Compare commits
1 commit
main
...
renovate/a
| Author | SHA1 | Date | |
|---|---|---|---|
| 7c4f2008c4 |
14 changed files with 45 additions and 58 deletions
|
|
@ -10,7 +10,7 @@ jobs:
|
|||
name: Ansible Lint
|
||||
runs-on: docker
|
||||
steps:
|
||||
- uses: actions/checkout@v5
|
||||
- uses: actions/checkout@v6
|
||||
- name: Install pip
|
||||
run: |
|
||||
apt update
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
all:
|
||||
hosts:
|
||||
ccchoir:
|
||||
ansible_host: ccchoir.hosts.hamburg.ccc.de
|
||||
ansible_host: ccchoir-intern.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
|
||||
chaosknoten:
|
||||
ansible_host: chaosknoten.hamburg.ccc.de
|
||||
cloud:
|
||||
|
|
@ -15,13 +15,13 @@ all:
|
|||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
grafana:
|
||||
ansible_host: grafana.hosts.hamburg.ccc.de
|
||||
ansible_host: grafana-intern.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
|
||||
tickets:
|
||||
ansible_host: tickets.hosts.hamburg.ccc.de
|
||||
ansible_host: tickets-intern.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
|
||||
keycloak:
|
||||
ansible_host: keycloak.hosts.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
|
|
@ -45,9 +45,9 @@ all:
|
|||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
pretalx:
|
||||
ansible_host: pretalx.hosts.hamburg.ccc.de
|
||||
ansible_host: pretalx-intern.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
|
||||
public-reverse-proxy:
|
||||
ansible_host: public-reverse-proxy.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
|
|
@ -59,13 +59,13 @@ all:
|
|||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
zammad:
|
||||
ansible_host: zammad.hosts.hamburg.ccc.de
|
||||
ansible_host: zammad-intern.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
|
||||
ntfy:
|
||||
ansible_host: ntfy.hosts.hamburg.ccc.de
|
||||
ansible_host: ntfy-intern.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
ansible_ssh_common_args: -J ssh://chaos@router.hamburg.ccc.de
|
||||
ansible_ssh_common_args: -J ssh://chaos@public-reverse-proxy.hamburg.ccc.de
|
||||
sunders:
|
||||
ansible_host: sunders.hosts.hamburg.ccc.de
|
||||
ansible_user: chaos
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@
|
|||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl http2 proxy_protocol;
|
||||
listen 8443 ssl http2 proxy_protocol;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 2a00:14b0:4200:3000:125::1;
|
||||
set_real_ip_from 172.31.17.140;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
|
|
@ -43,12 +43,12 @@ server {
|
|||
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl http2 proxy_protocol;
|
||||
listen 8443 ssl http2 proxy_protocol;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 2a00:14b0:4200:3000:125::1;
|
||||
set_real_ip_from 172.31.17.140;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl proxy_protocol;
|
||||
listen 8443 ssl proxy_protocol;
|
||||
http2 on;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@ server {
|
|||
server_name loki.hamburg.ccc.de;
|
||||
|
||||
listen [::]:50051 ssl;
|
||||
listen 172.31.17.145:50051 ssl;
|
||||
|
||||
http2 on;
|
||||
|
||||
|
|
@ -58,6 +59,7 @@ server {
|
|||
server_name loki.hamburg.ccc.de;
|
||||
|
||||
listen [::]:443 ssl;
|
||||
listen 172.31.17.145:443 ssl;
|
||||
|
||||
http2 on;
|
||||
|
||||
|
|
|
|||
|
|
@ -18,6 +18,7 @@ server {
|
|||
server_name metrics.hamburg.ccc.de;
|
||||
|
||||
listen [::]:443 ssl;
|
||||
listen 172.31.17.145:443 ssl;
|
||||
http2 on;
|
||||
|
||||
client_body_buffer_size 512k;
|
||||
|
|
|
|||
|
|
@ -2,13 +2,13 @@
|
|||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl proxy_protocol;
|
||||
listen 8443 ssl proxy_protocol;
|
||||
http2 on;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 2a00:14b0:4200:3000:125::1;
|
||||
set_real_ip_from 172.31.17.140;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@
|
|||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl http2 proxy_protocol;
|
||||
listen 8443 ssl http2 proxy_protocol;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 2a00:14b0:4200:3000:125::1;
|
||||
set_real_ip_from 172.31.17.140;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@
|
|||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl http2 proxy_protocol;
|
||||
listen 8443 ssl http2 proxy_protocol;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 2a00:14b0:4200:3000:125::1;
|
||||
set_real_ip_from 172.31.17.140;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
|
|
|
|||
|
|
@ -4,12 +4,12 @@ map $host $upstream_acme_challenge_host {
|
|||
c3cat.de 172.31.17.151:31820;
|
||||
www.c3cat.de 172.31.17.151:31820;
|
||||
staging.c3cat.de 172.31.17.151:31820;
|
||||
ccchoir.de ccchoir.hosts.hamburg.ccc.de:31820;
|
||||
www.ccchoir.de ccchoir.hosts.hamburg.ccc.de:31820;
|
||||
ccchoir.de ccchoir-intern.hamburg.ccc.de:31820;
|
||||
www.ccchoir.de ccchoir-intern.hamburg.ccc.de:31820;
|
||||
cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:31820;
|
||||
element.hamburg.ccc.de 172.31.17.151:31820;
|
||||
git.hamburg.ccc.de 172.31.17.154:31820;
|
||||
grafana.hamburg.ccc.de grafana.hosts.hamburg.ccc.de:31820;
|
||||
grafana.hamburg.ccc.de 172.31.17.145:31820;
|
||||
hackertours.hamburg.ccc.de 172.31.17.151:31820;
|
||||
staging.hackertours.hamburg.ccc.de 172.31.17.151:31820;
|
||||
hamburg.ccc.de 172.31.17.151:31820;
|
||||
|
|
@ -22,15 +22,15 @@ map $host $upstream_acme_challenge_host {
|
|||
netbox.hamburg.ccc.de netbox.hosts.hamburg.ccc.de:31820;
|
||||
onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:31820;
|
||||
pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:31820;
|
||||
pretalx.hamburg.ccc.de pretalx.hosts.hamburg.ccc.de:31820;
|
||||
pretalx.hamburg.ccc.de 172.31.17.157:31820;
|
||||
spaceapi.hamburg.ccc.de 172.31.17.151:31820;
|
||||
staging.hamburg.ccc.de 172.31.17.151:31820;
|
||||
wiki.ccchh.net wiki.hosts.hamburg.ccc.de:31820;
|
||||
wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:31820;
|
||||
www.hamburg.ccc.de 172.31.17.151:31820;
|
||||
tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:31820;
|
||||
tickets.hamburg.ccc.de 172.31.17.148:31820;
|
||||
sunders.hamburg.ccc.de sunders.hosts.hamburg.ccc.de:31820;
|
||||
zammad.hamburg.ccc.de zammad.hosts.hamburg.ccc.de:31820;
|
||||
zammad.hamburg.ccc.de 172.31.17.152:31820;
|
||||
eh03.easterhegg.eu 172.31.17.151:31820;
|
||||
eh05.easterhegg.eu 172.31.17.151:31820;
|
||||
eh07.easterhegg.eu 172.31.17.151:31820;
|
||||
|
|
@ -73,7 +73,7 @@ map $host $upstream_acme_challenge_host {
|
|||
design.hamburg.ccc.de 172.31.17.162:31820;
|
||||
hydra.hamburg.ccc.de 172.31.17.163:31820;
|
||||
cfp.eh22.easterhegg.eu 172.31.17.157:31820;
|
||||
ntfy.hamburg.ccc.de ntfy.hosts.hamburg.ccc.de:31820;
|
||||
ntfy.hamburg.ccc.de 172.31.17.149:31820;
|
||||
cryptoparty-hamburg.de 172.31.17.151:31820;
|
||||
cryptoparty.hamburg.ccc.de 172.31.17.151:31820;
|
||||
staging.cryptoparty-hamburg.de 172.31.17.151:31820;
|
||||
|
|
|
|||
|
|
@ -18,15 +18,15 @@ stream {
|
|||
resolver 212.12.50.158 192.76.134.90;
|
||||
|
||||
map $ssl_preread_server_name $address {
|
||||
ccchoir.de ccchoir.hosts.hamburg.ccc.de:8443;
|
||||
www.ccchoir.de ccchoir.hosts.hamburg.ccc.de:8443;
|
||||
ccchoir.de ccchoir-intern.hamburg.ccc.de:8443;
|
||||
www.ccchoir.de ccchoir-intern.hamburg.ccc.de:8443;
|
||||
cloud.hamburg.ccc.de cloud.hosts.hamburg.ccc.de:8443;
|
||||
pad.hamburg.ccc.de pad.hosts.hamburg.ccc.de:8443;
|
||||
pretalx.hamburg.ccc.de pretalx.hosts.hamburg.ccc.de:8443;
|
||||
pretalx.hamburg.ccc.de pretalx-intern.hamburg.ccc.de:8443;
|
||||
id.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
|
||||
invite.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
|
||||
keycloak-admin.hamburg.ccc.de keycloak.hosts.hamburg.ccc.de:8443;
|
||||
grafana.hamburg.ccc.de grafana.hosts.hamburg.ccc.de:8443;
|
||||
grafana.hamburg.ccc.de 172.31.17.145:8443;
|
||||
wiki.ccchh.net wiki.hosts.hamburg.ccc.de:8443;
|
||||
wiki.hamburg.ccc.de wiki.hosts.hamburg.ccc.de:8443;
|
||||
onlyoffice.hamburg.ccc.de onlyoffice.hosts.hamburg.ccc.de:8443;
|
||||
|
|
@ -42,9 +42,9 @@ stream {
|
|||
hamburg.ccc.de 172.31.17.151:8443;
|
||||
staging.hamburg.ccc.de 172.31.17.151:8443;
|
||||
spaceapi.hamburg.ccc.de 172.31.17.151:8443;
|
||||
tickets.hamburg.ccc.de tickets.hosts.hamburg.ccc.de:8443;
|
||||
tickets.hamburg.ccc.de 172.31.17.148:8443;
|
||||
sunders.hamburg.ccc.de sunders.hosts.hamburg.ccc.de:8443;
|
||||
zammad.hamburg.ccc.de zammad.hosts.hamburg.ccc.de:8443;
|
||||
zammad.hamburg.ccc.de 172.31.17.152:8443;
|
||||
c3cat.de 172.31.17.151:8443;
|
||||
www.c3cat.de 172.31.17.151:8443;
|
||||
staging.c3cat.de 172.31.17.151:8443;
|
||||
|
|
@ -90,8 +90,8 @@ stream {
|
|||
woodpecker.hamburg.ccc.de 172.31.17.160:8443;
|
||||
design.hamburg.ccc.de 172.31.17.162:8443;
|
||||
hydra.hamburg.ccc.de 172.31.17.163:8443;
|
||||
cfp.eh22.easterhegg.eu pretalx.hosts.hamburg.ccc.de:8443;
|
||||
ntfy.hamburg.ccc.de ntfy.hosts.hamburg.ccc.de:8443;
|
||||
cfp.eh22.easterhegg.eu pretalx-intern.hamburg.ccc.de:8443;
|
||||
ntfy.hamburg.ccc.de 172.31.17.149:8443;
|
||||
cryptoparty-hamburg.de 172.31.17.151:8443;
|
||||
cryptoparty.hamburg.ccc.de 172.31.17.151:8443;
|
||||
staging.cryptoparty-hamburg.de 172.31.17.151:8443;
|
||||
|
|
|
|||
|
|
@ -39,23 +39,7 @@ table inet host {
|
|||
ct state established,related accept
|
||||
|
||||
ip protocol icmp accept
|
||||
# ICMPv6
|
||||
# https://datatracker.ietf.org/doc/html/rfc4890#autoid-24
|
||||
# Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped"
|
||||
# Error messages that are essential to the establishment and maintenance of communications:
|
||||
icmpv6 type { destination-unreachable, packet-too-big } accept
|
||||
icmpv6 type { time-exceeded } accept
|
||||
icmpv6 type { parameter-problem } accept
|
||||
# Connectivity checking messages:
|
||||
icmpv6 type { echo-request, echo-reply } accept
|
||||
# Address Configuration and Router Selection messages:
|
||||
icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } accept
|
||||
# Link-Local Multicast Receiver Notification messages:
|
||||
icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report } accept
|
||||
# SEND Certificate Path Notification messages:
|
||||
icmpv6 type { 148, 149 } accept
|
||||
# Multicast Router Discovery messages:
|
||||
icmpv6 type { 151, 152, 153 } accept
|
||||
ip6 nexthdr icmpv6 accept
|
||||
|
||||
# Allow SSH access.
|
||||
tcp dport 22 accept comment "allow ssh access"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl http2 proxy_protocol;
|
||||
listen 8443 ssl http2 proxy_protocol;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
|
||||
server {
|
||||
# Listen on a custom port for the proxy protocol.
|
||||
listen [::]:8443 ssl http2 proxy_protocol;
|
||||
listen 8443 ssl http2 proxy_protocol;
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue