From 52d3fd4136087e798360656956b0316e777ec4a2 Mon Sep 17 00:00:00 2001
From: djerun <djerun@hamburg.ccc.de>
Date: Mon, 17 Aug 2026 15:09:08 +0200
Subject: [PATCH 01/24] [inventory] manage ssh connectivity in shared ssh.cfg
 usable outside of ansible with optional local overrides in ssh.cfg.local, use
 ssh.cfg in ansible and eliminate ssh config bleed from ~/.ssh/config, collect
 host key fingerprints in shared known_hosts file populated with fingerprints
 of reachable hosts

---
 .gitignore                         |   2 +-
 ansible.cfg                        |   3 +
 inventories/chaosknoten/hosts.yaml |  76 -------------
 inventories/external/hosts.yaml    |   2 -
 inventories/z9/hosts.yaml          |  13 ---
 known_hosts                        |  34 ++++++
 ssh.cfg                            | 165 +++++++++++++++++++++++++++++
 7 files changed, 203 insertions(+), 92 deletions(-)
 create mode 100644 known_hosts
 create mode 100644 ssh.cfg

diff --git a/.gitignore b/.gitignore
index 8bcf2f51..05976ef4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,4 @@
 .ansible/
 **/__pycache__
 **/.DS_store
-
+ssh.cfg.local
diff --git a/ansible.cfg b/ansible.cfg
index dd281164..243bdac3 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -5,3 +5,6 @@ vars_plugins_enabled = host_group_vars,community.sops.sops
 collections_path = ./
 roles_path = ./galaxy-roles
 interpreter_python = python3
+
+[ssh_connection]
+ssh_args = -F ssh.cfg -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=known_hosts
diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 0c841fb6..89db1b14 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -1,109 +1,33 @@
 all:
   hosts:
     ccchoir:
-      ansible_host: ccchoir.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     chaosknoten:
-      ansible_host: chaosknoten.hamburg.ccc.de
     cloud:
-      ansible_host: cloud.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     diday-staging-runner:
-      ansible_host: diday-staging-runner.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     eh22-wiki:
-      ansible_host: eh22-wiki.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     grafana:
-      ansible_host: grafana.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     tickets:
-      ansible_host: tickets.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     jitsi:
-      ansible_host: jitsi.hamburg.ccc.de
-      ansible_user: chaos
     keycloak:
-      ansible_host: keycloak.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     lists:
-      ansible_host: lists.hamburg.ccc.de
-      ansible_user: chaos
     mjolnir:
-      ansible_host: mjolnir.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     mumble:
-      ansible_host: mumble.hamburg.ccc.de
-      ansible_user: chaos
     netbox:
-      ansible_host: netbox.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     onlyoffice:
-      ansible_host: onlyoffice.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     pad:
-      ansible_host: pad.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     pretalx:
-      ansible_host: pretalx.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     public-reverse-proxy:
-      ansible_host: public-reverse-proxy.hamburg.ccc.de
-      ansible_user: chaos
     router:
-      ansible_host: router.hamburg.ccc.de
-      ansible_user: chaos
     wiki:
-      ansible_host: wiki.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     zammad:
-      ansible_host: zammad.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     ntfy:
-      ansible_host: ntfy.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     sunders:
-      ansible_host: sunders.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     renovate:
-      ansible_host: renovate.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     spaceapiccc:
-      ansible_host: spaceapiccc.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     acmedns:
-      ansible_host: acmedns.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     auth-dns:
-      ansible_host: auth-dns.hamburg.ccc.de
-      ansible_user: chaos
     forgejo-runner:
-      ansible_host: forgejo-runner.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     forgejo-runner-external:
-      ansible_host: forgejo-runner-external.hosts.hamburg.ccc.de
-      ansible_user: chaos
-      ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
 hypervisors:
   hosts:
     chaosknoten:
diff --git a/inventories/external/hosts.yaml b/inventories/external/hosts.yaml
index efcf5f0d..dcfd2b86 100644
--- a/inventories/external/hosts.yaml
+++ b/inventories/external/hosts.yaml
@@ -2,8 +2,6 @@ all:
   hosts:
     status:
       # TODO: Manually set up ufw on the host. Create a role for ufw.
-      ansible_host: status.hamburg.ccc.de
-      ansible_user: chaos
 base_config_hosts:
   hosts:
     status:
diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml
index ebbab18f..3e5bc6b7 100644
--- a/inventories/z9/hosts.yaml
+++ b/inventories/z9/hosts.yaml
@@ -1,25 +1,12 @@
 all:
   hosts:
     dooris:
-      ansible_host: dooris.ccchh.net
-      ansible_user: chaos
     light:
-      ansible_host: light.ccchh.net
-      ansible_user: chaos
     opensourcetorrents:
-      ansible_host: opensourcetorrents.ccchh.net
-      ansible_user: chaos
     pve01:
-      ansible_host: pve01.ccchh.net
     waybackproxy:
-      ansible_host: waybackproxy.ccchh.net
-      ansible_user: chaos
     yate:
-      ansible_host: yate.z9.ccchh.net
-      ansible_user: chaos
     z9-router:
-      ansible_host: z9-router.ccchh.net
-      ansible_user: chaos
 base_config_hosts:
   hosts:
     z9-router:
diff --git a/known_hosts b/known_hosts
new file mode 100644
index 00000000..660649c3
--- /dev/null
+++ b/known_hosts
@@ -0,0 +1,34 @@
+acmedns.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJfH16gO1ybLxz/qSwUQxfucwkkKdtaCs3LTm6mn1WBw
+auth-dns.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICot4CncMY6YA5u6T579uS1zC0OCHqmKdqC1gJLeqVzQ
+ccchoir.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK9ciwPXufyJe5GOktgR5C9wH+84xNxDwMC2/0ccEZOG
+chaosknoten.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3OQWuF+rFishyaGnrgyG5HGVocVlewxcYR3RaBaeAw
+cloud.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7ftSAggvJOW5WdzfocEAx5WGxrA6GgN9LozpX31R/w
+diday-staging-runner.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII3SR/4wX9dAAna7LNDbnrJdiO/GLMr3HTw1JEq8HWuI
+dooris.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII4g3VSYVjuhgA8JRRplSD7bcjmb9XfFyu5SocHCWtT3
+eh22-wiki.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBmG79nqY//ZrSURf9EgRHZVU6YWvZVUtHnLpmXorZk
+forgejo-runner-external.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINP0sfgMZaNJEQxzDrvUdtTHE+cBRg6p4mFGuxe+C5YI
+forgejo-runner.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/d7nDDth7U/F/ZO0Ug3S8C0rBARj77UdSCwwPVDZw3
+grafana.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGlIh+jGr3pA+M0t+LBbXswdwX1vBFcMhuhz+4KOtbC+
+jitsi.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJHQ7sD/LoHl2yiG6HsTujHGbmE72YdqXgtRDKrClqZA
+keycloak.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM4zJIin5wsYtPy6FfNBq4sWwwLAwD/YNQ8K438ePMXa
+light.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDTn7GK0USwNbONHR9gR4tc+B3iXAisNFIlmm21EUxm6
+lists.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7fbN5/jIDd0b6KHJtOjU1u1G6iBm967dym9IegHCji
+mjolnir.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMR+2CzZC91mT9oU2BbIAqPdl1m3sp2NAKWUoU/T2MKg
+mumble.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBosJxVv02kX8vdyZfQ8lSQJnNje9id2Dk9LBDwod4ni
+netbox.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAVLtLRFHBwhbh+rGvon3KvKYuASQ878me8rgXD0ndGq
+ntfy.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGASO8ZKHX2XUUNA3sdYTEsDnCgrb6M9UeiFsyXcERM3
+onlyoffice.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBfchhdp2p7+QKoZyQHgRiv+nnGK7scytJjca9WOQgmm
+opensourcetorrents.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLTNinzCymFZgt5Sb8pk89yfbj9MbiNENh1J0bWeyZh
+pad.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINysL9KOfnxojDyvPQnzXtHuT+UkqxyDry0vk23eIq1t
+pretalx.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIInDY4enlTPVohOSBgKc+f3bCFvYvDVYeWNcbYfftYPj
+public-reverse-proxy.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIexYb1btlzHhjjLRE1hWKOEd6Zuscn8/FgG8SLUjyCh
+pve01.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEFXcy9aD0sPpi+o5zvzy4Iw5jMmNjmJK9N8IVG0mrNk
+renovate.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN5vVef1U1k3CJx1wNG3PU35+9dAG7+j4Ffu+G7tMfM+
+router.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWM1wtkw+yVfZi2e3gRVTpjU3R8Doqlukiv1/ud6Kmv
+spaceapiccc.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMtggIp8L5i8SWM++hByCQMZJJLnliT0Ost7T4LjzcPN
+status.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIy1p5fPlmpJAVe8oO/eQjue1cBisxZhfpCizQFp1DTf
+sunders.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL10d+eTRCl/Ylzds1OvULvtQRhOd+oHqE7mxzomeyfk
+tickets.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGVt4P0NkXVlDyOoSMYRBkGnSa433SBb3ZGKvG8ycyp
+wiki.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG9zxa16pNhD/6Mrr4hhlLowA+3PS/a87EvOA3rSTrQD
+z9-router.ccchh.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIISqrS1ZQIOO5t62YIHZ66kYkSNZweNfyvXF9o4Npy3X
+zammad.hosts.hamburg.ccc.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJeoHcaAfZTkvzV464xFEiKhj1CLnO3tnB7A078wMw6e
diff --git a/ssh.cfg b/ssh.cfg
new file mode 100644
index 00000000..00791c9d
--- /dev/null
+++ b/ssh.cfg
@@ -0,0 +1,165 @@
+Include ssh.cfg.local
+
+Host acmedns
+	HostName acmedns.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host auth-dns
+	HostName auth-dns.hamburg.ccc.de
+	User chaos
+
+Host ccchoir
+	HostName ccchoir.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host chaosknoten
+	HostName chaosknoten.hamburg.ccc.de
+
+Host cloud
+	HostName cloud.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host diday-staging-runner
+	HostName diday-staging-runner.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host dooris
+	HostName dooris.ccchh.net
+	User chaos
+
+Host eh22-wiki
+	HostName eh22-wiki.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host forgejo-runner-external
+	HostName forgejo-runner-external.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host forgejo-runner
+	HostName forgejo-runner.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host grafana
+	HostName grafana.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host jitsi
+	HostName jitsi.hamburg.ccc.de
+	User chaos
+
+Host keycloak
+	HostName keycloak.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host light
+	HostName light.ccchh.net
+	User chaos
+
+Host lists
+	HostName lists.hamburg.ccc.de
+	User chaos
+
+Host mjolnir
+	HostName mjolnir.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host mumble
+	HostName mumble.hamburg.ccc.de
+	User chaos
+
+Host netbox
+	HostName netbox.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host ntfy
+	HostName ntfy.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host onlyoffice
+	HostName onlyoffice.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host opensourcetorrents
+	HostName opensourcetorrents.ccchh.net
+	User chaos
+
+Host pad
+	HostName pad.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host pretalx
+	HostName pretalx.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host public-reverse-proxy
+	HostName public-reverse-proxy.hamburg.ccc.de
+	User chaos
+
+Host pve01
+	HostName pve01.ccchh.net
+
+Host renovate
+	HostName renovate.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host router
+	HostName router.hamburg.ccc.de
+	User chaos
+
+Host spaceapiccc
+	HostName spaceapiccc.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host status
+	HostName status.hamburg.ccc.de
+	User chaos
+
+Host sunders
+	HostName sunders.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host tickets
+	HostName tickets.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host waybackproxy
+	HostName waybackproxy.ccchh.net
+	User chaos
+
+Host wiki
+	HostName wiki.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+
+Host yate
+	HostName yate.z9.ccchh.net
+	User chaos
+
+Host z9-router
+	HostName z9-router.ccchh.net
+	User chaos
+
+Host zammad
+	HostName zammad.hosts.hamburg.ccc.de
+	User chaos
+	ProxyJump ssh://chaos@router.hamburg.ccc.de
+

From a87c27b3d5a4521eab07e5aba868fdd2f6d492a2 Mon Sep 17 00:00:00 2001
From: bitwhisker <bitwhisker@noreply.git.hamburg.ccc.de>
Date: Mon, 17 Aug 2026 21:39:00 +0200
Subject: [PATCH 02/24] keycloak(host): allow right ipv4 of z9 router

---
 .../keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
index 1420e43d..bd819118 100644
--- a/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/keycloak-admin.hamburg.ccc.de.conf
@@ -41,7 +41,7 @@ server {
     # Also provide "_hidden" for by, since it's not relevant.
     proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
 
-    allow 185.161.129.132/32; # z9
+    allow 185.161.129.134/32; # z9
     allow 2a07:c480:0:100::/56; # z9
     allow 2a07:c481:1::/48; # z9 new ipv6
     allow 213.240.180.39/32; # stb home

From c610e8fb3e31fc8053a4e084bae58e5178f9f133 Mon Sep 17 00:00:00 2001
From: djerun <djerun@hamburg.ccc.de>
Date: Mon, 17 Aug 2026 22:41:48 +0200
Subject: [PATCH 03/24] [inventory] specify ssh user for chaosknoten

---
 ssh.cfg | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ssh.cfg b/ssh.cfg
index 00791c9d..8e33ab48 100644
--- a/ssh.cfg
+++ b/ssh.cfg
@@ -16,6 +16,7 @@ Host ccchoir
 
 Host chaosknoten
 	HostName chaosknoten.hamburg.ccc.de
+	User root
 
 Host cloud
 	HostName cloud.hosts.hamburg.ccc.de

From 1d6c131f792f1cb99cf87790fcfb088ab0ed4963 Mon Sep 17 00:00:00 2001
From: djerun <djerun@hamburg.ccc.de>
Date: Mon, 17 Aug 2026 23:42:43 +0200
Subject: [PATCH 04/24] [inventory] sort hosts

---
 inventories/chaosknoten/hosts.yaml | 138 ++++++++++++++---------------
 inventories/z9/hosts.yaml          |   2 +-
 2 files changed, 70 insertions(+), 70 deletions(-)

diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 89db1b14..eaa333d4 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -1,65 +1,65 @@
 all:
   hosts:
+    acmedns:
+    auth-dns:
     ccchoir:
     chaosknoten:
     cloud:
     diday-staging-runner:
     eh22-wiki:
+    forgejo-runner:
+    forgejo-runner-external:
     grafana:
-    tickets:
     jitsi:
     keycloak:
     lists:
     mjolnir:
     mumble:
     netbox:
+    ntfy:
     onlyoffice:
     pad:
     pretalx:
     public-reverse-proxy:
+    renovate:
     router:
+    spaceapiccc:
+    sunders:
+    tickets:
     wiki:
     zammad:
-    ntfy:
-    sunders:
-    renovate:
-    spaceapiccc:
-    acmedns:
-    auth-dns:
-    forgejo-runner:
-    forgejo-runner-external:
 hypervisors:
   hosts:
     chaosknoten:
 base_config_hosts:
   hosts:
     acmedns:
+    auth-dns:
     ccchoir:
     cloud:
     diday-staging-runner:
     eh22-wiki:
+    forgejo-runner:
+    forgejo-runner-external:
     grafana:
     jitsi:
     keycloak:
     lists:
+    mjolnir:
     mumble:
     netbox:
+    ntfy:
     onlyoffice:
     pad:
     pretalx:
     public-reverse-proxy:
+    renovate:
     router:
+    spaceapiccc:
+    sunders:
     tickets:
     wiki:
     zammad:
-    ntfy:
-    sunders:
-    renovate:
-    spaceapiccc:
-    mjolnir:
-    auth-dns:
-    forgejo-runner:
-    forgejo-runner-external:
 systemd_networkd_hosts:
   hosts:
     router:
@@ -72,17 +72,17 @@ docker_compose_hosts:
     ccchoir:
     diday-staging-runner:
     grafana:
-    tickets:
     keycloak:
     lists:
+    mjolnir:
+    ntfy:
     onlyoffice:
     pad:
     pretalx:
-    zammad:
-    ntfy:
-    sunders:
     spaceapiccc:
-    mjolnir:
+    sunders:
+    tickets:
+    zammad:
 nextcloud_hosts:
   hosts:
     cloud:
@@ -92,20 +92,20 @@ nginx_hosts:
     ccchoir:
     eh22-wiki:
     grafana:
-    tickets:
     keycloak:
     lists:
     mumble:
     netbox:
+    ntfy:
     onlyoffice:
     pad:
     pretalx:
     public-reverse-proxy:
+    spaceapiccc:
+    sunders:
+    tickets:
     wiki:
     zammad:
-    ntfy:
-    sunders:
-    spaceapiccc:
 public_reverse_proxy_hosts:
   hosts:
     public-reverse-proxy:
@@ -115,66 +115,66 @@ certbot_hosts:
     ccchoir:
     eh22-wiki:
     grafana:
-    tickets:
     keycloak:
     lists:
     mumble:
     netbox:
+    ntfy:
     onlyoffice:
     pad:
     pretalx:
+    spaceapiccc:
+    sunders:
+    tickets:
     wiki:
     zammad:
-    ntfy:
-    sunders:
-    spaceapiccc:
 alloy_hosts:
   hosts:
+    auth-dns:
     ccchoir:
+    cloud:
     eh22-wiki:
+    grafana:
     keycloak:
     netbox:
+    ntfy:
     onlyoffice:
     pad:
     pretalx:
+    public-reverse-proxy:
+    renovate:
+    router:
+    spaceapiccc:
+    sunders:
+    tickets:
     wiki:
     zammad:
-    grafana:
-    ntfy:
-    tickets:
-    renovate:
-    cloud:
-    public-reverse-proxy:
-    router:
-    sunders:
-    spaceapiccc:
-    auth-dns:
 infrastructure_authorized_keys_hosts:
   hosts:
+    auth-dns:
     ccchoir:
-    eh22-wiki:
-    grafana:
-    tickets:
     cloud:
+    eh22-wiki:
+    forgejo-runner:
+    forgejo-runner-external:
+    grafana:
     jitsi:
     keycloak:
+    lists:
+    mjolnir:
     netbox:
+    ntfy:
     onlyoffice:
     pad:
     pretalx:
     public-reverse-proxy:
+    renovate:
     router:
+    spaceapiccc:
+    sunders:
+    tickets:
     wiki:
     zammad:
-    ntfy:
-    sunders:
-    renovate:
-    spaceapiccc:
-    mjolnir:
-    auth-dns:
-    lists:
-    forgejo-runner:
-    forgejo-runner-external:
 wiki_hosts:
   hosts:
     eh22-wiki:
@@ -187,31 +187,31 @@ proxmox_vm_template_hosts:
     chaosknoten:
 ansible_pull_hosts:
   hosts:
-    netbox:
+    auth-dns:
+    ccchoir:
     cloud:
     diday-staging-runner:
     eh22-wiki:
+    forgejo-runner:
+    forgejo-runner-external:
     grafana:
-    onlyoffice:
-    pretalx:
-    sunders:
-    renovate:
-    wiki:
-    ccchoir:
-    tickets:
     jitsi:
     keycloak:
     lists:
-    mumble:
-    pad:
-    public-reverse-proxy:
-    zammad:
-    ntfy:
-    spaceapiccc:
     mjolnir:
-    auth-dns:
-    forgejo-runner:
-    forgejo-runner-external:
+    mumble:
+    netbox:
+    ntfy:
+    onlyoffice:
+    pad:
+    pretalx:
+    public-reverse-proxy:
+    renovate:
+    spaceapiccc:
+    sunders:
+    tickets:
+    wiki:
+    zammad:
 msmtp_hosts:
   hosts:
 renovate_hosts:
diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml
index 3e5bc6b7..23b47e46 100644
--- a/inventories/z9/hosts.yaml
+++ b/inventories/z9/hosts.yaml
@@ -57,9 +57,9 @@ kea_dhcp_hosts:
     z9-router:
 alloy_hosts:
   hosts:
+    dooris:
     light:
     yate:
-    dooris:
     z9-router:
 ansible_pull_hosts:
   hosts:

From 233131b6125aa612d8481e80c07870a75f41edcb Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Tue, 18 Aug 2026 19:27:54 +0200
Subject: [PATCH 05/24] Use correct hostname

---
 inventories/z9/hosts.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inventories/z9/hosts.yaml b/inventories/z9/hosts.yaml
index ebbab18f..66519db7 100644
--- a/inventories/z9/hosts.yaml
+++ b/inventories/z9/hosts.yaml
@@ -15,7 +15,7 @@ all:
       ansible_host: waybackproxy.ccchh.net
       ansible_user: chaos
     yate:
-      ansible_host: yate.z9.ccchh.net
+      ansible_host: yate.ccchh.net
       ansible_user: chaos
     z9-router:
       ansible_host: z9-router.ccchh.net

From 5ae8a3b186f08ba134cf1313431c2a764d218a56 Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Fri, 21 Aug 2026 23:28:21 +0200
Subject: [PATCH 06/24] Re-add IP for waybackproxy

---
 resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 1 +
 1 file changed, 1 insertion(+)

diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone
index c501167f..2f0ccdd1 100644
--- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone
+++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone
@@ -134,6 +134,7 @@ octopi                          A     10.89.212.31
 
 ;cisco-slm248p                   A     10.89.208.27
 
+waybackproxy                    A     10.89.212.33
 
 ;
 ; Public Club Services

From a2eba1ac706fc62c770e077e787856ed336be6cc Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Fri, 21 Aug 2026 23:34:10 +0200
Subject: [PATCH 07/24] fixed IP for Retro Sun SparcStation 4

---
 resources/chaosknoten/auth-dns/zones/ccchh.net.zone | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone
index 2f0ccdd1..e5c1d251 100644
--- a/resources/chaosknoten/auth-dns/zones/ccchh.net.zone
+++ b/resources/chaosknoten/auth-dns/zones/ccchh.net.zone
@@ -136,6 +136,9 @@ octopi                          A     10.89.212.31
 
 waybackproxy                    A     10.89.212.33
 
+alnair                          A     10.89.210.23
+                                TXT   "Sun SparcStation 4 Retro"
+
 ;
 ; Public Club Services
 ;

From ae314ea9b37a6e35d439cd63f6687a58372a0689 Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Mon, 24 Aug 2026 10:01:16 +0200
Subject: [PATCH 08/24] Configure manual subscriber lists

---
 resources/chaosknoten/lists/docker_compose/compose.yaml.j2 | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2 b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2
index 2a7ffdd8..7a109e8c 100644
--- a/resources/chaosknoten/lists/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/lists/docker_compose/compose.yaml.j2
@@ -80,9 +80,12 @@ services:
       - LIST_ATTRIBUTES=chaos@lists.hamburg.ccc.de:mailinglist-chaos,intern@lists.hamburg.ccc.de:mailinglist-intern
       - MAILMAN_API_PASSWORD={{ secret__lists__rest_password }}
       - MAILMAN_API_URL=http://mailman-core:8001/3.1
+      - MANUAL_SUBSCRIBER_LISTS=/manual-subscriber-lists
     image: git.hamburg.ccc.de/ccchh/mailman-subscription-sync:latest
     networks:
       mailman:
+    volumes:
+      - /home/chaos/mailman-manual-subscriber-lists:/manual-subscriber-lists
 
 networks:
   mailman:

From bd71738df3ab235bea10f31b6c4005f3f9acfbcd Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Tue, 25 Aug 2026 18:41:40 +0200
Subject: [PATCH 09/24] Temporary block until we can update Keycloak

---
 .../keycloak/nginx/id.hamburg.ccc.de.conf     | 23 +++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
index 82ba082d..f158e623 100644
--- a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
@@ -46,6 +46,29 @@ server {
     # Also provide "_hidden" for by, since it's not relevant.
     proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
 
+    # temporary until we can upgrade keycloak stb 2026-08-25
+    allow 185.161.129.134/32; # z9
+    allow 2a07:c480:0:100::/56; # z9
+    allow 2a07:c481:1::/48; # z9 new ipv6
+    allow 213.240.180.39/32; # stb home
+    allow 2a01:170:118b:f701::1/64; # stb home
+
+    # Wieske
+    allow 212.12.48.0/24;
+    allow 2a00:14b0:4200:3000::/64;
+    allow 172.31.18.0/24;
+    allow 172.31.17.0/25;
+    allow 172.31.17.128/25;
+    allow 212.12.51.128/28;
+    allow 2a00:14b0:4200:3500::130:0/112;
+    allow 2a00:14b0:f000:23::/64;
+    allow 10.32.2.0/24;
+    allow 2a00:14b0:42:102::/64;
+    allow 212.12.50.208/29;
+    allow 2a00:14b0:42:105::/64;
+
+    deny all;
+
     # Redirect a user opening any not set location on id.hamburg.ccc.de to the account management page.
     location ^~ / {
         return 307 https://id.hamburg.ccc.de/realms/ccchh/account/;

From 4540dc5516b440e8a1a8eb39b319e74759f5579b Mon Sep 17 00:00:00 2001
From: Stefan Bethke <stb@lassitu.de>
Date: Tue, 25 Aug 2026 19:04:44 +0200
Subject: [PATCH 10/24] Update to current version, open up fully again.

---
 .../keycloak/docker_compose/compose.yaml.j2   |  2 +-
 .../keycloak/nginx/id.hamburg.ccc.de.conf     | 23 +------------------
 2 files changed, 2 insertions(+), 23 deletions(-)

diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
index 75c94e04..e321b2f3 100644
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@@ -22,7 +22,7 @@
 
 services:
   keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.3
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.2
     pull_policy: always
     restart: unless-stopped
     command: start --optimized
diff --git a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
index f158e623..d963f802 100644
--- a/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
+++ b/resources/chaosknoten/keycloak/nginx/id.hamburg.ccc.de.conf
@@ -46,28 +46,7 @@ server {
     # Also provide "_hidden" for by, since it's not relevant.
     proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
 
-    # temporary until we can upgrade keycloak stb 2026-08-25
-    allow 185.161.129.134/32; # z9
-    allow 2a07:c480:0:100::/56; # z9
-    allow 2a07:c481:1::/48; # z9 new ipv6
-    allow 213.240.180.39/32; # stb home
-    allow 2a01:170:118b:f701::1/64; # stb home
-
-    # Wieske
-    allow 212.12.48.0/24;
-    allow 2a00:14b0:4200:3000::/64;
-    allow 172.31.18.0/24;
-    allow 172.31.17.0/25;
-    allow 172.31.17.128/25;
-    allow 212.12.51.128/28;
-    allow 2a00:14b0:4200:3500::130:0/112;
-    allow 2a00:14b0:f000:23::/64;
-    allow 10.32.2.0/24;
-    allow 2a00:14b0:42:102::/64;
-    allow 212.12.50.208/29;
-    allow 2a00:14b0:42:105::/64;
-
-    deny all;
+    allow all;
 
     # Redirect a user opening any not set location on id.hamburg.ccc.de to the account management page.
     location ^~ / {

From 247cb031f2e97b608489d6174bf0da1f884f3769 Mon Sep 17 00:00:00 2001
From: Max <max@catcatgo.de>
Date: Fri, 21 Aug 2026 13:53:47 +0200
Subject: [PATCH 11/24] auto update patch versions

---
 renovate.json | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/renovate.json b/renovate.json
index 8139008f..94317fc3 100644
--- a/renovate.json
+++ b/renovate.json
@@ -29,13 +29,17 @@
     // https://docs.renovatebot.com/presets-default/#automergestablenonmajor
     {
       "groupName": "all stable non-major dependencies",
-      "groupSlug": "all-stable-minor-patch",
+      "groupSlug": "all-stable-minor",
       "matchCurrentVersion": "!/^0/",
       "matchUpdateTypes": [
-        "minor",
-        "patch"
+        "minor"
       ]
     },
+    {
+      "matchUpdateTypes": ["patch"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true
+    },
     {
       "matchDatasources": ["docker"],
       "matchPackageNames": ["docker.io/pretix/standalone"],

From 39d95a7b9f22191fb444532d9776e0d53df9bbb2 Mon Sep 17 00:00:00 2001
From: Max <max@catcatgo.de>
Date: Fri, 21 Aug 2026 13:54:19 +0200
Subject: [PATCH 12/24] except keycloak from grouped update PRs

keycloak is a critical service
separating keycloak updates makes it easier to respond quickly to
critical updates or delay them when there are breaking changes
---
 renovate.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/renovate.json b/renovate.json
index 94317fc3..d36e7fef 100644
--- a/renovate.json
+++ b/renovate.json
@@ -33,6 +33,9 @@
       "matchCurrentVersion": "!/^0/",
       "matchUpdateTypes": [
         "minor"
+      ],
+      "excludePackageNames": [
+        "git.hamburg.ccc.de/ccchh/oci-images/keycloak"
       ]
     },
     {

From bf04f2d163e34df3be98ce1355e092b420feb03a Mon Sep 17 00:00:00 2001
From: jtbx <ccc@jtbx.de>
Date: Fri, 4 Sep 2026 20:59:20 +0200
Subject: [PATCH 13/24] Docs: Add dokuwiki upgrade guide

---
 docs/guides/update-dokuwiki.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 docs/guides/update-dokuwiki.md

diff --git a/docs/guides/update-dokuwiki.md b/docs/guides/update-dokuwiki.md
new file mode 100644
index 00000000..02d5942a
--- /dev/null
+++ b/docs/guides/update-dokuwiki.md
@@ -0,0 +1,27 @@
+---
+title: Updating Dokuwiki
+---
+
+!!! success "Goal"
+
+    How to update our wiki (<https://wiki.hamburg.ccc.de>) to the latest version
+
+## 1. Create a Snaphot
+
+Go to the Chaosknoten Proxmox UI and create a snapshot of the `wiki` VM: <https://chaosknoten.hamburg.ccc.de:8006/#v1:0:=qemu%2F127:4:::::29::>
+
+## 2. Update Plugins
+
+- Go to the wiki's extension manager: <https://wiki.hamburg.ccc.de/start?do=admin&page=extension> or go to Admin > Extension Manager
+- Update the "DokuWiki Upgrade Plugin" (if it has updates)
+- Update other plugins while we're here already
+
+## 3. Update Dokuwiki
+
+- Go to the Wiki Upgrade: <https://wiki.hamburg.ccc.de/start?do=admin&page=upgrade> or go to Admin > Wiki Upgrade
+- Click through the steps. Note: Disabling any plugins before the upgrade was not necessary in the past.
+
+## Closing Up
+
+Log out and back in again to verify that the Keycloak connection still works.
+Maybe browse some pages as check if anything is obviously broken.

From d20120d708a8331e9157af46b9c183eb54a52279 Mon Sep 17 00:00:00 2001
From: Renovate <no-reply@git.hamburg.ccc.de>
Date: Fri, 4 Sep 2026 00:17:50 +0000
Subject: [PATCH 14/24] Migrate config renovate.json

---
 renovate.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/renovate.json b/renovate.json
index d36e7fef..2d0a9848 100644
--- a/renovate.json
+++ b/renovate.json
@@ -34,8 +34,8 @@
       "matchUpdateTypes": [
         "minor"
       ],
-      "excludePackageNames": [
-        "git.hamburg.ccc.de/ccchh/oci-images/keycloak"
+      "matchPackageNames": [
+        "!git.hamburg.ccc.de/ccchh/oci-images/keycloak"
       ]
     },
     {

From 6a1caed8568e0880df67abcc33e0ed99cc1d150e Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Wed, 2 Sep 2026 11:01:50 +0200
Subject: [PATCH 15/24] add concept doc for matrix moderation

---
 .../matrix-moderation.md                      | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 docs/concepts-and-configurations/matrix-moderation.md

diff --git a/docs/concepts-and-configurations/matrix-moderation.md b/docs/concepts-and-configurations/matrix-moderation.md
new file mode 100644
index 00000000..d37c507e
--- /dev/null
+++ b/docs/concepts-and-configurations/matrix-moderation.md
@@ -0,0 +1,35 @@
+---
+title: Matrix Moderation
+---
+
+# Matrix Moderation
+
+All Matrix rooms created around CCCHH and which are considered *official* are subject to centralized moderation.
+This moderation is enforced by a [Mjolnir](https://github.com/matrix-org/mjolnir) bot on a techincal level and operated by a dedicated sub-team of the Infra Group.
+
+The moderation team can be reached at [matrix-moderation@hamburg.ccc.de](mailto:matrix-moderation@hamburg.ccc.de).
+
+## Principles and Guidelines
+
+During moderation, we adhere to the following principles:
+
+- No *predictive policing*. We strive for fast and accurate moderation and, while we do incorporate reports from trustworthy sources close to the chaos community, we do not moderate based on gut feelings.
+
+- Prohibited content includes spam, pornography, harassment, and fascist-like behavior. We remove such content (see Guide TODO) and subsequently ban the user responsible (see Guide TODO).
+
+- The CCCHH admin account may be used under special circumstances to issue warnings and explain the moderation team’s decisions in general terms. It does not respond to DMs and does not engage in discussions. If moderation action is to be discussed, people are referred to the moderation team at [matrix-moderation@hamburg.ccc.de](mailto:matrix-moderation@hamburg.ccc.de) instead.
+
+- New Matrix rooms related to CCCHH are **always** created by the CCCHH admin and protected by the moderation bot. See [Matrix: Create a New Room](../guides/matrix-create-room.md) for details on creating rooms.
+
+## How It Works
+
+The bot account `@moderation:hamburg.ccc.de` (Mjolnir) maintains various internal lists of rules that are applied in so-called "Protected Rooms".
+These can include, for example, user bans or entire server bans.
+Additionally, certain automatic monitoring measures (so-called "protections") apply in these rooms, which trigger a configured action if violated.
+For example, a user is not allowed to tag too many other users in a single message, as this is considered spam and results in a kick.
+The bot is controlled and configured via a privileged *CCCHH Moderation Management* room using `!mjolnir` commands.
+There, individual actions can also be triggered through the bot as needed, such as redacting messages, kicking users from all or some channels, etc.
+
+It is also possible to make our moderation bot's local lists available to other entities and subscribe our bot to other entities' lists.
+Our list is published in `#general-moderation:hamburg.ccc.de` and can be made available to others upon request.
+

From 8f07ad8ca44ba4029ba02790963d260bc1c27efb Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Wed, 2 Sep 2026 11:42:53 +0200
Subject: [PATCH 16/24] add guide about matrix room creation

---
 docs/guides/matrix-create-room.md | 53 +++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 docs/guides/matrix-create-room.md

diff --git a/docs/guides/matrix-create-room.md b/docs/guides/matrix-create-room.md
new file mode 100644
index 00000000..d43f6140
--- /dev/null
+++ b/docs/guides/matrix-create-room.md
@@ -0,0 +1,53 @@
+---
+title: "Matrix: Create a New Room"
+---
+
+# Matrix: Create a New Room
+
+!!! success "Goal"
+
+    Create a new matrix room for a CCCHH group or function with correct protections and permissions
+
+## 1. Create the Room
+
+Rooms are always created by the *CCCHH-Admin* Account whose credentials can be found in *infra-secrets*.
+To create a room, log in to https://element.hamburg.ccc.de and click on *New Conversation* -> *New Room*.
+Enter a Room Name and optionally give it an address on the *hamburg.ccc.de* server.
+
+## 2. Configure Room Metadata
+
+Once the room is created, please give it a topic and if possible a room icon.
+This makes it easier to distinguish the many rooms we have.
+
+## 3. Invite the Moderation-Bot
+
+Either perform the following steps via the GUI or enter the displayed commands into the chat window of the new room:
+
+
+1. Invite the User `@moderation:hamburg.ccc.de` to the new room
+   ```
+   /invite @moderation:hamburg.ccc.de
+   ```
+
+2. Give the moderation bot *Admin* Power-Level so that it can properly enforce all protections
+   ```
+   /op @moderation:hamburg.ccc.de 100
+   ```
+
+## 4. Set Up Room Protection
+
+We have now added the moderation bot to the room but this is not enough.
+The bot needs to be told explicitly which rooms it should protect and the newly created one therefore needs to be added to that list.
+
+First, note down the *Internal Room ID* which can be found in the new Rooms settings under the *Advanced* tab.
+Then enter the *CCCHH Moderation Management* room and write the follogin mjolnir command while substituting the copied room id:
+
+```
+!mjolnir rooms add <room-id>
+```
+
+## Closing Up
+
+You should now have a new Matrix Room under moderation protection.
+To verify that everything was done correctly, you can enter `!mjolnir verify` in the *CCCHH Moderation Management* room and observe that the moderation bot does not give you an error.
+

From ddce7783dbfddfbf849e4c9a1eac0fffb7039af5 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Wed, 2 Sep 2026 12:32:13 +0200
Subject: [PATCH 17/24] add guide for common matrix moderation actions

---
 .../matrix-moderation.md                      |  2 +-
 .../guides/matrix-taking-moderation-action.md | 52 +++++++++++++++++++
 2 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 docs/guides/matrix-taking-moderation-action.md

diff --git a/docs/concepts-and-configurations/matrix-moderation.md b/docs/concepts-and-configurations/matrix-moderation.md
index d37c507e..159fbb49 100644
--- a/docs/concepts-and-configurations/matrix-moderation.md
+++ b/docs/concepts-and-configurations/matrix-moderation.md
@@ -15,7 +15,7 @@ During moderation, we adhere to the following principles:
 
 - No *predictive policing*. We strive for fast and accurate moderation and, while we do incorporate reports from trustworthy sources close to the chaos community, we do not moderate based on gut feelings.
 
-- Prohibited content includes spam, pornography, harassment, and fascist-like behavior. We remove such content (see Guide TODO) and subsequently ban the user responsible (see Guide TODO).
+- Prohibited content includes spam, pornography, harassment, and fascist-like behavior. We remove such content and subsequently ban the user responsible (see [Matrix: Taking Moderation Action](../guides/matrix-taking-moderation-action.md)).
 
 - The CCCHH admin account may be used under special circumstances to issue warnings and explain the moderation team’s decisions in general terms. It does not respond to DMs and does not engage in discussions. If moderation action is to be discussed, people are referred to the moderation team at [matrix-moderation@hamburg.ccc.de](mailto:matrix-moderation@hamburg.ccc.de) instead.
 
diff --git a/docs/guides/matrix-taking-moderation-action.md b/docs/guides/matrix-taking-moderation-action.md
new file mode 100644
index 00000000..b1bf69fd
--- /dev/null
+++ b/docs/guides/matrix-taking-moderation-action.md
@@ -0,0 +1,52 @@
+---
+title: "Matrix: Taking Moderation Action"
+---
+
+!!! success "Goal"
+
+    Perform common moderation actions in Matrix using our moderation bot
+
+See the [Matrix-Moderation](../concepts-and-configurations/matrix-moderation.md) Concept for an overview on how the moderation system functions.
+
+All bot actions are triggered through the *CCCHH Moderation Management* room.
+
+!!! warning "Warning"
+
+    Moderation actions should be triggered through the bot to avoid exposing members of the moderation team to harassment.
+    Even if the bot is unwieldy, think before taking action with your personal account and do so on your own scrutiny.
+
+## Banning a User
+
+```
+!mjolnir ban general user <glob> <reason>
+```
+
+- `<glob>` can be a user ID (e.g. `@example:matrix.org`) but also more sophisticated. Be careful when using actual glob syntax as whole servers can be banned even if just a single user is the intended target.
+- `<reason>` is technically optional but should always be supplied so that we know why a certain user was banned in retrospect. The bot supports parsing quotations so `"<reason>"` is usually what you want if more than one word is used.
+
+## Banning a Server
+
+```
+!mjolnir ban server <glob> <reason>
+```
+
+- `<glob>` can be used to ban subdomains of a domain too, e.g. `*.example.com`. If used, an additional `--force` is required after the whole command.
+- `<reason>` should be supplied and supports quotation (`"<reason>") if more than one word is used
+- When a domain is banned, we usually also ban all subdomains too. This needs to be done in two separate commands.
+
+## Redacting a single Message
+
+```
+!mjolnir redact <permalink>
+```
+
+- `<permalink>` is **not** the message ID but the actual *https://matrix.to/#blablabla* link that can be retrieved with most clients through a *Share* or *Copy link to Message* button on an individual message.
+
+## Redacting all Messages of a User
+
+```
+!mjolnir redact <user-id>
+```
+
+- `user-id` the Matrix-ID of the user of whom all messages in all rooms should be redacted (e.g. `@bla:example.com`).
+

From f7c3e2146d9288c3224fe77df01e99c88e809076 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Sun, 6 Sep 2026 14:40:42 +0200
Subject: [PATCH 18/24] migrate mjolnir to draupnir

---
 .sops.yaml                                    |  6 ++---
 .../matrix-moderation.md                      |  2 +-
 docs/guides/matrix-create-room.md             |  6 ++---
 .../guides/matrix-taking-moderation-action.md |  8 +++----
 .../{mjolnir.sops.yaml => draupnir.sops.yaml} | 12 +++++-----
 .../host_vars/{mjolnir.yaml => draupnir.yaml} |  4 ++--
 inventories/chaosknoten/hosts.yaml            | 12 +++++-----
 .../auth-dns/zones/hamburg.ccc.de.zone        |  3 ++-
 .../draupnir/docker_compose/compose.yaml      | 11 +++++++++
 .../draupnir/docker_compose/config.yaml.j2    | 22 ++++++++++++++++++
 .../mjolnir/docker_compose/compose.yaml       | 10 --------
 .../mjolnir/docker_compose/config.yaml.j2     | 23 -------------------
 12 files changed, 60 insertions(+), 59 deletions(-)
 rename inventories/chaosknoten/host_vars/{mjolnir.sops.yaml => draupnir.sops.yaml} (93%)
 rename inventories/chaosknoten/host_vars/{mjolnir.yaml => draupnir.yaml} (58%)
 create mode 100644 resources/chaosknoten/draupnir/docker_compose/compose.yaml
 create mode 100644 resources/chaosknoten/draupnir/docker_compose/config.yaml.j2
 delete mode 100644 resources/chaosknoten/mjolnir/docker_compose/compose.yaml
 delete mode 100644 resources/chaosknoten/mjolnir/docker_compose/config.yaml.j2

diff --git a/.sops.yaml b/.sops.yaml
index 7df285b4..52d69f21 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -37,7 +37,7 @@ keys:
         - &host_ntfy_ansible_pull_age_key age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg
         - &host_spaceapiccc_ansible_pull_age_key age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa
         - &host_acmedns_ansible_pull_age_key age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv
-        - &host_mjolnir_ansible_pull_age_key age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
+        - &host_draupnir_ansible_pull_age_key age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
         - &host_diday_staging_runner_ansible_pull_age_key age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf
         - &host_auth_dns_ansible_pull_age_key age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
         - &host_forgejo_runner_ansible_pull_age_key age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf
@@ -201,12 +201,12 @@ creation_rules:
           *admin_gpg_keys
         age:
           - *host_spaceapiccc_ansible_pull_age_key
-  - path_regex: "inventories/chaosknoten/host_vars/mjolnir\\.sops\\..+"
+  - path_regex: "inventories/chaosknoten/host_vars/draupnir\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
-          - *host_mjolnir_ansible_pull_age_key
+          - *host_draupnir_ansible_pull_age_key
   - path_regex: "inventories/chaosknoten/host_vars/diday-staging-runner\\.sops\\..+"
     key_groups:
       - pgp:
diff --git a/docs/concepts-and-configurations/matrix-moderation.md b/docs/concepts-and-configurations/matrix-moderation.md
index 159fbb49..c4a31ab2 100644
--- a/docs/concepts-and-configurations/matrix-moderation.md
+++ b/docs/concepts-and-configurations/matrix-moderation.md
@@ -23,7 +23,7 @@ During moderation, we adhere to the following principles:
 
 ## How It Works
 
-The bot account `@moderation:hamburg.ccc.de` (Mjolnir) maintains various internal lists of rules that are applied in so-called "Protected Rooms".
+The bot account `@moderation:hamburg.ccc.de` (Draupnir) maintains various internal lists of rules that are applied in so-called "Protected Rooms".
 These can include, for example, user bans or entire server bans.
 Additionally, certain automatic monitoring measures (so-called "protections") apply in these rooms, which trigger a configured action if violated.
 For example, a user is not allowed to tag too many other users in a single message, as this is considered spam and results in a kick.
diff --git a/docs/guides/matrix-create-room.md b/docs/guides/matrix-create-room.md
index d43f6140..582e94c1 100644
--- a/docs/guides/matrix-create-room.md
+++ b/docs/guides/matrix-create-room.md
@@ -40,14 +40,14 @@ We have now added the moderation bot to the room but this is not enough.
 The bot needs to be told explicitly which rooms it should protect and the newly created one therefore needs to be added to that list.
 
 First, note down the *Internal Room ID* which can be found in the new Rooms settings under the *Advanced* tab.
-Then enter the *CCCHH Moderation Management* room and write the follogin mjolnir command while substituting the copied room id:
+Then enter the *CCCHH Moderation Management* room and write the following draupnir command while substituting the copied room id:
 
 ```
-!mjolnir rooms add <room-id>
+!draupnir rooms add <room-id>
 ```
 
 ## Closing Up
 
 You should now have a new Matrix Room under moderation protection.
-To verify that everything was done correctly, you can enter `!mjolnir verify` in the *CCCHH Moderation Management* room and observe that the moderation bot does not give you an error.
+To verify that everything was done correctly, you can enter `!draupnir verify` in the *CCCHH Moderation Management* room and observe that the moderation bot does not give you an error.
 
diff --git a/docs/guides/matrix-taking-moderation-action.md b/docs/guides/matrix-taking-moderation-action.md
index b1bf69fd..90f53657 100644
--- a/docs/guides/matrix-taking-moderation-action.md
+++ b/docs/guides/matrix-taking-moderation-action.md
@@ -18,7 +18,7 @@ All bot actions are triggered through the *CCCHH Moderation Management* room.
 ## Banning a User
 
 ```
-!mjolnir ban general user <glob> <reason>
+!draupnir ban general user <glob> <reason>
 ```
 
 - `<glob>` can be a user ID (e.g. `@example:matrix.org`) but also more sophisticated. Be careful when using actual glob syntax as whole servers can be banned even if just a single user is the intended target.
@@ -27,7 +27,7 @@ All bot actions are triggered through the *CCCHH Moderation Management* room.
 ## Banning a Server
 
 ```
-!mjolnir ban server <glob> <reason>
+!draupnir ban server <glob> <reason>
 ```
 
 - `<glob>` can be used to ban subdomains of a domain too, e.g. `*.example.com`. If used, an additional `--force` is required after the whole command.
@@ -37,7 +37,7 @@ All bot actions are triggered through the *CCCHH Moderation Management* room.
 ## Redacting a single Message
 
 ```
-!mjolnir redact <permalink>
+!draupnir redact <permalink>
 ```
 
 - `<permalink>` is **not** the message ID but the actual *https://matrix.to/#blablabla* link that can be retrieved with most clients through a *Share* or *Copy link to Message* button on an individual message.
@@ -45,7 +45,7 @@ All bot actions are triggered through the *CCCHH Moderation Management* room.
 ## Redacting all Messages of a User
 
 ```
-!mjolnir redact <user-id>
+!draupnir redact <user-id>
 ```
 
 - `user-id` the Matrix-ID of the user of whom all messages in all rooms should be redacted (e.g. `@bla:example.com`).
diff --git a/inventories/chaosknoten/host_vars/mjolnir.sops.yaml b/inventories/chaosknoten/host_vars/draupnir.sops.yaml
similarity index 93%
rename from inventories/chaosknoten/host_vars/mjolnir.sops.yaml
rename to inventories/chaosknoten/host_vars/draupnir.sops.yaml
index cd0972ed..36fe2cf6 100644
--- a/inventories/chaosknoten/host_vars/mjolnir.sops.yaml
+++ b/inventories/chaosknoten/host_vars/draupnir.sops.yaml
@@ -1,9 +1,8 @@
 ansible_pull__age_private_key: ENC[AES256_GCM,data:mUKh1aFJ8hn0GqfWQw5pWSAj9qaj5wH/NrHhEp9sdOYfNCBPp1dfYIDTqFAnPNz2SLzoQ+HIuPYxSCaWNq0zS8TStBelUoEGDuE=,iv:rbVLKpUzHr2ZZsHlRZtBp9E8IX9TVAa/nJAXfnh4fJQ=,tag:wT/0Ku9yrwD9snnzMigU3g==,type:str]
-secret__mjolnir_matrix_user_password: ENC[AES256_GCM,data:FDCZW5dt1HHxLDSqLi3rH5eX1Go7qKQDK9+w0q8IjpTSNFNZg91B19V4voDx+2UNv2l1OUwAngAgckEZ0mSndA==,iv:c+zW3LhoqAhuu3PWlXiyZ8r8TGgF/RnswnI+fo08EBE=,tag:lPrXolXFD+5gpoGkm4GMog==,type:str]
+secret__draupnir_matrix_user_token: ENC[AES256_GCM,data:WtWZQh8Khwv4bq0U0vg2203P4PnLHNRVBTN59NqGX9PggVi2rRy3PZc=,iv:L3d+xI85IXB0DfynjQxhAjAmZ3rKLTFVWCcBcdqxzF8=,tag:qAiv4M1EbKVd+ysWhV/JIA==,type:str]
 sops:
   age:
-    - recipient: age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
-      enc: |
+    - enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
         YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3b2MzYzFWaHJ4M3NkaDkw
         cEYzVDhQSGQ4SGpJQllmZGNTUUhGSy9KZkZjCi9CY0pRVTh3SUQyK0dlckMvVGI1
@@ -11,8 +10,9 @@ sops:
         V09XOXY4bHBpbWxpdTNycHVwVUptdE0KsksBHnhpGmag6KZmeUjI6GzYPVvG06bw
         mGhQf8hwa4m7tTtD806kVuKJ/nXhOZXFr1Gp65iWGBfT5lJk2VIayQ==
         -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-02-11T01:05:26Z"
-  mac: ENC[AES256_GCM,data:7DdCLStFif0EhqsgthwZD50v+FPa1drUmBKUhmWw9FKtCBKmNM5LbCI5TvKGJqq8gtKiMUKpOf/pA/8qGNavfl8MdRrhm9inlkHgkwgLQwAx7/ds8uHexVBjG2gV+hMPtoNCnGRkQRHwrepz/7L6Y5L5UUhWHEUEhMuxrejzNBY=,iv:SpziMsqQ34/hAH1HkbGjqG4ZyZybcWE9Xp5xWkPADGA=,tag:eYWlsKj+OPMcpU1u1Caavg==,type:str]
+      recipient: age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
+  lastmodified: "2026-09-06T11:30:21Z"
+  mac: ENC[AES256_GCM,data:tTOVUVlU2BOD7Xxxmn6I6b8V+zouNgyNfet18JZKuIrAqRgag/oKadoa+lBjiH/JiCUunNueACf14wsrw5eOdpJiL1zBg8sK6kyPDrI1IRGMJWXX0x01DJSL1INNz6fKdHTA+hqI0w6lTWPiLwgTbsfyMwF+lutaJv79cANC3UU=,iv:i34JCNJHLgQwZAKGrF1dX1TZSvOnB3HqQe/BvA9HTtY=,tag:8LY0AdEtVFTVY2d0dbiuDA==,type:str]
   pgp:
     - created_at: "2026-05-20T02:08:45Z"
       enc: |-
@@ -185,4 +185,4 @@ sops:
         -----END PGP MESSAGE-----
       fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
   unencrypted_suffix: _unencrypted
-  version: 3.11.0
+  version: 3.13.3
diff --git a/inventories/chaosknoten/host_vars/mjolnir.yaml b/inventories/chaosknoten/host_vars/draupnir.yaml
similarity index 58%
rename from inventories/chaosknoten/host_vars/mjolnir.yaml
rename to inventories/chaosknoten/host_vars/draupnir.yaml
index 7b6001af..16e8c7d0 100644
--- a/inventories/chaosknoten/host_vars/mjolnir.yaml
+++ b/inventories/chaosknoten/host_vars/draupnir.yaml
@@ -1,4 +1,4 @@
-docker_compose__compose_file_content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/mjolnir/docker_compose/compose.yaml') }}"
+docker_compose__compose_file_content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/draupnir/docker_compose/compose.yaml') }}"
 docker_compose__configuration_files:
   - name: config.yaml
-    content: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/mjolnir/docker_compose/config.yaml.j2') }}"
+    content: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/draupnir/docker_compose/config.yaml.j2') }}"
diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml
index 0c841fb6..7d641ae3 100644
--- a/inventories/chaosknoten/hosts.yaml
+++ b/inventories/chaosknoten/hosts.yaml
@@ -36,8 +36,8 @@ all:
     lists:
       ansible_host: lists.hamburg.ccc.de
       ansible_user: chaos
-    mjolnir:
-      ansible_host: mjolnir.hosts.hamburg.ccc.de
+    draupnir:
+      ansible_host: draupnir.hosts.hamburg.ccc.de
       ansible_user: chaos
       ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
     mumble:
@@ -132,7 +132,7 @@ base_config_hosts:
     sunders:
     renovate:
     spaceapiccc:
-    mjolnir:
+    draupnir:
     auth-dns:
     forgejo-runner:
     forgejo-runner-external:
@@ -158,7 +158,7 @@ docker_compose_hosts:
     ntfy:
     sunders:
     spaceapiccc:
-    mjolnir:
+    draupnir:
 nextcloud_hosts:
   hosts:
     cloud:
@@ -246,7 +246,7 @@ infrastructure_authorized_keys_hosts:
     sunders:
     renovate:
     spaceapiccc:
-    mjolnir:
+    draupnir:
     auth-dns:
     lists:
     forgejo-runner:
@@ -284,7 +284,7 @@ ansible_pull_hosts:
     zammad:
     ntfy:
     spaceapiccc:
-    mjolnir:
+    draupnir:
     auth-dns:
     forgejo-runner:
     forgejo-runner-external:
diff --git a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
index 96df3215..f3512af1 100644
--- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
+++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone
@@ -499,7 +499,8 @@ keycloak.hosts                      IN  AAAA            2a00:14b0:42:102::6
 onlyoffice.hosts                    IN  AAAA            2a00:14b0:42:102::7
 renovate.hosts                      IN  AAAA            2a00:14b0:42:102::8
 sunders.hosts                       IN  AAAA            2a00:14b0:42:102::9
-mjolnir.hosts                       IN  AAAA            2a00:14b0:42:102::a
+draupnir.hosts                      IN  AAAA            2a00:14b0:42:102::a
+mjolnir.hosts                       IN  CNAME           draupnir.hosts
 netbox.hosts                        IN  AAAA            2a00:14b0:42:102::b
 tickets.hosts                       IN  AAAA            2a00:14b0:42:102::c
 zammad.hosts                        IN  AAAA            2a00:14b0:42:102::d
diff --git a/resources/chaosknoten/draupnir/docker_compose/compose.yaml b/resources/chaosknoten/draupnir/docker_compose/compose.yaml
new file mode 100644
index 00000000..42bf8fda
--- /dev/null
+++ b/resources/chaosknoten/draupnir/docker_compose/compose.yaml
@@ -0,0 +1,11 @@
+# Links & Resources
+# https://github.com/matrix-org/mjolnir/blob/main/docs/setup_docker.md
+
+services:
+  draupnir:
+    image: ghcr.io/the-draupnir-project/draupnir:v3.1.0
+    command: [ "bot", "--draupnir-config", "/etc/draupnir/production.yaml" ]
+    restart: unless-stopped
+    volumes:
+      - ./draupnir_data:/data
+      - ./configs/config.yaml:/etc/draupnir/production.yaml:ro
diff --git a/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2 b/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2
new file mode 100644
index 00000000..20a73959
--- /dev/null
+++ b/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2
@@ -0,0 +1,22 @@
+# https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml
+
+homeserverUrl: "https://matrix.hamburg.ccc.de"
+rawHomeserverUrl: "https://matrix.hamburg.ccc.de"
+accessToken: "{{ secret__draupnir_matrix_user_token }}"
+
+dataPath: "/data/storage"
+logLevel: "INFO"
+recordIgnoredInvites: true
+managementRoom: "#moderation-management:hamburg.ccc.de"
+experimentalRustCrypto: true
+automaticallyRedactForReasons:
+  - "spam"
+  - "advertising"
+  - "porn"
+  - "harassmet"
+
+# currently not working because /_synapse is not routed via reverse proxy
+pollReports: false
+
+# this knob can turn of moderation action temporarily
+noop: false
diff --git a/resources/chaosknoten/mjolnir/docker_compose/compose.yaml b/resources/chaosknoten/mjolnir/docker_compose/compose.yaml
deleted file mode 100644
index 963c9d98..00000000
--- a/resources/chaosknoten/mjolnir/docker_compose/compose.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-# Links & Resources
-# https://github.com/matrix-org/mjolnir/blob/main/docs/setup_docker.md
-
-services:
-  mjolnir:
-    image: docker.io/matrixdotorg/mjolnir:v1.12.1
-    restart: unless-stopped
-    volumes:
-      - ./mjolnir_data:/data
-      - ./configs/config.yaml:/data/config/production.yaml:ro
diff --git a/resources/chaosknoten/mjolnir/docker_compose/config.yaml.j2 b/resources/chaosknoten/mjolnir/docker_compose/config.yaml.j2
deleted file mode 100644
index ff6e8fa3..00000000
--- a/resources/chaosknoten/mjolnir/docker_compose/config.yaml.j2
+++ /dev/null
@@ -1,23 +0,0 @@
-# https://github.com/matrix-org/mjolnir/blob/main/config/default.yaml
-
-homeserverUrl: "https://matrix.hamburg.ccc.de"
-rawHomeserverUrl: "https://matrix.hamburg.ccc.de"
-# Mjolnir should be able to retrieve an access token itself
-encryption:
-  use: true
-  username: "moderation"
-  password: {{ secret__mjolnir_matrix_user_password }}
-dataPath: "/data/storage"
-autojoinOnlyIfManager: true
-recordIgnoredInvites: true
-# The native encryption backend doesn't seem to support v12 rooms yet.
-# https://github.com/matrix-org/mjolnir/issues/641
-managementRoom: "#moderation-management-v11:hamburg.ccc.de"
-forwardMentionsToManagementRoom: false
-verboseLogging: false
-logLevel: "INFO"
-syncOnStartup: true
-verifyPermissionsOnStartup: true
-noop: false
-fasterMembershipChecks: false
-protectAllJoinedRooms: true

From e3635939f4c34b777b4d82f6daeb0d5273c2ffa0 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Mon, 7 Sep 2026 18:38:39 +0200
Subject: [PATCH 19/24] fix draupnir ban docs

---
 docs/guides/matrix-taking-moderation-action.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/guides/matrix-taking-moderation-action.md b/docs/guides/matrix-taking-moderation-action.md
index 90f53657..a516989c 100644
--- a/docs/guides/matrix-taking-moderation-action.md
+++ b/docs/guides/matrix-taking-moderation-action.md
@@ -18,7 +18,7 @@ All bot actions are triggered through the *CCCHH Moderation Management* room.
 ## Banning a User
 
 ```
-!draupnir ban general user <glob> <reason>
+!draupnir ban user general <glob> <reason>
 ```
 
 - `<glob>` can be a user ID (e.g. `@example:matrix.org`) but also more sophisticated. Be careful when using actual glob syntax as whole servers can be banned even if just a single user is the intended target.
@@ -27,7 +27,7 @@ All bot actions are triggered through the *CCCHH Moderation Management* room.
 ## Banning a Server
 
 ```
-!draupnir ban server <glob> <reason>
+!draupnir ban server general <glob> <reason>
 ```
 
 - `<glob>` can be used to ban subdomains of a domain too, e.g. `*.example.com`. If used, an additional `--force` is required after the whole command.

From f2a6ae5de9bc08335cb39c7534be20a06154e127 Mon Sep 17 00:00:00 2001
From: Renovate <no-reply@git.hamburg.ccc.de>
Date: Sat, 5 Sep 2026 21:30:54 +0000
Subject: [PATCH 20/24] Update docker.io/xenrox/ntfy-alertmanager Docker tag to
 v1.0.1

---
 .../chaosknoten/grafana/docker_compose/compose.yaml.j2    | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
index 5ae05997..f08c7994 100644
--- a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
@@ -70,7 +70,7 @@ services:
       - loki_data:/var/loki
 
   ntfy-alertmanager-ccchh-critical:
-    image: docker.io/xenrox/ntfy-alertmanager:1.0.0
+    image: docker.io/xenrox/ntfy-alertmanager:1.0.1
     container_name: ntfy-alertmanager-ccchh-critical
     volumes:
       - ./configs/ntfy-alertmanager-ccchh-critical:/etc/ntfy-alertmanager/config
@@ -79,7 +79,7 @@ services:
     restart: unless-stopped
 
   ntfy-alertmanager-fux-critical:
-    image: docker.io/xenrox/ntfy-alertmanager:1.0.0
+    image: docker.io/xenrox/ntfy-alertmanager:1.0.1
     container_name: ntfy-alertmanager-fux-critical
     volumes:
       - ./configs/ntfy-alertmanager-fux-critical:/etc/ntfy-alertmanager/config
@@ -88,7 +88,7 @@ services:
     restart: unless-stopped
 
   ntfy-alertmanager-ccchh:
-    image: docker.io/xenrox/ntfy-alertmanager:1.0.0
+    image: docker.io/xenrox/ntfy-alertmanager:1.0.1
     container_name: ntfy-alertmanager-ccchh
     volumes:
       - ./configs/ntfy-alertmanager-ccchh:/etc/ntfy-alertmanager/config
@@ -97,7 +97,7 @@ services:
     restart: unless-stopped
 
   ntfy-alertmanager-fux:
-    image: docker.io/xenrox/ntfy-alertmanager:1.0.0
+    image: docker.io/xenrox/ntfy-alertmanager:1.0.1
     container_name: ntfy-alertmanager-fux
     volumes:
       - ./configs/ntfy-alertmanager-fux:/etc/ntfy-alertmanager/config

From 129006320417115454b64f2593a1b0b1d47bd9e3 Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Tue, 8 Sep 2026 15:44:10 +0200
Subject: [PATCH 21/24] update our moderation policy room access policy

---
 docs/concepts-and-configurations/matrix-moderation.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/concepts-and-configurations/matrix-moderation.md b/docs/concepts-and-configurations/matrix-moderation.md
index c4a31ab2..4da6964d 100644
--- a/docs/concepts-and-configurations/matrix-moderation.md
+++ b/docs/concepts-and-configurations/matrix-moderation.md
@@ -31,5 +31,5 @@ The bot is controlled and configured via a privileged *CCCHH Moderation Manageme
 There, individual actions can also be triggered through the bot as needed, such as redacting messages, kicking users from all or some channels, etc.
 
 It is also possible to make our moderation bot's local lists available to other entities and subscribe our bot to other entities' lists.
-Our list is published in `#general-moderation:hamburg.ccc.de` and can be made available to others upon request.
+Our list is published in `#general-moderation:hamburg.ccc.de` where other moderation bots can freely watch it.
 

From 4bdd36b8f7c87c023090792471ca7c4edddfd36f Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Fri, 11 Sep 2026 10:09:48 +0200
Subject: [PATCH 22/24] update knot role to support more operational variety

Now secondary zones, dynamic zones, interpeted catalog zones, etc.
are supported by our knot role
---
 .../chaosknoten/host_vars/auth-dns.sops.yaml  |  15 +-
 .../chaosknoten/host_vars/auth-dns.yaml       |  11 +-
 roles/knot/defaults/main.yaml                 |   9 ++
 roles/knot/meta/argument_specs.yaml           | 132 ++++++++++++++++--
 roles/knot/tasks/02-configure.yaml            |  16 +--
 roles/knot/tasks/main.yaml                    |   9 +-
 roles/knot/templates/knot.conf.j2             | 120 ++++++++++++++--
 roles/knot/templates/netplan-disable-ra.yaml  |  13 --
 8 files changed, 264 insertions(+), 61 deletions(-)
 delete mode 100644 roles/knot/templates/netplan-disable-ra.yaml

diff --git a/inventories/chaosknoten/host_vars/auth-dns.sops.yaml b/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
index 78832249..fbf06b66 100644
--- a/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
+++ b/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
@@ -1,9 +1,11 @@
 ansible_pull__age_private_key: ENC[AES256_GCM,data:2kBG8j8JHa/dlXgWMdbSobulFdVunf052T1QQfm1X2vpEZx2HPCL87fWea+O0WOg7+eoMYbiShu0Vw1eTjb+687LjU8l4cj2JWIajnYfDGH+ipWXojxj613C3RZV3JfDOclVTwP8fCHu7z7P3fKrsKWb5d3t2ohTT+sGdVdimakAOf192CkufcVIthq2imiWbntiMTOdMGJxyIjqT2Io2H89nSbJXkONsuHCF/PbxhryB2LZbl8aZV32knk=,iv:hpscVc7iO4r/h31vS6Zno2pkEsgA2uR7wD/1PjH1znM=,tag:ypiwFtgeXuj4gOsgTCRTBw==,type:str]
-knot__dnssec_key_secret: ENC[AES256_GCM,data:WPFTLyJIttFtqqTZV2fGN0Tt1vRS318TGmd2YqNzYisE3TBi6Z2aClxuYh56Q+j7TUQwCvga3jd5w017sEz3kA==,iv:umaFHBCy9AZgNFv7uXLCtO0o/NZDAZ1QNg5DcGHWEW8=,tag:oR92C1Uj5iXU9L02MqzGSQ==,type:str]
+knot__keys:
+  - id: ENC[AES256_GCM,data:ff7Z1SHmKVseX4hguwcfrqLKyDKu3Imw1Q==,iv:Ds5T3cvi2XYAa3C8mbgYjN8AHM4FsKR2RTPvykWgy2E=,tag:7Gveno0zsLf3bDOYgkQkbw==,type:str]
+    secret: ENC[AES256_GCM,data:dJcVnqQ6hlA/xp4NQ5s9by+z9cm5oWD7KAlPX+kDsvSJn33YiZ/A/wf0jfT+FeVLaBerQ6WipxZs90rp8rD+dg==,iv:JVby6vORdqChps6cRx1EJPNBC7+M0Vgp1ji1nQtv3K4=,tag:X0KggJahlTOAowTNnpPs2g==,type:str]
+    algorithm: ENC[AES256_GCM,data:r7uojDN+o1yYgaY=,iv:KBWKZbd+5qZstuMh6gseq/vC86UB/l9m4wVZpA4usPk=,tag:gfU3asmwOIgxJQsqPG712g==,type:str]
 sops:
   age:
-    - recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
-      enc: |
+    - enc: |
         -----BEGIN AGE ENCRYPTED FILE-----
         YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArVUxoOFhZdi9PSkZlU3pw
         VW0vNVRTSG9EamUvVGR0dnN6ajcwTXdlQkdZCkFGVWxPcTNSOGtJdlpSMXJxOFBX
@@ -11,8 +13,9 @@ sops:
         SHhROG5nMGp2d3dwWVJsZk55TW93dU0KnW2ZhU6OhwwPBIxcO1xP+W8DV5Obj6ov
         Hgb8MQ6i9FlhAN/P8onBsqvbh0ttBEFQ6aRJj5njKs/MMfKUk9Q25g==
         -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2026-05-01T17:08:09Z"
-  mac: ENC[AES256_GCM,data:TaMWf1ESs8nYzxkElMYtsz+/Be0PtI7FA0q6IFK+ob4dl/EN+AeTD7Pp0MZF8zcRvZ4hF0Ybimet5bwVR+d7UIXlXz3qP//pX68JDCvcLMQuhNtm6Ws+mwVxkpxEvBr1PtxlSvcQ76vH3ryEsXkP84gmlCDEdX1GAZYZ9ZS3Cfk=,iv:g3tzUfTPNUQyOAxWJEFPHg0IAPAzQgwYABHm4mFOOrI=,tag:C6KE/bg/3jS7Wc56y6YOJQ==,type:str]
+      recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
+  lastmodified: "2026-09-11T08:40:23Z"
+  mac: ENC[AES256_GCM,data:UrncHXwMWUzs5pciDVUGJ885EBsPfrOFswzDOej2pQOTrp6+YomluHivy/L5niSYb05HaGy+9puw35+d+9SXQbgoI5WbwYo2LQ2MggMWSchnnZoy3O5S6LLjBhcvebDv4/1JGvftyBS1LnU7mmJaMekV5KASXaGyuwKumsdTojA=,iv:HJqCXtqQErP/50tR7LL2eAN574NkVO/3QfYsK1q9tt4=,tag:BniLURhadzSliPYz0cRgkA==,type:str]
   pgp:
     - created_at: "2026-05-20T02:08:47Z"
       enc: |-
@@ -185,4 +188,4 @@ sops:
         -----END PGP MESSAGE-----
       fp: 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
   unencrypted_suffix: _unencrypted
-  version: 3.12.1
+  version: 3.13.3
diff --git a/inventories/chaosknoten/host_vars/auth-dns.yaml b/inventories/chaosknoten/host_vars/auth-dns.yaml
index 7d220bcb..035e0328 100644
--- a/inventories/chaosknoten/host_vars/auth-dns.yaml
+++ b/inventories/chaosknoten/host_vars/auth-dns.yaml
@@ -3,18 +3,21 @@ deploy_systemd_resolved_config__enable: false
 
 alloy_config_additional: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/auth-dns/alloy/knot-exporter.alloy') }}"
 
-knot__dnssec_key_id: "auth-dns.hamburg.ccc.de-1"
 knot__remotes:
   - id: erfadns.ber.ccc.de
     address: [ "2a02:8000:1000:101::196", "185.106.84.196" ]
+    via: [ "2a00:14b0:4200:3000:124::1", "212.12.48.124" ]
   - id: ns.vie.ccc.de
     address: [ "2a02:1b8:10:31::228", "146.255.57.228" ]
+    via: [ "2a00:14b0:4200:3000:124::1", "212.12.48.124" ]
+  # - id: cccfr-de-hidden-primary
+  #   address: [ "89.163.204.252" ]
 
 knot__catalog_zones:
   - domain: "hamburg.ccc.de.catalog."
     notify_targets: [ "erfadns.ber.ccc.de" ]
 
-knot__zones:
+knot__primary_zones:
   - domain: "hh.ccc.de."
     catalog_member: "hamburg.ccc.de.catalog."
     notify_targets: [ "erfadns.ber.ccc.de" ]
@@ -48,3 +51,7 @@ knot__zones:
   - domain: "3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa."
     notify_targets: [ "erfadns.ber.ccc.de" ]
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa.zone') }}"
+
+# knot__catalog_secondary_zones:
+#   - domain: "cccfr.catalog.invalid"
+#     primary: "cccfr-de-hidden-primary"
diff --git a/roles/knot/defaults/main.yaml b/roles/knot/defaults/main.yaml
index 50a3ffb5..572abe28 100644
--- a/roles/knot/defaults/main.yaml
+++ b/roles/knot/defaults/main.yaml
@@ -1,2 +1,11 @@
 ---
+knot__deploy_prometheus_exporter: true
+knot__log_level: info
 knot__remotes: [ ]
+knot__keys: [ ]
+knot__catalog_zones: [ ]
+knot__primary_zones: [ ]
+knot__catalog_secondary_zones: [ ]
+knot__secondary_zones: [ ]
+knot__dynamic_zones: [ ]
+knot__acls: [ ]
diff --git a/roles/knot/meta/argument_specs.yaml b/roles/knot/meta/argument_specs.yaml
index 40a58238..61a529b1 100644
--- a/roles/knot/meta/argument_specs.yaml
+++ b/roles/knot/meta/argument_specs.yaml
@@ -2,14 +2,15 @@
 argument_specs:
   main:
     options:
-      knot__dnssec_key_id:
-        description: The id of the TSIG key which knot will use for zone transfer signing
+      knot__log_level:
         type: str
-        required: true
-      knot__dnssec_key_secret:
-        description: The secret value of the TSIG key which knot will use for zone transfer signing
-        type: str
-        required: true
+        required: false
+
+      knot__deploy_prometheus_exporter:
+        type: bool
+        required: false
+        description: Whether a prometheus exporter for knot should also be installed
+
       knot__remotes:
         description:
           - A list of definitions for remote nameservers that are used for different purposes
@@ -25,11 +26,19 @@ argument_specs:
             type: list
             required: true
             elements: str
+          key:
+            type: str
+            required: false
+          via:
+            type: list
+            elements: str
+            required: false
+
       knot__catalog_zones:
         description: A list of catalog zones that will be served by knot
         type: list
         elements: dict
-        required: true
+        required: false
         options:
           domain:
             type: str
@@ -38,11 +47,12 @@ argument_specs:
             type: list
             elements: str
             required: false
-      knot__zones:
+
+      knot__primary_zones:
         description: A list of user zones that will be served by knot
         type: list
         elements: dict
-        required: true
+        required: false
         options:
           domain:
             type: str
@@ -57,3 +67,105 @@ argument_specs:
           content:
             type: str
             required: true
+
+      knot__dynamic_zones:
+        description: A list of user zones operated via DDNS that will be served by knot
+        type: list
+        elements: dict
+        required: false
+        options:
+          domain:
+            type: str
+            required: true
+          notify_targets:
+            type: list
+            elements: str
+            required: false
+          catalog_member:
+            type: str
+            required: false
+          acl:
+            type: list
+            elements: str
+            required: true
+
+      knot__secondary_zones:
+        description: A list of secondary zones that will be served by knot
+        required: false
+        type: list
+        elements: dict
+        options:
+          domain:
+            type: str
+            required: true
+          notify_targets:
+            type: list
+            elements: str
+            required: false
+          catalog_member:
+            type: str
+            required: false
+          primary:
+            type: str
+            required: true
+
+      knot__catalog_secondary_zones:
+        description: A list of zones which are catalog secondaries and which will generate new zones based on the catalog content
+        type: list
+        elements: dict
+        required: false
+        options:
+          domain:
+            type: str
+            required: true
+          notify_targets:
+            type: list
+            elements: str
+            required: false
+          primary:
+            type: str
+            required: true
+
+      knot__keys:
+        description: TSIG Key stanzas used by knot
+        required: false
+        type: list
+        elements: dict
+        options:
+          id:
+            type: str
+            required: true
+          algorithm:
+            type: str
+            required: false
+          secret:
+            type: str
+            required: true
+
+      knot__acls:
+        description: ACL stanzas
+        required: false
+        type: list
+        elements: dict
+        options:
+          id:
+            type: str
+            required: true
+          address:
+            type: list
+            elements: str
+            required: false
+          key:
+            type: str
+            required: false
+          remote:
+            type: list
+            elements: str
+            required: false
+          action:
+            type: str
+            required: false
+          update_type:
+            type: list
+            elements: str
+            required: false
diff --git a/roles/knot/tasks/02-configure.yaml b/roles/knot/tasks/02-configure.yaml
index e79143fc..fe4be107 100644
--- a/roles/knot/tasks/02-configure.yaml
+++ b/roles/knot/tasks/02-configure.yaml
@@ -22,7 +22,7 @@
 - name: Deploy configured zones
   become: true
   notify: reload knot
-  loop: "{{ knot__zones }}"
+  loop: "{{ knot__primary_zones }}"
   loop_control:
     label: "{{ item.domain }}"
   vars:
@@ -34,17 +34,3 @@
     group: knot
     mode: u=rw,g=r
     validate: "kzonecheck -v -o '{{ item.domain }}' %s"
-
-# this seems weird but hear me out:
-# if we don't disable SLAAC, the node automatically gets an address based on IPv6 Router-Advertisements
-# this results in outgoing zone transfers failing because knot will prefer to use the dynamic address over the statically configured one.
-# so because we are configuring a DNS Nameserver where known IP-Addresses are actually important for ACL reasons, SLAAC is disabled
-- name: Disable IPv6 SLAAC
-  become: true
-  notify: netplan apply
-  ansible.builtin.template:
-    src: "netplan-disable-ra.yaml"
-    dest: "/etc/netplan/10-disable-ra.yaml"
-    owner: root
-    group: root
-    mode: u=rw,g=,o=
diff --git a/roles/knot/tasks/main.yaml b/roles/knot/tasks/main.yaml
index bdf5cf78..145dc582 100644
--- a/roles/knot/tasks/main.yaml
+++ b/roles/knot/tasks/main.yaml
@@ -1,4 +1,7 @@
 ---
-- ansible.builtin.import_tasks: 01-install.yaml # noqa: name[missing]
-- ansible.builtin.import_tasks: 02-configure.yaml # noqa: name[missing]
-- ansible.builtin.import_tasks: 03-configure-exporter.yaml # noqa: name[missing]
+- tags: [ knot ]
+  block:
+    - ansible.builtin.import_tasks: 01-install.yaml # noqa: name[missing]
+    - ansible.builtin.import_tasks: 02-configure.yaml # noqa: name[missing]
+    - ansible.builtin.include_tasks: 03-configure-exporter.yaml # noqa: name[missing]
+      when: knot__deploy_prometheus_exporter
diff --git a/roles/knot/templates/knot.conf.j2 b/roles/knot/templates/knot.conf.j2
index 45a0f8d9..03c46ffe 100644
--- a/roles/knot/templates/knot.conf.j2
+++ b/roles/knot/templates/knot.conf.j2
@@ -9,15 +9,17 @@ server:
 
 log:
   - target: syslog
-    any: info
+    any: {{ knot__log_level }}
 
 database:
     storage: "/var/lib/knot"
 
 key:
-  - id: {{ knot__dnssec_key_id }}
-    algorithm: hmac-sha512
-    secret: "{{ knot__dnssec_key_secret }}"
+  {% for i_key in knot__keys -%}
+  - id: "{{ i_key.id }}"
+    algorithm: "{{ i_key.algorithm | default("hmac-sha256") }}"
+    secret: "{{ i_key.secret }}"
+  {% endfor %}
 
 remote:
   # static, external and public remote used for DNSSEC KSK checking
@@ -28,6 +30,13 @@ remote:
   {% for i_remote in knot__remotes -%}
   - id: "{{ i_remote.id }}"
     address: [ {% for i_addr in i_remote.address %}"{{ i_addr}}"{% if not loop.last %},{% endif %} {% endfor %} ]
+    {% if i_remote.via | default(None) -%}
+    via: [ {% for i_via in i_remote.via %}"{{ i_via }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% endif -%}
+    {% if i_remote.key | default(None) -%}
+    key: "{{ i_remote.key }}"
+    {% endif %}
+
   {% endfor %}
   {% endif %}
 
@@ -46,10 +55,33 @@ policy:
     nsec3: true
     nsec3-salt-length: 0
 
+# explicit acl configurations
+# we mostly rely on automatic ACLs but for some dynamic zones, explicit allow stanzas are required
+acl:
+  {% for i_acl in knot__acls -%}
+  - id: "{{ i_acl.id }}"
+    {% if i_acl.address | default(None) -%}
+    address: [ {% for i_addr in i_acl.address %}"{{ i_addr}}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% endif -%}
+    {% if i_acl.key | default(None) -%}
+    key: "{{ i_acl.key }}"
+    {% endif -%}
+    {% if i_acl.remote | default(None) -%}
+    remote: "{{ i_acl.remote }}"
+    {% endif -%}
+    {% if i_acl.action | default(None) -%}
+    action: "{{ i_acl.action }}"
+    {% endif -%}
+    {% if i_acl.update_type | default(None) -%}
+    update-type: [ {% for i_addr in i_acl.update_type %}"{{ i_addr}}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% endif %}
+
+  {% endfor %}
+
 # define default settings that apply to all zones
 template:
-  # template for general-purpose user zones
-  - id: default
+  # template for general-purpose primary zones
+  - id: primary
     storage: "/etc/knot/zones"
     file: "%s.zone"
     semantic-checks: on
@@ -57,17 +89,45 @@ template:
     zonefile-load: difference-no-serial
     serial-policy: dateserial
     journal-content: all
-    default-ttl: 7200
     dnssec-signing: on
     dnssec-policy: default
 
-    {# catalog-role: member #}
-    {# catalog-zone: hamburg.ccc.de.catalog. #}
+  # template for generic secondary zones
+  - id: secondary
+    storage: "/var/lib/knot/secondary_zones/"
+    dnssec-signing: off
+
+  # template for zones that support dynamic updates
+  - id: dynamic-primary
+    storage: "/var/lib/knot/dynamic_zones/"
+    zonefile-load: whole
+    journal-content: changes
+    dnssec-signing: on
+    dnssec-policy: default
 
   # template for automatically created special zones
   - id: catalog
     catalog-role: generate
     dnssec-signing: off
+    storage: "/var/lib/knot/catalog_zones/"
+
+  # template for secondary catalog zones (they are interpreted and generate secondary zones based on their content)
+  - id: catalog-secondary
+    catalog-role: interpret
+    dnssec-signing: off
+    storage: "/var/lib/knot/secondary_zones/"
+
+  # templates for secondary catalog member zones
+  # these templates are for zones which get spawned by catalog zones
+  # unfortunately we need one template per interpreted catalog zone because it must include all information required for that zone to work as secondary
+  # it reuses master and notify values from the catalog zones
+  {% for i_zone in knot__catalog_secondary_zones -%}
+  - id: catalog-secondary-member-{{ i_zone.domain }}
+    storage: "/var/lib/knot/secondary_zones/"
+    dnssec-signing: off
+    master: {{ i_zone.primary }}
+
+  {% endfor %}
 
 
 # define zones on this server
@@ -80,10 +140,10 @@ zone:
     notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
   {% endfor %}
 
-  # normal zones
-  {% for i_zone in knot__zones -%}
+  # primary zones
+  {% for i_zone in knot__primary_zones -%}
   - domain: "{{ i_zone.domain }}"
-    template: default
+    template: primary
     notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
     {% if i_zone.catalog_member | default(False) -%}
     catalog-role: member
@@ -92,3 +152,39 @@ zone:
 
   {% endfor %}
 
+  # dynamic primary zones
+  {% for i_zone in knot__dynamic_zones -%}
+  - domain: "{{ i_zone.domain }}"
+    template: "dynamic-primary"
+    notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    acl: [ {% for i_acl in i_zone.acl %}"{{ i_acl }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% if i_zone.catalog_member | default(False) -%}
+    catalog-role: member
+    catalog-zone: "{{ i_zone.catalog_member }}"
+    {% endif %}
+
+  {% endfor %}
+
+  # secondary zones
+  {% for i_zone in knot__secondary_zones -%}
+  - domain: "{{ i_zone.domain }}"
+    template: secondary
+    master: {{ i_zone.primary }}
+    notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+    {% if i_zone.catalog_member | default(False) -%}
+    catalog-role: member
+    catalog-zone: "{{ i_zone.catalog_member }}"
+    {% endif %}
+
+  {% endfor %}
+
+  # secondary catalog zones
+  {% for i_zone in knot__catalog_secondary_zones -%}
+  - domain: "{{ i_zone.domain }}"
+    template: catalog-secondary
+    catalog-template: catalog-secondary-member-{{ i_zone.domain }}
+    master: {{ i_zone.primary }}
+    notify: [ {% for i_notif in i_zone.notify_targets | default([]) %}"{{ i_notif }}"{% if not loop.last %}, {% endif %}{% endfor %} ]
+
+  {% endfor %}
+
diff --git a/roles/knot/templates/netplan-disable-ra.yaml b/roles/knot/templates/netplan-disable-ra.yaml
deleted file mode 100644
index bad31a5a..00000000
--- a/roles/knot/templates/netplan-disable-ra.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# {{ ansible_managed }}
-network:
-  ethernets:
-    {%- for i_iface_name in ansible_facts["interfaces"] -%}
-    {%- if i_iface_name != "lo" -%}
-    {%- set i_iface = ansible_facts[i_iface_name] %}
-
-    {{ i_iface_name }}:
-      match:
-        macaddress: "{{ i_iface.macaddress }}"
-      accept-ra: false
-    {% endif %}
-    {% endfor %}

From 5925b22bf50bccca036d5ee5f2ad9a651a004bac Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Fri, 11 Sep 2026 10:46:25 +0200
Subject: [PATCH 23/24] setup cccfr secondary DNS

---
 inventories/chaosknoten/host_vars/auth-dns.sops.yaml |  7 +++++--
 inventories/chaosknoten/host_vars/auth-dns.yaml      | 12 +++++++-----
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/inventories/chaosknoten/host_vars/auth-dns.sops.yaml b/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
index fbf06b66..49dc4880 100644
--- a/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
+++ b/inventories/chaosknoten/host_vars/auth-dns.sops.yaml
@@ -3,6 +3,9 @@ knot__keys:
   - id: ENC[AES256_GCM,data:ff7Z1SHmKVseX4hguwcfrqLKyDKu3Imw1Q==,iv:Ds5T3cvi2XYAa3C8mbgYjN8AHM4FsKR2RTPvykWgy2E=,tag:7Gveno0zsLf3bDOYgkQkbw==,type:str]
     secret: ENC[AES256_GCM,data:dJcVnqQ6hlA/xp4NQ5s9by+z9cm5oWD7KAlPX+kDsvSJn33YiZ/A/wf0jfT+FeVLaBerQ6WipxZs90rp8rD+dg==,iv:JVby6vORdqChps6cRx1EJPNBC7+M0Vgp1ji1nQtv3K4=,tag:X0KggJahlTOAowTNnpPs2g==,type:str]
     algorithm: ENC[AES256_GCM,data:r7uojDN+o1yYgaY=,iv:KBWKZbd+5qZstuMh6gseq/vC86UB/l9m4wVZpA4usPk=,tag:gfU3asmwOIgxJQsqPG712g==,type:str]
+  - id: ENC[AES256_GCM,data:Dulyfbyd0yrEX2gUm/YA,iv:VmSUtH5aryl7Vhq8TDj7anRASqNZaN77usVI+Rd8SVc=,tag:1ZJmSHHufQr1+DcnKYyY9w==,type:str]
+    secret: ENC[AES256_GCM,data:zlEdYedWmlW8mTLu+cUejyjlqLcx14Bz4D20pPa21UagtCH7GYeCldmC5sM=,iv:+TvHyfRgCscza04CtLGuRIkt30KLVRx01GKEq0Dqkvw=,tag:mX/MrOePWjJ9JwiGP6TQQw==,type:str]
+    algorithm: ENC[AES256_GCM,data:r7uojDN+o1yYgaY=,iv:KBWKZbd+5qZstuMh6gseq/vC86UB/l9m4wVZpA4usPk=,tag:gfU3asmwOIgxJQsqPG712g==,type:str]
 sops:
   age:
     - enc: |
@@ -14,8 +17,8 @@ sops:
         Hgb8MQ6i9FlhAN/P8onBsqvbh0ttBEFQ6aRJj5njKs/MMfKUk9Q25g==
         -----END AGE ENCRYPTED FILE-----
       recipient: age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
-  lastmodified: "2026-09-11T08:40:23Z"
-  mac: ENC[AES256_GCM,data:UrncHXwMWUzs5pciDVUGJ885EBsPfrOFswzDOej2pQOTrp6+YomluHivy/L5niSYb05HaGy+9puw35+d+9SXQbgoI5WbwYo2LQ2MggMWSchnnZoy3O5S6LLjBhcvebDv4/1JGvftyBS1LnU7mmJaMekV5KASXaGyuwKumsdTojA=,iv:HJqCXtqQErP/50tR7LL2eAN574NkVO/3QfYsK1q9tt4=,tag:BniLURhadzSliPYz0cRgkA==,type:str]
+  lastmodified: "2026-09-11T08:41:08Z"
+  mac: ENC[AES256_GCM,data:Kp+FNfKFSD1SGgHS7xc51CGqugyAQlTHqI1bxQxuGLht7dTdbltu8llyyGSwYuToAeUAgBKi+Nv4OQ7qM3nQ/1I3IjUJ6t3G3LNbOfOe6h4cF5wb2pV8NnpzjpwEgOMVI6dzCbW/hRqND8JrgSgnkPjM4WyOtiz8+N7evY8qAOs=,iv:kOkxsVfuVO5/XJBmnQKZm8mFVoQlUZKT51TUUAGij/8=,tag:8i59H3tvwUvSBU0LWLsdbg==,type:str]
   pgp:
     - created_at: "2026-05-20T02:08:47Z"
       enc: |-
diff --git a/inventories/chaosknoten/host_vars/auth-dns.yaml b/inventories/chaosknoten/host_vars/auth-dns.yaml
index 035e0328..e481a4e6 100644
--- a/inventories/chaosknoten/host_vars/auth-dns.yaml
+++ b/inventories/chaosknoten/host_vars/auth-dns.yaml
@@ -10,8 +10,10 @@ knot__remotes:
   - id: ns.vie.ccc.de
     address: [ "2a02:1b8:10:31::228", "146.255.57.228" ]
     via: [ "2a00:14b0:4200:3000:124::1", "212.12.48.124" ]
-  # - id: cccfr-de-hidden-primary
-  #   address: [ "89.163.204.252" ]
+  - id: cccfr-de-hidden-primary
+    address: [ "89.163.204.252" ]
+    via: [ "2a00:14b0:4200:3000:124::1", "212.12.48.124" ]
+    key: "xfr-ccchh-cccfr"
 
 knot__catalog_zones:
   - domain: "hamburg.ccc.de.catalog."
@@ -52,6 +54,6 @@ knot__primary_zones:
     notify_targets: [ "erfadns.ber.ccc.de" ]
     content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/auth-dns/zones/3.2.0.0.0.0.0.f.0.b.4.1.0.0.a.2.ip6.arpa.zone') }}"
 
-# knot__catalog_secondary_zones:
-#   - domain: "cccfr.catalog.invalid"
-#     primary: "cccfr-de-hidden-primary"
+knot__catalog_secondary_zones:
+  - domain: "cccfr.catalog.invalid"
+    primary: "cccfr-de-hidden-primary"

From d422b9660a30acc3d7795da5e24b3431305ff28e Mon Sep 17 00:00:00 2001
From: lilly <li@lly.sh>
Date: Wed, 16 Sep 2026 13:39:42 +0200
Subject: [PATCH 24/24] docs: correct mjolnir -> draupnir

---
 docs/concepts-and-configurations/matrix-moderation.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/concepts-and-configurations/matrix-moderation.md b/docs/concepts-and-configurations/matrix-moderation.md
index 4da6964d..fc307645 100644
--- a/docs/concepts-and-configurations/matrix-moderation.md
+++ b/docs/concepts-and-configurations/matrix-moderation.md
@@ -5,7 +5,7 @@ title: Matrix Moderation
 # Matrix Moderation
 
 All Matrix rooms created around CCCHH and which are considered *official* are subject to centralized moderation.
-This moderation is enforced by a [Mjolnir](https://github.com/matrix-org/mjolnir) bot on a techincal level and operated by a dedicated sub-team of the Infra Group.
+This moderation is enforced by a [Draupnir](https://github.com/the-draupnir-project/Draupnir) bot on a techincal level and operated by a dedicated sub-team of the Infra Group.
 
 The moderation team can be reached at [matrix-moderation@hamburg.ccc.de](mailto:matrix-moderation@hamburg.ccc.de).