From bd71738df3ab235bea10f31b6c4005f3f9acfbcd Mon Sep 17 00:00:00 2001 From: Stefan Bethke Date: Tue, 25 Aug 2026 18:41:40 +0200 Subject: [PATCH 1/2] Temporary block until we can update Keycloak --- .../keycloak/nginx/id.hamburg.ccc.de.conf | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf index 82ba082d..f158e623 100644 --- a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf +++ b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf @@ -46,6 +46,29 @@ server { # Also provide "_hidden" for by, since it's not relevant. proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden"; + # temporary until we can upgrade keycloak stb 2026-08-25 + allow 185.161.129.134/32; # z9 + allow 2a07:c480:0:100::/56; # z9 + allow 2a07:c481:1::/48; # z9 new ipv6 + allow 213.240.180.39/32; # stb home + allow 2a01:170:118b:f701::1/64; # stb home + + # Wieske + allow 212.12.48.0/24; + allow 2a00:14b0:4200:3000::/64; + allow 172.31.18.0/24; + allow 172.31.17.0/25; + allow 172.31.17.128/25; + allow 212.12.51.128/28; + allow 2a00:14b0:4200:3500::130:0/112; + allow 2a00:14b0:f000:23::/64; + allow 10.32.2.0/24; + allow 2a00:14b0:42:102::/64; + allow 212.12.50.208/29; + allow 2a00:14b0:42:105::/64; + + deny all; + # Redirect a user opening any not set location on id.hamburg.ccc.de to the account management page. location ^~ / { return 307 https://id.hamburg.ccc.de/realms/ccchh/account/; From 7e0540760263c05f32af6bc3b9e636b741de921d Mon Sep 17 00:00:00 2001 From: Renovate Date: Tue, 25 Aug 2026 16:46:12 +0000 Subject: [PATCH 2/2] Update docker.io/library/postgres Docker tag to v18 --- inventories/chaosknoten/host_vars/cloud.yaml | 2 +- resources/chaosknoten/lists/docker_compose/compose.yaml.j2 | 2 +- resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/inventories/chaosknoten/host_vars/cloud.yaml b/inventories/chaosknoten/host_vars/cloud.yaml index 8f299b2d..c4164a77 100644 --- a/inventories/chaosknoten/host_vars/cloud.yaml +++ b/inventories/chaosknoten/host_vars/cloud.yaml @@ -1,7 +1,7 @@ # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud nextcloud__version: 34 # renovate: datasource=docker depName=docker.io/library/postgres -nextcloud__postgres_version: 15.18 +nextcloud__postgres_version: 18.6 nextcloud__fqdn: cloud.hamburg.ccc.de nextcloud__data_dir: /data/nextcloud nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}" diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 index 7a109e8c..fc1cb194 100644 --- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 @@ -62,7 +62,7 @@ services: - POSTGRES_DB=mailmandb - POSTGRES_USER=mailman - "POSTGRES_PASSWORD={{ secret__lists__postgres_password }}" - image: docker.io/library/postgres:12-alpine + image: docker.io/library/postgres:18-alpine volumes: - /opt/mailman/database:/var/lib/postgresql/data networks: diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index 3c6e5daa..6cdec7a9 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -3,7 +3,7 @@ services: database: - image: docker.io/library/postgres:15-alpine + image: docker.io/library/postgres:18-alpine environment: - "POSTGRES_USER=pretalx" - "POSTGRES_PASSWORD={{ secret__pretalx_db_password }}"