CCCHH/ansible-infra
CCCHH/ansible-infra
Watch
3
2
Fork
You've already forked ansible-infra
 1
Code Issues 20 Pull requests 14 Wiki Activity Actions
Ansible Playbooks and related configuration for CCCHH infrastructure https://infra-docs.hamburg.ccc.de/
875 commits 19 branches 1 tag 10 MiB
  • Python 56.3%
  • Jinja 35.3%
  • Shell 7.9%
  • HTML 0.3%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Stefan Bethke 32b5f147bc
All checks were successful
/ build (pull_request) Successful in 47s
Details
/ Ansible Lint (push) Successful in 5m31s
Details
/ Ansible Lint (pull_request) Successful in 4m35s
Details
Manage the CCCHH browser authentication flow as YAML 
Adds a keycloak_auth_flow role that locally validates flow
definitions (structure, nesting depth, known provider IDs, and a set
of Keycloak authentication-flow gotchas: conditions silently ignored
outside a Conditional subflow, keycloak/keycloak#29515's OTP+WebAuthn
sibling bug, conditional-credential config shape/semantics, and more)
before deploying them idempotently via
middleware_automation.keycloak.keycloak_authentication_v2.

Includes the CCCHH realm's actual "browser passkey and token" flow
(the realm's real browserFlow binding, not the untouched built-in
"browser" flow), exported from the live server so it's now reviewable
and redeployable from this repo instead of only editable in the
Keycloak admin console.
2026-09-02 11:07:45 +02:00
.forgejo/workflows Update all stable non-major dependencies 2026-07-08 00:16:11 +00:00
.vscode vscode settings: exclude vendored collections and roles from search 2026-02-09 19:53:27 +01:00
ansible_collections Vendor middleware_automation.keycloak collection 2026-09-02 10:46:57 +02:00
collections alloy(role): pull in alloy role that works from fux (#112) 2026-07-23 20:34:02 +02:00
docs Update with correct prefixes 2026-08-04 18:44:51 +02:00
inventories Manage the CCCHH browser authentication flow as YAML 2026-09-02 11:07:45 +02:00
playbooks Manage the CCCHH browser authentication flow as YAML 2026-09-02 11:07:45 +02:00
resources Manage the CCCHH browser authentication flow as YAML 2026-09-02 11:07:45 +02:00
roles Manage the CCCHH browser authentication flow as YAML 2026-09-02 11:07:45 +02:00
.ansible-lint ansible-lint: add collections and roles directories to excluded paths 2026-02-06 22:27:18 +01:00
.editorconfig add .editorconfig to ensure some style and format consistency 2024-11-23 02:11:48 +01:00
.gitignore general: update gitignore 2026-08-07 22:55:55 +02:00
.sops.yaml z9-router(host): add ansible pull 2026-08-07 22:55:31 +02:00
.yamllint.yaml add .yamllint.yaml for some nicer yaml configuration for ansible-lint 2024-11-23 02:31:31 +01:00
ansible.cfg mute ansible discovered interpreter warning 2026-05-06 11:44:41 +02:00
docs_requirements.txt docs: fix code blocks overflowing and add syntax highlighting 2026-05-19 18:33:03 +02:00
LICENSE Add LICENSE 2023-04-15 14:28:45 +00:00
mkdocs.yml Add documentation style outline (#97) 2026-05-27 20:49:07 +02:00
README.md README.md: correct sentence 2026-08-07 22:55:56 +02:00
renovate.json separate multiple major release upgrades 2026-07-11 21:57:34 +02:00
requirements.yml Vendor middleware_automation.keycloak collection 2026-09-02 10:46:57 +02:00

README.md

CCCHH Ansible Repository

Folgende Geräte und Server werden duch dieses Ansible Repository verwaltet:

  • Diverse VMs im z9 (PVE Cluster)
  • Diverse VMs auf dem Chaosknoten

Host-spezifische Konfigurationsdateien liegen unter resources/ und werden für jeweils über eine host_vars-Datei im Inventory geladen.

Galaxy-Collections und -Rollen

Für einige Aspekte verwenden wir Collections und Rollen aus Ansible Galaxy. Diese werden in ansible_collections bzw. galaxy-roles hier im Repo vorgehalten.

Um unsere gevendorte Version zu aktualisieren, kann man folgendes machen:

ansible-galaxy install -r requirements.yml
ansible-galaxy role install -r requirements.yml

Playbook nur für einzelne Hosts ausführen

Ein paar der Hosts haben den selben Namen, was es etwas schwieriger macht, das Playbook nur für einen der Hosts auszuführen, z. B. public-reverse-proxy. Die Kombination aus --inventory und --limit führt zum Erfolg:

ansible-playbook playbooks/deploy.yaml --inventory inventories/chaosknoten/hosts.yaml --limit public-reverse-proxy

License

This CCCHH ansible-ccchh repository is licensed under the MIT License.
custom_pipeline_oidc_group_and_role_mapping.py is licensed under the Creative Commons: CC BY-SA 4.0 license.