb7iu5g66T5PVAmi3vvJXTV5ZekEmXb0HS + XgHoo0biVdvjLVlqA8BOkVpNCnMhsNC0ccoW3QK7+H4Yl2ytaDk/fXF/fsc3ZFwu + Xg1M+CmsoRA3BgtLsLpjc9ibH1zw9P4pYJGq90PC8Qp5uq2C7KU3UgS5Y5c1WiA= + =Uk6Y + -----END PGP MESSAGE----- + fp: 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DQrf1tCqiJxoSAQdAInOGTOBg8qS9hDUqOJwNiu68zpxikVgCH2X+tW7ImzMw + yApo0haLTfw5xlQte7aMIPmZtxM94bzoPaU0i5hXpql7s8Wn8cfrjosceh/xu1Qu + 0l4Bu0YljO9Ehx/5SlxhP/mhC/tGigmKy4z1hLdUuUTSSBmZ/DejYRjL+nGI1riZ + K3A9fHW6hztj0kELKiguR9rYVvxpny7/NX/3Dze1NlwHcTSKT5l6yDiwCpd/8Qi+ + =mAcm + -----END PGP MESSAGE----- + fp: B71138A6A8964A3C3B8899857B4F70C356765BAB + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DzAGzViGx4qcSAQdAN3UbYHJEWKRYalqraIlAc3wSgTzzAZbht6TIncNOg1Aw + kIgZ1xlQiKE7hJ1piZZx8ZMNZHy3BSgbxZ+a/ieknyULAw8GZsOzo8LDrLA4SJgL + 0lgBWDTbNIM0hkouonaZZSuefuU0k7fcqFFtHXw4jkFNfi+jimx11LpGsRbTJzIr + dMoKp1JYyxWkagZLBGUGQ4wyYaWEKduSb+UlBsonnIdehjuLR6uYFrNj + =Lj6l + -----END PGP MESSAGE----- + fp: D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA2pVdGTIrZI+AQ//dvJKQU2EQGPUBtBXuVgMHP8yFMQagCDKM1sTJQLNWgz3 + 86Ey3XatwPw0YGYOBgqVyxe+XYG+XQUtfPoTo2oius3HyqZcvkb194QG/h5R5Tpa + +zMzLLe/YgENTkLcfRB/BStLyzzwv8sTQiI2RLTb3jX80PYCYU5VzKhz9KU74Nrv + l/TJE4fELFih164yt04Xqm6jAyEraJu2SavxZvyLl97driEwLuwfRMXPnjeaXkiw + Yv850rmZwF72b08F5Vw3Le1HCm2pRaTpw1bm58v4PNSjTuGThZKoYWToYrCDApHk + 1we0N6lZu2AOtXsO71PYJYWeyX0EHb9Ye6CG0TAsJ8Z5iM++Z9mZ8mzdMCbPoMk5 + srdKo6mT6y0HodyyRC3zcqLUGDFqq0ihcHxmaWCavFxpTEjC2cbLK/punklIS4e7 + IQPX0Lth2JB3VsGS9IXYqm0FDw8ldshAxBgtNIYoV6xhIAhTofQyH5P5fEyAE28n + uYW3v5V7qKRhSidIj19Etwu885OaWlo0XE0hapYffQZpA/fGDOZenf+XlbMpYePZ + E2Rj68SFq7S6xw5cqA26vk+4Dab5TeJ9PtI6RjnI7+Sqj0CLhrUzDLjQjrCZuAWY + GGBzWz6vP249G/sJAp/DClo1PsdIqyykkkRM/An5h5xUJXUkIB6+Ia0bCsupn4bS + XgGfbBBt1LgmkdSrHubLpAJ39W/uRfO0CbfXW+Btm1dxffgMxEh8WKkByoDEHAzu + kCEZNerjPRP5fpj5rDB0dq1H46IXXtbLZ48yocuhJWke0Ywmztjxffwxtu3nMW0= + =HrwC + -----END PGP MESSAGE----- + fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 + - created_at: "2026-07-07T22:15:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4DKKbvh61jX5USAQdAvj+VoDF+LUWyZlvdPNDEYZ7DsrNiacFlI1rgID+kHFow + yqbYk26DVNGfYlxAihq1wAKlMLQ1U1+VGsQANGZIz8OH9NhvhTkAwpz9HLHtdmtq + 0l4BdyPumBkzSOz+oWcVv+iOfINONOY2+ms8+X6lF9hBRWFeNIjxZOI/YE8JjIp5 + DrALA7UgZxCXJyQErNbxF/HLCP7aPBvYkd2lCz93TcEQLEtAkG82cNrjtIVQ3yxg + =NEpg + -----END PGP MESSAGE----- + fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49 + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 30072c8..95358de 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -97,6 +97,10 @@ all: ansible_host: forgejo-runner.hosts.hamburg.ccc.de ansible_user: chaos ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de + forgejo-runner-external: + ansible_host: forgejo-runner-external.hosts.hamburg.ccc.de + ansible_user: chaos + ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de hypervisors: hosts: chaosknoten: @@ -127,6 +131,7 @@ base_config_hosts: mjolnir: auth-dns: forgejo-runner: + forgejo-runner-external: systemd_networkd_hosts: hosts: router: @@ -240,6 +245,7 @@ infrastructure_authorized_keys_hosts: auth-dns: lists: forgejo-runner: + forgejo-runner-external: wiki_hosts: hosts: eh22-wiki: @@ -275,6 +281,7 @@ ansible_pull_hosts: mjolnir: auth-dns: forgejo-runner: + forgejo-runner-external: msmtp_hosts: hosts: renovate_hosts: diff --git a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone index 61efdb4..96df321 100644 --- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone +++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone @@ -515,6 +515,7 @@ diday-staging-runner.hosts IN AAAA 2a00:14b0:42:102::16 public-web-static.hosts IN AAAA 2a00:14b0:42:102::17 forgejo-actions-runner.hosts IN AAAA 2a00:14b0:42:102::18 forgejo-runner.hosts IN AAAA 2a00:14b0:42:102::19 +forgejo-runner-external.hosts IN AAAA 2a00:14b0:42:102::1a ; acme-challenges _acme-challenge.sunders CNAME a5ee8a99-3cdf-4212-972e-c0b6fda1242f.auth.acmedns From 9ae16363c553f1bc8affb1fb3a564eafb1329be1 Mon Sep 17 00:00:00 2001 From: June Date: Wed, 8 Jul 2026 00:42:50 +0200 Subject: [PATCH 37/38] forgejo-runner-external(host): configure forgejo-runner setup Configure connection for the DI-Day/website repo. --- .../forgejo-runner-external.sops.yaml | 5 +- .../host_vars/forgejo-runner-external.yaml | 1 + inventories/chaosknoten/hosts.yaml | 1 + .../forgejo-runner/configuration.yaml.j2 | 52 +++++++++++++++++++ 4 files changed, 57 insertions(+), 2 deletions(-) create mode 100644 inventories/chaosknoten/host_vars/forgejo-runner-external.yaml create mode 100644 resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2 diff --git a/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml b/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml index 9c05b12..e6bc00e 100644 --- a/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml +++ b/inventories/chaosknoten/host_vars/forgejo-runner-external.sops.yaml @@ -1,4 +1,5 @@ ansible_pull__age_private_key: ENC[AES256_GCM,data:moFPOIyQyFs7Js0sNjlV2Qdr24DdEYJsngDNqsiVJEIiu8mJS9qE9xdXozUympR99NF/dOgcsiBXmSSb4Bhv99OKZp8Kfto/s4eUSx4=,iv:biRudbCF5mdXnXim1p2N+5w9F0z3M9titSVBNJmDXwM=,tag:ESOBA5urjeLdUvTkUyDDOw==,type:str] +secret__forgejo_runner_codeberg_diday_website_token: ENC[AES256_GCM,data:RDXT2MfYdtVOBIlSrwEnfMQsxKOaloinKFNoXT1lBHrGac9E7ayQOA==,iv:ljt5bELla9rb5H4yhCarNav5qcj0KR2yD66KTKYBVqs=,tag:OZ9G8vS9Wt5/vk34nh6sPQ==,type:str] sops: age: - enc: | @@ -41,8 +42,8 @@ sops: 1U7Q2Eo+C+Xq7OM= -----END AGE ENCRYPTED FILE----- recipient: age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76 - lastmodified: "2026-07-07T22:15:31Z" - mac: ENC[AES256_GCM,data:CrH4s1yeMfK52Ltl2mnECvC+bzcedGX4FKV49shX4agp4xB3cNaIvp8++qjmJaJMMcC1Ab4ZGEMBniyRoS/e4tJwSZ0zos+MIwgEHLxP/tCrsxdSsrSobQuuFj1bOvTYO9USZ706tGOG64tpJSM5WpR0FZ98kPRxiQyY0TNiXWk=,iv:JyZB2ko+tJLw9TM0ozXh7r4j4i2eUz18QGjvxVCxOPo=,tag:7fsnFkGV608dscAAoc/nFg==,type:str] + lastmodified: "2026-07-07T22:27:10Z" + mac: ENC[AES256_GCM,data:bxgvYhfbWMQKhLhPbhw4GO5lbEBkdKHtf6kzUrZZ9UEmcM4JHfbX+RvtDSptcI6R3HOEwEzqVc6UUfvbLMaHgFzWcJP+Xl/5hghd7sauO3YQ7c6hRTpEHDRdBMeUvEO9Xcui27Gi30sSL8QMizkEenvVbdVtyM9bsfbwWHRwE/4=,iv:PbJ1sKqsuQOZqyl4Q3ccSyfx269gGlTAuwiEsxoYVpI=,tag:D94E/JPqnOJ3T6salPzUrA==,type:str] pgp: - created_at: "2026-07-07T22:15:14Z" enc: |- diff --git a/inventories/chaosknoten/host_vars/forgejo-runner-external.yaml b/inventories/chaosknoten/host_vars/forgejo-runner-external.yaml new file mode 100644 index 0000000..d260d05 --- /dev/null +++ b/inventories/chaosknoten/host_vars/forgejo-runner-external.yaml @@ -0,0 +1 @@ +forgejo_runner__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2') }}" diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 95358de..fa88b1c 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -292,3 +292,4 @@ secrets_hosts: forgejo_runner_hosts: hosts: forgejo-runner: + forgejo-runner-external: diff --git a/resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2 b/resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2 new file mode 100644 index 0000000..a83fc51 --- /dev/null +++ b/resources/chaosknoten/forgejo-runner-external/forgejo-runner/configuration.yaml.j2 @@ -0,0 +1,52 @@ +log: + level: info + job_level: info + +runner: + file: .runner + capacity: 4 + timeout: 1h + shutdown_timeout: 30m + insecure: false + fetch_timeout: 30s + fetch_interval: 2s + report_interval: 1s + labels: + # https://forgejo.org/docs/latest/admin/actions/configuration/#choosing-labels + - docker:docker://docker.io/library/node:lts + # Provide ubuntu labels similar to the images running at Codeberg. + # https://github.com/catthehacker/docker_images + # https://codeberg.org/actions/meta + - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest + - ubuntu-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04 + # Alpine + - alpine:docker://docker.io/library/alpine:latest + # Debian + - debian:docker://docker.io/library/debian:latest + +cache: + enabled: false + +container: + # Leave emtpy to create a network automatically. + network: "" + enable_ipv6: true + privileged: false + ## Something like this once gVisor can be used. + ## options: "--runtime=runsc --mount type=bind,src=/etc/gvisor-helper-resolv.conf,dst=/etc/resolv.conf,ro=true" + # Leave empty for default /workspace to be used. + workdir_parent: + ## Something like this once gVisor can be used. + ## Add /etc/gvisor-helper-resolv.conf to valid_volumes to make the bind-mount in options work. + ## valid_volumes: ["/etc/gvisor-helper-resolv.conf:ro"] + # Leave "-", so no docker host will be mounted in the job container. + docker_host: "-" + force_pull: true + force_rebuild: false + +server: + connections: + codeberg-diday-website: + url: https://codeberg.org/ + uuid: 9e145f54-2263-4fb1-8151-9efb205f88d1 + token: {{ secret__forgejo_runner_codeberg_diday_website_token }} From a35326a065a27c89a4b8bb1c252d93d8d63041b7 Mon Sep 17 00:00:00 2001 From: June Date: Wed, 8 Jul 2026 00:58:39 +0200 Subject: [PATCH 38/38] transmission(role): running the handler should always report changed Make ansible-lint happy by specifying that. --- roles/transmission/handlers/main.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/transmission/handlers/main.yaml b/roles/transmission/handlers/main.yaml index 781f442..2a8d98b 100644 --- a/roles/transmission/handlers/main.yaml +++ b/roles/transmission/handlers/main.yaml @@ -1,3 +1,5 @@ - name: update transmission settings ansible.builtin.command: /usr/local/sbin/update-transmission-settings become: true + # When it runs, this should always report changed. + changed_when: true