From bd71738df3ab235bea10f31b6c4005f3f9acfbcd Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Tue, 25 Aug 2026 18:41:40 +0200 Subject: [PATCH 1/2] Temporary block until we can update Keycloak --- .../keycloak/nginx/id.hamburg.ccc.de.conf | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf index 82ba082d..f158e623 100644 --- a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf +++ b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf @@ -46,6 +46,29 @@ server { # Also provide "_hidden" for by, since it's not relevant. proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden"; + # temporary until we can upgrade keycloak stb 2026-08-25 + allow 185.161.129.134/32; # z9 + allow 2a07:c480:0:100::/56; # z9 + allow 2a07:c481:1::/48; # z9 new ipv6 + allow 213.240.180.39/32; # stb home + allow 2a01:170:118b:f701::1/64; # stb home + + # Wieske + allow 212.12.48.0/24; + allow 2a00:14b0:4200:3000::/64; + allow 172.31.18.0/24; + allow 172.31.17.0/25; + allow 172.31.17.128/25; + allow 212.12.51.128/28; + allow 2a00:14b0:4200:3500::130:0/112; + allow 2a00:14b0:f000:23::/64; + allow 10.32.2.0/24; + allow 2a00:14b0:42:102::/64; + allow 212.12.50.208/29; + allow 2a00:14b0:42:105::/64; + + deny all; + # Redirect a user opening any not set location on id.hamburg.ccc.de to the account management page. location ^~ / { return 307 https://id.hamburg.ccc.de/realms/ccchh/account/; From 0b2d6770e912c8f60de47d4c5f9c8e94e67e86d6 Mon Sep 17 00:00:00 2001 From: Renovate Date: Tue, 25 Aug 2026 16:45:51 +0000 Subject: [PATCH 2/2] Update all stable non-major dependencies --- .forgejo/workflows/lint.yaml | 2 +- inventories/chaosknoten/host_vars/cloud.yaml | 2 +- inventories/chaosknoten/host_vars/netbox.yaml | 2 +- inventories/chaosknoten/host_vars/pad.yaml | 2 +- .../acmedns/docker_compose/compose.yaml.j2 | 2 +- .../grafana/docker_compose/compose.yaml.j2 | 18 +++++++++--------- .../keycloak/docker_compose/compose.yaml.j2 | 2 +- .../ntfy/docker_compose/compose.yaml.j2 | 2 +- .../pretalx/docker_compose/compose.yaml.j2 | 4 ++-- .../sunders/docker_compose/compose.yaml.j2 | 2 +- .../tickets/docker_compose/compose.yaml.j2 | 2 +- .../status/docker_compose/compose.yaml.j2 | 2 +- 12 files changed, 21 insertions(+), 21 deletions(-) diff --git a/.forgejo/workflows/lint.yaml b/.forgejo/workflows/lint.yaml index 5c1b82ac..6dc4a0c9 100644 --- a/.forgejo/workflows/lint.yaml +++ b/.forgejo/workflows/lint.yaml @@ -24,7 +24,7 @@ jobs: # work in our environmnet. # Rather manually setup python (pip) before instead. - name: Run ansible-lint - uses: https://github.com/ansible/ansible-lint@v26.6.0 + uses: https://github.com/ansible/ansible-lint@v26.8.0 with: setup_python: "false" requirements_file: "requirements.yml" diff --git a/inventories/chaosknoten/host_vars/cloud.yaml b/inventories/chaosknoten/host_vars/cloud.yaml index 8f299b2d..a441ac84 100644 --- a/inventories/chaosknoten/host_vars/cloud.yaml +++ b/inventories/chaosknoten/host_vars/cloud.yaml @@ -1,7 +1,7 @@ # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud nextcloud__version: 34 # renovate: datasource=docker depName=docker.io/library/postgres -nextcloud__postgres_version: 15.18 +nextcloud__postgres_version: 15.19 nextcloud__fqdn: cloud.hamburg.ccc.de nextcloud__data_dir: /data/nextcloud nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}" diff --git a/inventories/chaosknoten/host_vars/netbox.yaml b/inventories/chaosknoten/host_vars/netbox.yaml index 312b1d70..d40703ac 100644 --- a/inventories/chaosknoten/host_vars/netbox.yaml +++ b/inventories/chaosknoten/host_vars/netbox.yaml @@ -1,5 +1,5 @@ # renovate: datasource=github-releases depName=netbox packageName=netbox-community/netbox -netbox__version: "v4.6.4" +netbox__version: "v4.6.9" netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}" netbox__custom_pipeline_oidc_group_and_role_mapping: true diff --git a/inventories/chaosknoten/host_vars/pad.yaml b/inventories/chaosknoten/host_vars/pad.yaml index 0c9b29ea..c2fa834f 100644 --- a/inventories/chaosknoten/host_vars/pad.yaml +++ b/inventories/chaosknoten/host_vars/pad.yaml @@ -13,4 +13,4 @@ nginx__configurations: content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/pad/nginx/pad.hamburg.ccc.de.conf') }}" # renovate: datasource=docker depName=quay.io/hedgedoc/hedgedoc -host_pad__docker_compose__hedgedoc_version: 1.11.1 +host_pad__docker_compose__hedgedoc_version: 1.12.0 diff --git a/resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2 b/resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2 index 2553f4d7..4681da82 100644 --- a/resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2 @@ -2,7 +2,7 @@ services: oauth2-proxy: container_name: oauth2-proxy - image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.3 + image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.4 command: --config /oauth2-proxy.cfg hostname: oauth2-proxy volumes: diff --git a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 index 5ae05997..0800e86c 100644 --- a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 @@ -2,7 +2,7 @@ services: prometheus: - image: docker.io/prom/prometheus:v3.13.1 + image: docker.io/prom/prometheus:v3.14.0 container_name: prometheus command: - '--config.file=/etc/prometheus/prometheus.yml' @@ -19,7 +19,7 @@ services: - prom_data:/prometheus alertmanager: - image: docker.io/prom/alertmanager:v0.33.1 + image: docker.io/prom/alertmanager:v0.34.0 container_name: alertmanager command: - '--config.file=/etc/alertmanager/alertmanager.yaml' @@ -32,7 +32,7 @@ services: - alertmanager_data:/alertmanager grafana: - image: docker.io/grafana/grafana:13.1.0 + image: docker.io/grafana/grafana:13.2.0 container_name: grafana ports: - 3000:3000 @@ -46,7 +46,7 @@ services: - graf_data:/var/lib/grafana pve-exporter: - image: docker.io/prompve/prometheus-pve-exporter:3.9.0 + image: docker.io/prompve/prometheus-pve-exporter:3.10.0 container_name: pve-exporter ports: - 9221:9221 @@ -59,7 +59,7 @@ services: - /dev/null:/etc/prometheus/pve.yml loki: - image: docker.io/grafana/loki:3.7.3 + image: docker.io/grafana/loki:3.7.6 container_name: loki ports: - 13100:3100 @@ -70,7 +70,7 @@ services: - loki_data:/var/loki ntfy-alertmanager-ccchh-critical: - image: docker.io/xenrox/ntfy-alertmanager:1.0.0 + image: docker.io/xenrox/ntfy-alertmanager:1.0.1 container_name: ntfy-alertmanager-ccchh-critical volumes: - ./configs/ntfy-alertmanager-ccchh-critical:/etc/ntfy-alertmanager/config @@ -79,7 +79,7 @@ services: restart: unless-stopped ntfy-alertmanager-fux-critical: - image: docker.io/xenrox/ntfy-alertmanager:1.0.0 + image: docker.io/xenrox/ntfy-alertmanager:1.0.1 container_name: ntfy-alertmanager-fux-critical volumes: - ./configs/ntfy-alertmanager-fux-critical:/etc/ntfy-alertmanager/config @@ -88,7 +88,7 @@ services: restart: unless-stopped ntfy-alertmanager-ccchh: - image: docker.io/xenrox/ntfy-alertmanager:1.0.0 + image: docker.io/xenrox/ntfy-alertmanager:1.0.1 container_name: ntfy-alertmanager-ccchh volumes: - ./configs/ntfy-alertmanager-ccchh:/etc/ntfy-alertmanager/config @@ -97,7 +97,7 @@ services: restart: unless-stopped ntfy-alertmanager-fux: - image: docker.io/xenrox/ntfy-alertmanager:1.0.0 + image: docker.io/xenrox/ntfy-alertmanager:1.0.1 container_name: ntfy-alertmanager-fux volumes: - ./configs/ntfy-alertmanager-fux:/etc/ntfy-alertmanager/config diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 index 75c94e04..e321b2f3 100644 --- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 @@ -22,7 +22,7 @@ services: keycloak: - image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.3 + image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.2 pull_policy: always restart: unless-stopped command: start --optimized diff --git a/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 b/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 index a982bf3a..e65b1693 100644 --- a/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2 @@ -1,7 +1,7 @@ --- services: ntfy: - image: docker.io/binwiederhier/ntfy:v2.26.0 + image: docker.io/binwiederhier/ntfy:v2.27.0 container_name: ntfy command: - serve diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index 3c6e5daa..b3bdb34e 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -15,7 +15,7 @@ services: - pretalx_net redis: - image: docker.io/library/redis:8.8.0 + image: docker.io/library/redis:8.10.1 restart: unless-stopped volumes: - redis:/data @@ -23,7 +23,7 @@ services: - pretalx_net static: - image: docker.io/library/nginx:1.31.2 + image: docker.io/library/nginx:1.31.4 restart: unless-stopped volumes: - public:/usr/share/nginx/html diff --git a/resources/chaosknoten/sunders/docker_compose/compose.yaml.j2 b/resources/chaosknoten/sunders/docker_compose/compose.yaml.j2 index 8ee08bab..0e3d5e59 100644 --- a/resources/chaosknoten/sunders/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/sunders/docker_compose/compose.yaml.j2 @@ -3,7 +3,7 @@ services: db: - image: mariadb:12.3.2 + image: mariadb:12.3.3 command: --max_allowed_packet=3250585600 environment: MYSQL_ROOT_PASSWORD: "{{ secret__sunders_db_root_password }}" diff --git a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 index 9eac87ca..df06e559 100644 --- a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2 @@ -13,7 +13,7 @@ services: restart: unless-stopped redis: - image: docker.io/library/redis:8.8.0 + image: docker.io/library/redis:8.10.1 ports: - "6379:6379" volumes: diff --git a/resources/external/status/docker_compose/compose.yaml.j2 b/resources/external/status/docker_compose/compose.yaml.j2 index 638ebbe2..3d3cb7af 100644 --- a/resources/external/status/docker_compose/compose.yaml.j2 +++ b/resources/external/status/docker_compose/compose.yaml.j2 @@ -4,7 +4,7 @@ services: database: - image: docker.io/library/postgres:18.4 + image: docker.io/library/postgres:18.6 restart: always volumes: - ./database:/var/lib/postgresql