sunders(host): deploy sunders using docker compose

https://git.hamburg.ccc.de/CCCHH/sunders

inventories/chaosknoten/host_vars/sunders.sops.yaml

@@ -1,4 +1,7 @@
 ansible_pull__age_private_key: ENC[AES256_GCM,data:tP84jDYh2zeWjf7wqDoefm9zaeg/Q2TWUyIstOcrjYHgrZdGLk64skLuGyH5q4FxQL9QEhe9qBT+AAxxKE6fU630/M1LVOR4Sls=,iv:I9W6KxIoisJFFMtOrN5u8KgnsmuIgF9RvzWanLNGVVM=,tag:w9bhDahR4Ai4/nLLeR58lA==,type:str]
+secret__sunders_db_root_password: ENC[AES256_GCM,data:m3Xt6dOKibRflon/rWG9KmdBPHEBbqE/GIpKdFI1Di7Lpl/THxzrgx12mTK6aZnwDrM=,iv:hD/UGwo88ye9CxyTCEQ0SVon2+ipPjeA9NF2/OhYwmc=,tag:DRdQ5hvTgUO5FVae/ul7kQ==,type:str]
+secret__sunders_db_camera_password: ENC[AES256_GCM,data:tOt4ImpedgfGvRpcThPO30YyEl/bP244ruJQzAYodJIsEhFuk5LxHpPASEnsqlN6m3M=,iv:rQXBjiYWZlzeUdaqDdTlrdbSSqGaPDeZOPhUaMjgcjU=,tag:lkSlIdJWFowyPfWEjpC/Zg==,type:str]
+secret__sunders_db_camera_select_password: ENC[AES256_GCM,data:PveGcD2WmvpMc8bafGY1c45aQ2XH/ym2yj5YacauQPeZO6Xem3kaxU0kwjs0Wd26ugc=,iv:tk288L9i0lxsJbTFq5ET5IiKkJfMQwc6uKNFXILcD7o=,tag:hOIivp3mOtDNBCsKvrSrBw==,type:str]
 sops:
   age:
     - recipient: age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd
@@ -10,8 +13,8 @@ sops:
         S3NiK3R6UWQ5UU0xUmYwa1hqMUo5c28K4EVQwBcALc6k53CNsemfMy2s6AGO5LJf
         3U1zeFtEcsvEnUfkvFT//M7cB6pUqQF0KIq1VnnFoQF7IpvSN23lxg==
         -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2025-10-14T23:43:05Z"
+  lastmodified: "2025-11-01T16:32:10Z"
-  mac: ENC[AES256_GCM,data:15TRSKlDhjQy3yMcFhz2Den2YorcrpJmCw0BVl10qlG8u9G7Vw/7aV/hJnZdkCz3w1ZkEbNS6DCKxCLs1Qgf2SEPaG/cRraO2mcl+YH7k4gb5LMzu81fRkbCx66B4LG+DY8fsAJeO4mxui2m0ZAHb2SNFIP4Q4vdLav3jTaiwAc=,iv:71qa6JTc+S5MLynGc27tx1WBGrpvTCSCoEv01SZnPF8=,tag:ju4WP1MK1/sWw7TAitzM0Q==,type:str]
+  mac: ENC[AES256_GCM,data:8Q6DBSFtzwHuVxduRlZYxlRWO0trSoesNGUR8r/dWnp9ashFBSZqVyffXb4Vq6DB5thANJ6/b3PCNsHdiAKn6Ai2UT8G0HimFjUUgNpZxo4xoNGmDhDvfdBgUL6O2pHhY+ojjguUXDYeYc99+eaxfKqZ3w+PAPaySltKm99foz8=,iv:ILOErdiWbUjk9kovXXZYcAqZFQp2Wo1Tm14sgK3niWg=,tag:Q2gT6wbQyhDXjoQEG2Lngw==,type:str]
   pgp:
     - created_at: "2025-10-15T08:45:25Z"
       enc: |-
@@ -207,4 +210,4 @@ sops:
         -----END PGP MESSAGE-----
       fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
   unencrypted_suffix: _unencrypted
-  version: 3.10.2
+  version: 3.11.0

inventories/chaosknoten/host_vars/sunders.yaml

@@ -0,0 +1,13 @@
+docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/sunders/docker_compose/compose.yaml.j2') }}"
+
+certbot__version_spec: ""
+certbot__acme_account_email_address: le-admin@hamburg.ccc.de
+certbot__certificate_domains:
+  - "sunders.hamburg.ccc.de"
+certbot__new_cert_commands:
+  - "systemctl reload nginx.service"
+
+nginx__version_spec: ""
+nginx__configurations:
+  - name: sunders.hamburg.ccc.de
+    content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf') }}"

inventories/chaosknoten/hosts.yaml

@@ -106,6 +106,7 @@ docker_compose_hosts:
     pretalx:
     zammad:
     ntfy:
+    sunders:
 nextcloud_hosts:
   hosts:
     cloud:
@@ -126,6 +127,7 @@ nginx_hosts:
     wiki:
     zammad:
     ntfy:
+    sunders:
 public_reverse_proxy_hosts:
   hosts:
     public-reverse-proxy:
@@ -145,6 +147,7 @@ certbot_hosts:
     wiki:
     zammad:
     ntfy:
+    sunders:
 prometheus_node_exporter_hosts:
   hosts:
     ccchoir:

resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf

@@ -29,6 +29,7 @@ map $host $upstream_acme_challenge_host {
     wiki.hamburg.ccc.de 172.31.17.146:31820;
     www.hamburg.ccc.de 172.31.17.151:31820;
     tickets.hamburg.ccc.de 172.31.17.148:31820;
+    sunders.hamburg.ccc.de 172.31.17.170:31820;
     zammad.hamburg.ccc.de 172.31.17.152:31820;
     eh03.easterhegg.eu 172.31.17.151:31820;
     eh05.easterhegg.eu 172.31.17.151:31820;

resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf

@@ -43,6 +43,7 @@ stream {
         staging.hamburg.ccc.de 172.31.17.151:8443;
         spaceapi.hamburg.ccc.de 172.31.17.151:8443;
         tickets.hamburg.ccc.de 172.31.17.148:8443;
+        sunders.hamburg.ccc.de 172.31.17.170:8443;
         zammad.hamburg.ccc.de 172.31.17.152:8443;
         c3cat.de 172.31.17.151:8443;
         www.c3cat.de 172.31.17.151:8443;

resources/chaosknoten/sunders/docker_compose/compose.yaml.j2

@@ -0,0 +1,57 @@
+# Source:
+# https://git.hamburg.ccc.de/CCCHH/sunders/src/branch/main/docker-compose.yml
+
+services:
+  db:
+    image: mariadb:12.0.2
+    command: --max_allowed_packet=3250585600
+    environment:
+      MYSQL_ROOT_PASSWORD: "{{ secret__sunders_db_root_password }}"
+      MYSQL_DATABASE: camera
+      MYSQL_USER: camera
+      MYSQL_PASSWORD: "{{ secret__sunders_db_camera_password }}"
+    volumes:
+        - mariadb:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-uroot", "-prootpassword"]
+      interval: 10s
+      timeout: 5s
+      start_period: 30s
+      retries: 5
+
+  web:
+    image: git.hamburg.ccc.de/ccchh/sunders/web:latest
+    environment:
+      MYSQL_HOST: db
+      MYSQL_DB: camera
+      CAMERA_SELECT_USER: camera_select
+      CAMERA_SELECT_USER_PASSWORD: "{{ secret__sunders_db_camera_select_password }}"
+      DEFAULT_ZOOM: 12
+      DEFAULT_LAT: 0
+      DEFAULT_LON: 0
+      DEFAULT_LANGUAGE: en
+      IMPRESSUM_URL: https://hamburg.ccc.de/imprint/
+    ports:
+      - "8080:80"
+    depends_on:
+      data_handler:
+        condition: service_started
+
+  data_handler:
+    image: git.hamburg.ccc.de/ccchh/sunders/data_handler:latest
+    environment:
+      MYSQL_HOST: db
+      MYSQL_DB: camera
+      MYSQL_USER: root
+      MYSQL_PASSWORD: "{{ secret__sunders_db_root_password }}"
+      CAMERA_USER: camera
+      CAMERA_USER_PASSWORD: "{{ secret__sunders_db_camera_password }}"
+      CAMERA_SELECT_USER: camera_select
+      CAMERA_SELECT_USER_PASSWORD: "{{ secret__sunders_db_camera_select_password }}"
+    depends_on:
+      db:
+        condition: service_healthy
+        restart: true
+
+volumes:
+  mariadb:

resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf

@@ -0,0 +1,42 @@
+# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+server {
+    # Listen on a custom port for the proxy protocol.
+    listen 8443 ssl http2 proxy_protocol;
+    # Make use of the ngx_http_realip_module to set the $remote_addr and
+    # $remote_port to the client address and client port, when using proxy
+    # protocol.
+    # First set our proxy protocol proxy as trusted.
+    set_real_ip_from 172.31.17.140;
+    # Then tell the realip_module to get the addreses from the proxy protocol
+    # header.
+    real_ip_header proxy_protocol;
+
+    server_name sunders.hamburg.ccc.de;
+
+    ssl_certificate /etc/letsencrypt/live/sunders.hamburg.ccc.de/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/sunders.hamburg.ccc.de/privkey.pem;
+    # verify chain of trust of OCSP response using Root CA and Intermediate certs
+    ssl_trusted_certificate /etc/letsencrypt/live/sunders.hamburg.ccc.de/chain.pem;
+
+    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
+    add_header Strict-Transport-Security "max-age=63072000" always;
+
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Port 443;
+    # This is https in any case.
+    proxy_set_header X-Forwarded-Proto https;
+    # Hide the X-Forwarded header.
+    proxy_hide_header X-Forwarded;
+    # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that
+    # is transparent).
+    # Also provide "_hidden" for by, since it's not relevant.
+    proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden";
+
+    location / {
+        proxy_pass http://127.0.0.1:8080/;
+    }
+}