bypass pull request workflow for automatic patch updates

By default the limit on file descriptors is at a 1024 hard limit and 520k hard limit.
Unsure how this affects nginx, but each client connection needs two file descriptors.
So let's try to set the limit of open files explicitly.

.ansible-lint

@@ -3,11 +3,7 @@ skip_list:
   - "name[casing]"
 
 exclude_paths:
-  - .ansible/
   - .forgejo/
   - "**/*.sops.yaml"
   - ansible_collections/
-  - collections/
   - galaxy_roles/
-  - docs/
-  - resources/

.yamllint.yaml

@@ -1,6 +1,5 @@
 rules:
   brackets:
-    forbid: false
     min-spaces-inside: 1
     max-spaces-inside: 1
     min-spaces-inside-empty: 1

renovate.json

@@ -38,10 +38,13 @@
         "!git.hamburg.ccc.de/ccchh/oci-images/keycloak"
       ]
     },
+    // Automatically merge patch level updates
+    // https://docs.renovatebot.com/key-concepts/automerge/
     {
       "matchUpdateTypes": ["patch"],
-      "matchCurrentVersion": "!/^0/",
+      "automerge": true,
-      "automerge": true
+      "ignoreTests": true,
+      "automergeType": "branch"
     },
     {
       "matchDatasources": ["docker"],

resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone

@@ -228,10 +228,7 @@ rproxy-intern                       IN  A               172.31.17.180
                                     IN  AAAA            2a00:14b0:f000:23::80
                                     IN  MX 10           cow.hamburg.ccc.de.
 
-bildungsurlaub                      IN  CNAME           rproxy
+bildungsurlaub                      IN  CNAME           public-reverse-proxy
-doku                                IN  CNAME           rproxy
-test                                IN  CNAME           rproxy
-www.test                            IN  CNAME           rproxy
 eh2003                              IN  CNAME           public-reverse-proxy
 www.eh2003                          IN  CNAME           public-reverse-proxy
 easterhegg2003                      IN  CNAME           public-reverse-proxy
@@ -510,8 +507,6 @@ pretalx.hosts                       IN  AAAA            2a00:14b0:42:102::10
 ntfy.hosts                          IN  AAAA            2a00:14b0:42:102::11
 spaceapiccc.hosts                   IN  AAAA            2a00:14b0:42:102::12
 acmedns.hosts                       IN  AAAA            2a00:14b0:42:102::13
-www2.hosts                          IN  AAAA            2a00:14b0:42:102::14
-www3.hosts                          IN  AAAA            2a00:14b0:42:102::15
 diday-staging-runner.hosts          IN  AAAA            2a00:14b0:42:102::16
 public-web-static.hosts             IN  AAAA            2a00:14b0:42:102::17
 forgejo-actions-runner.hosts        IN  AAAA            2a00:14b0:42:102::18

resources/chaosknoten/draupnir/docker_compose/config.yaml.j2

@@ -15,6 +15,9 @@ automaticallyRedactForReasons:
   - "porn"
   - "harassmet"
 
+# set to low value to have Draupnir chain consecutive backgrounded operations faster
+backgroundDelayMS: 10
+
 # currently not working because /_synapse is not routed via reverse proxy
 pollReports: false
 

resources/chaosknoten/grafana/docker_compose/compose.yaml.j2

@@ -59,7 +59,7 @@ services:
       - /dev/null:/etc/prometheus/pve.yml
 
   loki:
-    image: docker.io/grafana/loki:3.7.3
+    image: docker.io/grafana/loki:3.7.8
     container_name: loki
     ports:
       - 13100:3100

resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2

@@ -22,7 +22,7 @@
 
 services:
   keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.2
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.4
     pull_policy: always
     restart: unless-stopped
     command: start --optimized

resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2

@@ -23,7 +23,7 @@ services:
       - pretalx_net
 
   static:
-    image: docker.io/library/nginx:1.31.2
+    image: docker.io/library/nginx:1.31.6
     restart: unless-stopped
     volumes:
       - public:/usr/share/nginx/html

resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf

@@ -92,6 +92,7 @@ map $host $upstream_acme_challenge_host {
     ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820;
     überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820;
     xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:31820;
+    bildungsurlaub.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820;
     default "";
 }
 

resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf

@@ -3,6 +3,7 @@
 
 user  nginx;
 worker_processes  auto;
+worker_rlimit_nofile  2050; # should be worker_connections*2 at least
 
 error_log  /var/log/nginx/error.log notice;
 pid        /var/run/nginx.pid;
@@ -115,6 +116,7 @@ stream {
         ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443;
         überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443;
         xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:8443;
+        bildungsurlaub.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443;
     }
 
     server {