public-reverse-proxy(host): Increase nginx worker fd limit

By default the limit on file descriptors is at a 1024 hard limit and 520k hard limit. Unsure how this affects nginx, but each client connection needs two file descriptors. So let's try to set the limit of open files explicitly.
Update git.hamburg.ccc.de/ccchh/oci-images/keycloak Docker tag to v26.7.4
2026-09-22 16:05:05 +02:00 · 2026-09-22 00:16:40 +00:00 · 2026-09-22 02:10:47 +02:00 · 2026-09-21 22:52:07 +02:00 · 2026-09-21 22:49:09 +02:00 · 2026-09-21 19:51:18 +02:00
9 changed files with 10 additions and 14 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@ -3,11 +3,7 @@ skip_list:
  - "name[casing]"

 exclude_paths:
-  - .ansible/
  - .forgejo/
  - "**/*.sops.yaml"
  - ansible_collections/
-  - collections/
  - galaxy_roles/
-  - docs/
-  - resources/
--- a/.yamllint.yaml
+++ b/.yamllint.yaml
@ -1,6 +1,5 @@
 rules:
  brackets:
-    forbid: false
    min-spaces-inside: 1
    max-spaces-inside: 1
    min-spaces-inside-empty: 1
--- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
+++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
@ -228,10 +228,7 @@ rproxy-intern                       IN  A               172.31.17.180
                                    IN  AAAA            2a00:14b0:f000:23::80
                                    IN  MX 10           cow.hamburg.ccc.de.

-bildungsurlaub                      IN  CNAME           rproxy
-doku                                IN  CNAME           rproxy
-test                                IN  CNAME           rproxy
-www.test                            IN  CNAME           rproxy
+bildungsurlaub                      IN  CNAME           public-reverse-proxy
 eh2003                              IN  CNAME           public-reverse-proxy
 www.eh2003                          IN  CNAME           public-reverse-proxy
 easterhegg2003                      IN  CNAME           public-reverse-proxy
@ -510,8 +507,6 @@ pretalx.hosts                       IN  AAAA            2a00:14b0:42:102::10
 ntfy.hosts                          IN  AAAA            2a00:14b0:42:102::11
 spaceapiccc.hosts                   IN  AAAA            2a00:14b0:42:102::12
 acmedns.hosts                       IN  AAAA            2a00:14b0:42:102::13
-www2.hosts                          IN  AAAA            2a00:14b0:42:102::14
-www3.hosts                          IN  AAAA            2a00:14b0:42:102::15
 diday-staging-runner.hosts          IN  AAAA            2a00:14b0:42:102::16
 public-web-static.hosts             IN  AAAA            2a00:14b0:42:102::17
 forgejo-actions-runner.hosts        IN  AAAA            2a00:14b0:42:102::18
--- a/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2
+++ b/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2
@ -15,6 +15,9 @@ automaticallyRedactForReasons:
  - "porn"
  - "harassmet"

+# set to low value to have Draupnir chain consecutive backgrounded operations faster
+backgroundDelayMS: 10
+
 # currently not working because /_synapse is not routed via reverse proxy
 pollReports: false

--- a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
@ -59,7 +59,7 @@ services:
      - /dev/null:/etc/prometheus/pve.yml

  loki:
-    image: docker.io/grafana/loki:3.7.3
+    image: docker.io/grafana/loki:3.7.8
    container_name: loki
    ports:
      - 13100:3100
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@ -22,7 +22,7 @@

 services:
  keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.2
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.4
    pull_policy: always
    restart: unless-stopped
    command: start --optimized
--- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
@ -23,7 +23,7 @@ services:
      - pretalx_net

  static:
-    image: docker.io/library/nginx:1.31.2
+    image: docker.io/library/nginx:1.31.6
    restart: unless-stopped
    volumes:
      - public:/usr/share/nginx/html
--- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf
@ -92,6 +92,7 @@ map $host $upstream_acme_challenge_host {
    ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820;
    überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820;
    xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:31820;
+    bildungsurlaub.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
    default "";
 }

--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@ -3,6 +3,7 @@

 user  nginx;
 worker_processes  auto;
+worker_rlimit_nofile  2050; # should be worker_connections*2 at least

 error_log  /var/log/nginx/error.log notice;
 pid        /var/run/nginx.pid;
@ -115,6 +116,7 @@ stream {
        ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443;
        überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443;
        xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:8443;
+        bildungsurlaub.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;
    }

    server {
Author	SHA1	Message	Date
jtbx	83b0ab0950	public-reverse-proxy(host): Increase nginx worker fd limit All checks were successful / build (push) Successful in 25s Details / Ansible Lint (push) Successful in 4m9s Details By default the limit on file descriptors is at a 1024 hard limit and 520k hard limit. Unsure how this affects nginx, but each client connection needs two file descriptors. So let's try to set the limit of open files explicitly.	2026-09-22 16:05:05 +02:00
Renovate	1901ca515d	Update git.hamburg.ccc.de/ccchh/oci-images/keycloak Docker tag to v26.7.4 All checks were successful / build (pull_request) Successful in 30s Details / Ansible Lint (pull_request) Successful in 3m29s Details / cleanup-staging (pull_request) Successful in 7s Details / build (push) Successful in 27s Details / Ansible Lint (push) Successful in 2m42s Details	2026-09-22 00:16:40 +00:00
June	049682bce2	host(draupnir): set backgroundDelayMS to have Draupnir act fast All checks were successful / build (push) Successful in 25s Details / Ansible Lint (push) Successful in 4m17s Details Use a recommended low value for backgroundDelayMS to have Draupnir chain consecutive backgrounded operations faster and therefore act faster.	2026-09-22 02:10:47 +02:00
Renovate	81e5380a14	Update docker.io/library/nginx Docker tag to v1.31.6 All checks were successful / build (push) Successful in 24s Details / Ansible Lint (push) Successful in 2m31s Details	2026-09-21 22:52:07 +02:00
Renovate	acf0b57d97	Update docker.io/grafana/loki Docker tag to v3.7.8 Some checks failed / build (push) Successful in 26s Details / Ansible Lint (push) Has been cancelled Details	2026-09-21 22:49:09 +02:00
jtbx	fbddd28c71	public-reverse-proxy(host): Add bildungsurlaub.hamburg.ccc.de All checks were successful / build (pull_request) Successful in 28s Details / cleanup-staging (pull_request) Successful in 9s Details / build (push) Successful in 27s Details / Ansible Lint (pull_request) Successful in 2m31s Details / Ansible Lint (push) Successful in 2m39s Details	2026-09-21 19:51:18 +02:00
jtbx	a649455d92	auth-dns(host): Move bildungsurlaub.hamburg.ccc.de to public-web-static All checks were successful / Ansible Lint (push) Successful in 2m30s Details	2026-09-21 19:48:56 +02:00
jtbx	547210d31f	auth-dns(host): Remove deleted www2 and www3 VMs	2026-09-21 19:44:51 +02:00