From 547210d31f4529a06a16cc449420e59570acd485 Mon Sep 17 00:00:00 2001 From: jtbx Date: Mon, 21 Sep 2026 19:44:51 +0200 Subject: [PATCH 1/8] auth-dns(host): Remove deleted www2 and www3 VMs --- resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone | 2 -- 1 file changed, 2 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone index f3512af1..05e5e030 100644 --- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone +++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone @@ -510,8 +510,6 @@ pretalx.hosts IN AAAA 2a00:14b0:42:102::10 ntfy.hosts IN AAAA 2a00:14b0:42:102::11 spaceapiccc.hosts IN AAAA 2a00:14b0:42:102::12 acmedns.hosts IN AAAA 2a00:14b0:42:102::13 -www2.hosts IN AAAA 2a00:14b0:42:102::14 -www3.hosts IN AAAA 2a00:14b0:42:102::15 diday-staging-runner.hosts IN AAAA 2a00:14b0:42:102::16 public-web-static.hosts IN AAAA 2a00:14b0:42:102::17 forgejo-actions-runner.hosts IN AAAA 2a00:14b0:42:102::18 From a649455d92409363753d86ad0205ca412848c6bc Mon Sep 17 00:00:00 2001 From: jtbx Date: Mon, 21 Sep 2026 19:48:56 +0200 Subject: [PATCH 2/8] auth-dns(host): Move bildungsurlaub.hamburg.ccc.de to public-web-static --- resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone index 05e5e030..5cdb7a8f 100644 --- a/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone +++ b/resources/chaosknoten/auth-dns/zones/hamburg.ccc.de.zone @@ -228,10 +228,7 @@ rproxy-intern IN A 172.31.17.180 IN AAAA 2a00:14b0:f000:23::80 IN MX 10 cow.hamburg.ccc.de. -bildungsurlaub IN CNAME rproxy -doku IN CNAME rproxy -test IN CNAME rproxy -www.test IN CNAME rproxy +bildungsurlaub IN CNAME public-reverse-proxy eh2003 IN CNAME public-reverse-proxy www.eh2003 IN CNAME public-reverse-proxy easterhegg2003 IN CNAME public-reverse-proxy From fbddd28c71105357683f74f55e15b94d6489ddc9 Mon Sep 17 00:00:00 2001 From: jtbx Date: Mon, 21 Sep 2026 19:51:18 +0200 Subject: [PATCH 3/8] public-reverse-proxy(host): Add bildungsurlaub.hamburg.ccc.de --- .../chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf | 1 + resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf | 1 + 2 files changed, 2 insertions(+) diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf index 2513b7c8..be0a2665 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf @@ -92,6 +92,7 @@ map $host $upstream_acme_challenge_host { ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820; überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:31820; xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:31820; + bildungsurlaub.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:31820; default ""; } diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf index 01d0b5d6..c7be7563 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf @@ -115,6 +115,7 @@ stream { ueberwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443; überwachungsfrei.eu public-web-static.hosts.hamburg.ccc.de:8443; xn--berwachungsfrei-yvb.eu public-web-static.hosts.hamburg.ccc.de:8443; + bildungsurlaub.hamburg.ccc.de public-web-static.hosts.hamburg.ccc.de:8443; } server { From acf0b57d97a393f8d075649a24bd74a3380dfed5 Mon Sep 17 00:00:00 2001 From: Renovate Date: Sat, 19 Sep 2026 00:16:32 +0000 Subject: [PATCH 4/8] Update docker.io/grafana/loki Docker tag to v3.7.8 --- resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 index f08c7994..05d1c7e5 100644 --- a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2 @@ -59,7 +59,7 @@ services: - /dev/null:/etc/prometheus/pve.yml loki: - image: docker.io/grafana/loki:3.7.3 + image: docker.io/grafana/loki:3.7.8 container_name: loki ports: - 13100:3100 From 81e5380a140524eae66bd06ba22328c200127603 Mon Sep 17 00:00:00 2001 From: Renovate Date: Sat, 19 Sep 2026 00:16:33 +0000 Subject: [PATCH 5/8] Update docker.io/library/nginx Docker tag to v1.31.6 --- resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 index 3c6e5daa..0d5e34ec 100644 --- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2 @@ -23,7 +23,7 @@ services: - pretalx_net static: - image: docker.io/library/nginx:1.31.2 + image: docker.io/library/nginx:1.31.6 restart: unless-stopped volumes: - public:/usr/share/nginx/html From 049682bce280b2cdf938081fed17df62820f7613 Mon Sep 17 00:00:00 2001 From: June Date: Tue, 22 Sep 2026 02:10:47 +0200 Subject: [PATCH 6/8] host(draupnir): set backgroundDelayMS to have Draupnir act fast Use a recommended low value for backgroundDelayMS to have Draupnir chain consecutive backgrounded operations faster and therefore act faster. --- resources/chaosknoten/draupnir/docker_compose/config.yaml.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2 b/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2 index 20a73959..12ae7e2c 100644 --- a/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2 +++ b/resources/chaosknoten/draupnir/docker_compose/config.yaml.j2 @@ -15,6 +15,9 @@ automaticallyRedactForReasons: - "porn" - "harassmet" +# set to low value to have Draupnir chain consecutive backgrounded operations faster +backgroundDelayMS: 10 + # currently not working because /_synapse is not routed via reverse proxy pollReports: false From 1901ca515d86d3112ae62178b477369f3f939986 Mon Sep 17 00:00:00 2001 From: Renovate Date: Tue, 22 Sep 2026 00:16:40 +0000 Subject: [PATCH 7/8] Update git.hamburg.ccc.de/ccchh/oci-images/keycloak Docker tag to v26.7.4 --- resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 index e321b2f3..72d02544 100644 --- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 +++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2 @@ -22,7 +22,7 @@ services: keycloak: - image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.2 + image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.7.4 pull_policy: always restart: unless-stopped command: start --optimized From 83b0ab09505d1e9e5fa20f5a35aa429f117f335b Mon Sep 17 00:00:00 2001 From: jtbx Date: Fri, 28 Aug 2026 12:11:03 +0200 Subject: [PATCH 8/8] public-reverse-proxy(host): Increase nginx worker fd limit By default the limit on file descriptors is at a 1024 hard limit and 520k hard limit. Unsure how this affects nginx, but each client connection needs two file descriptors. So let's try to set the limit of open files explicitly. --- resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf index c7be7563..04b310a1 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf @@ -3,6 +3,7 @@ user nginx; worker_processes auto; +worker_rlimit_nofile 2050; # should be worker_connections*2 at least error_log /var/log/nginx/error.log notice; pid /var/run/nginx.pid;