Update all stable non-major dependencies

.forgejo/workflows/lint.yaml

@@ -24,7 +24,7 @@ jobs:
       # work in our environmnet.
       # Rather manually setup python (pip) before instead.
       - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@v26.1.1
+        uses: https://github.com/ansible/ansible-lint@v26.3.0
         with:
           setup_python: "false"
           requirements_file: "requirements.yml"

.sops.yaml

@@ -43,170 +43,170 @@ keys:
 
 creation_rules:
   ## group vars
-  - path_regex: inventories/chaosknoten/group_vars/all.*
+  - path_regex: "inventories/chaosknoten/group_vars/.+\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           *host_chaosknoten_age_keys
-  - path_regex: inventories/external/group_vars/all.*
+  - path_regex: "inventories/external/group_vars/.+\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           *host_external_age_keys
-  - path_regex: inventories/z9/group_vars/all.*
+  - path_regex: "inventories/z9/group_vars/.+\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
   ## host vars
   # chaosknoten hosts
-  - path_regex: inventories/chaosknoten/host_vars/acmedns.*
+  - path_regex: "inventories/chaosknoten/host_vars/acmedns\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_acmedns_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/cloud.*
+  - path_regex: "inventories/chaosknoten/host_vars/cloud\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_cloud_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/keycloak.*
+  - path_regex: "inventories/chaosknoten/host_vars/keycloak\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_keycloak_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/grafana.*
+  - path_regex: "inventories/chaosknoten/host_vars/grafana\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_grafana_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/pad.*
+  - path_regex: "inventories/chaosknoten/host_vars/pad\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_pad_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/ccchoir.*
+  - path_regex: "inventories/chaosknoten/host_vars/ccchoir\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_ccchoir_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/pretalx.*
+  - path_regex: "inventories/chaosknoten/host_vars/pretalx\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_pretalx_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/netbox.*
+  - path_regex: "inventories/chaosknoten/host_vars/netbox\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_netbox_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/tickets.*
+  - path_regex: "inventories/chaosknoten/host_vars/tickets\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_tickets_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/onlyoffice.*
+  - path_regex: "inventories/chaosknoten/host_vars/onlyoffice\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_onlyoffice_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/zammad.*
+  - path_regex: "inventories/chaosknoten/host_vars/zammad\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_zammad_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/ntfy.*
+  - path_regex: "inventories/chaosknoten/host_vars/ntfy\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_ntfy_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/eh22-wiki.*
+  - path_regex: "inventories/chaosknoten/host_vars/eh22-wiki\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_eh22_wiki_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/sunders.*
+  - path_regex: "inventories/chaosknoten/host_vars/sunders\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_sunders_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/wiki.*
+  - path_regex: "inventories/chaosknoten/host_vars/wiki\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_wiki_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/renovate.*
+  - path_regex: "inventories/chaosknoten/host_vars/renovate\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_renovate_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/lists.*
+  - path_regex: "inventories/chaosknoten/host_vars/lists\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_lists_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/mumble.*
+  - path_regex: "inventories/chaosknoten/host_vars/mumble\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_mumble_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/public-reverse-proxy.*
+  - path_regex: "inventories/chaosknoten/host_vars/public-reverse-proxy\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_public_reverse_proxy_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/spaceapiccc.*
+  - path_regex: "inventories/chaosknoten/host_vars/spaceapiccc\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_spaceapiccc_ansible_pull_age_key
-  - path_regex: inventories/chaosknoten/host_vars/mjolnir.*
+  - path_regex: "inventories/chaosknoten/host_vars/mjolnir\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_mjolnir_ansible_pull_age_key
   # external hosts
-  - path_regex: inventories/external/host_vars/status.*
+  - path_regex: "inventories/external/host_vars/status\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
         age:
           - *host_status_ansible_pull_age_key
   # z9 hosts
-  - path_regex: inventories/z9/host_vars/dooris.*
+  - path_regex: "inventories/z9/host_vars/dooris\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
-  - path_regex: inventories/z9/host_vars/yate.*
+  - path_regex: "inventories/z9/host_vars/yate\\.sops\\..+"
     key_groups:
       - pgp:
           *admin_gpg_keys
   # general
-  - key_groups:
-      - pgp:
-          *admin_gpg_keys
+  - path_regex: ".+\\.sops\\..+"
+    key_groups:
+      - pgp: *admin_gpg_keys
 
 stores:
   yaml:

inventories/chaosknoten/host_vars/cloud.yaml

@@ -1,7 +1,7 @@
 # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud
 nextcloud__version: 32
 # renovate: datasource=docker depName=docker.io/library/postgres
-nextcloud__postgres_version: 15.15
+nextcloud__postgres_version: 15.17
 nextcloud__fqdn: cloud.hamburg.ccc.de
 nextcloud__data_dir: /data/nextcloud
 nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"

inventories/chaosknoten/host_vars/netbox.yaml

@@ -1,5 +1,5 @@
 # renovate: datasource=github-releases depName=netbox packageName=netbox-community/netbox
-netbox__version: "v4.5.0"
+netbox__version: "v4.5.4"
 netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}"
 netbox__custom_pipeline_oidc_group_and_role_mapping: true
 

resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2

@@ -2,7 +2,7 @@
 services:
   oauth2-proxy:
     container_name: oauth2-proxy
-    image: quay.io/oauth2-proxy/oauth2-proxy:v7.14.2
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.14.3
     command: --config /oauth2-proxy.cfg
     hostname: oauth2-proxy
     volumes:

resources/chaosknoten/grafana/docker_compose/compose.yaml.j2

@@ -2,7 +2,7 @@
 services:
 
   prometheus:
-    image: docker.io/prom/prometheus:v3.9.1
+    image: docker.io/prom/prometheus:v3.10.0
     container_name: prometheus
     command:
       - '--config.file=/etc/prometheus/prometheus.yml'
@@ -19,7 +19,7 @@ services:
       - prom_data:/prometheus
 
   alertmanager:
-    image: docker.io/prom/alertmanager:v0.30.1
+    image: docker.io/prom/alertmanager:v0.31.1
     container_name: alertmanager
     command:
       - '--config.file=/etc/alertmanager/alertmanager.yaml'
@@ -32,7 +32,7 @@ services:
       - alertmanager_data:/alertmanager
 
   grafana:
-    image: docker.io/grafana/grafana:12.3.1
+    image: docker.io/grafana/grafana:12.4.0
     container_name: grafana
     ports:
       - 3000:3000
@@ -46,7 +46,7 @@ services:
       - graf_data:/var/lib/grafana
 
   pve-exporter:
-    image: docker.io/prompve/prometheus-pve-exporter:3.8.0
+    image: docker.io/prompve/prometheus-pve-exporter:3.8.1
     container_name: pve-exporter
     ports:
       - 9221:9221
@@ -59,7 +59,7 @@ services:
       - /dev/null:/etc/prometheus/pve.yml
 
   loki:
-    image: docker.io/grafana/loki:3.6.4
+    image: docker.io/grafana/loki:3.6.7
     container_name: loki
     ports:
       - 13100:3100

resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2

@@ -22,7 +22,7 @@
 
 services:
   keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.4
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.5
     pull_policy: always
     restart: unless-stopped
     command: start --optimized
@@ -46,7 +46,7 @@ services:
       - "8080:8080"
 
   db:
-    image: docker.io/library/postgres:15.15
+    image: docker.io/library/postgres:15.17
     restart: unless-stopped
     networks:
       - keycloak

resources/chaosknoten/mjolnir/docker_compose/compose.yaml

@@ -3,7 +3,7 @@
 
 services:
   mjolnir:
-    image: docker.io/matrixdotorg/mjolnir:v1.11.0
+    image: docker.io/matrixdotorg/mjolnir:v1.12.0
     restart: unless-stopped
     volumes:
       - ./mjolnir_data:/data

resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2

@@ -1,7 +1,7 @@
 ---
 services:
   ntfy:
-    image: docker.io/binwiederhier/ntfy:v2.15.0
+    image: docker.io/binwiederhier/ntfy:v2.17.0
     container_name: ntfy
     command:
       - serve

resources/chaosknoten/onlyoffice/docker_compose/compose.yaml.j2

@@ -4,7 +4,7 @@
 
 services:
   onlyoffice:
-    image: docker.io/onlyoffice/documentserver:9.2.1
+    image: docker.io/onlyoffice/documentserver:9.3.1
     restart: unless-stopped
     volumes:
       - "./onlyoffice/DocumentServer/logs:/var/log/onlyoffice"

resources/chaosknoten/pad/docker_compose/compose.yaml.j2

@@ -13,7 +13,7 @@ services:
     restart: unless-stopped
 
   app:
-    image: quay.io/hedgedoc/hedgedoc:1.10.5
+    image: quay.io/hedgedoc/hedgedoc:1.10.7
     environment:
       - "CMD_DB_URL=postgres://hedgedoc:{{ secret__hedgedoc_db_password }}@database:5432/hedgedoc"
       - "CMD_DOMAIN=pad.hamburg.ccc.de"

resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2

@@ -15,7 +15,7 @@ services:
       - pretalx_net
 
   redis:
-    image: docker.io/library/redis:8.4.0
+    image: docker.io/library/redis:8.6.1
     restart: unless-stopped
     volumes:
       - redis:/data
@@ -23,7 +23,7 @@ services:
       - pretalx_net
 
   static:
-    image: docker.io/library/nginx:1.29.4
+    image: docker.io/library/nginx:1.29.5
     restart: unless-stopped
     volumes:
       - public:/usr/share/nginx/html

resources/chaosknoten/sunders/docker_compose/compose.yaml.j2

@@ -3,7 +3,7 @@
 
 services:
   db:
-    image: mariadb:12.1.2
+    image: mariadb:12.2.2
     command: --max_allowed_packet=3250585600
     environment:
       MYSQL_ROOT_PASSWORD: "{{ secret__sunders_db_root_password }}"

resources/chaosknoten/tickets/docker_compose/compose.yaml.j2

@@ -13,7 +13,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: docker.io/library/redis:7.4.7
+    image: docker.io/library/redis:7.4.8
     ports:
       - "6379:6379"
     volumes:

resources/external/status/docker_compose/compose.yaml.j2

@@ -4,7 +4,7 @@
 
 services:
   database:
-    image: docker.io/library/postgres:18.1
+    image: docker.io/library/postgres:18.3
     volumes:
       - ./database:/var/lib/postgresql
     environment:
@@ -15,7 +15,7 @@ services:
       - gatus
 
   gatus:
-    image: ghcr.io/twin/gatus:v5.34.0
+    image: ghcr.io/twin/gatus:v5.35.0
     restart: always
     ports:
       - "8080:8080"