acmedns(host): add to ansible_pull_hosts

update dooris configuration to allow connection to club-assistant
Update docker.io/xenrox/ntfy-alertmanager Docker tag to v1.0.2
2026-11-07 19:24:08 +01:00 · 2026-11-07 12:20:09 +01:00 · 2026-11-06 02:16:48 +00:00 · 2026-11-05 20:16:20 +00:00 · 2026-11-05 15:32:06 +01:00 · 2026-11-05 09:25:06 +01:00
3751 changed files with 386390 additions and 3704 deletions
--- a/.ansible-lint
+++ b/.ansible-lint
@ -3,4 +3,11 @@ skip_list:
  - "name[casing]"

 exclude_paths:
+  - .ansible/
  - .forgejo/
+  - "**/*.sops.yaml"
+  - ansible_collections/
+  - collections/
+  - galaxy_roles/
+  - docs/
+  - resources/
--- a/.forgejo/workflows/cleanup-docs.yaml
+++ b/.forgejo/workflows/cleanup-docs.yaml
@ -0,0 +1,24 @@
+on:
+  pull_request:
+    types:
+      - closed
+
+jobs:
+  cleanup-staging:
+    runs-on: docker
+    container:
+      image: code.forgejo.org/oci/node:22-bookworm
+    steps:
+      - name: Pipeline info PR
+        run: |
+          echo "Run triggered by ${{ github.event_name }} (${{ github.event.action }}) on ref ${{ github.ref_name }}"
+
+      - name: Staging Deployment - Prepare keys
+        run: |
+          echo "${{ secrets.SSH_DEPLOY_KEY }}" > deploykey.priv
+          chmod 400 deploykey.priv
+          echo "${{ vars.SSH_KNOWN_HOSTS }}" > ./known_hosts
+
+      - name: Staging Deployment - Remove PR from staging
+        run: |
+          ssh -i deploykey.priv -o 'UserKnownHostsFile ./known_hosts' infra-docs-deploy@public-web-static.hosts.hamburg.ccc.de -t "rm -r /var/www/staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}/"
--- a/.forgejo/workflows/deploy-docs.yaml
+++ b/.forgejo/workflows/deploy-docs.yaml
@ -0,0 +1,75 @@
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+env:
+  TZ: Europe/Berlin
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: docker.io/library/python:3.14-trixie
+    steps:
+      - name: Pipeline info
+        run: |
+          echo "Run triggered by ${{ github.event_name }} (${{ github.event.action }}) on ref ${{ github.ref_name }}"
+
+      - name: Install packages
+        run: |
+          apt update
+          apt -y install nodejs git rsync openssh-client
+          pip install --upgrade pip
+
+      - uses: actions/checkout@v7
+
+      - name: Install Python packages
+        run: |
+          pip install -r docs_requirements.txt
+
+      - name: Build website - prod
+        if: github.event_name != 'pull_request'
+        run: |
+          mkdocs build
+
+      - name: Build website - staging
+        if: github.event_name == 'pull_request'
+        run: |
+          sed -i "s#site_url: https://infra-docs.hamburg.ccc.de#site_url: https://staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}/#" mkdocs.yml
+          mkdocs build
+
+      - name: Deploy - Prepare keys
+        run: |
+          echo "${{ secrets.SSH_DEPLOY_KEY }}" > deploykey.priv
+          chmod 400 deploykey.priv
+          echo "${{ vars.SSH_KNOWN_HOSTS }}" > ./known_hosts
+
+      - name: Deploy - Upload PR to staging
+        if: github.event_name == 'pull_request'
+        run: |
+          echo "Deploying to staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}"
+          rsync -v -r --delete -e "ssh -i deploykey.priv -o 'UserKnownHostsFile ./known_hosts'" site/ infra-docs-deploy@public-web-static.hosts.hamburg.ccc.de:/var/www/staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}/
+
+      - name: Deploy - Add comment to PR with staging URL
+        if: github.event_name == 'pull_request' && github.event.action == 'opened'
+        run: |
+          curl \
+            -X POST \
+            ${{ github.event.pull_request.base.repo.url }}/issues/${{ github.event.pull_request.number }}/comments \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $FORGEJO_TOKEN" \
+            --data '{ "body": "You can view your changes at https://staging.infra-docs.hamburg.ccc.de/pr${{ github.event.pull_request.number }}/" }'
+
+      - name: Deploy - Upload to prod
+        if: github.event_name != 'pull_request'
+        run: |
+          rsync -v -r --delete -e "ssh -i deploykey.priv -o 'UserKnownHostsFile ./known_hosts'" site/ infra-docs-deploy@public-web-static.hosts.hamburg.ccc.de:/var/www/infra-docs.hamburg.ccc.de/
+
+      - uses: actions/upload-artifact@v3
+        if: github.event_name == 'pull_request'
+        with:
+          name: docs-build
+          path: site/
+          retention-days: 3
--- a/.forgejo/workflows/lint.yaml
+++ b/.forgejo/workflows/lint.yaml
@ -10,7 +10,7 @@ jobs:
    name: Ansible Lint
    runs-on: docker
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
      - name: Install pip
        run: |
          apt update
@ -24,7 +24,7 @@ jobs:
      # work in our environmnet.
      # Rather manually setup python (pip) before instead.
      - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@v24.10.0
+        uses: https://github.com/ansible/ansible-lint@v26.6.0
        with:
          setup_python: "false"
          requirements_file: "requirements.yml"
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,4 @@
 .ansible/
+**/__pycache__
+**/.DS_store
+
--- a/.sops.yaml
+++ b/.sops.yaml
@ -1,226 +1,295 @@
 keys:
-  - &admin_gpg_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
-  - &admin_gpg_stb F155144FC925A1BEA1F8A2C59A2A4CD59BFDC5EC
-  - &admin_gpg_jtbx 18DFCE01456DAB52EA38A6584EDC64F35FA1D6A5
-  - &admin_gpg_yuri 87AB00D45D37C9E9167B5A5A333448678B60E505
-  - &admin_gpg_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
-  - &admin_gpg_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
-  - &admin_gpg_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD
-  - &admin_gpg_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
-  - &admin_gpg_max 9DFA033E3DAEBAD7FDD71B056C7AAA54BE05F7BA
-  - &admin_gpg_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB
-  - &admin_gpg_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
-  - &admin_gpg_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
+  admins: &admin_keys
+    pgp: &admin_pgp_keys
+      - &admin_pgp_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
+      - &admin_pgp_stb 21C9579E6503CA815A68ABD8541F9408A813C8B7
+      - &admin_pgp_fi 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
+      - &admin_pgp_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
+      - &admin_pgp_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
+      # - &admin_pgp_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD # expired
+      - &admin_pgp_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
+      - &admin_pgp_c6ris B71138A6A8964A3C3B8899857B4F70C356765BAB
+      - &admin_pgp_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
+      - &admin_pgp_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
+      - &admin_pgp_bitwhisker 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
+    age: &admin_age_keys
+      - &admin_age_jtbx ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk
+      - &admin_age_c6ris age1yubikey1qv7jkffslarpma2fxjm9gnq43xfvwdws0m6y3u58h033edwdyg0uzt8jl5n
+  hosts:
+    chaosknoten:
+      age: &host_chaosknoten_age_keys
+        - &host_netbox_ansible_pull_age_key age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3
+        - &host_cloud_ansible_pull_age_key age1gdfhx5hy829uqkw4nwjwlpvl7zqvljguzsnjv0dpwz5q5u7dtf6s90wndt
+        - &host_eh22_wiki_ansible_pull_age_key age13nm6hfz66ce4wpn89fye05mag3l3h04etvz6wj7szm3vzrdlfupqhrp3fa
+        - &host_grafana_ansible_pull_age_key age1jtusr294t8mzar2qy857v6s329ret9s353y4kuulxwnlyy4dvpjsvyl67m
+        - &host_onlyoffice_ansible_pull_age_key age1a27euccw8j23wec76ls8vmzp7mntfcn4v8tkyegmg8alzfhk3suqwm6vgv
+        - &host_pretalx_ansible_pull_age_key age133wy6sxhgx3kkwxecra6xf9ey2uhnvtjpgwawwfmpvz0jpd0s5dqe385u3
+        - &host_sunders_ansible_pull_age_key age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd
+        - &host_wiki_ansible_pull_age_key age1sqs05anv4acculyap35e6vehdxw3g6ycwnvh6hsuv8u33re984zsnqfvqv
+        - &host_renovate_ansible_pull_age_key age18qam683rva3ee3wgue7r0ey4ws4jttz4a4dpe3q8kq8lmrp97ezq2cns8d
+        - &host_ccchoir_ansible_pull_age_key age19rg2cuj9smv8nzxmr03azfqe69edhep53dep6kvh83paf08zv58sntm0fg
+        - &host_tickets_ansible_pull_age_key age16znyzvquuy8467gg27mdwdt8k6kcu3fjrvfm6gnl4nmqp8tuvqaspqgcet
+        - &host_jitsi_ansible_pull_age_key age187zdk64205lx7r83a4m26pfa8hq6khc8sf83k266jasngeq08v3sfqswfg
+        - &host_keycloak_ansible_pull_age_key age1azkgwrcwqhc6flj7gturptpl2uvay6pd94cam4t6yuk2n4wlnsqsj38hca
+        - &host_lists_ansible_pull_age_key age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
+        - &host_mumble_ansible_pull_age_key age1wnympe3x8ce8hk87cymmt6wvccs4aes5rhhs44hq0s529v5z4g5sfyphwx
+        - &host_pad_ansible_pull_age_key age172pk7lyc6p4ewy0f2h6pau5d5sz6z8cq66hm4u4tpzx3an496a2sljx7x5
+        - &host_public_reverse_proxy_ansible_pull_age_key age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen
+        - &host_zammad_ansible_pull_age_key age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs
+        - &host_ntfy_ansible_pull_age_key age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg
+        - &host_spaceapiccc_ansible_pull_age_key age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa
+        - &host_acmedns_ansible_pull_age_key age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv
+        - &host_draupnir_ansible_pull_age_key age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
+        - &host_diday_staging_runner_ansible_pull_age_key age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf
+        - &host_auth_dns_ansible_pull_age_key age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
+        - &host_forgejo_runner_ansible_pull_age_key age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf
+        - &host_forgejo_runner_external_ansible_pull_age_key age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76
+        - &host_matrix_sync_external_ansible_pull_age_key age1q7kz3pnfq6cvtn56rlfgs52efcvtcmaq4xny0va3x5wxj4vpgccsenwxk6
+        - &host_hta_ansible_pull_age_key age1n44q80zmsnq8dehnkm8g78u0ku48zafrq4vg5pzz8ft9jkqja5jsamwxhn
+    external:
+      age: &host_external_age_keys
+        - &host_status_ansible_pull_age_key age1p546j6whqsyfkjuf674lawrnk2ex653fuvwhcwt46gkrspkq59sqzm5y87
+    z9:
+      age: &host_z9_age_keys
+        - &host_dooris_ansible_pull_age_key age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax
+        - &host_light_ansible_pull_age_key age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q
+        - &host_waybackproxy_ansible_pull_age_key age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j
+        - &host_yate_ansible_pull_age_key age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22
+        - &host_z9_router_ansible_pull_age_key age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp
+
 creation_rules:
-  - path_regex: inventories/chaosknoten/host_vars/cloud.*
+  ## group vars
+  - path_regex: "inventories/chaosknoten/group_vars/.+\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/keycloak.*
+      - age:
+          *host_chaosknoten_age_keys
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/external/group_vars/.+\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/grafana.*
+      - age:
+          *host_external_age_keys
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/z9/group_vars/.+\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/pad.*
+      - age:
+          *host_z9_age_keys
+        merge:
+          - *admin_keys
+  ## host vars
+  # chaosknoten hosts
+  - path_regex: "inventories/chaosknoten/host_vars/acmedns\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/ccchoir.*
+      - age:
+          - *host_acmedns_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/cloud\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/pretalx.*
+      - age:
+          - *host_cloud_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/jitsi\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/netbox.*
+      - age:
+          - *host_jitsi_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/keycloak\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/tickets.*
+      - age:
+          - *host_keycloak_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/grafana\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/onlyoffice.*
+      - age:
+          - *host_grafana_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/pad\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/zammad.*
+      - age:
+          - *host_pad_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/ccchoir\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/chaosknoten/host_vars/ntfy.*
+      - age:
+          - *host_ccchoir_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/pretalx\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/z9/host_vars/dooris.*
+      - age:
+          - *host_pretalx_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/netbox\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - path_regex: inventories/z9/host_vars/yate.*
+      - age:
+          - *host_netbox_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/hta\\.sops\\..+"
    key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
-  - key_groups:
-      - pgp:
-          - *admin_gpg_djerun
-          - *admin_gpg_stb
-          - *admin_gpg_jtbx
-          - *admin_gpg_yuri
-          - *admin_gpg_june
-          - *admin_gpg_haegar
-          - *admin_gpg_dario
-          - *admin_gpg_echtnurich
-          - *admin_gpg_max
-          - *admin_gpg_c6ristian
-          - *admin_gpg_lilly
-          - *admin_gpg_langoor
+      - age:
+          - *host_hta_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/tickets\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_tickets_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/onlyoffice\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_onlyoffice_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/zammad\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_zammad_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/ntfy\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_ntfy_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/eh22-wiki\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_eh22_wiki_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/sunders\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_sunders_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/wiki\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_wiki_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/renovate\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_renovate_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/lists\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_lists_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/mumble\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_mumble_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/public-reverse-proxy\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_public_reverse_proxy_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/spaceapiccc\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_spaceapiccc_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/draupnir\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_draupnir_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/diday-staging-runner\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_diday_staging_runner_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/auth-dns\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_auth_dns_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_forgejo_runner_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner-external\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_forgejo_runner_external_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/chaosknoten/host_vars/matrix-sync\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_matrix_sync_external_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  # external hosts
+  - path_regex: "inventories/external/host_vars/status\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_status_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  # z9 hosts
+  - path_regex: "inventories/z9/host_vars/dooris\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_dooris_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/z9/host_vars/light\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_light_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/z9/host_vars/waybackproxy\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_waybackproxy_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/z9/host_vars/yate\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_yate_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  - path_regex: "inventories/z9/host_vars/z9-router\\.sops\\..+"
+    key_groups:
+      - age:
+          - *host_z9_router_ansible_pull_age_key
+        merge:
+          - *admin_keys
+  # general
+  - path_regex: ".+\\.sops\\..+"
+    key_groups:
+      - *admin_keys
+
 stores:
  yaml:
    indent: 2
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@ -2,5 +2,7 @@
    "search.exclude": {
        "/playbooks/roles/": true,
        "/playbooks/resources/": true,
+        "/ansible_collections/": true,
+        "/galaxy-roles/": true,
    },
 }
--- a/.yamllint.yaml
+++ b/.yamllint.yaml
@ -1,5 +1,6 @@
 rules:
  brackets:
+    forbid: false
    min-spaces-inside: 1
    max-spaces-inside: 1
    min-spaces-inside-empty: 1
--- a/README.md
+++ b/README.md
@ -2,31 +2,21 @@

 Folgende Geräte und Server werden duch dieses Ansible Repository verwaltet:

-* Diverse VMs auf dem ThinkCCCluster
+* Diverse VMs im z9 (PVE Cluster)
 * Diverse VMs auf dem Chaosknoten

 Host-spezifische Konfigurationsdateien liegen unter `resources/` und werden für jeweils über eine `host_vars`-Datei im Inventory geladen.

-## Galaxy-Collections und -Rollen installieren
+## Galaxy-Collections und -Rollen

-Für einige Aspekte verwenden wir Rollen aus Ansible Galaxy. Die müssen zunächst installiert werden:
+Für einige Aspekte verwenden wir Collections und Rollen aus Ansible Galaxy. Diese werden in [`ansible_collections`](./ansible_collections/) bzw. [`galaxy-roles`](./galaxy-roles/) hier im Repo vorgehalten.

+Um unsere gevendorte Version zu aktualisieren, kann man folgendes machen:
 ```bash
 ansible-galaxy install -r requirements.yml
+ansible-galaxy role install -r requirements.yml
 ```

-## Secrets
-
-Generally try to avoid secrets (e.g. use SSH keys instead of passwords).
-
-Because secrets are nonetheless needed sometimes, we use [SOPS](https://github.com/getsops/sops) to securely store secrets in this repository.  
-SOPS encrypts secrets according to "creation rules" which are defined in the `.sops.yaml`.
-Generally all secrets get encrypted for all GPG-keys of all members of the infrastructure team.  
-Ansible then has access to the secrets with the help of the [`community.sops.sops` vars plugin](https://docs.ansible.com/ansible/latest/collections/community/sops/docsite/guide.html#working-with-encrypted-variables), which is configured in this repository.
-A local Ansible run then uses the locally available GPG-key to decrypt the secrets.
-
-For a tutorial on how to set up secrets using SOPS for a new host, see [Setting Up Secrets Using SOPS for a New Host](./docs/setting_up_secrets_using_sops_for_a_new_host.md).
-
 ## Playbook nur für einzelne Hosts ausführen

 Ein paar der Hosts haben den selben Namen, was es etwas schwieriger macht, das Playbook nur für einen der Hosts auszuführen, z. B. `public-reverse-proxy`. Die Kombination aus `--inventory` und `--limit` führt zum Erfolg:
@ -35,22 +25,6 @@ Ein paar der Hosts haben den selben Namen, was es etwas schwieriger macht, das P
 ansible-playbook playbooks/deploy.yaml --inventory inventories/chaosknoten/hosts.yaml --limit public-reverse-proxy
 ```

-## Neuen Web-Service hinzufügen
-
-Wir deployen Web-Services auf dem Chaosknoten hinter dem `public-reverse-proxy`. Der Service-Name `service.hamburg.ccc.de` sollte ein CNAME für `public-reverse-proxy.hamburg.ccc.de` und die Service-VM unter `service-intern.hamburg.ccc.de` mit einer `172.31.17.x`-Adresse erreichbar sein.
-
-Im Ansible-Repo müssen diese Sachen hinzugefügt werden:
-* `inventories/chaosknoten/hosts.yaml`: 
-    * SSH-Config für die neue VM unter all/children/debian_12/hosts
-    * Einträge für die Rollen, die dieser Host haben soll, min. `certbot_hosts`, `nginx_hosts`, ggf. `docker_compose_hosts`
-* `inventories/chaosknoten/host_vars/`*host*`.yaml`: config vars für den neuen Host
-* `resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf`: Liste der Hostnamen um den neuen Host erweitern, die hinter dem Reverse-Proxy stehen
-* `resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf`: Liste der Hostnamen um den neuen Host erweitern, die hinter dem Reverse-Proxy stehen
-* `resources/chaosknoten/`*host*`/nginx/`*host*`.hamburg.ccc.de.conf`: Server auf dem Service-Host
-    * Individuelle Config für den Service. Wenn Docker Compose, hier weiterleiten auf den eigentlichen Dienst in Compose.
-    * Cert-Dateinamen anpassen
-* `resources/chaosknoten/`*host*`/docker_compose/compose.yaml.j2`: Config für Docker Compose (wenn verwendet)
-
 ## License

 This CCCHH ansible-ccchh repository is licensed under the [MIT License](./LICENSE).  
--- a/ansible.cfg
+++ b/ansible.cfg
@ -2,3 +2,6 @@
 inventory = ./inventories/z9/hosts.yaml
 pipelining = True
 vars_plugins_enabled = host_group_vars,community.sops.sops
+collections_path = ./
+roles_path = ./galaxy-roles
+interpreter_python = python3
--- a/ansible_collections/community/docker/.ansible-lint
+++ b/ansible_collections/community/docker/.ansible-lint
@ -0,0 +1,30 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+skip_list:
+  # Ignore rules that make no sense:
+  - galaxy[tags]
+  - galaxy[version-incorrect]
+  - meta-runtime[unsupported-version]
+  - no-changed-when
+  - sanity[cannot-ignore]  # some of the rules you cannot ignore actually MUST be ignored, like yamllint:unparsable-with-libyaml
+  - yaml  # we're using yamllint ourselves
+  - run-once[task]  # wtf???
+
+  # To be checked and maybe fixed:
+  - ignore-errors
+  - key-order[task]
+  - name[casing]
+  - name[missing]
+  - name[play]
+  - name[template]
+  - no-free-form
+  - no-handler
+  - risky-file-permissions
+  - risky-shell-pipe
+  - var-naming[no-reserved]
+  - var-naming[no-role-prefix]
+  - var-naming[pattern]
+  - var-naming[read-only]
--- a/ansible_collections/community/docker/.azure-pipelines/README.md
+++ b/ansible_collections/community/docker/.azure-pipelines/README.md
@ -0,0 +1,9 @@
+<!--
+Copyright (c) Ansible Project
+GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+SPDX-License-Identifier: GPL-3.0-or-later
+-->
+
+## Azure Pipelines Configuration
+
+Please see the [Documentation](https://github.com/ansible/community/wiki/Testing:-Azure-Pipelines) for more information.
--- a/ansible_collections/community/docker/.azure-pipelines/azure-pipelines.yml
+++ b/ansible_collections/community/docker/.azure-pipelines/azure-pipelines.yml
@ -0,0 +1,280 @@
+---
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+trigger:
+  batch: true
+  branches:
+    include:
+      - main
+      - stable-*
+
+pr:
+  autoCancel: true
+  branches:
+    include:
+      - main
+      - stable-*
+
+schedules:
+  - cron: 0 9 * * *
+    displayName: Nightly
+    always: true
+    branches:
+      include:
+        - main
+  - cron: 0 12 * * 0
+    displayName: Weekly (old stable branches)
+    always: true
+    branches:
+      include:
+        - stable-4
+
+variables:
+  - name: checkoutPath
+    value: ansible_collections/community/docker
+  - name: coverageBranches
+    value: main
+  - name: entryPoint
+    value: tests/utils/shippable/shippable.sh
+  - name: fetchDepth
+    value: 0
+
+resources:
+  containers:
+    - container: default
+      image: quay.io/ansible/azure-pipelines-test-container:7.0.0
+
+pool: Standard
+
+stages:
+
+### Sanity & units
+  - stage: Ansible_devel
+    displayName: Sanity & Units devel
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: 'devel/sanity/1'
+            - name: Units
+              test: 'devel/units/1'
+  - stage: Ansible_2_20
+    displayName: Sanity & Units 2.20
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: '2.20/sanity/1'
+            - name: Units
+              test: '2.20/units/1'
+  - stage: Ansible_2_19
+    displayName: Sanity & Units 2.19
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: '2.19/sanity/1'
+            - name: Units
+              test: '2.19/units/1'
+  - stage: Ansible_2_18
+    displayName: Sanity & Units 2.18
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          targets:
+            - name: Sanity
+              test: '2.18/sanity/1'
+            - name: Units
+              test: '2.18/units/1'
+
+### Docker
+  - stage: Docker_devel
+    displayName: Docker devel
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: devel/linux/{0}
+          targets:
+            - name: Fedora 42
+              test: fedora42
+            - name: Ubuntu 22.04
+              test: ubuntu2204
+            - name: Ubuntu 24.04
+              test: ubuntu2404
+            - name: Alpine 3.22
+              test: alpine322
+          groups:
+            - 4
+            - 5
+  - stage: Docker_2_20
+    displayName: Docker 2.20
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.20/linux/{0}
+          targets:
+            - name: Fedora 42
+              test: fedora42
+            - name: Alpine 3.22
+              test: alpine322
+          groups:
+            - 4
+            - 5
+  - stage: Docker_2_19
+    displayName: Docker 2.19
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.19/linux/{0}
+          targets:
+            - name: Fedora 41
+              test: fedora41
+            - name: Alpine 3.21
+              test: alpine321
+          groups:
+            - 4
+            - 5
+  - stage: Docker_2_18
+    displayName: Docker 2.18
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.18/linux/{0}
+          targets:
+            - name: Fedora 40
+              test: fedora40
+            - name: Ubuntu 22.04
+              test: ubuntu2204
+            - name: Alpine 3.20
+              test: alpine320
+          groups:
+            - 4
+            - 5
+
+### Community Docker
+  - stage: Docker_community_devel
+    displayName: Docker (community images) devel
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: devel/linux-community/{0}
+          targets:
+            - name: Debian 11 Bullseye
+              test: debian-bullseye/3.9
+            - name: Debian 12 Bookworm
+              test: debian-bookworm/3.11
+            - name: Debian 13 Trixie
+              test: debian-13-trixie/3.13
+            - name: ArchLinux
+              test: archlinux/3.13
+          groups:
+            - 4
+            - 5
+
+### Remote
+  - stage: Remote_devel
+    displayName: Remote devel
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: devel/{0}
+          targets:
+            - name: RHEL 10.0
+              test: rhel/10.0
+            - name: RHEL 9.6 with Docker SDK, urllib3, requests from sources
+              test: rhel/9.6-dev-latest
+            # For some reason, Ubuntu 24.04 is *extremely* slower than RHEL 9.6
+            # - name: Ubuntu 24.04
+            #   test: ubuntu/24.04
+          groups:
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+  - stage: Remote_2_20
+    displayName: Remote 2.20
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.20/{0}
+          targets:
+            - name: RHEL 9.6
+              test: rhel/9.6
+          groups:
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+  - stage: Remote_2_19
+    displayName: Remote 2.19
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.19/{0}
+          targets:
+            - name: RHEL 9.5
+              test: rhel/9.5
+            - name: Ubuntu 22.04
+              test: ubuntu/22.04
+          groups:
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+  - stage: Remote_2_18
+    displayName: Remote 2.18
+    dependsOn: []
+    jobs:
+      - template: templates/matrix.yml
+        parameters:
+          testFormat: 2.18/{0}
+          targets:
+            - name: RHEL 9.4
+              test: rhel/9.4
+          groups:
+            - 1
+            - 2
+            - 3
+            - 4
+            - 5
+
+  ## Finally
+
+  - stage: Summary
+    condition: succeededOrFailed()
+    dependsOn:
+      - Ansible_devel
+      - Ansible_2_20
+      - Ansible_2_19
+      - Ansible_2_18
+      - Remote_devel
+      - Remote_2_20
+      - Remote_2_19
+      - Remote_2_18
+      - Docker_devel
+      - Docker_2_20
+      - Docker_2_19
+      - Docker_2_18
+      - Docker_community_devel
+    jobs:
+      - template: templates/coverage.yml
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/aggregate-coverage.sh
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/aggregate-coverage.sh
@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Aggregate code coverage results for later processing.
+
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+set -o pipefail -eu
+
+agent_temp_directory="$1"
+
+PATH="${PWD}/bin:${PATH}"
+
+mkdir "${agent_temp_directory}/coverage/"
+
+if [[ "$(ansible --version)" =~ \ 2\.9\. ]]; then
+    exit
+fi
+
+options=(--venv --venv-system-site-packages --color -v)
+
+ansible-test coverage combine --group-by command --export "${agent_temp_directory}/coverage/" "${options[@]}"
+
+if ansible-test coverage analyze targets generate --help >/dev/null 2>&1; then
+    # Only analyze coverage if the installed version of ansible-test supports it.
+    # Doing so allows this script to work unmodified for multiple Ansible versions.
+    ansible-test coverage analyze targets generate "${agent_temp_directory}/coverage/coverage-analyze-targets.json" "${options[@]}"
+fi
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/combine-coverage.py
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/combine-coverage.py
@ -0,0 +1,64 @@
+#!/usr/bin/env python
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""
+Combine coverage data from multiple jobs, keeping the data only from the most recent attempt from each job.
+Coverage artifacts must be named using the format: "Coverage $(System.JobAttempt) {StableUniqueNameForEachJob}"
+The recommended coverage artifact name format is: Coverage $(System.JobAttempt) $(System.StageDisplayName) $(System.JobDisplayName)
+Keep in mind that Azure Pipelines does not enforce unique job display names (only names).
+It is up to pipeline authors to avoid name collisions when deviating from the recommended format.
+"""
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import os
+import re
+import shutil
+import sys
+
+
+def main():
+    """Main program entry point."""
+    source_directory = sys.argv[1]
+
+    if '/ansible_collections/' in os.getcwd():
+        output_path = "tests/output"
+    else:
+        output_path = "test/results"
+
+    destination_directory = os.path.join(output_path, 'coverage')
+
+    if not os.path.exists(destination_directory):
+        os.makedirs(destination_directory)
+
+    jobs = {}
+    count = 0
+
+    for name in os.listdir(source_directory):
+        match = re.search('^Coverage (?P<attempt>[0-9]+) (?P<label>.+)$', name)
+        label = match.group('label')
+        attempt = int(match.group('attempt'))
+        jobs[label] = max(attempt, jobs.get(label, 0))
+
+    for label, attempt in jobs.items():
+        name = 'Coverage {attempt} {label}'.format(label=label, attempt=attempt)
+        source = os.path.join(source_directory, name)
+        source_files = os.listdir(source)
+
+        for source_file in source_files:
+            source_path = os.path.join(source, source_file)
+            destination_path = os.path.join(destination_directory, source_file + '.' + label)
+            print('"%s" -> "%s"' % (source_path, destination_path))
+            shutil.copyfile(source_path, destination_path)
+            count += 1
+
+    print('Coverage file count: %d' % count)
+    print('##vso[task.setVariable variable=coverageFileCount]%d' % count)
+    print('##vso[task.setVariable variable=outputPath]%s' % output_path)
+
+
+if __name__ == '__main__':
+    main()
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/process-results.sh
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/process-results.sh
@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Check the test results and set variables for use in later steps.
+
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+set -o pipefail -eu
+
+if [[ "$PWD" =~ /ansible_collections/ ]]; then
+    output_path="tests/output"
+else
+    output_path="test/results"
+fi
+
+echo "##vso[task.setVariable variable=outputPath]${output_path}"
+
+if compgen -G "${output_path}"'/junit/*.xml' > /dev/null; then
+    echo "##vso[task.setVariable variable=haveTestResults]true"
+fi
+
+if compgen -G "${output_path}"'/bot/ansible-test-*' > /dev/null; then
+    echo "##vso[task.setVariable variable=haveBotResults]true"
+fi
+
+if compgen -G "${output_path}"'/coverage/*' > /dev/null; then
+    echo "##vso[task.setVariable variable=haveCoverageData]true"
+fi
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/publish-codecov.py
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/publish-codecov.py
@ -0,0 +1,105 @@
+#!/usr/bin/env python
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""
+Upload code coverage reports to codecov.io.
+Multiple coverage files from multiple languages are accepted and aggregated after upload.
+Python coverage, as well as PowerShell and Python stubs can all be uploaded.
+"""
+
+import argparse
+import dataclasses
+import pathlib
+import shutil
+import subprocess
+import tempfile
+import typing as t
+import urllib.request
+
+
+@dataclasses.dataclass(frozen=True)
+class CoverageFile:
+    name: str
+    path: pathlib.Path
+    flags: t.List[str]
+
+
+@dataclasses.dataclass(frozen=True)
+class Args:
+    dry_run: bool
+    path: pathlib.Path
+
+
+def parse_args() -> Args:
+    parser = argparse.ArgumentParser()
+    parser.add_argument('-n', '--dry-run', action='store_true')
+    parser.add_argument('path', type=pathlib.Path)
+
+    args = parser.parse_args()
+
+    # Store arguments in a typed dataclass
+    fields = dataclasses.fields(Args)
+    kwargs = {field.name: getattr(args, field.name) for field in fields}
+
+    return Args(**kwargs)
+
+
+def process_files(directory: pathlib.Path) -> t.Tuple[CoverageFile, ...]:
+    processed = []
+    for file in directory.joinpath('reports').glob('coverage*.xml'):
+        name = file.stem.replace('coverage=', '')
+
+        # Get flags from name
+        flags = name.replace('-powershell', '').split('=')  # Drop '-powershell' suffix
+        flags = [flag if not flag.startswith('stub') else flag.split('-')[0] for flag in flags]  # Remove "-01" from stub files
+
+        processed.append(CoverageFile(name, file, flags))
+
+    return tuple(processed)
+
+
+def upload_files(codecov_bin: pathlib.Path, files: t.Tuple[CoverageFile, ...], dry_run: bool = False) -> None:
+    for file in files:
+        cmd = [
+            str(codecov_bin),
+            '--name', file.name,
+            '--file', str(file.path),
+        ]
+        for flag in file.flags:
+            cmd.extend(['--flags', flag])
+
+        if dry_run:
+            print(f'DRY-RUN: Would run command: {cmd}')
+            continue
+
+        subprocess.run(cmd, check=True)
+
+
+def download_file(url: str, dest: pathlib.Path, flags: int, dry_run: bool = False) -> None:
+    if dry_run:
+        print(f'DRY-RUN: Would download {url} to {dest} and set mode to {flags:o}')
+        return
+
+    with urllib.request.urlopen(url) as resp:
+        with dest.open('w+b') as f:
+            # Read data in chunks rather than all at once
+            shutil.copyfileobj(resp, f, 64 * 1024)
+
+    dest.chmod(flags)
+
+
+def main():
+    args = parse_args()
+    url = 'https://ansible-ci-files.s3.amazonaws.com/codecov/linux/codecov'
+    with tempfile.TemporaryDirectory(prefix='codecov-') as tmpdir:
+        codecov_bin = pathlib.Path(tmpdir) / 'codecov'
+        download_file(url, codecov_bin, 0o755, args.dry_run)
+
+        files = process_files(args.path)
+        upload_files(codecov_bin, files, args.dry_run)
+
+
+if __name__ == '__main__':
+    main()
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/report-coverage.sh
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/report-coverage.sh
@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Generate code coverage reports for uploading to Azure Pipelines and codecov.io.
+
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+set -o pipefail -eu
+
+PATH="${PWD}/bin:${PATH}"
+
+if [[ "$(ansible --version)" =~ \ 2\.9\. ]]; then
+    exit
+fi
+
+if ! ansible-test --help >/dev/null 2>&1; then
+    # Install the devel version of ansible-test for generating code coverage reports.
+    # This is only used by Ansible Collections, which are typically tested against multiple Ansible versions (in separate jobs).
+    # Since a version of ansible-test is required that can work the output from multiple older releases, the devel version is used.
+    pip install https://github.com/ansible/ansible/archive/devel.tar.gz --disable-pip-version-check
+fi
+
+ansible-test coverage xml --group-by command --stub --venv --venv-system-site-packages --color -v
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/run-tests.sh
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/run-tests.sh
@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Configure the test environment and run the tests.
+
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+set -o pipefail -eu
+
+entry_point="$1"
+test="$2"
+read -r -a coverage_branches <<< "$3"  # space separated list of branches to run code coverage on for scheduled builds
+
+export COMMIT_MESSAGE
+export COMPLETE
+export COVERAGE
+export IS_PULL_REQUEST
+
+if [ "${SYSTEM_PULLREQUEST_TARGETBRANCH:-}" ]; then
+    IS_PULL_REQUEST=true
+    COMMIT_MESSAGE=$(git log --format=%B -n 1 HEAD^2)
+else
+    IS_PULL_REQUEST=
+    COMMIT_MESSAGE=$(git log --format=%B -n 1 HEAD)
+fi
+
+COMPLETE=
+COVERAGE=
+
+if [ "${BUILD_REASON}" = "Schedule" ]; then
+    COMPLETE=yes
+
+    if printf '%s\n' "${coverage_branches[@]}" | grep -q "^${BUILD_SOURCEBRANCHNAME}$"; then
+        COVERAGE=yes
+    fi
+fi
+
+"${entry_point}" "${test}" 2>&1 | "$(dirname "$0")/time-command.py"
--- a/ansible_collections/community/docker/.azure-pipelines/scripts/time-command.py
+++ b/ansible_collections/community/docker/.azure-pipelines/scripts/time-command.py
@ -0,0 +1,29 @@
+#!/usr/bin/env python
+# Copyright (c) Ansible Project
+# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Prepends a relative timestamp to each input line from stdin and writes it to stdout."""
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+import sys
+import time
+
+
+def main():
+    """Main program entry point."""
+    start = time.time()
+
+    sys.stdin.reconfigure(errors='surrogateescape')
+    sys.stdout.reconfigure(errors='surrogateescape')
+
+    for line in sys.stdin:
+        seconds = time.time() - start
+        sys.stdout.write('%02d:%02d %s' % (seconds // 60, seconds % 60, line))
+        sys.stdout.flush()
+
+
+if __name__ == '__main__':
+    main()
--- a/Show more
+++ b/Show more