wip: ansible pull

reboot(role): intro. reboot role, which handles local conns. gracefully
Also use this role instead of plain ansible.builtin.reboot. This is in preparation for using ansible_pull as we don't want to have ansible.builtin.reboot fail local playbook runs.
2025-07-23 15:27:38 +02:00 · 2025-07-21 20:06:36 +02:00
3744 changed files with 3784 additions and 386218 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@ -3,11 +3,4 @@ skip_list:
  - "name[casing]"

 exclude_paths:
-  - .ansible/
  - .forgejo/
-  - "**/*.sops.yaml"
-  - ansible_collections/
-  - collections/
-  - galaxy_roles/
-  - docs/
-  - resources/
--- a/.forgejo/workflows/cleanup-docs.yaml
+++ b/.forgejo/workflows/cleanup-docs.yaml
@ -1,24 +0,0 @@
-on:
-  pull_request:
-    types:
-      - closed
-
-jobs:
-  cleanup-staging:
-    runs-on: docker
-    container:
-      image: code.forgejo.org/oci/node:22-bookworm
-    steps:
-      - name: Pipeline info PR
-        run: |
-          echo "Run triggered by ${{ github.event_name }} (${{ github.event.action }}) on ref ${{ github.ref_name }}"
-
-      - name: Staging Deployment - Prepare keys
-        run: |
-          echo "${{ secrets.SSH_DEPLOY_KEY }}" > deploykey.priv
-          chmod 400 deploykey.priv
-          echo "${{ vars.SSH_KNOWN_HOSTS }}" > ./known_hosts
-
-      - name: Staging Deployment - Remove PR from staging
-        run: |
-          ssh -i deploykey.priv -o 'UserKnownHostsFile ./known_hosts' infra-docs-deploy@public-web-static.hosts.hamburg.ccc.de -t "rm -r /var/www/staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}/"
--- a/.forgejo/workflows/deploy-docs.yaml
+++ b/.forgejo/workflows/deploy-docs.yaml
@ -1,75 +0,0 @@
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-env:
-  TZ: Europe/Berlin
-
-jobs:
-  build:
-    runs-on: docker
-    container:
-      image: docker.io/library/python:3.14-trixie
-    steps:
-      - name: Pipeline info
-        run: |
-          echo "Run triggered by ${{ github.event_name }} (${{ github.event.action }}) on ref ${{ github.ref_name }}"
-
-      - name: Install packages
-        run: |
-          apt update
-          apt -y install nodejs git rsync openssh-client
-          pip install --upgrade pip
-
-      - uses: actions/checkout@v7
-
-      - name: Install Python packages
-        run: |
-          pip install -r docs_requirements.txt
-
-      - name: Build website - prod
-        if: github.event_name != 'pull_request'
-        run: |
-          mkdocs build
-
-      - name: Build website - staging
-        if: github.event_name == 'pull_request'
-        run: |
-          sed -i "s#site_url: https://infra-docs.hamburg.ccc.de#site_url: https://staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}/#" mkdocs.yml
-          mkdocs build
-
-      - name: Deploy - Prepare keys
-        run: |
-          echo "${{ secrets.SSH_DEPLOY_KEY }}" > deploykey.priv
-          chmod 400 deploykey.priv
-          echo "${{ vars.SSH_KNOWN_HOSTS }}" > ./known_hosts
-
-      - name: Deploy - Upload PR to staging
-        if: github.event_name == 'pull_request'
-        run: |
-          echo "Deploying to staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}"
-          rsync -v -r --delete -e "ssh -i deploykey.priv -o 'UserKnownHostsFile ./known_hosts'" site/ infra-docs-deploy@public-web-static.hosts.hamburg.ccc.de:/var/www/staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}/
-
-      - name: Deploy - Add comment to PR with staging URL
-        if: github.event_name == 'pull_request' && github.event.action == 'opened'
-        run: |
-          curl \
-            -X POST \
-            ${{ github.event.pull_request.base.repo.url }}/issues/${{ github.event.pull_request.number }}/comments \
-            -H "Content-Type: application/json" \
-            -H "Authorization: token $FORGEJO_TOKEN" \
-            --data '{ "body": "You can view your changes at https://staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}/" }'
-
-      - name: Deploy - Upload to prod
-        if: github.event_name != 'pull_request'
-        run: |
-          rsync -v -r --delete -e "ssh -i deploykey.priv -o 'UserKnownHostsFile ./known_hosts'" site/ infra-docs-deploy@public-web-static.hosts.hamburg.ccc.de:/var/www/infra-docs.hamburg.ccc.de/
-
-      - uses: actions/upload-artifact@v3
-        if: github.event_name == 'pull_request'
-        with:
-          name: docs-build
-          path: site/
-          retention-days: 3
--- a/.forgejo/workflows/lint.yaml
+++ b/.forgejo/workflows/lint.yaml
@ -10,7 +10,7 @@ jobs:
    name: Ansible Lint
    runs-on: docker
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v4
      - name: Install pip
        run: |
          apt update
@ -24,7 +24,7 @@ jobs:
      # work in our environmnet.
      # Rather manually setup python (pip) before instead.
      - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@v26.6.0
+        uses: https://github.com/ansible/ansible-lint@v24.10.0
        with:
          setup_python: "false"
          requirements_file: "requirements.yml"
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1 @@
 .ansible/
-**/__pycache__
-**/.DS_store
-
--- a/.sops.yaml
+++ b/.sops.yaml
@ -1,295 +1,229 @@
 keys:
-  admins: &admin_keys
-    pgp: &admin_pgp_keys
-      - &admin_pgp_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
-      - &admin_pgp_stb 21C9579E6503CA815A68ABD8541F9408A813C8B7
-      - &admin_pgp_fi 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
-      - &admin_pgp_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
-      - &admin_pgp_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-      # - &admin_pgp_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD # expired
-      - &admin_pgp_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-      - &admin_pgp_c6ris B71138A6A8964A3C3B8899857B4F70C356765BAB
-      - &admin_pgp_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-      - &admin_pgp_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
-      - &admin_pgp_bitwhisker 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
-    age: &admin_age_keys
-      - &admin_age_jtbx ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk
-      - &admin_age_c6ris age1yubikey1qv7jkffslarpma2fxjm9gnq43xfvwdws0m6y3u58h033edwdyg0uzt8jl5n
-  hosts:
-    chaosknoten:
-      age: &host_chaosknoten_age_keys
-        - &host_netbox_ansible_pull_age_key age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3
-        - &host_cloud_ansible_pull_age_key age1gdfhx5hy829uqkw4nwjwlpvl7zqvljguzsnjv0dpwz5q5u7dtf6s90wndt
-        - &host_eh22_wiki_ansible_pull_age_key age13nm6hfz66ce4wpn89fye05mag3l3h04etvz6wj7szm3vzrdlfupqhrp3fa
-        - &host_grafana_ansible_pull_age_key age1jtusr294t8mzar2qy857v6s329ret9s353y4kuulxwnlyy4dvpjsvyl67m
-        - &host_onlyoffice_ansible_pull_age_key age1a27euccw8j23wec76ls8vmzp7mntfcn4v8tkyegmg8alzfhk3suqwm6vgv
-        - &host_pretalx_ansible_pull_age_key age133wy6sxhgx3kkwxecra6xf9ey2uhnvtjpgwawwfmpvz0jpd0s5dqe385u3
-        - &host_sunders_ansible_pull_age_key age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd
-        - &host_wiki_ansible_pull_age_key age1sqs05anv4acculyap35e6vehdxw3g6ycwnvh6hsuv8u33re984zsnqfvqv
-        - &host_renovate_ansible_pull_age_key age18qam683rva3ee3wgue7r0ey4ws4jttz4a4dpe3q8kq8lmrp97ezq2cns8d
-        - &host_ccchoir_ansible_pull_age_key age19rg2cuj9smv8nzxmr03azfqe69edhep53dep6kvh83paf08zv58sntm0fg
-        - &host_tickets_ansible_pull_age_key age16znyzvquuy8467gg27mdwdt8k6kcu3fjrvfm6gnl4nmqp8tuvqaspqgcet
-        - &host_jitsi_ansible_pull_age_key age187zdk64205lx7r83a4m26pfa8hq6khc8sf83k266jasngeq08v3sfqswfg
-        - &host_keycloak_ansible_pull_age_key age1azkgwrcwqhc6flj7gturptpl2uvay6pd94cam4t6yuk2n4wlnsqsj38hca
-        - &host_lists_ansible_pull_age_key age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
-        - &host_mumble_ansible_pull_age_key age1wnympe3x8ce8hk87cymmt6wvccs4aes5rhhs44hq0s529v5z4g5sfyphwx
-        - &host_pad_ansible_pull_age_key age172pk7lyc6p4ewy0f2h6pau5d5sz6z8cq66hm4u4tpzx3an496a2sljx7x5
-        - &host_public_reverse_proxy_ansible_pull_age_key age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen
-        - &host_zammad_ansible_pull_age_key age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs
-        - &host_ntfy_ansible_pull_age_key age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg
-        - &host_spaceapiccc_ansible_pull_age_key age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa
-        - &host_acmedns_ansible_pull_age_key age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv
-        - &host_draupnir_ansible_pull_age_key age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
-        - &host_diday_staging_runner_ansible_pull_age_key age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf
-        - &host_auth_dns_ansible_pull_age_key age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
-        - &host_forgejo_runner_ansible_pull_age_key age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf
-        - &host_forgejo_runner_external_ansible_pull_age_key age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76
-        - &host_matrix_sync_external_ansible_pull_age_key age1q7kz3pnfq6cvtn56rlfgs52efcvtcmaq4xny0va3x5wxj4vpgccsenwxk6
-        - &host_hta_ansible_pull_age_key age1n44q80zmsnq8dehnkm8g78u0ku48zafrq4vg5pzz8ft9jkqja5jsamwxhn
-    external:
-      age: &host_external_age_keys
-        - &host_status_ansible_pull_age_key age1p546j6whqsyfkjuf674lawrnk2ex653fuvwhcwt46gkrspkq59sqzm5y87
-    z9:
-      age: &host_z9_age_keys
-        - &host_dooris_ansible_pull_age_key age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax
-        - &host_light_ansible_pull_age_key age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q
-        - &host_waybackproxy_ansible_pull_age_key age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j
-        - &host_yate_ansible_pull_age_key age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22
-        - &host_z9_router_ansible_pull_age_key age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp
-
+  - &admin_gpg_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
+  - &admin_gpg_stb F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
+  - &admin_gpg_jtbx 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
+  - &admin_gpg_yuri 87AB00D45D37C9E9167B5A5A333448678B60E505
+  - &admin_gpg_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
+  - &admin_gpg_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
+  - &admin_gpg_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
+  - &admin_gpg_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
+  - &admin_gpg_max 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
+  - &admin_gpg_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB
+  - &admin_gpg_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
+  - &admin_gpg_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
+  - &host_netbox_ansible_pull_age_key age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3
 creation_rules:
-  ## group vars
-  - path_regex: "inventories/chaosknoten/group_vars/.+\\.sops\\..+"
+  - path_regex: inventories/chaosknoten/host_vars/cloud.*
    key_groups:
-      - age:
-          *host_chaosknoten_age_keys
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/external/group_vars/.+\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/keycloak.*
    key_groups:
-      - age:
-          *host_external_age_keys
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/z9/group_vars/.+\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/grafana.*
    key_groups:
-      - age:
-          *host_z9_age_keys
-        merge:
-          - *admin_keys
-  ## host vars
-  # chaosknoten hosts
-  - path_regex: "inventories/chaosknoten/host_vars/acmedns\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/pad.*
    key_groups:
-      - age:
-          - *host_acmedns_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/cloud\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/ccchoir.*
    key_groups:
-      - age:
-          - *host_cloud_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/jitsi\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/pretalx.*
    key_groups:
-      - age:
-          - *host_jitsi_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/keycloak\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/netbox.*
    key_groups:
-      - age:
-          - *host_keycloak_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/grafana\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_grafana_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/pad\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_pad_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/ccchoir\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_ccchoir_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/pretalx\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_pretalx_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/netbox\\.sops\\..+"
-    key_groups:
-      - age:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+        age:
          - *host_netbox_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/hta\\.sops\\..+"
+  - path_regex: inventories/chaosknoten/host_vars/tickets.*
    key_groups:
-      - age:
-          - *host_hta_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/tickets\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/onlyoffice.*
    key_groups:
-      - age:
-          - *host_tickets_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/onlyoffice\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/zammad.*
    key_groups:
-      - age:
-          - *host_onlyoffice_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/zammad\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/chaosknoten/host_vars/ntfy.*
    key_groups:
-      - age:
-          - *host_zammad_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/ntfy\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/z9/host_vars/dooris.*
    key_groups:
-      - age:
-          - *host_ntfy_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/eh22-wiki\\.sops\\..+"
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - path_regex: inventories/z9/host_vars/yate.*
    key_groups:
-      - age:
-          - *host_eh22_wiki_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/sunders\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_sunders_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/wiki\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_wiki_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/renovate\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_renovate_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/lists\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_lists_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/mumble\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_mumble_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/public-reverse-proxy\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_public_reverse_proxy_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/spaceapiccc\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_spaceapiccc_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/draupnir\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_draupnir_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/diday-staging-runner\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_diday_staging_runner_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/auth-dns\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_auth_dns_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_forgejo_runner_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner-external\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_forgejo_runner_external_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/chaosknoten/host_vars/matrix-sync\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_matrix_sync_external_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  # external hosts
-  - path_regex: "inventories/external/host_vars/status\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_status_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  # z9 hosts
-  - path_regex: "inventories/z9/host_vars/dooris\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_dooris_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/z9/host_vars/light\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_light_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/z9/host_vars/waybackproxy\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_waybackproxy_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/z9/host_vars/yate\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_yate_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  - path_regex: "inventories/z9/host_vars/z9-router\\.sops\\..+"
-    key_groups:
-      - age:
-          - *host_z9_router_ansible_pull_age_key
-        merge:
-          - *admin_keys
-  # general
-  - path_regex: ".+\\.sops\\..+"
-    key_groups:
-      - *admin_keys
-
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
+  - key_groups:
+      - pgp:
+          - *admin_gpg_djerun
+          - *admin_gpg_stb
+          - *admin_gpg_jtbx
+          - *admin_gpg_yuri
+          - *admin_gpg_june
+          - *admin_gpg_haegar
+          - *admin_gpg_dario
+          - *admin_gpg_echtnurich
+          - *admin_gpg_max
+          - *admin_gpg_c6ristian
+          - *admin_gpg_lilly
+          - *admin_gpg_langoor
 stores:
  yaml:
    indent: 2
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@ -2,7 +2,5 @@
    "search.exclude": {
        "/playbooks/roles/": true,
        "/playbooks/resources/": true,
-        "/ansible_collections/": true,
-        "/galaxy-roles/": true,
    },
 }
--- a/.yamllint.yaml
+++ b/.yamllint.yaml
@ -1,6 +1,5 @@
 rules:
  brackets:
-    forbid: false
    min-spaces-inside: 1
    max-spaces-inside: 1
    min-spaces-inside-empty: 1
--- a/README.md
+++ b/README.md
@ -2,21 +2,31 @@

 Folgende Geräte und Server werden duch dieses Ansible Repository verwaltet:

-* Diverse VMs im z9 (PVE Cluster)
+* Diverse VMs auf dem ThinkCCCluster
 * Diverse VMs auf dem Chaosknoten

 Host-spezifische Konfigurationsdateien liegen unter `resources/` und werden für jeweils über eine `host_vars`-Datei im Inventory geladen.

-## Galaxy-Collections und -Rollen
+## Galaxy-Collections und -Rollen installieren

-Für einige Aspekte verwenden wir Collections und Rollen aus Ansible Galaxy. Diese werden in [`ansible_collections`](./ansible_collections/) bzw. [`galaxy-roles`](./galaxy-roles/) hier im Repo vorgehalten.
+Für einige Aspekte verwenden wir Rollen aus Ansible Galaxy. Die müssen zunächst installiert werden:

-Um unsere gevendorte Version zu aktualisieren, kann man folgendes machen:
 ```bash
 ansible-galaxy install -r requirements.yml
-ansible-galaxy role install -r requirements.yml
 ```

+## Secrets
+
+Generally try to avoid secrets (e.g. use SSH keys instead of passwords).
+
+Because secrets are nonetheless needed sometimes, we use [SOPS](https://github.com/getsops/sops) to securely store secrets in this repository.  
+SOPS encrypts secrets according to "creation rules" which are defined in the `.sops.yaml`.
+Generally all secrets get encrypted for all GPG-keys of all members of the infrastructure team.  
+Ansible then has access to the secrets with the help of the [`community.sops.sops` vars plugin](https://docs.ansible.com/ansible/latest/collections/community/sops/docsite/guide.html#working-with-encrypted-variables), which is configured in this repository.
+A local Ansible run then uses the locally available GPG-key to decrypt the secrets.
+
+For a tutorial on how to set up secrets using SOPS for a new host, see [Setting Up Secrets Using SOPS for a New Host](./docs/setting_up_secrets_using_sops_for_a_new_host.md).
+
 ## Playbook nur für einzelne Hosts ausführen

 Ein paar der Hosts haben den selben Namen, was es etwas schwieriger macht, das Playbook nur für einen der Hosts auszuführen, z. B. `public-reverse-proxy`. Die Kombination aus `--inventory` und `--limit` führt zum Erfolg:
@ -25,6 +35,22 @@ Ein paar der Hosts haben den selben Namen, was es etwas schwieriger macht, das P
 ansible-playbook playbooks/deploy.yaml --inventory inventories/chaosknoten/hosts.yaml --limit public-reverse-proxy
 ```

+## Neuen Web-Service hinzufügen
+
+Wir deployen Web-Services auf dem Chaosknoten hinter dem `public-reverse-proxy`. Der Service-Name `service.hamburg.ccc.de` sollte ein CNAME für `public-reverse-proxy.hamburg.ccc.de` und die Service-VM unter `service-intern.hamburg.ccc.de` mit einer `172.31.17.x`-Adresse erreichbar sein.
+
+Im Ansible-Repo müssen diese Sachen hinzugefügt werden:
+* `inventories/chaosknoten/hosts.yaml`: 
+    * SSH-Config für die neue VM unter all/children/debian_12/hosts
+    * Einträge für die Rollen, die dieser Host haben soll, min. `certbot_hosts`, `nginx_hosts`, ggf. `docker_compose_hosts`
+* `inventories/chaosknoten/host_vars/`*host*`.yaml`: config vars für den neuen Host
+* `resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf`: Liste der Hostnamen um den neuen Host erweitern, die hinter dem Reverse-Proxy stehen
+* `resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf`: Liste der Hostnamen um den neuen Host erweitern, die hinter dem Reverse-Proxy stehen
+* `resources/chaosknoten/`*host*`/nginx/`*host*`.hamburg.ccc.de.conf`: Server auf dem Service-Host
+    * Individuelle Config für den Service. Wenn Docker Compose, hier weiterleiten auf den eigentlichen Dienst in Compose.
+    * Cert-Dateinamen anpassen
+* `resources/chaosknoten/`*host*`/docker_compose/compose.yaml.j2`: Config für Docker Compose (wenn verwendet)
+
 ## License

 This CCCHH ansible-ccchh repository is licensed under the [MIT License](./LICENSE).  
--- a/ansible.cfg
+++ b/ansible.cfg
@ -2,6 +2,3 @@
 inventory = ./inventories/z9/hosts.yaml
 pipelining = True
 vars_plugins_enabled = host_group_vars,community.sops.sops
-collections_path = ./
-roles_path = ./galaxy-roles
-interpreter_python = python3
--- a/ansible_collections/community/docker/.ansible-lint
+++ b/ansible_collections/community/docker/.ansible-lint
@ -1,30 +0,0 @@
---
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-skip_list:
-  # Ignore rules that make no sense:
-  - galaxy[tags]
-  - galaxy[version-incorrect]
-  - meta-runtime[unsupported-version]
-  - no-changed-when
-  - sanity[cannot-ignore]  # some of the rules you cannot ignore actually MUST be ignored, like yamllint:unparsable-with-libyaml
-  - yaml  # we're using yamllint ourselves
-  - run-once[task]  # wtf???
-
-  # To be checked and maybe fixed:
-  - ignore-errors
-  - key-order[task]
-  - name[casing]
-  - name[missing]
-  - name[play]
-  - name[template]
-  - no-free-form
-  - no-handler
-  - risky-file-permissions
-  - risky-shell-pipe
-  - var-naming[no-reserved]
-  - var-naming[no-role-prefix]
-  - var-naming[pattern]
-  - var-naming[read-only]
--- a/ansible_collections/community/docker/.azure-pipelines/README.md
+++ b/ansible_collections/community/docker/.azure-pipelines/README.md
@ -1,9 +0,0 @@
-<!--
-Copyright (c) Ansible Project
-GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-SPDX-License-Identifier: GPL-3.0-or-later
-->
-
-## Azure Pipelines Configuration
-
-Please see the [Documentation](https://github.com/ansible/community/wiki/Testing:-Azure-Pipelines) for more information.
--- a/ansible_collections/community/docker/.azure-pipelines/azure-pipelines.yml
+++ b/ansible_collections/community/docker/.azure-pipelines/azure-pipelines.yml
@ -1,280 +0,0 @@
---
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-trigger:
-  batch: true
-  branches:
-    include:
-      - main
-      - stable-*
-
-pr:
-  autoCancel: true
-  branches:
-    include:
-      - main
-      - stable-*
-
-schedules:
-  - cron: 0 9 * * *
-    displayName: Nightly
-    always: true
-    branches:
-      include:
-        - main
-  - cron: 0 12 * * 0
-    displayName: Weekly (old stable branches)
-    always: true
-    branches:
-      include:
-        - stable-4
-
-variables:
-  - name: checkoutPath
-    value: ansible_collections/community/docker
-  - name: coverageBranches
-    value: main
-  - name: entryPoint
-    value: tests/utils/shippable/shippable.sh
-  - name: fetchDepth
-    value: 0
-
-resources:
-  containers:
-    - container: default
-      image: quay.io/ansible/azure-pipelines-test-container:7.0.0
-
-pool: Standard
-
-stages:
-
-### Sanity & units
-  - stage: Ansible_devel
-    displayName: Sanity & Units devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          targets:
-            - name: Sanity
-              test: 'devel/sanity/1'
-            - name: Units
-              test: 'devel/units/1'
-  - stage: Ansible_2_20
-    displayName: Sanity & Units 2.20
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          targets:
-            - name: Sanity
-              test: '2.20/sanity/1'
-            - name: Units
-              test: '2.20/units/1'
-  - stage: Ansible_2_19
-    displayName: Sanity & Units 2.19
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          targets:
-            - name: Sanity
-              test: '2.19/sanity/1'
-            - name: Units
-              test: '2.19/units/1'
-  - stage: Ansible_2_18
-    displayName: Sanity & Units 2.18
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          targets:
-            - name: Sanity
-              test: '2.18/sanity/1'
-            - name: Units
-              test: '2.18/units/1'
-
-### Docker
-  - stage: Docker_devel
-    displayName: Docker devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: devel/linux/{0}
-          targets:
-            - name: Fedora 42
-              test: fedora42
-            - name: Ubuntu 22.04
-              test: ubuntu2204
-            - name: Ubuntu 24.04
-              test: ubuntu2404
-            - name: Alpine 3.22
-              test: alpine322
-          groups:
-            - 4
-            - 5
-  - stage: Docker_2_20
-    displayName: Docker 2.20
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.20/linux/{0}
-          targets:
-            - name: Fedora 42
-              test: fedora42
-            - name: Alpine 3.22
-              test: alpine322
-          groups:
-            - 4
-            - 5
-  - stage: Docker_2_19
-    displayName: Docker 2.19
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.19/linux/{0}
-          targets:
-            - name: Fedora 41
-              test: fedora41
-            - name: Alpine 3.21
-              test: alpine321
-          groups:
-            - 4
-            - 5
-  - stage: Docker_2_18
-    displayName: Docker 2.18
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.18/linux/{0}
-          targets:
-            - name: Fedora 40
-              test: fedora40
-            - name: Ubuntu 22.04
-              test: ubuntu2204
-            - name: Alpine 3.20
-              test: alpine320
-          groups:
-            - 4
-            - 5
-
-### Community Docker
-  - stage: Docker_community_devel
-    displayName: Docker (community images) devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: devel/linux-community/{0}
-          targets:
-            - name: Debian 11 Bullseye
-              test: debian-bullseye/3.9
-            - name: Debian 12 Bookworm
-              test: debian-bookworm/3.11
-            - name: Debian 13 Trixie
-              test: debian-13-trixie/3.13
-            - name: ArchLinux
-              test: archlinux/3.13
-          groups:
-            - 4
-            - 5
-
-### Remote
-  - stage: Remote_devel
-    displayName: Remote devel
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: devel/{0}
-          targets:
-            - name: RHEL 10.0
-              test: rhel/10.0
-            - name: RHEL 9.6 with Docker SDK, urllib3, requests from sources
-              test: rhel/9.6-dev-latest
-            # For some reason, Ubuntu 24.04 is *extremely* slower than RHEL 9.6
-            # - name: Ubuntu 24.04
-            #   test: ubuntu/24.04
-          groups:
-            - 1
-            - 2
-            - 3
-            - 4
-            - 5
-  - stage: Remote_2_20
-    displayName: Remote 2.20
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.20/{0}
-          targets:
-            - name: RHEL 9.6
-              test: rhel/9.6
-          groups:
-            - 1
-            - 2
-            - 3
-            - 4
-            - 5
-  - stage: Remote_2_19
-    displayName: Remote 2.19
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.19/{0}
-          targets:
-            - name: RHEL 9.5
-              test: rhel/9.5
-            - name: Ubuntu 22.04
-              test: ubuntu/22.04
-          groups:
-            - 1
-            - 2
-            - 3
-            - 4
-            - 5
-  - stage: Remote_2_18
-    displayName: Remote 2.18
-    dependsOn: []
-    jobs:
-      - template: templates/matrix.yml
-        parameters:
-          testFormat: 2.18/{0}
-          targets:
-            - name: RHEL 9.4
-              test: rhel/9.4
-          groups:
-            - 1
-            - 2
-            - 3
-            - 4
-            - 5
-
-  ## Finally
-
-  - stage: Summary
-    condition: succeededOrFailed()
-    dependsOn:
-      - Ansible_devel
-      - Ansible_2_20
-      - Ansible_2_19
-      - Ansible_2_18
-      - Remote_devel
-      - Remote_2_20
-      - Remote_2_19
-      - Remote_2_18
-      - Docker_devel
-      - Docker_2_20
-      - Docker_2_19
-      - Docker_2_18
-      - Docker_community_devel
-    jobs:
-      - template: templates/coverage.yml
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/aggregate-coverage.sh
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/aggregate-coverage.sh
@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-# Aggregate code coverage results for later processing.
-
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-set -o pipefail -eu
-
-agent_temp_directory="$1"
-
-PATH="${PWD}/bin:${PATH}"
-
-mkdir "${agent_temp_directory}/coverage/"
-
-if [[ "$(ansible --version)" =~ \ 2\.9\. ]]; then
-    exit
-fi
-
-options=(--venv --venv-system-site-packages --color -v)
-
-ansible-test coverage combine --group-by command --export "${agent_temp_directory}/coverage/" "${options[@]}"
-
-if ansible-test coverage analyze targets generate --help >/dev/null 2>&1; then
-    # Only analyze coverage if the installed version of ansible-test supports it.
-    # Doing so allows this script to work unmodified for multiple Ansible versions.
-    ansible-test coverage analyze targets generate "${agent_temp_directory}/coverage/coverage-analyze-targets.json" "${options[@]}"
-fi
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/combine-coverage.py
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/combine-coverage.py
@ -1,64 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-"""
-Combine coverage data from multiple jobs, keeping the data only from the most recent attempt from each job.
-Coverage artifacts must be named using the format: "Coverage $(System.JobAttempt) {StableUniqueNameForEachJob}"
-The recommended coverage artifact name format is: Coverage $(System.JobAttempt) $(System.StageDisplayName) $(System.JobDisplayName)
-Keep in mind that Azure Pipelines does not enforce unique job display names (only names).
-It is up to pipeline authors to avoid name collisions when deviating from the recommended format.
-"""
-
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-import os
-import re
-import shutil
-import sys
-
-
-def main():
-    """Main program entry point."""
-    source_directory = sys.argv[1]
-
-    if '/ansible_collections/' in os.getcwd():
-        output_path = "tests/output"
-    else:
-        output_path = "test/results"
-
-    destination_directory = os.path.join(output_path, 'coverage')
-
-    if not os.path.exists(destination_directory):
-        os.makedirs(destination_directory)
-
-    jobs = {}
-    count = 0
-
-    for name in os.listdir(source_directory):
-        match = re.search('^Coverage (?P<attempt>[0-9]+) (?P<label>.+)$', name)
-        label = match.group('label')
-        attempt = int(match.group('attempt'))
-        jobs[label] = max(attempt, jobs.get(label, 0))
-
-    for label, attempt in jobs.items():
-        name = 'Coverage {attempt} {label}'.format(label=label, attempt=attempt)
-        source = os.path.join(source_directory, name)
-        source_files = os.listdir(source)
-
-        for source_file in source_files:
-            source_path = os.path.join(source, source_file)
-            destination_path = os.path.join(destination_directory, source_file + '.' + label)
-            print('"%s" -> "%s"' % (source_path, destination_path))
-            shutil.copyfile(source_path, destination_path)
-            count += 1
-
-    print('Coverage file count: %d' % count)
-    print('##vso[task.setVariable variable=coverageFileCount]%d' % count)
-    print('##vso[task.setVariable variable=outputPath]%s' % output_path)
-
-
-if __name__ == '__main__':
-    main()
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/process-results.sh
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/process-results.sh
@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-# Check the test results and set variables for use in later steps.
-
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-set -o pipefail -eu
-
-if [[ "$PWD" =~ /ansible_collections/ ]]; then
-    output_path="tests/output"
-else
-    output_path="test/results"
-fi
-
-echo "##vso[task.setVariable variable=outputPath]${output_path}"
-
-if compgen -G "${output_path}"'/junit/*.xml' > /dev/null; then
-    echo "##vso[task.setVariable variable=haveTestResults]true"
-fi
-
-if compgen -G "${output_path}"'/bot/ansible-test-*' > /dev/null; then
-    echo "##vso[task.setVariable variable=haveBotResults]true"
-fi
-
-if compgen -G "${output_path}"'/coverage/*' > /dev/null; then
-    echo "##vso[task.setVariable variable=haveCoverageData]true"
-fi
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/publish-codecov.py
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/publish-codecov.py
@ -1,105 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-"""
-Upload code coverage reports to codecov.io.
-Multiple coverage files from multiple languages are accepted and aggregated after upload.
-Python coverage, as well as PowerShell and Python stubs can all be uploaded.
-"""
-
-import argparse
-import dataclasses
-import pathlib
-import shutil
-import subprocess
-import tempfile
-import typing as t
-import urllib.request
-
-
-@dataclasses.dataclass(frozen=True)
-class CoverageFile:
-    name: str
-    path: pathlib.Path
-    flags: t.List[str]
-
-
-@dataclasses.dataclass(frozen=True)
-class Args:
-    dry_run: bool
-    path: pathlib.Path
-
-
-def parse_args() -> Args:
-    parser = argparse.ArgumentParser()
-    parser.add_argument('-n', '--dry-run', action='store_true')
-    parser.add_argument('path', type=pathlib.Path)
-
-    args = parser.parse_args()
-
-    # Store arguments in a typed dataclass
-    fields = dataclasses.fields(Args)
-    kwargs = {field.name: getattr(args, field.name) for field in fields}
-
-    return Args(**kwargs)
-
-
-def process_files(directory: pathlib.Path) -> t.Tuple[CoverageFile, ...]:
-    processed = []
-    for file in directory.joinpath('reports').glob('coverage*.xml'):
-        name = file.stem.replace('coverage=', '')
-
-        # Get flags from name
-        flags = name.replace('-powershell', '').split('=')  # Drop '-powershell' suffix
-        flags = [flag if not flag.startswith('stub') else flag.split('-')[0] for flag in flags]  # Remove "-01" from stub files
-
-        processed.append(CoverageFile(name, file, flags))
-
-    return tuple(processed)
-
-
-def upload_files(codecov_bin: pathlib.Path, files: t.Tuple[CoverageFile, ...], dry_run: bool = False) -> None:
-    for file in files:
-        cmd = [
-            str(codecov_bin),
-            '--name', file.name,
-            '--file', str(file.path),
-        ]
-        for flag in file.flags:
-            cmd.extend(['--flags', flag])
-
-        if dry_run:
-            print(f'DRY-RUN: Would run command: {cmd}')
-            continue
-
-        subprocess.run(cmd, check=True)
-
-
-def download_file(url: str, dest: pathlib.Path, flags: int, dry_run: bool = False) -> None:
-    if dry_run:
-        print(f'DRY-RUN: Would download {url} to {dest} and set mode to {flags:o}')
-        return
-
-    with urllib.request.urlopen(url) as resp:
-        with dest.open('w+b') as f:
-            # Read data in chunks rather than all at once
-            shutil.copyfileobj(resp, f, 64 * 1024)
-
-    dest.chmod(flags)
-
-
-def main():
-    args = parse_args()
-    url = 'https://ansible-ci-files.s3.amazonaws.com/codecov/linux/codecov'
-    with tempfile.TemporaryDirectory(prefix='codecov-') as tmpdir:
-        codecov_bin = pathlib.Path(tmpdir) / 'codecov'
-        download_file(url, codecov_bin, 0o755, args.dry_run)
-
-        files = process_files(args.path)
-        upload_files(codecov_bin, files, args.dry_run)
-
-
-if __name__ == '__main__':
-    main()
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/report-coverage.sh
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/report-coverage.sh
@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-# Generate code coverage reports for uploading to Azure Pipelines and codecov.io.
-
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-set -o pipefail -eu
-
-PATH="${PWD}/bin:${PATH}"
-
-if [[ "$(ansible --version)" =~ \ 2\.9\. ]]; then
-    exit
-fi
-
-if ! ansible-test --help >/dev/null 2>&1; then
-    # Install the devel version of ansible-test for generating code coverage reports.
-    # This is only used by Ansible Collections, which are typically tested against multiple Ansible versions (in separate jobs).
-    # Since a version of ansible-test is required that can work the output from multiple older releases, the devel version is used.
-    pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check
-fi
-
-ansible-test coverage xml --group-by command --stub --venv --venv-system-site-packages --color -v
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/run-tests.sh
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/run-tests.sh
@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# Configure the test environment and run the tests.
-
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-set -o pipefail -eu
-
-entry_point="$1"
-test="$2"
-read -r -a coverage_branches <<< "$3"  # space separated list of branches to run code coverage on for scheduled builds
-
-export COMMIT_MESSAGE
-export COMPLETE
-export COVERAGE
-export IS_PULL_REQUEST
-
-if [ "${SYSTEM_PULLREQUEST_TARGETBRANCH:-}" ]; then
-    IS_PULL_REQUEST=true
-    COMMIT_MESSAGE=$(git log --format=%B -n 1 HEAD^2)
-else
-    IS_PULL_REQUEST=
-    COMMIT_MESSAGE=$(git log --format=%B -n 1 HEAD)
-fi
-
-COMPLETE=
-COVERAGE=
-
-if [ "${BUILD_REASON}" = "Schedule" ]; then
-    COMPLETE=yes
-
-    if printf '%s\n' "${coverage_branches[@]}" | grep -q "^${BUILD_SOURCEBRANCHNAME}$"; then
-        COVERAGE=yes
-    fi
-fi
-
-"${entry_point}" "${test}" 2>&1 | "$(dirname "$0")/time-command.py"
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/time-command.py
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/time-command.py
@ -1,29 +0,0 @@
-#!/usr/bin/env python
-# Copyright (c) Ansible Project
-# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-"""Prepends a relative timestamp to each input line from stdin and writes it to stdout."""
-
-from __future__ import (absolute_import, division, print_function)
-__metaclass__ = type
-
-import sys
-import time
-
-
-def main():
-    """Main program entry point."""
-    start = time.time()
-
-    sys.stdin.reconfigure(errors='surrogateescape')
-    sys.stdout.reconfigure(errors='surrogateescape')
-
-    for line in sys.stdin:
-        seconds = time.time() - start
-        sys.stdout.write('%02d:%02d %s' % (seconds // 60, seconds % 60, line))
-        sys.stdout.flush()
-
-
-if __name__ == '__main__':
-    main()
--- a/Show more
+++ b/Show more
Author	SHA1	Message	Date
June	a7ba739ec9	wip: ansible pull Some checks failed / Ansible Lint (push) Failing after 50s Details / Ansible Lint (pull_request) Failing after 48s Details	2025-07-23 15:27:38 +02:00
June	968308eeeb	reboot(role): intro. reboot role, which handles local conns. gracefully Also use this role instead of plain ansible.builtin.reboot. This is in preparation for using ansible_pull as we don't want to have ansible.builtin.reboot fail local playbook runs.	2025-07-21 20:06:36 +02:00