wip: ansible pull

Also use this role instead of plain ansible.builtin.reboot.
This is in preparation for using ansible_pull as we don't want to have
ansible.builtin.reboot fail local playbook runs.

inventories/z9/host_vars/yate.sops.yaml

@@ -2,13 +2,16 @@
 secret__yate__sip_trunk_epvpn: ENC[AES256_GCM,data:BkdNaCooUjsDlCXJ,iv:saO4IGsz1HAinvW5ZGAMA4WEtBbo+UNdfBkr0g29uag=,tag:t8RM0GNYhl1w/RMNO8wKbQ==,type:str]
 secret__yate__sip_trunk_fonial: ENC[AES256_GCM,data:N18C3XZHIi1/IA==,iv:vs9dCYNRp+1ptxRajdUO5ODTOmNREJslF99xnFL92XM=,tag:IUmnlPeRI1WTRYELzZRk/w==,type:str]
 secret__yate__sip_trunk_fux: ENC[AES256_GCM,data:zcVxNjyS3BE2dw==,iv:Prmy8nP1yeFrVI5mQaPJPKHGFCzuZp84f6fH04I9zJM=,tag:X15wqvaaifMU2/kcqLqUZQ==,type:str]
+secret__yate__sip_extension_ewerkstatt: ENC[AES256_GCM,data:qbatVvfXZiUcpVnOJUpzYw==,iv:E/fCmKGrwYvQP1gGvwT0UrL0DZ/PcMwKG+NteiukB5M=,tag:PFmU0DX56+IbSQqMtY5NSQ==,type:str]
 secret__yate__sip_extension_fritzbox_analog1: ENC[AES256_GCM,data:+ayQ6P4P34D5hTNOFv3HVA==,iv:UD71G07Z633mDmvnJVei9SKgHyM+JFXJdtOhyBhvKGY=,tag:0ISsYGQCIMMgToLWA09JwQ==,type:str]
 secret__yate__sip_extension_fritzbox_analog2: ENC[AES256_GCM,data:DbFmTcZ8wW2fqstm09yUWw==,iv:jKUqtSXaGF/QpIwPJ6hKQWZvv9xtZeIQBiPHt2xm+3I=,tag:MkWzODFnWZc8o+pVLR3KJw==,type:str]
 secret__yate__sip_extension_fritzbox_dect1: ENC[AES256_GCM,data:87MFTNA0DXmfhesT/M++ug==,iv:qDM8HWZhG9FADLFNPRJXkadN2jXD6/CfroDShNPzA+o=,tag:Ylf56nCczEdDaOGko5GrBw==,type:str]
+secret__yate__sip_extension_fritzbox_dect2: ENC[AES256_GCM,data:KOUKexyzJqZPj1HKJxFl4Q==,iv:OCChQmSF1s8C/VYuw9D3hHA1CAoCnwC4adyTpWO5Iac=,tag:VFFuYi5Nd49ChU1Ki/nHiA==,type:str]
+secret__yate__sip_extension_flausch: ENC[AES256_GCM,data:eIieA4A/ZmU8e7t20xwmCw==,iv:oDMgZIjQBDcwIVPK4/qIT1HyQKc+vImdr1iPZE1LEn4=,tag:RgS+enGC6DP6dwE8u30a6g==,type:str]
 secret__yate__sip_extension_legacy: ENC[AES256_GCM,data:gC43eKUOAYU9dgNV1JQ+nw==,iv:xN7aad2NPaihlMT4Ym2xanpKU4eX04V0FS4m6XRgZFo=,tag:Oq0yBCSf+CB8Xkx4D4TH5w==,type:str]
 sops:
-  lastmodified: "2025-07-11T17:10:24Z"
+  lastmodified: "2025-08-02T07:43:00Z"
-  mac: ENC[AES256_GCM,data:aO2kEoKvWccDkF9lnaNeoBWfgUetZ3W4ImappoPU4emLpWMtRGWFiKUbTwQCbLGBdQ/C+Dk0bZYV1wJjotmSIiEyPzijINX+d5obH7Gm2XSkqFHGlz+XnVg11PY91enBbHSQTiOyCzS1Ez/xWAVdztTHWA5r8lhaojmAHSe3UHo=,iv:VAEnZscqlPmVuEypiNRdhfGoooGa1qet9FBht/NNUK0=,tag:o2Q5GsHRS5GaZuQm3chZDA==,type:str]
+  mac: ENC[AES256_GCM,data:Irv3y4/QbofyM5BvE4h/T6zNF3A6oTjDssMOcqmGxUOGpqL11Am1DMHBivkUgEYe4ir9N0kvPUmed1XOyDwImrl06E1mGAT6hOlfVSYKtZP0Pwvi4VVeeP6IAYN56zu8k4X8oIxv7AEfS3Fq94sJ52Fd3xDPPCG4aVtUXxxDuwQ=,iv:HdqbgUVR0lIysZnnPkOkW9gDp9G/EOrHDkwmQH6LVKQ=,tag:amVPLxjvx1Qtv+v27SGtGA==,type:str]
   pgp:
     - created_at: "2025-07-20T18:28:37Z"
       enc: |-

resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf

@@ -71,6 +71,10 @@ map $host $upstream_acme_challenge_host {
     hydra.hamburg.ccc.de 172.31.17.163:31820;
     cfp.eh22.easterhegg.eu 172.31.17.157:31820;
     ntfy.hamburg.ccc.de 172.31.17.149:31820;
+    cryptoparty-hamburg.de 172.31.17.151:31820;
+    cryptoparty.hamburg.ccc.de 172.31.17.151:31820;
+    staging.cryptoparty-hamburg.de 172.31.17.151:31820;
+    staging.cryptoparty.hamburg.ccc.de 172.31.17.151:31820;
     default "";
 }
 

resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf

@@ -89,6 +89,10 @@ stream {
         hydra.hamburg.ccc.de 172.31.17.163:8443;
         cfp.eh22.easterhegg.eu pretalx-intern.hamburg.ccc.de:8443;
         ntfy.hamburg.ccc.de 172.31.17.149:8443;
+        cryptoparty-hamburg.de 172.31.17.151:8443;
+        cryptoparty.hamburg.ccc.de 172.31.17.151:8443;
+        staging.cryptoparty-hamburg.de 172.31.17.151:8443;
+        staging.cryptoparty.hamburg.ccc.de 172.31.17.151:8443;
     }
 
     server {

resources/z9/yate/docker_compose/regfile.conf.j2

@@ -10,75 +10,28 @@ alternatives=0,1008,1337
 callername=Legacy
 # Yealink im großen Raum am Fenster
 
+[502]
+password={{ secret__yate__sip_extension_flausch}}
+alternatives=0,1008,1337
+callername=Flausch
+# Yealink im großen Raum am Sofa
+
+[503]
+password={{ secret__yate__sip_extension_ewerkstatt }}
+alternatives=0,1008,1337
+callername=E-Werkstatt
+# Yealink in der E-Werkstatt
+
 [610]
 password={{ secret__yate__sip_extension_fritzbox_dect1 }}
 alternatives=0,1008,1337
 callername=DECT-1
 
+[611]
+password={{ secret__yate__sip_extension_fritzbox_dect2 }}
+alternatives=0,1008,1337
+callername=DECT-2
+
 [100]
 password=test100
 callername=stb 100
-
-
-;;;;; old stuff, please clean up stb 2025-07-11
-
-[echt]
-password=test
-alternatives=0,9,91,3248,1337
-
-[test]
-password=test
-alternatives=0,9,92,3248,1337
-
-[unittest1]
-password=test
-alternatives=93,3248,1337
-
-[unittest2]
-password=test
-alternatives=94,3248,1337
-
-[door]
-password=test
-alternatives=0,1,11,3248,1337
-callername=Main Door
-
-[kitchen]
-password=test
-alternatives=0,1,12,3248,1337
-callername=Kitchen
-
-[desk]
-password=test
-alternatives=0,1,13,3248,1337
-callername=Desk
-
-[workshop]
-password=test
-alternatives=0,2,21,3248,1337
-callername=Workshop Lobby
-
-[clean]
-password=test
-alternatives=0,2,22,3248,1337
-callername=Clean Workshop
-
-[dirty]
-password=test
-alternatives=0,2,23,3248,1337
-callername=Dirty Workshop
-
-[dect1]
-password=test
-alternatives=0,3,31,3248,1337
-callername=DECT-1
-
-[analog1]
-password=test
-alternatives=0,4,41,3248,1337
-callername=Analog-1
-
-[analog2]
-password=test
-alternatives=0,4,42,3248,1337
-callername=Analog-2