Update all stable non-major dependencies

don't pin digests anymore
The benefit of digest pinning isn't that great for this project really and it comes at the cost of more issues and additional renovate noise, so just don't anymore. Adjust renovate config accordingly as well.
2025-11-18 14:45:36 +00:00 · 2025-11-18 14:24:21 +01:00 · 2025-11-11 23:03:59 +01:00 · 2025-11-11 22:47:42 +01:00 · 2025-11-07 20:09:02 +01:00 · 2025-11-06 21:19:20 +01:00
20 changed files with 52 additions and 69 deletions
--- a/.forgejo/workflows/lint.yaml
+++ b/.forgejo/workflows/lint.yaml
@ -10,7 +10,7 @@ jobs:
    name: Ansible Lint
    runs-on: docker
    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@v5
      - name: Install pip
        run: |
          apt update
@ -24,7 +24,7 @@ jobs:
      # work in our environmnet.
      # Rather manually setup python (pip) before instead.
      - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@d7cd7cfa2469536527aceaef9ef2ec6f2fb331cb # v25.9.2
+        uses: https://github.com/ansible/ansible-lint@v25.11.0
        with:
          setup_python: "false"
          requirements_file: "requirements.yml"
--- a/inventories/chaosknoten/host_vars/cloud.yaml
+++ b/inventories/chaosknoten/host_vars/cloud.yaml
@ -1,7 +1,7 @@
 # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud
 nextcloud__version: 32
 # renovate: datasource=docker depName=docker.io/library/postgres
-nextcloud__postgres_version: 15.14
+nextcloud__postgres_version: 15.15
 nextcloud__fqdn: cloud.hamburg.ccc.de
 nextcloud__data_dir: /data/nextcloud
 nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"
--- a/inventories/chaosknoten/host_vars/netbox.yaml
+++ b/inventories/chaosknoten/host_vars/netbox.yaml
@ -1,5 +1,5 @@
 # renovate: datasource=github-releases depName=netbox packageName=netbox-community/netbox
-netbox__version: "v4.4.5"
+netbox__version: "v4.4.6"
 netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}"
 netbox__custom_pipeline_oidc_group_and_role_mapping: true

--- a/inventories/z9/hosts.yaml
+++ b/inventories/z9/hosts.yaml
@ -4,7 +4,7 @@ all:
      ansible_host: authoritative-dns.z9.ccchh.net
      ansible_user: chaos
    dooris:
-      ansible_host: 10.31.208.201
+      ansible_host: dooris.z9.ccchh.net
      ansible_user: chaos
    light:
      ansible_host: light.z9.ccchh.net
--- a/renovate.json
+++ b/renovate.json
@ -1,13 +1,17 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
-    "config:recommended", // Included in config:best-practices anyway, but added for clarity.
-    "config:best-practices",
+    "config:recommended",
+    // Parts from config:best-practices:
+    // https://docs.renovatebot.com/presets-config/#configbest-practices
+    ":configMigration",
+    "abandonments:recommended",
+    "security:minimumReleaseAgeNpm",
+
    ":ignoreUnstable",
    ":disableRateLimiting",
    ":rebaseStalePrs",
-    ":label(renovate)",
-    "group:allDigest"
+    ":label(renovate)"
  ],
  "semanticCommits": "disabled",
  "packageRules": [
@ -28,12 +32,6 @@
      "matchDatasources": ["docker"],
      "matchPackageNames": ["docker.io/pretix/standalone"],
      "versioning": "regex:^(?<major>\\d+\\.\\d+)(?:\\.(?<minor>\\d+))$"
-    },
-    // Since Forgejo seems to clean up older tag versions, so older digests, disable digest pinning for our images.
-    {
-      "matchDatasources": ["docker"],
-      "matchPackageNames": ["git.hamburg.ccc.de/*"],
-      "pinDigests": false
    }
  ],
  "customManagers": [
--- a/resources/chaosknoten/ccchoir/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/ccchoir/docker_compose/compose.yaml.j2
@ -3,7 +3,7 @@

 services:
  database:
-    image: docker.io/library/mariadb:11@sha256:ae6119716edac6998ae85508431b3d2e666530ddf4e94c61a10710caec9b0f71
+    image: docker.io/library/mariadb:11
    environment:
      - "MARIADB_DATABASE=wordpress"
      - "MARIADB_ROOT_PASSWORD={{ secret__mariadb_root_password }}"
@ -17,7 +17,7 @@ services:
    restart: unless-stopped

  app:
-    image: docker.io/library/wordpress:6-php8.1@sha256:75f79f9c45a587b283e47fd21c6e51077d0c9dbbba529377faaa0c28d5b8f5a4
+    image: docker.io/library/wordpress:6-php8.1
    environment:
      - "WORDPRESS_DB_HOST=database"
      - "WORDPRESS_DB_NAME=wordpress"
--- a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
@ -2,12 +2,13 @@
 services:

  prometheus:
-    image: docker.io/prom/prometheus:v3.7.3@sha256:49214755b6153f90a597adcbff0252cc61069f8ab69ce8411285cd4a560e8038
+    image: docker.io/prom/prometheus:v3.7.3
    container_name: prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--web.enable-remote-write-receiver'
      - '--enable-feature=promql-experimental-functions'
+      - '--storage.tsdb.retention.time=28d'
    ports:
      - 9090:9090
    restart: unless-stopped
@ -18,7 +19,7 @@ services:
      - prom_data:/prometheus

  alertmanager:
-    image: docker.io/prom/alertmanager:v0.29.0@sha256:88743b63b3e09ea6e31e140ced5bf45f4a8e82c617c2a963f78841f4995ad1d7
+    image: docker.io/prom/alertmanager:v0.29.0
    container_name: alertmanager
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yaml'
@ -31,7 +32,7 @@ services:
      - alertmanager_data:/alertmanager

  grafana:
-    image: docker.io/grafana/grafana:12.2.1@sha256:35c41e0fd0295f5d0ee5db7e780cf33506abfaf47686196f825364889dee878b
+    image: docker.io/grafana/grafana:12.2.1
    container_name: grafana
    ports:
      - 3000:3000
@ -45,7 +46,7 @@ services:
      - graf_data:/var/lib/grafana

  pve-exporter:
-    image: docker.io/prompve/prometheus-pve-exporter:3.5.5@sha256:79a5598906697b1a5a006d09f0200528a77c6ff1568faf018539ac65824454df
+    image: docker.io/prompve/prometheus-pve-exporter:3.5.5
    container_name: pve-exporter
    ports:
      - 9221:9221
@ -58,7 +59,7 @@ services:
      - /dev/null:/etc/prometheus/pve.yml

  loki:
-    image: docker.io/grafana/loki:3.5.7@sha256:0eaee7bf39cc83aaef46914fb58f287d4f4c4be6ec96b86c2ed55719a75e49c8
+    image: docker.io/grafana/loki:3.6.0
    container_name: loki
    ports:
      - 13100:3100
@ -69,7 +70,7 @@ services:
      - loki_data:/var/loki

  ntfy-alertmanager-ccchh-critical:
-    image: docker.io/xenrox/ntfy-alertmanager:0.5.0@sha256:5fea88db3bf0257d98c007ab0c4ef064c6d67d7b7ceead7d6956dfa0a5cb333b
+    image: docker.io/xenrox/ntfy-alertmanager:0.5.0
    container_name: ntfy-alertmanager-ccchh-critical
    volumes:
      - ./configs/ntfy-alertmanager-ccchh-critical:/etc/ntfy-alertmanager/config
@ -78,7 +79,7 @@ services:
    restart: unless-stopped

  ntfy-alertmanager-fux-critical:
-    image: docker.io/xenrox/ntfy-alertmanager:0.5.0@sha256:5fea88db3bf0257d98c007ab0c4ef064c6d67d7b7ceead7d6956dfa0a5cb333b
+    image: docker.io/xenrox/ntfy-alertmanager:0.5.0
    container_name: ntfy-alertmanager-fux-critical
    volumes:
      - ./configs/ntfy-alertmanager-fux-critical:/etc/ntfy-alertmanager/config
@ -87,7 +88,7 @@ services:
    restart: unless-stopped

  ntfy-alertmanager-ccchh:
-    image: docker.io/xenrox/ntfy-alertmanager:0.5.0@sha256:5fea88db3bf0257d98c007ab0c4ef064c6d67d7b7ceead7d6956dfa0a5cb333b
+    image: docker.io/xenrox/ntfy-alertmanager:0.5.0
    container_name: ntfy-alertmanager-ccchh
    volumes:
      - ./configs/ntfy-alertmanager-ccchh:/etc/ntfy-alertmanager/config
@ -96,7 +97,7 @@ services:
    restart: unless-stopped

  ntfy-alertmanager-fux:
-    image: docker.io/xenrox/ntfy-alertmanager:0.5.0@sha256:5fea88db3bf0257d98c007ab0c4ef064c6d67d7b7ceead7d6956dfa0a5cb333b
+    image: docker.io/xenrox/ntfy-alertmanager:0.5.0
    container_name: ntfy-alertmanager-fux
    volumes:
      - ./configs/ntfy-alertmanager-fux:/etc/ntfy-alertmanager/config
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@ -46,7 +46,7 @@ services:
      - "8080:8080"

  db:
-    image: docker.io/library/postgres:15.14@sha256:424e79b81868f5fc5cf515eaeac69d288692ebcca7db86d98f91b50d4bce64bb
+    image: docker.io/library/postgres:15.15
    restart: unless-stopped
    networks:
      - keycloak
--- a/resources/chaosknoten/lists/docker_compose/compose.yaml
+++ b/resources/chaosknoten/lists/docker_compose/compose.yaml
@ -1,7 +1,7 @@
 services:
  mailman-core:
    restart: unless-stopped
-    image: docker.io/maxking/mailman-core:0.5@sha256:cb8e412bb18d74480f996da68f46e92473b6103995e71bc5aeba139b255cc3d2 # Use a specific version tag (tag latest is not published)
+    image: docker.io/maxking/mailman-core:0.5 # Use a specific version tag (tag latest is not published)
    container_name: mailman-core
    hostname: mailman-core
    volumes:
@ -25,7 +25,7 @@ services:

  mailman-web:
    restart: unless-stopped
-    image: docker.io/maxking/mailman-web:0.5@sha256:014726db85586fb53541f66f6ce964bf07e939791cfd5ffc796cd6d243696a18 # Use a specific version tag (tag latest is not published)
+    image: docker.io/maxking/mailman-web:0.5 # Use a specific version tag (tag latest is not published)
    container_name: mailman-web
    hostname: mailman-web
    depends_on:
@ -56,7 +56,7 @@ services:
      - POSTGRES_DB=mailmandb
      - POSTGRES_USER=mailman
      - POSTGRES_PASSWORD=wvQjbMRnwFuxGEPz
-    image: docker.io/library/postgres:12-alpine@sha256:7c8f4870583184ebadf7f17a6513620aac5f365a7938dc6a6911c1d5df2f481a
+    image: docker.io/library/postgres:12-alpine
    volumes:
      - /opt/mailman/database:/var/lib/postgresql/data
    networks:
--- a/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2
@ -1,7 +1,7 @@
 ---
 services:
  ntfy:
-    image: docker.io/binwiederhier/ntfy:v2.14.0@sha256:5a051798d14138c3ecb12c038652558ab6a077e1aceeb867c151cbf5fa8451ef
+    image: docker.io/binwiederhier/ntfy:v2.15.0
    container_name: ntfy
    command:
      - serve
--- a/resources/chaosknoten/onlyoffice/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/onlyoffice/docker_compose/compose.yaml.j2
@ -4,7 +4,7 @@

 services:
  onlyoffice:
-    image: docker.io/onlyoffice/documentserver:9.1.0@sha256:34b92f4a67bfd939bd6b75893e8217556e3b977f81e49472f7e28737b741ba1d
+    image: docker.io/onlyoffice/documentserver:9.1.0
    restart: unless-stopped
    volumes:
      - "./onlyoffice/DocumentServer/logs:/var/log/onlyoffice"
--- a/resources/chaosknoten/pad/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/pad/docker_compose/compose.yaml.j2
@ -3,7 +3,7 @@

 services:
  database:
-    image: docker.io/library/postgres:15-alpine@sha256:64583b3cb4f2010277bdd9749456de78e5c36f8956466ba14b0b96922e510950
+    image: docker.io/library/postgres:15-alpine
    environment:
      - "POSTGRES_USER=hedgedoc"
      - "POSTGRES_PASSWORD={{ secret__hedgedoc_db_password }}"
@ -13,7 +13,7 @@ services:
    restart: unless-stopped

  app:
-    image: quay.io/hedgedoc/hedgedoc:1.10.3@sha256:ca58fd73ecf05c89559b384fb7a1519c18c8cbba5c21a0018674ed820b9bdb73
+    image: quay.io/hedgedoc/hedgedoc:1.10.3
    environment:
      - "CMD_DB_URL=postgres://hedgedoc:{{ secret__hedgedoc_db_password }}@database:5432/hedgedoc"
      - "CMD_DOMAIN=pad.hamburg.ccc.de"
--- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
@ -3,7 +3,7 @@

 services:
  database:
-    image: docker.io/library/postgres:15-alpine@sha256:64583b3cb4f2010277bdd9749456de78e5c36f8956466ba14b0b96922e510950
+    image: docker.io/library/postgres:15-alpine
    environment:
      - "POSTGRES_USER=pretalx"
      - "POSTGRES_PASSWORD={{ secret__pretalx_db_password }}"
@ -15,7 +15,7 @@ services:
      - pretalx_net

  redis:
-    image: docker.io/library/redis:8.2.3@sha256:5c7c0445ed86918cb9efb96d95a6bfc03ed2059fe2c5f02b4d74f477ffe47915
+    image: docker.io/library/redis:8.2.3
    restart: unless-stopped
    volumes:
      - redis:/data
@ -23,7 +23,7 @@ services:
      - pretalx_net

  static:
-    image: docker.io/library/nginx:1.29.3@sha256:f547e3d0d5d02f7009737b284abc87d808e4252b42dceea361811e9fc606287f
+    image: docker.io/library/nginx:1.29.3
    restart: unless-stopped
    volumes:
      - public:/usr/share/nginx/html
@ -33,7 +33,7 @@ services:
      - pretalx_net

  pretalx:
-    image: docker.io/pretalx/standalone:v2025.1.0@sha256:fb2d15f11bcae8bb15430084ed81a150cfdf7c79705450583b51e352ba486e8e
+    image: docker.io/pretalx/standalone:v2025.1.0
    entrypoint: gunicorn
    command:
      - "pretalx.wsgi"
@ -78,7 +78,7 @@ services:
      - pretalx_net

  celery:
-    image: docker.io/pretalx/standalone:v2025.1.0@sha256:fb2d15f11bcae8bb15430084ed81a150cfdf7c79705450583b51e352ba486e8e
+    image: docker.io/pretalx/standalone:v2025.1.0
    command:
      - taskworker
    restart: unless-stopped
--- a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
@ -1,7 +1,7 @@
 ---
 services:
  database:
-    image: docker.io/library/postgres:15-alpine@sha256:64583b3cb4f2010277bdd9749456de78e5c36f8956466ba14b0b96922e510950
+    image: docker.io/library/postgres:15-alpine
    environment:
      - "POSTGRES_USER=pretix"
      - "POSTGRES_PASSWORD={{ secret__pretix_db_password }}"
@ -13,7 +13,7 @@ services:
    restart: unless-stopped

  redis:
-    image: docker.io/library/redis:7.4.7@sha256:f3cd89d901f3ee81c80c6544f8ae175213fb97bf077cb555ef5673e1be0f8c68
+    image: docker.io/library/redis:7.4.7
    ports:
      - "6379:6379"
    volumes:
@ -25,7 +25,7 @@ services:
      backend:

  pretix:
-    image: docker.io/pretix/standalone:2024.8@sha256:110bac37efa5f736227f158f38e421ed738d03dccc274dfb415b258ab0f75cfe
+    image: docker.io/pretix/standalone:2024.8
    command: ["all"]
    ports:
      - "8345:80"
--- a/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/tickets/nginx/tickets.hamburg.ccc.de.conf
@ -38,11 +38,7 @@ server {

    location = / {
        #return 302 https://wiki.hamburg.ccc.de/infrastructure:service-overview#tickets_pretix;
-        return 302 https://tickets.hamburg.ccc.de/hackertours/eh22ht/;
-    }
-
-    location = /hackertours/eh22/ {
-        return 302 https://tickets.hamburg.ccc.de/hackertours/eh22ht/;
+        return 302 https://tickets.hamburg.ccc.de/hackertours/39c3ht/;
    }

    location / {
--- a/resources/z9/waybackproxy/docker_compose/compose.yaml.j2
+++ b/resources/z9/waybackproxy/docker_compose/compose.yaml.j2
@ -1,7 +1,7 @@
 services:
  # https://github.com/richardg867/WaybackProxy
  waybackproxy:
-    image: cttynul/waybackproxy:latest@sha256:e001d5b1d746522cd1ab2728092173c0d96f08086cbd3e49cdf1e298b8add22e
+    image: cttynul/waybackproxy:latest
    environment:
      DATE: 19990101
      DATE_TOLERANCE: 730
--- a/roles/deploy_ssh_server_config/templates/sshd_config.j2
+++ b/roles/deploy_ssh_server_config/templates/sshd_config.j2
@ -17,7 +17,15 @@ HostKey /etc/ssh/ssh_host_ed25519_key
 HostKey /etc/ssh/ssh_host_rsa_key
 HostKey /etc/ssh/ssh_host_ecdsa_key

+
+{% if ansible_facts["distribution"] == "Debian" and ansible_facts["distribution_major_version"] == "13" %}
+KexAlgorithms sntrup761x25519-sha512,mlkem768x25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
+{% elif ansible_facts["distribution"] == "Debian" and ansible_facts["distribution_major_version"] == "12" %}
+KexAlgorithms sntrup761x25519-sha512,curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
+{% else %}
 KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
+{% endif %}
+

 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr

--- a/roles/foobazdmx/meta/main.yaml
+++ b/roles/foobazdmx/meta/main.yaml
@ -1,8 +0,0 @@
---
-dependencies:
-  - role: distribution_check
-    vars:
-      distribution_check__distribution_support_spec:
-        - name: Debian
-          major_versions:
-            - "11"
--- a/roles/foobazdmx/tasks/main.yaml
+++ b/roles/foobazdmx/tasks/main.yaml
@ -7,11 +7,7 @@
      - python3
      - python3-pip
      - python3-setuptools
-
- name: Ensure python peotry is installed
-  become: true
-  ansible.builtin.pip:
-    name: poetry
+      - python3-poetry

 - name: Ensure foobazdmx user exists
  become: true
--- a/roles/ola/meta/main.yaml
+++ b/roles/ola/meta/main.yaml
@ -1,8 +0,0 @@
---
-dependencies:
-  - role: distribution_check
-    vars:
-      distribution_check__distribution_support_spec:
-        - name: Debian
-          major_versions:
-            - "11"
Author	SHA1	Message	Date
Renovate	bcac9ef990	Update all stable non-major dependencies Some checks failed / Ansible Lint (pull_request) Failing after 2m36s Details / Ansible Lint (push) Failing after 2m40s Details	2025-11-18 14:45:36 +00:00
June	ddab157600	don't pin digests anymore Some checks failed / Ansible Lint (push) Failing after 47s Details The benefit of digest pinning isn't that great for this project really and it comes at the cost of more issues and additional renovate noise, so just don't anymore. Adjust renovate config accordingly as well.	2025-11-18 14:24:21 +01:00
c6ristian	80acd5fdc6	grafana: store date for up to 28 days Some checks failed / Ansible Lint (push) Failing after 1m58s Details	2025-11-11 23:03:59 +01:00
c6ristian	5f6000adca	ssh_config: also enable sntrup761x25519-sha512 for Debain 13 Some checks failed / Ansible Lint (push) Failing after 1m46s Details tldr: PQC algorithms are complex but sntrup still is not brocken	2025-11-11 22:47:42 +01:00
Stefan Bethke	6fea98ffd2	Redirect to 39c3 instead of eh22 Some checks failed / Ansible Lint (push) Failing after 2m3s Details	2025-11-07 20:09:02 +01:00
lilly	63917722ff	fix foobazdmx role Some checks failed / Ansible Lint (push) Failing after 1m58s Details poetry is available via apt now so we install it that way	2025-11-06 21:19:20 +01:00
lilly	aeec08fce8	remove distribution checks Some checks failed / Ansible Lint (push) Failing after 2m2s Details Signed-Off-By: june	2025-11-06 21:16:42 +01:00
June	cffe5c2b16	dooris: use hostname instead of IP Some checks failed / Ansible Lint (push) Failing after 2m9s Details	2025-11-06 18:25:29 +01:00
c6ristian	d690f81e3d	deploy_ssh_server_config: setup ssh pq cryptography Some checks failed / Ansible Lint (push) Failing after 2m14s Details	2025-11-05 23:08:28 +01:00