README.md

@@ -1,68 +1,11 @@
 # Binary Kitchen Ansible Playbooks
 
-This repository contains the roles to setup most of the infrastructure related to the hackspace Binary Kitchen.
+This repository contains the roles to setup most of the infrastructure related to the hackerspace Binary Kitchen.
 
-## Usage
+## Using
 
-To apply the current set of roles to a single host you can type: `ansible-playbook site.yml -l $hostname`
+TBA
 
-It is recommenced to alway run in check mode (`--check`) first and use `--diff` to see what has been (or would be) changed
+## Style / Contributing
 
-
-## Current setup
-
-Currently the following hosts are installed:
-
-### Internal Servers
-
-| Hostname                  | OS        | Purpose                 |
-| ------------------------- | --------- | ----------------------- |
-| wurst.binary.kitchen      | Proxmox 8 | VM Host                 |
-| salat.binary.kitchen      | Proxmox 8 | VM Host                 |
-| weizen.binary.kitchen     | Proxmox 8 | VM Host                 |
-| bacon.binary.kitchen      | Debian 12 | DNS, DHCP, LDAP, RADIUS |
-| aveta.binary.kitchen      | Debian 12 | DNS, DHCP, LDAP, RADIUS |
-| aeron.binary.kitchen      | Debian 12 | DNS, DHCP, LDAP, RADIUS |
-| sulis.binary.kitchen      | Debian 12 | Shell                   |
-| nabia.binary.kitchen      | Debian 12 | Monitoring              |
-| epona.binary.kitchen      | Debian 12 | NetBox                  |
-| pizza.binary.kitchen      | Debian 11 | OpenHAB *               |
-| pancake.binary.kitchen    | Debian 12 | XRDP                    |
-| knoedel.binary.kitchen    | Debian 12 | SIP-DECT OMM            |
-| bob.binary.kitchen        | Debian 12 | Gitea Actions           |
-| lasagne.binary.kitchen    | Debian 12 | Home Assistant *        |
-| tschunk.binary.kitchen    | Debian 11 | Strichliste             |
-| bowle.binary.kitchen      | Debian 12 | Files                   |
-| lock-auweg.binary.kitchen | Debian 11 | Doorlock                |
-
-\*: The main application is not managed by ansible but manually installed
-
-### External Servers
-
-| Hostname                      | OS        | Purpose                 |
-| ----------------------------- | --------- | ----------------------- |
-| helium.binary-kitchen.net     | Debian 12 | LDAP Master             |
-| lithium.binary-kitchen.net    | Debian 12 | Mail                    |
-| beryllium.binary-kitchen.net  | Debian 12 | Web *                   |
-| boron.binary-kitchen.net      | Debian 12 | Gitea                   |
-| carbon.binary-kitchen.net     | Debian 12 | Jabber                  |
-| nitrogen.binary-kitchen.net   | Debian 12 | NextCloud               |
-| oxygen.binary-kitchen.net     | Debian 12 | Shell                   |
-| fluorine.binary-kitchen.net   | Debian 12 | Web (div. via Docker)   |
-| neon.binary-kitchen.net       | Debian 12 | Auth. DNS               |
-| sodium.binary-kitchen.net     | Debian 12 | Mattrix                 |
-| magnesium.binary-kitchen.net  | Debian 12 | TURN                    |
-| aluminium.binary-kitchen.net  | Debian 12 | Zammad                  |
-| krypton.binary-kitchen.net    | Debian 12 | PartDB *                |
-| yttrium.binary-kitchen.net    | Debian 12 | Hintervvoidler *        |
-| zirconium.binary-kitchen.net  | Debian 12 | Jitsi                   |
-| molybdenum.binary-kitchen.net | Debian 12 | Telefonzelle *          |
-| technetium.binary-kitchen.net | Debian 12 | Event CTFd *            |
-| ruthenium.binary-kitchen.net  | Debian 12 | Minecraft *             |
-| rhodium.binary-kitchen.net    | Debian 12 | Event pretix            |
-| palladium.binary-kitchen.net  | Debian 12 | Event pretalx           |
-| argentum.binary-kitchen.net   | Debian 12 | Event Web *             |
-| cadmium.binary-kitchen.neti   | Debian 12 | Event NetBox *          |
-| barium.binary-kitchen.net     | Debian 12 | Workadventure           |
-
-\*: The main application is not managed by ansible but manually installed
+TBA/TBD

group_vars/all/vars.yml

@@ -5,14 +5,6 @@ acertmgr_mode: webdir
 acme_dnskey_file: /etc/acertmgr/nsupdate.key
 acme_dnskey_server: neon.binary-kitchen.net
 
-authentik_domain: auth.binary-kitchen.de
-authentik_dbname: authentik
-authentik_dbuser: authentik
-authentik_dbpass: "{{ vault_authentik_dbpass }}"
-authentik_secret: "{{ vault_authentik_secret }}"
-
-bk23b_domain: 23b.binary-kitchen.de
-
 coturn_realm: turn.binary-kitchen.de
 coturn_secret: "{{ vault_coturn_secret }}"
 
@@ -22,12 +14,19 @@ dns_axfr_ips:
 
 dhcp_omapi_key: "{{ vault_dhcp_omapi_key }}"
 
+drone_admin: moepman
+drone_domain: drone.binary-kitchen.de
+drone_dbname: drone
+drone_dbuser: drone
+drone_dbpass: "{{ vault_drone_dbpass }}"
+drone_uipass: "{{ vault_drone_uipass }}"
+drone_secret: "{{ vault_drone_secret }}"
+drone_gitea_client: "{{ vault_drone_gitea_client }}"
+drone_gitea_secret: "{{ vault_drone_gitea_secret }}"
+
 dss_domain: dss.binary-kitchen.de
 dss_secret: "{{ vault_dss_secret }}"
 
-fpm_status_user: admin
-fpm_status_pass: "{{ vault_fpm_status_pass }}"
-
 gitea_domain: git.binary-kitchen.de
 gitea_dbname: gogs
 gitea_dbuser: gogs
@@ -36,8 +35,8 @@ gitea_secret: "{{ vault_gitea_secret }}"
 gitea_jwt_secret: "{{ vault_gitea_jwt_secret }}"
 
 hedgedoc_domain: pad.binary-kitchen.de
-hedgedoc_dbname: hedgedoc
-hedgedoc_dbuser: hedgedoc
+hedgedoc_dbname: hackmd
+hedgedoc_dbuser: hackmd
 hedgedoc_dbpass: "{{ vault_hedgedoc_dbpass }}"
 hedgedoc_secret: "{{ vault_hedgedoc_secret }}"
 
@@ -68,7 +67,6 @@ mail_domain: binary-kitchen.de
 mail_domains:
 - ccc-r.de
 - ccc-regensburg.de
-- eh21.easterhegg.eu
 - makerspace-regensburg.de
 mail_postsrsd_secret: "{{ vault_mail_postsrsd_secret }}"
 mail_server: mail.binary-kitchen.de
@@ -77,17 +75,13 @@ mail_trusted:
 - 213.166.246.0/28
 - 213.166.246.37/32
 - 213.166.246.45/32
-- 213.166.246.46/32
-- 213.166.246.47/32
 - 213.166.246.250/32
 - 2a02:958:0:f6::/124
 - 2a02:958:0:f6::37/128
 - 2a02:958:0:f6::45/128
-- 2a02:958:0:f6::46/128
-- 2a02:958:0:f6::47/128
 mail_aliases:
 - "auweg@binary-kitchen.de	venti@binary-kitchen.de,anti@binary-kitchen.de,anke@binary-kitchen.de,gruenewald.clemens@gmail.com"
-- "bbb@binary-kitchen.de	boehm.johannes@gmail.com"
+- "bbb@binary-kitchen.de	timo.schindler@binary-kitchen.de"
 - "dasfilament@binary-kitchen.de	taxx@binary-kitchen.de"
 - "epvpn@binary-kitchen.de	noby@binary-kitchen.de"
 - "google@binary-kitchen.de	vorstand@binary-kitchen.de"
@@ -100,12 +94,11 @@ mail_aliases:
 - "orga@ccc-regensburg.de	anti@binary-kitchen.de"
 - "paypal@binary-kitchen.de	ralf@binary-kitchen.de"
 - "post@makerspace-regensburg.de	vorstand@binary-kitchen.de"
-- "pretalx@binary-kitchen.de	moepman@binary-kitchen.de"
 - "pretix@binary-kitchen.de	moepman@binary-kitchen.de"
 - "root@binary-kitchen.de	moepman@binary-kitchen.de,kishi@binary-kitchen.de"
 - "seife@binary-kitchen.de	anke@binary-kitchen.de"
 - "siebdruck@binary-kitchen.de	anke@binary-kitchen.de"
-- "vorstand@binary-kitchen.de	anke@binary-kitchen.de,christoph@schindlbeck.eu,ralf@binary-kitchen.de,zaesa@binary-kitchen.de"
+- "vorstand@binary-kitchen.de	anti@binary-kitchen.de,avarrish@binary-kitchen.de,ralf@binary-kitchen.de,zaesa@binary-kitchen.de"
 - "voucher1@binary-kitchen.de	exxess@binary-kitchen.de"
 - "voucher2@binary-kitchen.de	exxess@binary-kitchen.de"
 - "voucher3@binary-kitchen.de	exxess@binary-kitchen.de"
@@ -119,8 +112,6 @@ mail_aliases:
 - "voucher11@binary-kitchen.de	exxess@binary-kitchen.de"
 - "voucher12@binary-kitchen.de	exxess@binary-kitchen.de"
 - "workshops@binary-kitchen.de	timo.schindler@binary-kitchen.de,venti@binary-kitchen.de"
-- "tickets@eh21.easterhegg.eu	orga@eh21.easterhegg.eu"
-- "hackzuck@eh21.easterhegg.eu	kekskruemml@binary-kitchen.de"
 
 matrix_domain: matrix.binary-kitchen.de
 matrix_dbname: matrix
@@ -140,16 +131,11 @@ nextcloud_dbname: owncloud
 nextcloud_dbuser: owncloud
 nextcloud_dbpass: "{{ vault_owncloud_dbpass }}"
 
-omm_domain: omm.binary.kitchen
-
-pretalx_domain: fahrplan.eh21.easterhegg.eu
-pretalx_dbname: pretalx
-pretalx_dbuser: pretalx
-pretalx_dbpass: "{{ vault_pretalx_dbpass }}"
-pretalx_mail: pretalx@binary-kitchen.de
+nslcd_base_group: ou=groups,dc=binary-kitchen,dc=de
+nslcd_base_shadow: ou=people,dc=binary-kitchen,dc=de
+nslcd_base_passwd: ou=people,dc=binary-kitchen,dc=de
 
 pretix_domain: pretix.events.binary-kitchen.de
-pretix_domainx: tickets.eh21.easterhegg.eu
 pretix_dbname: pretix
 pretix_dbuser: pretix
 pretix_dbpass: "{{ vault_pretix_dbpass }}"
@@ -175,21 +161,4 @@ slapd_root_hash: "{SSHA}OB75kTfH6JRyX0dA0fM8/8ldP89qyzb+"
 slapd_root_pass: "{{ vault_slapd_root_pass }}"
 slapd_san: ldap.binary.kitchen
 
-sssd_base_group: ou=groups,dc=binary-kitchen,dc=de
-sssd_base_user: ou=people,dc=binary-kitchen,dc=de
-
-strichliste_domain: tschunk.binary.kitchen
-strichliste_dbname: strichliste
-strichliste_dbuser: strichliste
-strichliste_dbpass: "{{ vault_strichliste_dbpass }}"
-
-vaultwarden_domain: vault.binary-kitchen.de
-vaultwarden_dbname: vaultwarden
-vaultwarden_dbuser: vaultwarden
-vaultwarden_dbpass: "{{ vault_vaultwarden_dbpass }}"
-vaultwarden_token: "{{ vault_vaultwarden_token }}"
-vaultwarden_yubico_secret: "{{ vault_vaultwarden_yubico_secret }}"
-
 workadventure_domain: wa.binary-kitchen.de
-
-zammad_domain: requests.binary-kitchen.de

group_vars/all/vault.yml

@@ -1,109 +1,102 @@
 $ANSIBLE_VAULT;1.1;AES256
-63626562396631623335303064393137396262393239366236373634323333343264343335306330
-3861326430303265376564306139323064356339653039330a613335323233356361303066663139
-34386465306537666464643736656230356632633239363865386166373834653030363736613834
-6339303364363166620a626134303835346130386238653232316663346633313631653164336336
-34653639363635663537356639646333616438336438333463656537326134343531393435663266
-64366333346130653730613865346134356161373237343539373965623036656231653939303365
-62326638666431333265343639326461313433656639393839396366633431616435393263336231
-66303634656536636165636462396637656331666336623734333139316533636664306262326566
-36616366663933613561336164386463393635636264613737316464666535366361613065363362
-30316566323663623133346130393032646237353934363531326530396263363130326638393032
-30633832663134613964323733623230363831636664373661633966366264373766326161623862
-39396331313231633237313735636261653531313961616230626565623633636638643936326237
-62333066366439643163336233353361343662326237376332396461393663623761613962333237
-65633039363636323235356632326563376163386161373362383466346339356463636437646262
-38313164393036393661336633373265303536316165623330643236313936666139376237366164
-31373364663136356139356433386132343630396531373961616131343333663463616262373439
-34393161323334333732383866653463656265393761346533663530613530313062626330356535
-65393037636665303564316536376531386561366466643961666439326462353864643635353934
-66616432303966643731386133613430313737356539386331623832656132663461393538363962
-64313935613063373832343862373734316634663333313835323836386466336663643661656436
-61353663646165623165663035383461376331373439666433386433376234613163396234373632
-61646230363163366338653332373834386534333436373737383463363335356436313463626333
-63393166316663323066323863373830393937353864376366313535663565613031643932383364
-62623633353662323965393563363261623564396632643662663032613032666162616132336130
-39376430663833303264306135643832383231623336613734373964653736376235653334333639
-63376661636561383236633365303031326630356661633062663564396133313633323738333539
-66303235613562313636343766356263383132643962393232396263393665666334633438383632
-38646635643030303464396634356161333836376364333361356461346664303563346463333838
-34356139373233313631653533356633643730663438646630373331313065363136663938306439
-38336563363966653632613436356530316234326365666438326635313537343665663233363731
-36646565393937326336626333383863656565323832303937323536346366303839633236663566
-32373632646463363634363031626635383233656361336532636366653434623562623937656137
-66303663316165633932643365623732323430376334303036303961396264303664616433356361
-64366135376232313265376563633163373933343066653939313433366539396163656163346663
-30626331333034316131343361636364653936373235623562336366336237353966613536316637
-61343530326139636365613434386263383430626663333932386431313164346532666562346537
-32623538353365383030396332386133343464643732653038623337353135663964643566396439
-64633435623763666461356331306539373638383034343735373765373333656562326338613763
-63633732373765316238633539316665623431616333363364316531306630343735393335616630
-36613362336566393866623566666430336639376662633233656130653837313161653462346335
-63396532663633393363626136373161303235613761373235633831393736343630353031613364
-32353463383934313961313638613533623638383062343936616336646431383935393938623138
-31383032326365333136666165633832333836346231636332353830336264636235383162356630
-38316137623935633863363162376239623932373233663663323830363162313665613830623763
-63656237343662616130326339386231376564613164666163393232653762613932343561343031
-66386431343139373734626430656139353635636233336236653438353066393732663637323435
-63303434376634366262646662616162343664666365373934346530343239653330356234373065
-31373934363731373136346665623334306631626134613334633135666461636462303164653662
-36323132376532613431653063643965636233373165333639323966663333633563303438396466
-64633761376164383835613038633630623439643364323232633437386334346138343361306638
-38626632326137303839306531633536643161656231636662383461373964646333303936343733
-36333863316162393134646563316235663164613062303734346662386466656461346364356564
-35326234336439623961383938316136633037343863363933616663366536613866666165376664
-30306438666365333333636632643832303463356533343033623938653365663732336164303033
-65653936363839323239306463366533653439663437343536393564336163313962313935636534
-34346330393637343834323931353762613839366166353139303535376230356466646261363464
-33386337616230623537376665663835373766316332363433313234326461313935636666363261
-30653433333436306564653461303165656163363331643536323535623062396561643662323334
-35626565616538396566363433363732656538313531636632643163633637303339656431346466
-61353030666638393361613833353532656130643866636135643434366562386363656434323366
-36343764316136316630353338363735646533346362386266643136626366356331656363393133
-35636633353662393435346365663432656166646136346331363563363539326162633166393164
-34303164353632373437613564336266373934396236383962376530613631633932626431333864
-64623439336638613337383763353531376133343436346330373362313034616166616537636366
-30306132613333633261326630323038323431643163373365376662623339396136313531366332
-66663037643036303836376632646132383563316262393438636432666661333836376663666130
-31316135366562633134306633333834636132623739373131626161633636313737646334376434
-33376337393630663338643366316465353266346365333830613533393139333235366237323339
-66346465313462373334316535383633343165373733313230373461366336353664306537306538
-32653538366565663764353031303763613835366461666163336665656436333563613835653438
-65376265303131376239616536353933346633393438643466343439643039313236373033323034
-64316364663139353664653564393262323565646235356431326331343433373639316234363938
-65633034666532306137353431613732663166323936356433323733376261386161383265663264
-35643038663565646135343233623530396165336263303931653037393934343833623337343834
-31343631343563626561393763356463393930616338623861363835343635376238653337653133
-31393834343536396536363533363739306639646333313836393331306566393534383265613234
-31623238306531383936343836336466343336396530633033323063346261366633343936316637
-30343165333861346635623934363537383531323637313461663964353338653639366562306236
-30363265393038633564626463393166333665396538663639346665353736336134643862663630
-62393037363963613263313939613865393066323830656362656464643730636535623639636131
-63343263333134336364323236656639613635323165383164636465353438653134646334643962
-35306463626336626664383638323865633631346437613139623239663538666363313237323663
-39323734353363643334343538303635366637373530383832393861346164666666306631643563
-63306565306337383539636330623933666266353635396238656435373563383830666636616335
-39386134383938626439366437383138303062333236306436336163393832613532303332303833
-39323539396235383765613234303765303136653064336361333035643365386232613766356362
-30656437376537623165626530623365393463626337383139663734396331396363396162383330
-31663636383037613563346330323063393637616334356439666263623662383666376265313732
-63343837306336313264313934653836363665616264396662633761363237366437653962626664
-38383462313435383133613465656435363563373765313361623565636564616236313666633264
-37393165386163393666376636343963333932346463303661373339303765303938636135323363
-35663731656431656330336366383330616163353934333564356633613165396463393066396533
-32396264653265333865643365346233633863333335383735396134663062343166656233613931
-35633133336337343531313266323663363830353236323035313031646434303761343737633139
-30343439323330353531633337353365363031666635653364326235316435383835663139376136
-39343361636662346166363432366162666631366431623563363936336164323836376232326162
-39316337343436386363643064653337613131346266353636333664373262326563386264303831
-65343534616464633232373532313865363732663235376534396436333531633261393066313263
-38316437643232336234343663666536353134626139623138636234396661613261326437303065
-36383331323061643632323339383530626430343132613039393434333939383065623464646362
-65303135313962613564666261356533313961323464623535393631613337663366626136343364
-61363035333636366439313961326462633463616237343133356437303234323363306337343237
-61376138323336663839623539633866313133346338313165623039336335663666313532636261
-36383332346636373936366632393364323331303866623533643062666361613133383262383538
-64343665333761326134303566656638633362643031306535333661623437636139353565623435
-39323631393132336636653731636264356637373031633037653466383163663865626339323731
-34623137386338343038373464613832363761643362623434373136376638663537623762646266
-63306439363039303461
+34313430623638333161613331623835666163626232326164366136373833633138373733333231
+6563336334663666373235313064363364646361643033310a663033616232363434306230313765
+31386338646433393334663031623261353661333565663763363834313264363463383562633934
+3663623932356635360a306231613431623763663130656634623365643730336564663862336536
+34663863313364613831656162663663646634636432656539643531326163653363376662393935
+61343934313135623265646539616136306231633566616534383562393964663565323534386162
+31646233313339383863313334353031386166653264353831383133633761306539636533656336
+37643866646538316234633736613136356166613037383638303465663639633432326533653832
+30313862646132393063393239656561646566336362643466386435613734623632613361323266
+64316166313635306631396166303132626139386563613231646439356637393662623530353261
+62326661663064393362653136346262313762376130623461313563613161623838356363306263
+38376438333632623962646535313239343038383030383736313536303935346236326631616632
+65376162613630343064356361336535623030316435333036363635623461626330663635653631
+61313435373839366363613338666630366333383962393734333662646239663237386437373333
+31373065336139643033643666653737306664626134643937343264646539616264393530343462
+38366232393832666439383066383738643966363132663832396562646238306638343266353934
+38396236373830303661336635646137306236386436343033383764666535323834313534346533
+35333665303534383634303732346164616666643731313839353462343365356338386561613231
+35333965353736386531356565376434393563653562373261633664623438346638613765303736
+65336230636539613332616433326335326436333136636566383731306437663438306636363930
+31376230353230613038636662623432646361383263663532396234656133333237333738666233
+61613961343963393437393664393265306564373164316265363232303831663331393130356662
+39313230616463636163386261353431356338353833393161313861643137646166363864313861
+64306161653565396339656333346235346365373836373633376231333833313034353864656434
+33623861326664356339336333663365663663353061323037346330653133396235363831623136
+63343662356235633332373733626232353437373263343038663932636232363030336436616131
+65376436663962363631386664353531303963313263633261633766326566383262643334646466
+65363664306332656134633039643135323134616535613834313533626633353066343762646132
+31353761373366313365373632366661646235333039656231323030366338326264333162646562
+39343265376234363635306537636464323030316231306564316635656563303565336539326237
+36393632386564343730616566373535616263383564343866353665373363363333343935346464
+31646338353235356231353135663062323766663231383730396235373934303465346239303961
+66646463663762633963336365356431323431383938373839346364303464633031633633663937
+36646165633661633361313635393134646133363334373863663132376266336233336435356435
+38303862613564363731313062316533633465353830316436326431656132353431373231646337
+33343464353039623236643633636239343965643633343966326562343934313664633563613730
+63313930643936393838636634613331633835656434646163386661663037376330646366656232
+32623461633935353134343533626266653031666335336236343039363066396337633639363235
+38626233383461356264616534656537633931663936383330386532363434383833613835613439
+64306262626539623136376630646439353335623266306139306434663331346237306331666533
+37363433343433363632336333633065313865626564633134616462393831626237333638333739
+61623030386235666132666661623462323332393666623539636139326530623233396533373939
+32396261306661663739333138353335663734316232303661353166376133653934306233343739
+33353833323739343163396234633264373139346264653933633433393132363966636135393365
+36363530396166363630643764633436663037666631343535366132373334663938333930396133
+36303864303961333664653635343935353266396231313964646262363038626561653466646438
+62306434373136393738303835656130333936663430636139383137633536383131616533613634
+62343464636332343031326365383964326666636466666636663236633935356635336435313437
+33626137326238356537353762613164653731326563663239316537646338643131643564663632
+33353536383265303030343735616530666236343064323337623232396130393366363161356636
+61333862313432323139313963386538393365373335373139353533356537383739373539646134
+37623936653933326633643961313530663533326532383133353238303336643432353833393338
+31633065666336373236386537636536326236636639376465346136326535653764373131636135
+61393932643639383234396163326633393733616563343637613661326432623461393934653965
+32643162386238316261633733613366323834393365633430643964666262306339633766613533
+65366264313431333132303063393564383062346365633133383463376631303933643065613137
+61383231393339363465363064633862633135326536663163366234623764626439346461303164
+32373738636533306362333138643832643862656239303464373434303537653336646430356633
+36626436356231616166666163346539633738623734343031373735346165303664346137343132
+31663230343934333138656333626339623133323630336266353831653135616363333432616361
+33613236623538333663366136656563663331366237303763653238336139363163366635646532
+37316430623433336436376462656331373336303831393333626166346135333737326435353834
+37636162646438313162303462633830353239623565393331316662616535343138613437653665
+31316563346234633031653131666531333266306139346566383263303835343532363633373665
+30336462626434393063343234356633636433356164363163363564383263623364386435383239
+33323738366534633730666436303433343731306662393863323633653263316138386365376666
+35316365303361623030383836316436323663646464386231346432396563663133643834383636
+61326534313237316130393538613834656231303732656163346237643535663239366536636633
+36306137616664623735613966343264653932363035373336636465323163393539363064386562
+31626138316163393466323333613530376265386136376330636364363166323061383034623336
+38643166363864383264373665323238326232376633653565356536376466303834313733613531
+65333734353036303935333533306334306231373731353463346461353930316562316439356562
+38336435366335333230323766626134376131323435323735653736336662313962393766383435
+39323734643037643066363338373332653830393337306633336131663131616164336536393837
+35383366316130343162663231343763373331613261393566366133346564636334643464373535
+37633536323531613831656662323263316630623061383930363637346438623735383430366538
+39303961326461323661346630313636643531303265393461373036306435353863643036623665
+66333965303032653537613232633162303138343632396134336130333430636666376430323466
+61323535313463653866666265313765623831376633666534623033643063386231623238656439
+63323166373764306162613233323466366363666535643339646361306638343762393834343131
+31393437373733343138306563363032353831616334383631656266346131303161633265343461
+62343234383936303664643234323665343635626435613766343737396564656137393061666165
+66313531666562303030323764356632626233333432343461393362303563643661336335366339
+62346366643835303563646161366434386532363265313531303634336136653062613464376138
+66336333623565623263363561303537303337623137656430353830353937323265313837333237
+62343132326665326130376566626661366534353335366532623539303536323762646462306261
+63383133633462376162316338663765393933663536663239636439643733376434333030616131
+63326332336563326232346430643534336133376334646635653862333133306135666132353839
+37336136346464363365633262623630343463343035666161626665663030346533303266313837
+32323566393630626566393334353832383235626161343532323930656430343739663432333866
+62663136333637663563366536303437363964666638326134373766313837383431663733383630
+63336432656239393465353666383131326536643531663337396234396663373432303163653331
+33626237386237626433653637313835376632613131663235353037336231613134633065323035
+31366531343131303937663561336262623062313961366233633430323639383332656236363535
+35353639633366366439666532326539666230323338643931383264306436386634316331393133
+33393963303734303037353139356436313036343766646131333735356266333434333039363339
+62396231303137303236626439633331306663313630653437363733656130653863646537316536
+39346233633436323565363466653862333630633030666136613237333663643339306334613532
+63343565393632353138616637356339623639373135636334333130323032346536626465323430
+63383363313338636466316464303039633236343038613734633632633234313837656436663137
+62643130383463333137363537646233613366653664613137623130333330636362

group_vars/auweg

@@ -5,8 +5,6 @@ dhcpd_primary: 172.23.13.3
 
 dns_primary: 172.23.13.3
 
-doorlock_domain: lock-auweg.binary.kitchen
-
 name_servers:
 - 172.23.13.3
 

host_vars/aeron.binary.kitchen

@@ -3,5 +3,4 @@
 radius_hostname: radius3.binary.kitchen
 
 slapd_hostname: ldap3.binary.kitchen
-slapd_replica_id: 3
 slapd_role: slave

host_vars/argentum.binary-kitchen.net

@@ -1,6 +0,0 @@
----
-
-root_keys_host:
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyGAePGA47K+VNFcKdvcQG3xM3ywcnrVtUD7wPrIin1 christoph"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqSDdYNxbI3C5PMtjBHmTukbapSzpXDY0x3aICQkZhl toffy"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINIhrQu5sf9LYoQ6ll1ShqDMX8xpsV9RUiaSw95JGafH flo@io3"

host_vars/aveta.binary.kitchen

@@ -3,5 +3,4 @@
 radius_hostname: radius2.binary.kitchen
 
 slapd_hostname: ldap2.binary.kitchen
-slapd_replica_id: 2
 slapd_role: slave

host_vars/bacon.binary.kitchen

@@ -13,5 +13,4 @@ ntp_peers:
 radius_hostname: radius1.binary.kitchen
 
 slapd_hostname: ldap1.binary.kitchen
-slapd_replica_id: 1
 slapd_role: slave

host_vars/beryllium.binary-kitchen.net

@@ -1,5 +1,5 @@
 ---
 
 root_keys_host:
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqSDdYNxbI3C5PMtjBHmTukbapSzpXDY0x3aICQkZhl toffy"
+- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAB+wC+Lik9TNbRo40+e2BmJzJY8EuwRiJzKKvGCHlMmagOmZVf+zUmjc1uMvrgoA4UPJyKlkW1HqRhKLmsoccD2wg1JLlnjx6KBhiPGjPt833eWv0CyfJVqoHVPUs14BwCRGzuFZPXh8LC1XWiDlo23RC0RgPpk+wcOzf79ZivYSL4UNMcBIMIKmPlRwBLRUUXjYU2jgv1mWvIQVdKRbwmLk7FajREANKiLj+Tk+D4VmkDq6gUqXZHYbyUauwrtpYSv2JM6YQYhWz+eNXIID1NmlopAf66RwFxAaane6qMUMSCQw3HUBL2BjFGgmmdJPvsEfrj+S1CYh61iC1NHmPhP6DDnQO7aiP6dWLnRXLg4qcUaN0XGNZmhScls/jNbN4U+w6gIlR12KyoCJOK4pXiifBiuqmFGucyETex1jdKoaLPeB8Smu4HkFksmRgTZHbiYVvkgI/iW9KjBBzxCc8cwehabUpQ0DVN4chpFiFNHb3SfCh6W/3IKFcu4ou4lbvVowq+v/M7aDhjSqGEBMS/HRMQ8KteNTngFBcpTzMPBz1RQIOqlWUGp8yqu1SwZ/ZG1nMyUehchfkw/n+ML676UYMCZX2m7hqWXVccCnJLzFApv+0Lzqf3TNSbeLS1N/MDdjg+uejtj1889/leIF1/CnaHIs7WJN1qmdeVGw== anti"
 - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMJDyq3veSnK+6hSw+Ml6lvTQTPC6vRFqtDXvPBnOtId8F9+/N0ADcPa5UTesnTkQgSAY7WpSoN5D6clYzdcPR55e5WZwZfMSkX14D7v7mrGxUcE4HshTorfEYv5XBd11Tvu0ruMdxlFQ+VFHkZIF305xgyx32INA3zUfnhzHJlKEdIAy8iSbERUV+X5kB59aep6xSpitCHJtsTT5Ky+EsvAhndKB5hDBuwVVr0+Sg5PypeTQ4zzWFyR6DFBEvyEj6bs/pQff9WxSRIXEuLffXOXdRLGHWqX7PfhWcH9WNH55WT7ZKCMGVuG4kYLkZ633c296ISg9q0eNKn99oHuwvzVg/wV3wndHINE+iUKKJjaRUpDUwd9DftFqMbFGATpf8en6KPs/7bgZUGACIfDO6Uy59V75cntiMFZc+BnnpV2qLVBFFD5ClRBCRdqH5D0px+jpuQFo9EUhggL4jzlj9wQf26zv0E4zSGTqbM1jfO3zcXlxSjg3H3Og2GAO5fCQiodpsqkW9Hby/p4s5l+P97tlVlgapnZlSA/1em4lmYshmRk/9scN8PMSXfW9uhncv9qXqp0ypEqEuNfj5u/1Eu8zmayIA9V23xyPn92LMT6MP2BB1kC7jeAXfXHdKBhTYW6bLQJKMs9nypH6RODK1fb9JlIrB61ZDJ9L5K++o2Q== noby"

host_vars/fluorine.binary-kitchen.net

@@ -1,4 +0,0 @@
----
-
-root_keys_host:
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6uNwYKF3rqleM/HP95M+rsm+gwKY8epdtW2OutneY9 ralf@pluto"

host_vars/krypton.binary-kitchen.net

@@ -2,4 +2,3 @@
 
 root_keys_host:
 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0Wq37DP89UO6MiJvvRbsXEcEV9d5/JJb7K2R0WHsHa sct39667@m-mob-062"
-- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMJDyq3veSnK+6hSw+Ml6lvTQTPC6vRFqtDXvPBnOtId8F9+/N0ADcPa5UTesnTkQgSAY7WpSoN5D6clYzdcPR55e5WZwZfMSkX14D7v7mrGxUcE4HshTorfEYv5XBd11Tvu0ruMdxlFQ+VFHkZIF305xgyx32INA3zUfnhzHJlKEdIAy8iSbERUV+X5kB59aep6xSpitCHJtsTT5Ky+EsvAhndKB5hDBuwVVr0+Sg5PypeTQ4zzWFyR6DFBEvyEj6bs/pQff9WxSRIXEuLffXOXdRLGHWqX7PfhWcH9WNH55WT7ZKCMGVuG4kYLkZ633c296ISg9q0eNKn99oHuwvzVg/wV3wndHINE+iUKKJjaRUpDUwd9DftFqMbFGATpf8en6KPs/7bgZUGACIfDO6Uy59V75cntiMFZc+BnnpV2qLVBFFD5ClRBCRdqH5D0px+jpuQFo9EUhggL4jzlj9wQf26zv0E4zSGTqbM1jfO3zcXlxSjg3H3Og2GAO5fCQiodpsqkW9Hby/p4s5l+P97tlVlgapnZlSA/1em4lmYshmRk/9scN8PMSXfW9uhncv9qXqp0ypEqEuNfj5u/1Eu8zmayIA9V23xyPn92LMT6MP2BB1kC7jeAXfXHdKBhTYW6bLQJKMs9nypH6RODK1fb9JlIrB61ZDJ9L5K++o2Q== noby"

host_vars/lasagne.binary.kitchen

@@ -1,11 +0,0 @@
----
-
-root_keys_host:
-- "# Thomas Basler"
-- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMJDyq3veSnK+6hSw+Ml6lvTQTPC6vRFqtDXvPBnOtId8F9+/N0ADcPa5UTesnTkQgSAY7WpSoN5D6clYzdcPR55e5WZwZfMSkX14D7v7mrGxUcE4HshTorfEYv5XBd11Tvu0ruMdxlFQ+VFHkZIF305xgyx32INA3zUfnhzHJlKEdIAy8iSbERUV+X5kB59aep6xSpitCHJtsTT5Ky+EsvAhndKB5hDBuwVVr0+Sg5PypeTQ4zzWFyR6DFBEvyEj6bs/pQff9WxSRIXEuLffXOXdRLGHWqX7PfhWcH9WNH55WT7ZKCMGVuG4kYLkZ633c296ISg9q0eNKn99oHuwvzVg/wV3wndHINE+iUKKJjaRUpDUwd9DftFqMbFGATpf8en6KPs/7bgZUGACIfDO6Uy59V75cntiMFZc+BnnpV2qLVBFFD5ClRBCRdqH5D0px+jpuQFo9EUhggL4jzlj9wQf26zv0E4zSGTqbM1jfO3zcXlxSjg3H3Og2GAO5fCQiodpsqkW9Hby/p4s5l+P97tlVlgapnZlSA/1em4lmYshmRk/9scN8PMSXfW9uhncv9qXqp0ypEqEuNfj5u/1Eu8zmayIA9V23xyPn92LMT6MP2BB1kC7jeAXfXHdKBhTYW6bLQJKMs9nypH6RODK1fb9JlIrB61ZDJ9L5K++o2Q=="
-- "# Ralf Ramsauer"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6uNwYKF3rqleM/HP95M+rsm+gwKY8epdtW2OutneY9 ralf@pluto"
-- "# Thomas Schmid"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0Wq37DP89UO6MiJvvRbsXEcEV9d5/JJb7K2R0WHsHa sct39667@m-mob-062"
-
-uau_reboot: "false"

host_vars/oxygen.binary-kitchen.net

@@ -1,4 +1,3 @@
 ---
 
-sshd_authkeys_command: "/usr/bin/sss_ssh_authorizedkeys"
-sshd_password_authentication: "yes"
+uau_reboot: "false"

host_vars/pizza.binary.kitchen

@@ -4,7 +4,8 @@ root_keys_host:
 - "# Thomas Basler"
 - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMJDyq3veSnK+6hSw+Ml6lvTQTPC6vRFqtDXvPBnOtId8F9+/N0ADcPa5UTesnTkQgSAY7WpSoN5D6clYzdcPR55e5WZwZfMSkX14D7v7mrGxUcE4HshTorfEYv5XBd11Tvu0ruMdxlFQ+VFHkZIF305xgyx32INA3zUfnhzHJlKEdIAy8iSbERUV+X5kB59aep6xSpitCHJtsTT5Ky+EsvAhndKB5hDBuwVVr0+Sg5PypeTQ4zzWFyR6DFBEvyEj6bs/pQff9WxSRIXEuLffXOXdRLGHWqX7PfhWcH9WNH55WT7ZKCMGVuG4kYLkZ633c296ISg9q0eNKn99oHuwvzVg/wV3wndHINE+iUKKJjaRUpDUwd9DftFqMbFGATpf8en6KPs/7bgZUGACIfDO6Uy59V75cntiMFZc+BnnpV2qLVBFFD5ClRBCRdqH5D0px+jpuQFo9EUhggL4jzlj9wQf26zv0E4zSGTqbM1jfO3zcXlxSjg3H3Og2GAO5fCQiodpsqkW9Hby/p4s5l+P97tlVlgapnZlSA/1em4lmYshmRk/9scN8PMSXfW9uhncv9qXqp0ypEqEuNfj5u/1Eu8zmayIA9V23xyPn92LMT6MP2BB1kC7jeAXfXHdKBhTYW6bLQJKMs9nypH6RODK1fb9JlIrB61ZDJ9L5K++o2Q=="
 - "# Ralf Ramsauer"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6uNwYKF3rqleM/HP95M+rsm+gwKY8epdtW2OutneY9 ralf@pluto"
+- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2bKOm2jd2QsPaJPE4V3bHBLjXB3pnpggkdEhf03aFvB08C72vKQcHpIYNhp8DLBr4N5epA0JP1cXdRSdKhQgzYbqL8CQgOJoNwf0OeOhFyXdThu1OqmaRMrRGlB/Q+sqBEXaknHqcXzq+24zkR+ID7sGkq7WaIKPln0qNY5RxWYrPE98ZhU5fZh1Qorcv34UBHYhVP4y8vM43LHcbkLgr0gg9tb2vItF6YvyIxgtz6KCODObzBZfkLLnVhVcb9VWbDh72rIz4OXI1fl+mCCH2l7XlqKP1vhF5LVsUjPcGY3Go0fw2vHIyxWe479OJ/9elFnKRIUY/f1Xz+YikLTmj ralf@YUBIKEY"
+- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUAsEgyHNq7iQpAltGVVHGdf/PIQH7sYuq1PbaFEJzj ralf@lefay"
 - "# Thomas Schmid"
 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0Wq37DP89UO6MiJvvRbsXEcEV9d5/JJb7K2R0WHsHa sct39667@m-mob-062"
 

host_vars/rhodium.binary-kitchen.net

@@ -1,4 +0,0 @@
----
-
-root_keys_host:
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0Wq37DP89UO6MiJvvRbsXEcEV9d5/JJb7K2R0WHsHa sct39667@m-mob-062"

host_vars/ruthenium.binary-kitchen.net

@@ -2,6 +2,6 @@
 
 root_keys_host:
 - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCtTJqeSsB+aRiQ2WeFLVA5dz5YfCuv2TZmsyFqZ8NefJH/ZP3+gud3DwBq4l9HbDJUbfvApLQ9qbwaX0VhBv67mM6f4sWNG8uUW+9MYd6ZTeP3KUwZIHM52nqMFe5XScADL4s8Jsnb08gVp9xdcdufsbiLNYfuNFk+wcwRYtD5eqXZi3oaqshlq61LfBeC958vzvceDrZ2obfCJJ2pvmhUyORvgb6jXfx3kZku5qgk6m9NfyY95UZvSweDZPiN5YqLYekz+jxrYDyeA0DPgwlTcyGn8JI9/HkAD/odTpTAH+T6sbf0OkUi7ufNElAXvxDOJZN8NhxPFfUAW9naTYwGoPd4OJw0AOVLzKcVIjEXKtrxeQ0NOZVoucLFgnXO4iDZGrVHohPVj1UbrVpF00lokBLz1Xh4egrNw0g2Gt28HmZ9lg5Ymv8jJWAy87r5wV0O6aIuseGkSr/V6+92AGK/Yy1tKhZujtv5+CvVVBrLvoOnJJh8vFoVuRM+ucLBhqpewDY2yHZHzQ3J5SZKJ30mBUSYAKHBqVI4VmC/n235VMumIEsqnZvzk96G5TXWyZb0qzkXcct1H8MyQgG0SR0G4Ylm5skCZppEE7udV/wb8lRZv+2YrqBueKZ+Wu6IT3HJbUkor7CcbORjhwL4ETziPm4g4BrTPGUTjyeZ4nSDPQ== exxess"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6uNwYKF3rqleM/HP95M+rsm+gwKY8epdtW2OutneY9 ralf@pluto"
+- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUAsEgyHNq7iQpAltGVVHGdf/PIQH7sYuq1PbaFEJzj ralf@lefay"
 
 uau_reboot: "false"

host_vars/strontium.binary-kitchen.net

@@ -0,0 +1,4 @@
+---
+
+root_keys_host:
+- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINkN1eqP1Mv29z0npVznVJ4Cumyf4EoqS44xHKl0ms0e timo@charon"

host_vars/sulis.binary.kitchen

@@ -1,4 +0,0 @@
----
-
-sshd_authkeys_command: "/usr/bin/sss_ssh_authorizedkeys"
-sshd_password_authentication: "yes"

host_vars/technetium.binary-kitchen.net

@@ -1,5 +1,4 @@
 ---
 
 root_keys_host:
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBMLLlnlzbf5GTes2QrxuOTAR0BWTtbqQS80yPfI0mbh timo@styx"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC7oyUa65KoSuv9l8tH/zVgZZ5mg5P45RIhlRZSt/amL x70b1"
+- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcoIXTF0RtzM2vDir8axegFpLKNxGJyYNLj2triQm59GIvNRPHG/nBoaDcUwRT5b6Ew91KMw6iT1eI0n9oKbTMHZHvdSLLUmNmZT4z4JQOQm0n415ZW9m1r3R3S8sAxiLQ+5U91xnbHlzfuBKvpI56RLZNbkhAcqw9kS/UasO0UAFpdGL5CBnbJt0KPb4C9cYUM6H4clZFpWVDdK3+6gh+/Jx9QPmpPv0wfWI7z0fvQYUcXDFLjPh8CFK7BOcPZcv4V4bl5Tq1dTURMLaueTD0F5Ygn7cxKaDNvql4EIPDZaRCEz3cIvFB7435emRgZC54YmhWIYC+oJrLTlMCrYKhISLtWg92EcE/aCUNL0V+n1EK5dkds+AY/eDiyP58ArAHNsopXmcHiko3goyZyEK5Y0tJ5sA9L4Q0mgLz/rW1CsZHcpiYU9yKpDRscbf3DDlFMzMYG8O9JufgcyF+GFhxIhXesfjJ4gDNepaYhd/qutwThip027cKtoczLAMR2xbT6bUYr7KKmxvXVlP7Epkfi3N2cj/Wx9gAm1qIs1yjcWCe71k1QMC+dTNTV+T9Ch5d1lji7lGOKDl70rB/WytdISVlEJr8TviBk27oldCuC1WCPGjRxWeGv5uVxE9O7nQh0dxox+HFssa7ENuDR9LEd9O6Zvuf09pzDASB0PjFyw== bedah@binary-kitchen.de"

host_vars/tschunk.binary.kitchen

@@ -1,7 +0,0 @@
----
-
-root_keys_host:
-- "# Thomas Schmid"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0Wq37DP89UO6MiJvvRbsXEcEV9d5/JJb7K2R0WHsHa sct39667@m-mob-062"
-
-uau_reboot: "true"

host_vars/yttrium.binary-kitchen.net

@@ -1,6 +1,5 @@
 ---
 
 root_keys_host:
-- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCtTJqeSsB+aRiQ2WeFLVA5dz5YfCuv2TZmsyFqZ8NefJH/ZP3+gud3DwBq4l9HbDJUbfvApLQ9qbwaX0VhBv67mM6f4sWNG8uUW+9MYd6ZTeP3KUwZIHM52nqMFe5XScADL4s8Jsnb08gVp9xdcdufsbiLNYfuNFk+wcwRYtD5eqXZi3oaqshlq61LfBeC958vzvceDrZ2obfCJJ2pvmhUyORvgb6jXfx3kZku5qgk6m9NfyY95UZvSweDZPiN5YqLYekz+jxrYDyeA0DPgwlTcyGn8JI9/HkAD/odTpTAH+T6sbf0OkUi7ufNElAXvxDOJZN8NhxPFfUAW9naTYwGoPd4OJw0AOVLzKcVIjEXKtrxeQ0NOZVoucLFgnXO4iDZGrVHohPVj1UbrVpF00lokBLz1Xh4egrNw0g2Gt28HmZ9lg5Ymv8jJWAy87r5wV0O6aIuseGkSr/V6+92AGK/Yy1tKhZujtv5+CvVVBrLvoOnJJh8vFoVuRM+ucLBhqpewDY2yHZHzQ3J5SZKJ30mBUSYAKHBqVI4VmC/n235VMumIEsqnZvzk96G5TXWyZb0qzkXcct1H8MyQgG0SR0G4Ylm5skCZppEE7udV/wb8lRZv+2YrqBueKZ+Wu6IT3HJbUkor7CcbORjhwL4ETziPm4g4BrTPGUTjyeZ4nSDPQ== exxess"
-- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMJDyq3veSnK+6hSw+Ml6lvTQTPC6vRFqtDXvPBnOtId8F9+/N0ADcPa5UTesnTkQgSAY7WpSoN5D6clYzdcPR55e5WZwZfMSkX14D7v7mrGxUcE4HshTorfEYv5XBd11Tvu0ruMdxlFQ+VFHkZIF305xgyx32INA3zUfnhzHJlKEdIAy8iSbERUV+X5kB59aep6xSpitCHJtsTT5Ky+EsvAhndKB5hDBuwVVr0+Sg5PypeTQ4zzWFyR6DFBEvyEj6bs/pQff9WxSRIXEuLffXOXdRLGHWqX7PfhWcH9WNH55WT7ZKCMGVuG4kYLkZ633c296ISg9q0eNKn99oHuwvzVg/wV3wndHINE+iUKKJjaRUpDUwd9DftFqMbFGATpf8en6KPs/7bgZUGACIfDO6Uy59V75cntiMFZc+BnnpV2qLVBFFD5ClRBCRdqH5D0px+jpuQFo9EUhggL4jzlj9wQf26zv0E4zSGTqbM1jfO3zcXlxSjg3H3Og2GAO5fCQiodpsqkW9Hby/p4s5l+P97tlVlgapnZlSA/1em4lmYshmRk/9scN8PMSXfW9uhncv9qXqp0ypEqEuNfj5u/1Eu8zmayIA9V23xyPn92LMT6MP2BB1kC7jeAXfXHdKBhTYW6bLQJKMs9nypH6RODK1fb9JlIrB61ZDJ9L5K++o2Q== noby"
-- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC0Wq37DP89UO6MiJvvRbsXEcEV9d5/JJb7K2R0WHsHa sct39667@m-mob-062"
+- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDetxImx0c/Fald9Y2wIHNJCi356rfskVUBT/SGH64N1HVZGBZhlWkeKJkCCufm3jLXdjJrlFDFlP0EjbohR6SP3VVf8Z7zAoazCtxWq0dyjPDvOjUrIuBeILbXZu0Q+qmFHPwvp5vR2wWFUwNLl1Te3CNSzQnn2KxOXfeZ56cDogzonlxh5JXDd0JWpINAuLp7uR6IshfmEMKsyCGjqzMUJ9YCztzkI9TJYDc4xitmQTvea44hRhyeIRf2ip8YlHnEIpJ9i712CQ5UEHBZUfy2gZwoLW0yYy9HJucF2A5gzvoUQ1wjA9/irlGiabKq6rOyT4ezBSoZZLEBIa6GU4qKMc1rE4Hnifi0AUnQ+4MqrCCu2QTJGNvyYzNt2XtkjakN3gtlz5xCsYV08PEB4VjAFVIa1yku66UblAW5KqixfE4mU7Z29b8faF5Ld7XO1tlNgiuHih7+JoQiwJ+auULYwRX1C2v6fAEU3PGU73VT3TZJTa5IS+fkTWzn643atxklP6Lmo8hrZIS0NXIr22OP1zYuCZm5/JLDhe0qOCYd8YQU2dNww4OUZ1uMLNOM+0UJvCHbWdjw8amR58yO5W83xp0qLHGUFjDpgvuP4ius4gvwjlhFdSVYRGwr2intLitXvOf3btjBJKUDIN0VM4MFzkvyUyCOgBgEkdCBvI7g4w== philmacfly"
+- "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8MB80WTE9ZW/mGRdPWjkpiupvoSGVnmK9wvOqm6xpwDwZkD52RGfiWQW2IbJObCLGJxoigSi4lVvrJD6MWjXAsj5Foq1H3Ok+xJET2zfWMf4s/0uStSS9kaJ/gI6Qd5jMsnz1xATTInWAHIK7u3I4trt81FWkXQdfRSNC0mPh/PYBsXzwgx/m5s3o1nUtcIBXFZUeGNnhSSf1As0Wi0Bsv3GXIIDH4b4cIi7aGHqGuaes2cTUW1r0RspUVI139Gx2O4mgv4JE/n61t/4AzfYGoaszoqPCHQt5LR8Wd/XIaPLwnM1kzo4QVqNgqkY/awryt9IPoAFqJBbIvP0Bt3irGOPrdl7e7KcV55a9gPpCmz+bVaQO2oBmQ34AsZFg9tCP26OmViQu0Lx14vWWYDFkxzCxCDDngo6+f+e5AsyAjO2pHz/ZKv/VE5P3y8CnadHG88cO0qeoI6VH4jjGk5GYYrVD4BHf8StlvAg8unwMlYchuvaKLtQyQXFW40ww4VDdPo6KSv5T5a6SozEzRtN2QKRLyxIz68xVnKYq4TanR2lsm6wecUSriV48qscglokcTKJspWD29DQ62dMt5xFDtM8i9dE8W3SUePB8qPTBK9LUrO8PkGjb0X/RgMZB5bCWBmz4I1G1X+9Y8OLpr4NKGP9UFntYtJ3tpMCHtPgf4Q== philmacfly"

hosts

@@ -9,8 +9,6 @@ pizza.binary.kitchen ansible_host=172.23.2.33
 pancake.binary.kitchen ansible_host=172.23.2.34
 knoedel.binary.kitchen ansible_host=172.23.2.35
 bob.binary.kitchen ansible_host=172.23.2.37
-lasagne.binary.kitchen ansible_host=172.23.2.38
-tschunk.binary.kitchen ansible_host=172.23.2.39
 bowle.binary.kitchen ansible_host=172.23.2.62
 salat.binary.kitchen ansible_host=172.23.9.61
 [auweg]
@@ -29,15 +27,10 @@ fluorine.binary-kitchen.net
 neon.binary-kitchen.net
 sodium.binary-kitchen.net
 magnesium.binary-kitchen.net
-aluminium.binary-kitchen.net
 krypton.binary-kitchen.net
 yttrium.binary-kitchen.net
 zirconium.binary-kitchen.net
 molybdenum.binary-kitchen.net
-technetium.binary-kitchen.net
 ruthenium.binary-kitchen.net
 rhodium.binary-kitchen.net
-palladium.binary-kitchen.net
-argentum.binary-kitchen.net
-cadmium.binary-kitchen.net
 barium.binary-kitchen.net

roles/23b/tasks/main.yml

@@ -1,49 +0,0 @@
----
-
-- name: Install packages
-  apt:
-    name:
-    - docker-compose
-
-- name: Create 23b group
-  group: name=23b
-
-- name: Create 23b user
-  user:
-    name: 23b
-    home: /opt/23b
-    shell: /bin/bash
-    group: 23b
-    groups: docker
-
-# docker-compolse.yml is managed outside ansible
-
-- name: Ensure certificates are available
-  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ bk23b_domain }}.key -out /etc/nginx/ssl/{{ bk23b_domain }}.crt -days 730 -subj "/CN={{ bk23b_domain }}" creates=/etc/nginx/ssl/{{ bk23b_domain }}.crt
-  notify: Restart nginx
-
-- name: Configure certificate manager for 23b
-  template: src=certs.j2 dest=/etc/acertmgr/{{ bk23b_domain }}.conf
-  notify: Run acertmgr
-
-- name: Configure vhost
-  template: src=vhost.j2 dest=/etc/nginx/sites-available/23b
-  notify: Restart nginx
-
-- name: Enable vhost
-  file: src=/etc/nginx/sites-available/23b dest=/etc/nginx/sites-enabled/23b state=link
-  notify: Restart nginx
-
-- name: Systemd unit for 23b
-  template: src=23b.service.j2 dest=/etc/systemd/system/23b.service
-  notify:
-  - Reload systemd
-  - Restart 23b
-
-- name: Start the 23b service
-  service: name=23b state=started enabled=yes
-
-- name: Enable monitoring
-  include_role: name=icinga-monitor tasks_from=http
-  vars:
-    vhost: "{{ bk23b_domain }}"

roles/23b/templates/23b.service.j2

@@ -1,28 +0,0 @@
-[Unit]
-Description=23b service using docker compose
-Requires=docker.service
-After=docker.service
-Before=nginx.service
-
-[Service]
-Type=simple
-
-User=23b
-Group=23b
-
-Restart=always
-TimeoutStartSec=1200
-
-WorkingDirectory=/opt/23b/23b/23b
-
-# Make sure no old containers are running
-ExecStartPre=/usr/bin/docker-compose down -v
-
-# Compose up
-ExecStart=/usr/bin/docker-compose up
-
-# Compose down, remove containers and volumes
-ExecStop=/usr/bin/docker-compose down -v
-
-[Install]
-WantedBy=multi-user.target

roles/23b/templates/vhost.j2

@@ -1,36 +0,0 @@
-server {
-	listen 80;
-	listen [::]:80;
-
-	server_name {{ bk23b_domain }};
-
-	location /.well-known/acme-challenge {
-		default_type "text/plain";
-		alias /var/www/acme-challenge;
-	}
-
-	location / {
-		return 301 https://{{ bk23b_domain }}$request_uri;
-	}
-}
-
-server {
-	listen 443 ssl http2;
-	listen [::]:443 ssl http2;
-
-	server_name {{ bk23b_domain }};
-
-	ssl_certificate_key /etc/nginx/ssl/{{ bk23b_domain }}.key;
-	ssl_certificate /etc/nginx/ssl/{{ bk23b_domain }}.crt;
-
-	# set max upload size
-	client_max_body_size 8M;
-
-	location / {
-		proxy_pass http://localhost:5000;
-		proxy_set_header Host $host;
-		proxy_set_header X-Real-IP $remote_addr;
-		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-		proxy_set_header X-Forwarded-Proto $scheme;
-	}
-}

roles/act_runner/defaults/main.yml

@@ -1,7 +0,0 @@
----
-
-actrunner_user: act_runner
-actrunner_group: act_runner
-
-actrunner_version: 0.2.10
-actrunner_url: https://gitea.com/gitea/act_runner/releases/download/v{{ actrunner_version }}/act_runner-{{ actrunner_version }}-linux-amd64

roles/act_runner/handlers/main.yml

@@ -1,7 +0,0 @@
----
-
-- name: Reload systemd
-  systemd: daemon_reload=yes
-
-- name: Restart act_runner
-  service: name=act_runner state=restarted

roles/act_runner/tasks/main.yml

@@ -1,35 +0,0 @@
----
-
-- name: Create group
-  group: name={{ actrunner_group }}
-
-- name: Create user
-  user: name={{ actrunner_user }} home=/var/lib/act_runner group={{ actrunner_group }} groups=docker
-
-- name: Create directories
-  file: path={{ item }} state=directory owner={{ actrunner_user }} group={{ actrunner_group }}
-  with_items:
-  - /etc/act_runner
-  - /var/lib/act_runner
-
-- name: Download act_runner binary
-  get_url: url={{ actrunner_url }} dest=/usr/local/bin/act_runner-{{ actrunner_version }} mode=0755
-  register: runner_download
-
-- name: Symlink act_runner binary
-  file: src=/usr/local/bin/act_runner-{{ actrunner_version }} dest=/usr/local/bin/act_runner state=link
-  when: runner_download.changed
-  notify: Restart act_runner
-
-- name: Configure act_runner
-  template: src=config.yaml.j2 dest=/etc/act_runner/config.yaml owner={{ actrunner_user }} group={{ actrunner_group }}
-  notify: Restart act_runner
-
-- name: Install systemd unit
-  template: src=act_runner.service.j2 dest=/lib/systemd/system/act_runner.service
-  notify:
-  - Reload systemd
-  - Restart act_runner
-
-- name: Enable act_runner
-  service: name=act_runner state=started enabled=yes

roles/act_runner/templates/act_runner.service.j2

@@ -1,16 +0,0 @@
-[Unit]
-Description=Gitea Actions runner
-Documentation=https://gitea.com/gitea/act_runner
-After=docker.service
-
-[Service]
-ExecStart=/usr/local/bin/act_runner daemon --config /etc/act_runner/config.yaml
-ExecReload=/bin/kill -s HUP $MAINPID
-WorkingDirectory=/var/lib/act_runner
-TimeoutSec=0
-RestartSec=10
-Restart=always
-User={{ actrunner_user }}
-
-[Install]
-WantedBy=multi-user.target

roles/act_runner/templates/config.yaml.j2

@@ -1,86 +0,0 @@
-log:
-  # The level of logging, can be trace, debug, info, warn, error, fatal
-  level: warn
-
-runner:
-  # Where to store the registration result.
-  file: .runner
-  # Execute how many tasks concurrently at the same time.
-  capacity: 4
-  # Extra environment variables to run jobs.
-  envs:
-  # Extra environment variables to run jobs from a file.
-  # It will be ignored if it's empty or the file doesn't exist.
-  env_file: .env
-  # The timeout for a job to be finished.
-  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
-  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
-  timeout: 3h
-  # Whether skip verifying the TLS certificate of the Gitea instance.
-  insecure: false
-  # The timeout for fetching the job from the Gitea instance.
-  fetch_timeout: 5s
-  # The interval for fetching the job from the Gitea instance.
-  fetch_interval: 2s
-  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
-  # Like: ["macos-arm64:host", "ubuntu-latest:docker://node:16-bullseye", "ubuntu-22.04:docker://node:16-bullseye"]
-  # If it's empty when registering, it will ask for inputting labels.
-  # If it's empty when execute `deamon`, will use labels in `.runner` file.
-  labels: [
-    "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest",
-    "ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04",
-    "ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04",
-  ]
-
-cache:
-  # Enable cache server to use actions/cache.
-  enabled: true
-  # The directory to store the cache data.
-  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
-  dir: ""
-  # The host of the cache server.
-  # It's not for the address to listen, but the address to connect from job containers.
-  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
-  host: ""
-  # The port of the cache server.
-  # 0 means to use a random available port.
-  port: 0
-  # The external cache server URL. Valid only when enable is true.
-  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
-  # The URL should generally end with "/".
-  external_server: ""
-
-container:
-  # Specifies the network to which the container will connect.
-  # Could be host, bridge or the name of a custom network.
-  # If it's empty, act_runner will create a network automatically.
-  network: ""
-  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
-  privileged: false
-  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
-  options:
-  # The parent directory of a job's working directory.
-  # If it's empty, /workspace will be used.
-  workdir_parent:
-  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
-  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
-  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
-  # valid_volumes:
-  #   - data
-  #   - /src/*.json
-  # If you want to allow any volume, please use the following configuration:
-  # valid_volumes:
-  #   - '**'
-  valid_volumes: []
-  # overrides the docker client host with the specified one.
-  # If it's empty, act_runner will find an available docker host automatically.
-  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
-  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
-  docker_host: ""
-  # Pull docker image(s) even if already present
-  force_pull: false
-
-host:
-  # The parent directory of a job's working directory.
-  # If it's empty, $HOME/.cache/act/ will be used.
-  workdir_parent:

roles/authentik/handlers/main.yml

@@ -1,13 +0,0 @@
----
-
-- name: Reload systemd
-  systemd: daemon_reload=yes
-
-- name: Restart authentik
-  service: name=authentik state=restarted
-
-- name: Restart nginx
-  service: name=nginx state=restarted
-
-- name: Run acertmgr
-  command: /usr/bin/acertmgr

roles/authentik/tasks/main.yml

@@ -1,51 +0,0 @@
----
-
-- name: Install packages
-  apt:
-    name:
-    - docker-compose
-
-- name: Create authentik group
-  group: name=authentik
-
-- name: Create authentik user
-  user:
-    name: authentik
-    home: /opt/authentik
-    shell: /bin/bash
-    group: authentik
-    groups: docker
-
-- name: Configure authentik container
-  template: src=docker-compose.yml.j2 dest=/opt/authentik/docker-compose.yml
-  notify: Restart authentik
-
-- name: Ensure certificates are available
-  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ authentik_domain }}.key -out /etc/nginx/ssl/{{ authentik_domain }}.crt -days 730 -subj "/CN={{ authentik_domain }}" creates=/etc/nginx/ssl/{{ authentik_domain }}.crt
-  notify: Restart nginx
-
-- name: Configure certificate manager for authentik
-  template: src=certs.j2 dest=/etc/acertmgr/{{ authentik_domain }}.conf
-  notify: Run acertmgr
-
-- name: Configure vhost
-  template: src=vhost.j2 dest=/etc/nginx/sites-available/authentik
-  notify: Restart nginx
-
-- name: Enable vhost
-  file: src=/etc/nginx/sites-available/authentik dest=/etc/nginx/sites-enabled/authentik state=link
-  notify: Restart nginx
-
-- name: Systemd unit for authentik
-  template: src=authentik.service.j2 dest=/etc/systemd/system/authentik.service
-  notify:
-  - Reload systemd
-  - Restart authentik
-
-- name: Start the authentik service
-  service: name=authentik state=started enabled=yes
-
-- name: Enable monitoring
-  include_role: name=icinga-monitor tasks_from=http
-  vars:
-    vhost: "{{ authentik_domain }}"

roles/authentik/templates/authentik.service.j2

@@ -1,28 +0,0 @@
-[Unit]
-Description=authentik service using docker compose
-Requires=docker.service
-After=docker.service
-Before=nginx.service
-
-[Service]
-Type=simple
-
-User=authentik
-Group=authentik
-
-Restart=always
-TimeoutStartSec=1200
-
-WorkingDirectory=/opt/authentik
-
-# Make sure no old containers are running
-ExecStartPre=/usr/bin/docker-compose down -v
-
-# Compose up
-ExecStart=/usr/bin/docker-compose up
-
-# Compose down, remove containers and volumes
-ExecStop=/usr/bin/docker-compose down -v
-
-[Install]
-WantedBy=multi-user.target

roles/authentik/templates/certs.j2

@@ -1,15 +0,0 @@
----
-
-{{ authentik_domain }}:
-- path: /etc/nginx/ssl/{{ authentik_domain }}.key
-  user: root
-  group: root
-  perm: '400'
-  format: key
-  action: '/usr/sbin/service nginx restart'
-- path: /etc/nginx/ssl/{{ authentik_domain }}.crt
-  user: root
-  group: root
-  perm: '400'
-  format: crt,ca
-  action: '/usr/sbin/service nginx restart'

roles/authentik/templates/docker-compose.yml.j2

@@ -1,75 +0,0 @@
----
-version: "3.4"
-services:
-  postgresql:
-    image: docker.io/library/postgres:12-alpine
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 5s
-    volumes:
-      - ./database:/var/lib/postgresql/data
-    environment:
-      POSTGRES_PASSWORD: {{ authentik_dbpass }}
-      POSTGRES_USER: {{ authentik_dbuser }}
-      POSTGRES_DB: {{ authentik_dbname }}
-  redis:
-    image: docker.io/library/redis:alpine
-    command: --save 60 1 --loglevel warning
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      start_period: 20s
-      interval: 30s
-      retries: 5
-      timeout: 3s
-    volumes:
-      - ./redis:/data
-  server:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
-    restart: unless-stopped
-    command: server
-    environment:
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: {{ authentik_dbuser }}
-      AUTHENTIK_POSTGRESQL__NAME: {{ authentik_dbname }}
-      AUTHENTIK_POSTGRESQL__PASSWORD: {{ authentik_dbpass }}
-      AUTHENTIK_SECRET_KEY: {{ authentik_secret }}
-    volumes:
-      - ./media:/media
-      - ./custom-templates:/templates
-    ports:
-      - "127.0.0.1:9000:9000"
-    depends_on:
-      - postgresql
-      - redis
-  worker:
-    image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.4.2}
-    restart: unless-stopped
-    command: worker
-    environment:
-      AUTHENTIK_REDIS__HOST: redis
-      AUTHENTIK_POSTGRESQL__HOST: postgresql
-      AUTHENTIK_POSTGRESQL__USER: {{ authentik_dbuser }}
-      AUTHENTIK_POSTGRESQL__NAME: {{ authentik_dbname }}
-      AUTHENTIK_POSTGRESQL__PASSWORD: {{ authentik_dbpass }}
-      AUTHENTIK_SECRET_KEY: {{ authentik_secret }}
-    # `user: root` and the docker socket volume are optional.
-    # See more for the docker socket integration here:
-    # https://goauthentik.io/docs/outposts/integrations/docker
-    # Removing `user: root` also prevents the worker from fixing the permissions
-    # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
-    # (1000:1000 by default)
-    user: root
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - ./media:/media
-      - ./certs:/certs
-      - ./custom-templates:/templates
-    depends_on:
-      - postgresql
-      - redis

roles/authentik/templates/vhost.j2

@@ -1,41 +0,0 @@
-map $http_upgrade $connection_upgrade {
-	default	upgrade;
-	''	close;
-}
-
-server {
-	listen 80;
-	listen [::]:80;
-
-	server_name {{ authentik_domain }};
-
-	location /.well-known/acme-challenge {
-		default_type "text/plain";
-		alias /var/www/acme-challenge;
-	}
-
-	location / {
-		return 301 https://{{ authentik_domain }}$request_uri;
-	}
-}
-
-server {
-	listen 443 ssl http2;
-	listen [::]:443 ssl http2;
-
-	server_name {{ authentik_domain }};
-
-	ssl_certificate_key /etc/nginx/ssl/{{ authentik_domain }}.key;
-	ssl_certificate /etc/nginx/ssl/{{ authentik_domain }}.crt;
-
-	location / {
-		proxy_pass http://localhost:9000;
-		proxy_http_version 1.1;
-		proxy_set_header Host $host;
-		proxy_set_header X-Real-IP $remote_addr;
-		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-		proxy_set_header X-Forwarded-Proto $scheme;
-		proxy_set_header Upgrade $http_upgrade;
-		proxy_set_header Connection $connection_upgrade;
-	}
-}

roles/bk_dss/defaults/main.yml

@@ -1,4 +1,4 @@
 ---
 
 dss_uwsgi_port: 5001
-dss_version: 0.8.5
+dss_version: 0.8.4

roles/bk_dss/templates/config.cfg.j2

@@ -1,14 +1,12 @@
 DEBUG = True
-REMEMBER_COOKIE_SECURE = True
 SECRET_KEY = "{{ dss_secret }}"
-SESSION_COOKIE_SECURE = True
 SESSION_TIMEOUT = 3600
 
 LDAP_CA = "/etc/ssl/certs/ca-certificates.crt"
 LDAP_URI = "{{ ldap_uri }}"
 LDAP_BASE = "{{ ldap_base }}"
 
-ADMINS = [ "cn=moepman,ou=people,dc=binary-kitchen,dc=de", "cn=anke,ou=people,dc=binary-kitchen,dc=de", "cn=toffy,ou=people,dc=binary-kitchen,dc=de", "cn=zaesa,ou=people,dc=binary-kitchen,dc=de", "cn=Manager,dc=binary-kitchen,dc=de" ]
+ADMINS = [ "cn=moepman,ou=people,dc=binary-kitchen,dc=de", "cn=marove,ou=people,dc=binary-kitchen,dc=de", "cn=zaesa,ou=people,dc=binary-kitchen,dc=de", "cn=Manager,dc=binary-kitchen,dc=de" ]
 
 USER_DN = "cn={user},ou=people,dc=binary-kitchen,dc=de"
 
@@ -30,7 +28,7 @@ USER_ATTRS = {
 	'userPassword' : '{pass}'
 }
 
-GROUP_FILTER = "(objectClass=posixGroup)"
+GROUP_DN = 'cn=members,ou=groups,dc=binary-kitchen,dc=de'
 
 REDIS_HOST = "127.0.0.1"
 REDIS_PASSWD = None

roles/common/tasks/Debian.yml

@@ -16,7 +16,6 @@
     - rsync
     - sudo
     - vim-nox
-    - wget
     - zsh
 
 - name: Install software on KVM VMs
@@ -104,7 +103,7 @@
     replace: "rotate 7"
   loop: "{{ logrotateconfigpaths }}"
 
-- name: Configure sshd
+- name: Configure ssh password login
   template:
     src: sshd_config.j2
     dest: /etc/ssh/sshd_config

roles/common/templates/chrony.conf.j2

@@ -1,9 +1,6 @@
 # Welcome to the chrony configuration file. See chrony.conf(5) for more
 # information about usable directives.
 
-# Include configuration files found in /etc/chrony/conf.d.
-confdir /etc/chrony/conf.d
-
 {% for srv in ntp_servers %}
 server {{ srv }} iburst
 {% endfor %}
@@ -26,9 +23,6 @@ keyfile /etc/chrony/chrony.keys
 # information.
 driftfile /var/lib/chrony/chrony.drift
 
-# Save NTS keys and cookies.
-ntsdumpdir /var/lib/chrony
-
 # Uncomment the following line to turn logging on.
 #log tracking measurements statistics
 
@@ -39,7 +33,7 @@ logdir /var/log/chrony
 maxupdateskew 100.0
 
 # This directive enables kernel synchronisation (every 11 minutes) of the
-# real-time clock. Note that it can't be used along with the 'rtcfile' directive.
+# real-time clock. Note that it can’t be used along with the 'rtcfile' directive.
 rtcsync
 
 # Step the system clock instead of slewing it if the adjustment is larger than

roles/common/templates/sshd_config.j2

@@ -43,17 +43,8 @@ PermitRootLogin {{ sshd_permit_root_login }}
 
 #AuthorizedPrincipalsFile none
 
-{% if sshd_authkeys_command is defined and sshd_authkeys_command %}
-AuthorizedKeysCommand {{ sshd_authkeys_command }}
-{%   if sshd_authkeys_user is defined and sshd_authkeys_user %}
-AuthorizedKeysCommandUser {{ sshd_authkeys_user }}
-{%   else %}
-AuthorizedKeysCommandUser nobody
-{%   endif %}
-{% else %}
 #AuthorizedKeysCommand none
 #AuthorizedKeysCommandUser nobody
-{% endif %}
 
 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
 #HostbasedAuthentication no

roles/dhcpd/templates/dhcp/dhcpd.conf.j2

@@ -107,6 +107,7 @@ subnet 172.23.13.0 netmask 255.255.255.0 {
 # Users Auweg
 subnet 172.23.14.0 netmask 255.255.255.0 {
   option routers 172.23.14.1;
+  ddns-domainname "users.binary.kitchen";
   option domain-search "binary.kitchen", "users.binary.kitchen";
   pool {
 {% if dhcpd_failover == true %}
@@ -142,7 +143,7 @@ host ap01 {
 }
 
 host ap04 {
-  hardware ethernet 74:9e:75:ce:93:54;
+  hardware ethernet 44:48:c1:ce:90:06;
   fixed-address ap04.binary.kitchen;
 }
 

roles/dns_extern/templates/pdns.conf.j2

@@ -1,4 +1,5 @@
-local-address=0.0.0.0, ::
+local-address=0.0.0.0
+local-ipv6=::
 launch=gsqlite3
 gsqlite3-dnssec
 gsqlite3-database=/var/lib/powerdns/powerdns.sqlite3

roles/dns_intern/templates/bind/23.172.in-addr.arpa.zone.j2

@@ -1,7 +1,7 @@
 $ORIGIN 23.172.in-addr.arpa.	; base for unqualified names
 $TTL 1h				; default time-to-live
 @				IN	SOA ns1.binary.kitchen. hostmaster.binary.kitchen. (
-					2024051300; serial
+					2022071600; serial
 					1d; refresh
 					2h; retry
 					4w; expire
@@ -11,7 +11,7 @@ $TTL 1h				; default time-to-live
 				IN	NS	ns2.binary.kitchen.
 ; Loopback
 1.0				IN	PTR	core.binary.kitchen.
-2.0				IN	PTR	rt-w13b.binary.kitchen.
+2.0				IN	PTR	erx-bk.binary.kitchen.
 3.0				IN	PTR	erx-rz.binary.kitchen.
 4.0				IN	PTR	erx-auweg.binary.kitchen.
 ; Management
@@ -50,8 +50,6 @@ $TTL 1h				; default time-to-live
 35.2				IN	PTR	knoedel.binary.kitchen.
 36.2				IN	PTR	schweinshaxn.binary.kitchen.
 37.2				IN	PTR	bob.binary.kitchen.
-38.2				IN	PTR	lasagne.binary.kitchen.
-39.2				IN	PTR	tschunk.binary.kitchen.
 62.2				IN	PTR	bowle.binary.kitchen.
 91.2				IN	PTR	strammermax.binary.kitchen.
 92.2				IN	PTR	obatzda.binary.kitchen.
@@ -69,7 +67,6 @@ $GENERATE 10-230 $.3		IN	PTR	dhcp-${0,3,d}-03.binary.kitchen.
 ; MQTT
 1.4				IN	PTR	v2304.core.binary.kitchen.
 6.4				IN	PTR	pizza.mqtt.binary.kitchen.
-7.4				IN	PTR	lasagne.mqtt.binary.kitchen.
 $GENERATE 10-240 $.4		IN	PTR	dhcp-${0,3,d}-04.binary.kitchen.
 241.4				IN	PTR	habdisplay1.mqtt.binary.kitchen.
 242.4				IN	PTR	habdisplay2.mqtt.binary.kitchen.

roles/dns_intern/templates/bind/binary.kitchen.zone.j2

@@ -1,7 +1,7 @@
 $ORIGIN binary.kitchen		; base for unqualified names
 $TTL 1h				; default time-to-live
 @				IN	SOA ns1.binary.kitchen. hostmaster.binary.kitchen. (
-					2024051300; serial
+					2022071600; serial
 					1d; refresh
 					2h; retry
 					4w; expire
@@ -30,11 +30,12 @@ netbox				IN	A	172.23.2.7
 ns1				IN	A	172.23.2.3
 ns2				IN	A	172.23.2.4
 omm				IN	A	172.23.2.35
+racktables			IN	A	172.23.2.6
 radius				IN	A	172.23.2.3
 radius				IN	A	172.23.2.4
 ; Loopback
 core				IN	A	172.23.0.1
-rt-w13b				IN	A	172.23.0.2
+erx-bk				IN	A	172.23.0.2
 erx-rz				IN	A	172.23.0.3
 erx-auweg			IN	A	172.23.0.4
 ; Management
@@ -73,8 +74,6 @@ pancake				IN	A	172.23.2.34
 knoedel				IN	A	172.23.2.35
 schweinshaxn			IN	A	172.23.2.36
 bob				IN	A	172.23.2.37
-lasagne				IN	A	172.23.2.38
-tschunk				IN	A	172.23.2.39
 bowle				IN	A	172.23.2.62
 strammermax			IN	A	172.23.2.91
 obatzda				IN	A	172.23.2.92
@@ -92,7 +91,6 @@ noodlehub			IN	A	172.23.3.251
 ; MQTT
 v2304.core			IN	A	172.23.4.1
 pizza.mqtt			IN	A	172.23.4.6
-lasagne.mqtt			IN	A	172.23.4.7
 $GENERATE 10-240 dhcp-${0,3,d}-04	IN	A	172.23.4.$
 habdisplay1.mqtt		IN	A	172.23.4.241
 habdisplay2.mqtt		IN	A	172.23.4.242

roles/dns_intern/templates/dnsdist.conf.j2

@@ -10,11 +10,11 @@ newServer({address='127.0.0.1:5353', pool='resolve'})
 
 {% if dns_secondary is defined %}
 -- allow AXFR/IXFR only from slaves
-addAction(AndRule({OrRule({QTypeRule(DNSQType.AXFR), QTypeRule(DNSQType.IXFR)}), NotRule(makeRule("{{ dns_secondary }}"))}), RCodeAction(DNSRCode.REFUSED))
+addAction(AndRule({OrRule({QTypeRule(dnsdist.AXFR), QTypeRule(dnsdist.IXFR)}), NotRule(makeRule("{{ dns_secondary }}"))}), RCodeAction(dnsdist.REFUSED))
 {% endif %}
 
 -- allow NOTIFY only from master
-addAction(AndRule({OpcodeRule(DNSOpcode.Notify), NotRule(makeRule("{{ dns_primary }}"))}), RCodeAction(DNSRCode.REFUSED))
+addAction(AndRule({OpcodeRule(DNSOpcode.Notify), NotRule(makeRule("{{ dns_primary }}"))}), RCodeAction(dnsdist.REFUSED))
 
 -- use auth servers for own zones
 addAction('binary.kitchen', PoolAction('authdns'))

roles/dns_intern/templates/pdns.conf.j2

@@ -26,6 +26,12 @@ launch=bind,gsqlite3
 # local-address=0.0.0.0
 local-address=127.0.0.1
 
+#################################
+# local-ipv6	Local IP address to which we bind
+#
+# local-ipv6=::
+local-ipv6=
+
 #################################
 # local-port	The port on which we listen
 #

roles/dns_intern/templates/recursor.conf.j2

@@ -11,9 +11,9 @@
 config-dir=/etc/powerdns
 
 #################################
-# dnssec	DNSSEC mode: off/process-no-validate/process (default)/log-fail/validate
+# dnssec	DNSSEC mode: off/process-no-validate (default)/process/log-fail/validate
 #
-# dnssec=process
+# dnssec=process-no-validate
 dnssec=off
 
 #################################

roles/docker/tasks/main.yml

@@ -1,10 +1,17 @@
 ---
 
+- name: Enable docker apt-key
+  apt_key: url='https://download.docker.com/linux/debian/gpg'
+
+- name: Enable docker repository
+  apt_repository:
+    repo: 'deb https://download.docker.com/linux/debian {{ ansible_distribution_release }} stable'
+    filename: docker
+
 - name: Install docker
   apt:
     name:
-    - docker.io
+    - docker-ce
+    - docker-ce-cli
+    - containerd.io
     - python3-docker
-
-- name: Enable docker
-  service: name=docker state=started enabled=yes

roles/doorlock/handlers/main.yml

@@ -1,7 +0,0 @@
----
-
-- name: Run acertmgr
-  command: /usr/bin/acertmgr
-
-- name: Restart nginx
-  service: name=nginx state=restarted

roles/doorlock/meta/main.yml

@@ -1,5 +0,0 @@
----
-
-dependencies:
-- { role: acertmgr }
-- { role: nginx, nginx_ssl: True }

roles/doorlock/tasks/main.yml

@@ -1,20 +0,0 @@
----
-
-- name: Ensure certificates are available
-  command:
-    cmd: >
-      openssl req -x509 -nodes -newkey rsa:2048
-      -keyout /etc/nginx/ssl/{{ doorlock_domain }}.key -out /etc/nginx/ssl/{{ doorlock_domain }}.crt
-      -days 730 -subj "/CN={{ doorlock_domain }}"
-    creates: /etc/nginx/ssl/{{ doorlock_domain }}.crt
-  notify: Restart nginx
-
-- name: Request nsupdate key for certificate
-  include_role: name=acme-dnskey-generate
-  vars:
-    acme_dnskey_san_domains:
-    - "{{ doorlock_domain }}"
-
-- name: Configure certificate manager for doorlock
-  template: src=certs.j2 dest=/etc/acertmgr/{{ doorlock_domain }}.conf
-  notify: Run acertmgr

roles/doorlock/templates/certs.j2

@@ -1,18 +0,0 @@
----
-
-{{ doorlock_domain }}:
-- mode: dns.nsupdate
-  nsupdate_server: {{ acme_dnskey_server }}
-  nsupdate_keyfile: {{ acme_dnskey_file }}
-- path: /etc/nginx/ssl/{{ doorlock_domain }}.key
-  user: root
-  group: root
-  perm: '400'
-  format: key
-  action: '/usr/sbin/service nginx restart'
-- path: /etc/nginx/ssl/{{ doorlock_domain }}.crt
-  user: root
-  group: root
-  perm: '400'
-  format: crt,ca
-  action: '/usr/sbin/service nginx restart'

roles/drone/files/drone.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=drone.io server
+After=network-online.target
+
+[Service]
+Type=simple
+User=drone
+EnvironmentFile=/etc/default/drone
+ExecStart=/opt/drone/bin/drone-server
+Restart=always
+RestartSec=5s
+
+[Install]
+WantedBy=multi-user.target

roles/drone/handlers/main.yml

@@ -3,11 +3,11 @@
 - name: Reload systemd
   systemd: daemon_reload=yes
 
-- name: Restart 23b
-  service: name=23b state=restarted
+- name: Run acertmgr
+  command: /usr/bin/acertmgr
+
+- name: Restart drone
+  service: name=drone state=restarted
 
 - name: Restart nginx
   service: name=nginx state=restarted
-
-- name: Run acertmgr
-  command: /usr/bin/acertmgr

roles/drone/tasks/main.yml

@@ -0,0 +1,57 @@
+---
+
+- name: Create user
+  user: name=drone
+
+# TODO install drone to /opt/drone/bin
+# currently it is manually compiled
+
+- name: Configure drone
+  template: src=drone.j2 dest=/etc/default/drone
+  notify: Restart drone
+
+- name: Install PostgreSQL
+  apt:
+    name:
+    - postgresql
+    - python3-psycopg2
+
+- name: Configure PostgreSQL database
+  postgresql_db: name={{ drone_dbname }}
+  become: true
+  become_user: postgres
+
+- name: Configure PostgreSQL user
+  postgresql_user: db={{ drone_dbname }} name={{ drone_dbuser }} password={{ drone_dbpass }} priv=ALL state=present
+  become: true
+  become_user: postgres
+
+- name: Ensure certificates are available
+  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ drone_domain }}.key -out /etc/nginx/ssl/{{ drone_domain }}.crt -days 730 -subj "/CN={{ drone_domain }}" creates=/etc/nginx/ssl/{{ drone_domain }}.crt
+  notify: Restart nginx
+
+- name: Configure certificate manager for drone
+  template: src=certs.j2 dest=/etc/acertmgr/{{ drone_domain }}.conf
+  notify: Run acertmgr
+
+- name: Configure vhost
+  template: src=vhost.j2 dest=/etc/nginx/sites-available/drone
+  notify: Restart nginx
+
+- name: Enable vhost
+  file: src=/etc/nginx/sites-available/drone dest=/etc/nginx/sites-enabled/drone state=link
+  notify: Restart nginx
+
+- name: Install systemd unit
+  copy: src=drone.service dest=/lib/systemd/system/drone.service
+  notify:
+  - Reload systemd
+  - Restart drone
+
+- name: Enable drone
+  service: name=drone enabled=yes
+
+- name: Enable monitoring
+  include_role: name=icinga-monitor tasks_from=http
+  vars:
+    vhost: "{{ drone_domain }}"

roles/drone/templates/certs.j2

@@ -1,13 +1,13 @@
 ---
 
-{{ bk23b_domain }}:
-- path: /etc/nginx/ssl/{{ bk23b_domain }}.key
+{{ drone_domain }}:
+- path: /etc/nginx/ssl/{{ drone_domain }}.key
   user: root
   group: root
   perm: '400'
   format: key
   action: '/usr/sbin/service nginx restart'
-- path: /etc/nginx/ssl/{{ bk23b_domain }}.crt
+- path: /etc/nginx/ssl/{{ drone_domain }}.crt
   user: root
   group: root
   perm: '400'

roles/drone/templates/drone.j2

@@ -0,0 +1,10 @@
+DRONE_AGENTS_ENABLED=true
+DRONE_DATABASE_DATASOURCE=postgres://{{ drone_dbuser }}:{{ drone_dbpass }}@127.0.0.1:5432/{{ drone_dbname }}
+DRONE_DATABASE_DRIVER=postgres
+DRONE_GITEA_SERVER=https://{{ gitea_domain }}
+DRONE_GITEA_CLIENT_ID={{ drone_gitea_client }}
+DRONE_GITEA_CLIENT_SECRET={{ drone_gitea_secret }}
+DRONE_RPC_SECRET={{ drone_secret }}
+DRONE_SERVER_HOST={{ drone_domain }}
+DRONE_SERVER_PROTO=https
+DRONE_USER_CREATE=username:{{ drone_admin }},admin:true

roles/drone/templates/vhost.j2

@@ -0,0 +1,31 @@
+server {
+	listen 80;
+	listen [::]:80;
+
+	server_name {{ drone_domain }};
+
+	location /.well-known/acme-challenge {
+		default_type "text/plain";
+		alias /var/www/acme-challenge;
+	}
+
+	location / {
+		return 301 https://{{ drone_domain }}$request_uri;
+	}
+}
+
+server {
+	listen 443 ssl http2;
+	listen [::]:443 ssl http2;
+
+	server_name {{ drone_domain }};
+
+	ssl_certificate_key /etc/nginx/ssl/{{ drone_domain }}.key;
+	ssl_certificate /etc/nginx/ssl/{{ drone_domain }}.crt;
+
+	location / {
+		client_max_body_size 128M;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_pass http://localhost:8080;
+	}
+}

roles/drone_runner/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+
+- name: Run runner container
+  docker_container:
+    name: runner
+    image: drone/drone-runner-docker:1
+    env:
+      DRONE_RPC_PROTO: "https"
+      DRONE_RPC_HOST: "{{ drone_domain }}"
+      DRONE_RPC_SECRET: "{{ drone_secret }}"
+      DRONE_RUNNER_CAPACITY: "2"
+      DRONE_RUNNER_NAME: "{{ ansible_fqdn }}"
+      DRONE_UI_USERNAME: "admin"
+      DRONE_UI_PASSWORD: "{{ drone_uipass }}"
+    ports:
+    - "3000:3000"
+    pull: yes
+    restart_policy: unless-stopped
+    state: started
+    volumes:
+    - "/var/run/docker.sock:/var/run/docker.sock"

roles/event_web/files/certs

@@ -1,15 +0,0 @@
----
-
-eh21.easterhegg.eu engel.eh21.easterhegg.eu:
-- path: /etc/nginx/ssl/eh21.easterhegg.eu.crt
-  user: root
-  group: root
-  perm: '400'
-  format: crt,ca
-  action: '/usr/sbin/service nginx restart'
-- path: /etc/nginx/ssl/eh21.easterhegg.eu.key
-  user: root
-  group: root
-  perm: '400'
-  format: key
-  action: '/usr/sbin/service nginx restart'

roles/event_web/files/vhost

@@ -1,68 +0,0 @@
-server {
-	listen 80;
-	listen [::]:80;
-
-	server_name eh21.easterhegg.eu;
-
-	location /.well-known/acme-challenge {
-		default_type "text/plain";
-		alias /var/www/acme-challenge;
-	}
-
-	location / {
-		return 301 https://eh21.easterhegg.eu$request_uri;
-	}
-}
-
-server {
-	listen 443 ssl http2;
-	listen [::]:443 ssl http2;
-
-	server_name eh21.easterhegg.eu;
-
-	ssl_certificate_key /etc/nginx/ssl/eh21.easterhegg.eu.key;
-	ssl_certificate /etc/nginx/ssl/eh21.easterhegg.eu.crt;
-
-	root /var/www/eh21;
-}
-
-server {
-	listen 80;
-	listen [::]:80;
-
-	server_name engel.eh21.easterhegg.eu;
-
-	location /.well-known/acme-challenge {
-		default_type "text/plain";
-		alias /var/www/acme-challenge;
-	}
-
-	location / {
-		return 301 https://engel.eh21.easterhegg.eu$request_uri;
-	}
-}
-
-server {
-	listen 443 ssl http2;
-	listen [::]:443 ssl http2;
-
-	server_name engel.eh21.easterhegg.eu;
-
-	ssl_certificate_key /etc/nginx/ssl/eh21.easterhegg.eu.key;
-	ssl_certificate /etc/nginx/ssl/eh21.easterhegg.eu.crt;
-
-	root /var/www/engel/public;
-
-	index index.php;
-
-	location / {
-		try_files $uri $uri/ /index.php?$args;
-	}
-
-	location ~ \.php$ {
-		fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
-		fastcgi_index index.php;
-		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-		include fastcgi_params;
-	}
-}

roles/event_web/handlers/main.yml

@@ -1,7 +0,0 @@
----
-
-- name: Restart nginx
-  service: name=nginx state=restarted
-
-- name: Run acertmgr
-  command: /usr/bin/acertmgr

roles/event_web/meta/main.yml

@@ -1,5 +0,0 @@
----
-
-dependencies:
-- { role: acertmgr }
-- { role: nginx, nginx_ssl: True }

roles/event_web/tasks/main.yml

@@ -1,31 +0,0 @@
----
-
-- name: Install dependencies
-  apt:
-    name:
-    - php-fpm
-
-- name: Create vhost directory
-  file: path=/var/www/eh21 state=directory owner=www-data group=www-data
-
-- name: Create vhost directory
-  file: path=/var/www/engel state=directory owner=www-data group=www-data
-
-- name: Ensure certificates are available
-  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/eh21.easterhegg.eu.key -out /etc/nginx/ssl/eh21.easterhegg.eu.crt -days 730 -subj "/CN=eh21.easterhegg.eu" creates=/etc/nginx/ssl/eh21.easterhegg.eu.crt
-  notify: Restart nginx
-
-- name: Configure certificate manager
-  copy: src=certs dest=/etc/acertmgr/eh21.easterhegg.eu.conf
-  notify: Run acertmgr
-
-- name: Configure vhosts
-  copy: src=vhost dest=/etc/nginx/sites-available/www
-  notify: Restart nginx
-
-- name: Enable vhosts
-  file: src=/etc/nginx/sites-available/www dest=/etc/nginx/sites-enabled/www state=link
-  notify: Restart nginx
-
-- name: Start php8.2-fpm
-  service: name=php8.2-fpm state=started enabled=yes

roles/fileserver/templates/smb.conf.j2

@@ -42,7 +42,7 @@
 # option cannot handle dynamic or non-broadcast interfaces correctly.
 ;   bind interfaces only = yes
 
-   min protocol = NT1
+
 
 #### Debugging/Accounting ####
 
@@ -213,7 +213,7 @@
 ;[printers]
 ;   comment = All Printers
 ;   browseable = no
-;   path = /var/tmp
+;   path = /var/spool/samba
 ;   printable = yes
 ;   guest ok = no
 ;   read only = yes
@@ -240,5 +240,5 @@
    browseable = yes
    read only = no
    guest ok = yes
-   create mask = 0660
-   directory mask = 0770
+   create mask = 0600
+   directory mask = 0700

roles/gitea/defaults/main.yml

@@ -3,5 +3,6 @@
 gitea_user: gogs
 gitea_group: gogs
 
-gitea_version: 1.21.11
+gitea_checksum: sha256:bc4a8e1f5d5f64d4be2e50c387de08d07c062aecdba2f742c2f61c20accfcc46
+gitea_version: 1.17.0
 gitea_url: https://github.com/go-gitea/gitea/releases/download/v{{ gitea_version }}/gitea-{{ gitea_version }}-linux-amd64

roles/gitea/tasks/main.yml

@@ -6,24 +6,19 @@
 - name: Create user
   user: name={{ gitea_user }} home=/home/{{ gitea_user }} group={{ gitea_group }}
 
-- name: Create directories
-  file: path={{ item }} state=directory owner={{ gitea_user }} group={{ gitea_group }}
+- name: Create gitea directories
+  file: path={{ item }} state=directory owner={{ gitea_user }}
   with_items:
   - /opt/gitea
   - /opt/gitea/custom
   - /opt/gitea/custom/conf
 
 - name: Download gitea binary
-  get_url: url={{ gitea_url }} dest=/opt/gitea/gitea-{{ gitea_version }} mode=0755
-  register: gitea_download
-
-- name: Symlink gitea binary
-  file: src=/opt/gitea/gitea-{{ gitea_version }} dest=/opt/gitea/gitea state=link
-  when: gitea_download.changed
+  get_url: url={{ gitea_url }} dest=/opt/gitea/gitea checksum={{ gitea_checksum }} mode=0755
   notify: Restart gitea
 
 - name: Configure gitea
-  template: src=app.ini.j2 dest=/opt/gitea/custom/conf/app.ini force=no owner={{ gitea_user }} group={{ gitea_group }}
+  template: src=app.ini.j2 dest=/opt/gitea/custom/conf/app.ini force=no owner={{ gitea_user }}
 
 - name: Install systemd unit
   template: src=gitea.service.j2 dest=/lib/systemd/system/gitea.service
@@ -67,7 +62,7 @@
   notify: Restart nginx
 
 - name: Enable gitea
-  service: name=gitea state=started enabled=yes
+  service: name=gitea enabled=yes
 
 - name: Enable monitoring
   include_role: name=icinga-monitor tasks_from=http

roles/gitea/templates/gitea.service.j2

@@ -8,7 +8,7 @@ Requires=postgresql.service
 RestartSec=2s
 Type=simple
 User={{ gitea_user }}
-Group={{ gitea_group }}
+Group={{ gitea_user }}
 WorkingDirectory=/opt/gitea/
 ExecStart=/opt/gitea/gitea web
 Restart=always

roles/grafana/tasks/main.yml

@@ -1,10 +1,10 @@
 ---
 
 - name: Enable grafana apt-key
-  apt_key: url="https://apt.grafana.com/gpg.key" keyring="/etc/apt/trusted.gpg.d/grafana.gpg"
+  apt_key: url="https://packages.grafana.com/gpg.key"
 
 - name: Enable grafana repository
-  apt_repository: repo="deb https://apt.grafana.com stable main"
+  apt_repository: repo="deb https://packages.grafana.com/oss/deb stable main"
 
 - name: Install grafana
   apt: name=grafana

roles/hackmd/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+
+hedgedoc_version: 1.9.3
+hedgedoc_archive: https://github.com/hedgedoc/hedgedoc/archive/{{ hedgedoc_version }}.tar.gz

roles/hackmd/tasks/main.yml

@@ -0,0 +1,110 @@
+---
+
+- name: Create user
+  user: name=hackmd
+
+- name: Enable nodesource apt-key
+  apt_key: url="https://deb.nodesource.com/gpgkey/nodesource.gpg.key"
+
+- name: Enable nodesource repository
+  apt_repository: repo="deb https://deb.nodesource.com/node_14.x/ {{ ansible_distribution_release }} main"
+
+- name: Enable yarnpkg apt-key
+  apt_key: url="https://dl.yarnpkg.com/debian/pubkey.gpg"
+
+- name: Enable yarnpkg repository
+  apt_repository: repo="deb https://dl.yarnpkg.com/debian/ stable main"
+
+- name: Pin nodejs repository
+  blockinfile:
+    path: /etc/apt/preferences.d/nodejs
+    create: yes
+    block: |
+      Package: *
+      Pin: origin deb.nodesource.com
+      Pin-Priority: 600
+
+- name: Install packages
+  apt:
+    name:
+    - build-essential
+    - git
+    - nodejs
+    - postgresql
+    - python3-psycopg2
+    - yarn
+
+- name: Unpack hedgedoc
+  unarchive: src={{ hedgedoc_archive }} dest=/opt owner=hackmd group=hackmd remote_src=yes creates=/opt/hedgedoc-{{ hedgedoc_version }}
+  register: hedgedoc_unarchive
+
+- name: Create hedgedoc upload path
+  file: path=/opt/hedgedoc/uploads state=directory recurse=yes owner=hackmd group=hackmd
+
+- name: Remove old hedgedoc upload path
+  file: path=/opt/hedgedoc-{{ hedgedoc_version }}/public/uploads state=absent force=yes
+
+- name: Link hedgedoc upload path
+  file: path=/opt/hedgedoc-{{ hedgedoc_version }}/public/uploads src=/opt/hedgedoc/uploads state=link owner=hackmd group=hackmd
+
+- name: Setup hedgedoc
+  command: bin/setup chdir=/opt/hedgedoc-{{ hedgedoc_version }} creates=/opt/hedgedoc-{{ hedgedoc_version }}/config.json
+  become: true
+  become_user: hackmd
+
+- name: Configure hedgedoc
+  template: src=config.json.j2 dest=/opt/hedgedoc-{{ hedgedoc_version }}/config.json owner=hackmd
+  register: hedgedoc_config
+  notify: Restart hedgedoc
+
+- name: Install hedgedoc frontend deps
+  command: /usr/bin/yarn install chdir=/opt/hedgedoc-{{ hedgedoc_version }}
+  become: true
+  become_user: hackmd
+  when: hedgedoc_unarchive.changed or hedgedoc_config.changed
+
+- name: Build hedgedoc frontend
+  command: /usr/bin/yarn build chdir=/opt/hedgedoc-{{ hedgedoc_version }}
+  become: true
+  become_user: hackmd
+  when: hedgedoc_unarchive.changed or hedgedoc_config.changed
+
+- name: Configure PostgreSQL database
+  postgresql_db: name={{ hedgedoc_dbname }}
+  become: true
+  become_user: postgres
+
+- name: Configure PostgreSQL user
+  postgresql_user: db={{ hedgedoc_dbname }} name={{ hedgedoc_dbuser }} password={{ hedgedoc_dbpass }} priv=ALL state=present
+  become: true
+  become_user: postgres
+
+- name: Ensure certificates are available
+  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ hedgedoc_domain }}.key -out /etc/nginx/ssl/{{ hedgedoc_domain }}.crt -days 730 -subj "/CN={{ hedgedoc_domain }}" creates=/etc/nginx/ssl/{{ hedgedoc_domain }}.crt
+  notify: Restart nginx
+
+- name: Configure certificate manager for hedgedoc
+  template: src=certs.j2 dest=/etc/acertmgr/{{ hedgedoc_domain }}.conf
+  notify: Run acertmgr
+
+- name: Configure vhost
+  template: src=vhost.j2 dest=/etc/nginx/sites-available/hedgedoc
+  notify: Restart nginx
+
+- name: Enable vhost
+  file: src=/etc/nginx/sites-available/hedgedoc dest=/etc/nginx/sites-enabled/hedgedoc state=link
+  notify: Restart nginx
+
+- name: Systemd unit for hedgedoc
+  template: src=hedgedoc.service.j2 dest=/etc/systemd/system/hedgedoc.service
+  notify:
+  - Reload systemd
+  - Restart hedgedoc
+
+- name: Start the hedgedoc service
+  service: name=hedgedoc state=started enabled=yes
+
+- name: Enable monitoring
+  include_role: name=icinga-monitor tasks_from=http
+  vars:
+    vhost: "{{ hedgedoc_domain }}"

roles/hackmd/templates/config.json.j2

@@ -0,0 +1,45 @@
+{
+    "production": {
+        "domain": "{{ hedgedoc_domain }}",
+        "protocolUseSSL": true,
+        "allowAnonymous": false,
+        "allowAnonymousEdits": true,
+        "allowFreeURL": true,
+        "sessionSecret": "{{ hedgedoc_secret }}",
+        "hsts": {
+            "enable": true,
+            "maxAgeSeconds": 2592000,
+            "includeSubdomains": true,
+            "preload": true
+        },
+        "csp": {
+            "enable": true,
+            "directives": {
+            },
+            "upgradeInsecureRequests": "auto",
+            "addDefaults": true,
+            "addDisqus": true,
+            "addGoogleAnalytics": true
+        },
+        "db": {
+            "username": "{{ hedgedoc_dbuser }}",
+            "password": "{{ hedgedoc_dbpass }}",
+            "database": "{{ hedgedoc_dbname }}",
+            "host": "localhost",
+            "port": "5432",
+            "dialect": "postgres"
+        },
+        "ldap": {
+            "url": "{{ ldap_uri }}",
+            "bindDn": "{{ ldap_binddn }}",
+            "bindCredentials": "{{ ldap_bindpw }}",
+            "searchBase": "{{ ldap_base }}",
+            "searchFilter": "(uid={{ '{{' }}username{{ '}}' }})",
+            "searchAttributes": ["cn", "uid"],
+            "usernameField": "cn",
+            "useridField": "uid",
+            "tlsca": "/etc/ssl/certs/ca-certificates.crt"
+        },
+        "email": false
+    }
+}

roles/hackmd/templates/hedgedoc.service.j2

@@ -0,0 +1,14 @@
+[Unit]
+Description=HedgeDoc
+After=network.target
+
+[Service]
+Environment=NODE_ENV=production
+WorkingDirectory=/opt/hedgedoc-{{ hedgedoc_version }}
+Type=simple
+User=hackmd
+ExecStart=/usr/bin/yarn start
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target

roles/hedgedoc/meta/main.yml

@@ -1,5 +0,0 @@
----
-
-dependencies:
-- { role: acertmgr }
-- { role: nginx, nginx_ssl: True }

roles/hedgedoc/tasks/main.yml

@@ -1,51 +0,0 @@
----
-
-- name: Install packages
-  apt:
-    name:
-    - docker-compose
-
-- name: Create hedgedoc group
-  group: name=hedgedoc
-
-- name: Create hedgedoc user
-  user:
-    name: hedgedoc
-    home: /opt/hedgedoc
-    shell: /bin/bash
-    group: hedgedoc
-    groups: docker
-
-- name: Configure hedgedoc container
-  template: src=docker-compose.yml.j2 dest=/opt/hedgedoc/docker-compose.yml
-  notify: Restart hedgedoc
-
-- name: Ensure certificates are available
-  command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/nginx/ssl/{{ hedgedoc_domain }}.key -out /etc/nginx/ssl/{{ hedgedoc_domain }}.crt -days 730 -subj "/CN={{ hedgedoc_domain }}" creates=/etc/nginx/ssl/{{ hedgedoc_domain }}.crt
-  notify: Restart nginx
-
-- name: Configure certificate manager for hedgedoc
-  template: src=certs.j2 dest=/etc/acertmgr/{{ hedgedoc_domain }}.conf
-  notify: Run acertmgr
-
-- name: Configure vhost
-  template: src=vhost.j2 dest=/etc/nginx/sites-available/hedgedoc
-  notify: Restart nginx
-
-- name: Enable vhost
-  file: src=/etc/nginx/sites-available/hedgedoc dest=/etc/nginx/sites-enabled/hedgedoc state=link
-  notify: Restart nginx
-
-- name: Systemd unit for hedgedoc
-  template: src=hedgedoc.service.j2 dest=/etc/systemd/system/hedgedoc.service
-  notify:
-  - Reload systemd
-  - Restart hedgedoc
-
-- name: Start the hedgedoc service
-  service: name=hedgedoc state=started enabled=yes
-
-- name: Enable monitoring
-  include_role: name=icinga-monitor tasks_from=http
-  vars:
-    vhost: "{{ hedgedoc_domain }}"

roles/hedgedoc/templates/docker-compose.yml.j2

@@ -1,44 +0,0 @@
-version: "3"
-services:
-  database:
-    image: postgres:13-alpine
-    environment:
-      - POSTGRES_USER={{ hedgedoc_dbuser }}
-      - POSTGRES_PASSWORD={{ hedgedoc_dbpass }}
-      - POSTGRES_DB={{ hedgedoc_dbname }}
-    volumes:
-      - ./database:/var/lib/postgresql/data
-  app:
-    image: quay.io/hedgedoc/hedgedoc:1.9.9
-    restart: on-failure
-    environment:
-      - CMD_DOMAIN={{ hedgedoc_domain }}
-      - CMD_PROTOCOL_USESSL=true
-      - CMD_ALLOW_ANONYMOUS=false
-      - CMD_ALLOW_ANONYMOUS_EDITS=true
-      - CMD_ALLOW_FREEURL=true
-      - CMD_SESSION_SECRET={{ hedgedoc_secret }}
-      - CMD_HSTS_ENABLE=true
-      - CMD_HSTS_MAX_AGE=2592000
-      - CMD_HSTS_INCLUDE_SUBDOMAINS=true
-      - CMD_HSTS_PRELOAD=true
-      - CMD_CSP_ENABLE=true
-      - CMD_DB_URL=postgres://{{ hedgedoc_dbuser }}:{{ hedgedoc_dbpass }}@database/{{ hedgedoc_dbname }}
-      - CMD_LDAP_URL={{ ldap_uri }}
-      - CMD_LDAP_BINDDN={{ ldap_binddn }}
-      - CMD_LDAP_BINDCREDENTIALS={{ ldap_bindpw }}
-      - CMD_LDAP_SEARCHBASE={{ ldap_base }}
-      - CMD_LDAP_SEARCHFILTER=(uid={{ '{{' }}username{{ '}}' }})
-      - CMD_LDAP_SEARCHATTRIBUTES=cn,uid
-      - CMD_LDAP_USERIDFIELD=uid
-      - CMD_LDAP_USERNAMEFIELD=cn
-      - CMD_LDAP_TLS_CA=/etc/ssl/certs/ca-certificates.crt
-      - CMD_EMAIL=false
-    volumes:
-      - /etc/hosts:/etc/hosts:ro
-      - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
-      - ./uploads:/hedgedoc/public/uploads
-    ports:
-      - "127.0.0.1:3000:3000"
-    depends_on:
-      - database

roles/hedgedoc/templates/hedgedoc.service.j2

@@ -1,28 +0,0 @@
-[Unit]
-Description=hedgedoc service using docker compose
-Requires=docker.service
-After=docker.service
-Before=nginx.service
-
-[Service]
-Type=simple
-
-User=hedgedoc
-Group=hedgedoc
-
-Restart=always
-TimeoutStartSec=1200
-
-WorkingDirectory=/opt/hedgedoc
-
-# Make sure no old containers are running
-ExecStartPre=/usr/bin/docker-compose down -v
-
-# Compose up
-ExecStart=/usr/bin/docker-compose up
-
-# Compose down, remove containers and volumes
-ExecStop=/usr/bin/docker-compose down -v
-
-[Install]
-WantedBy=multi-user.target

roles/heisenbridge/defaults/main.yml

@@ -1,7 +0,0 @@
----
-
-heisenbridge_user: heisenbridge
-heisenbridge_group: heisenbridge
-
-heisenbridge_directory: /opt/heisenbridge
-heisenbridge_config: "{{ heisenbridge_directory }}/heisenbridge.yaml"

roles/heisenbridge/handlers/main.yml

@@ -1,7 +0,0 @@
----
-
-- name: Reload systemd
-  systemd: daemon_reload=yes
-
-- name: Restart heisenbridge
-  service: name=heisenbridge state=restarted

roles/heisenbridge/tasks/main.yml

@@ -1,56 +0,0 @@
----
-
-- name: Install dependencies
-  apt:
-    name:
-    - python3-pip
-    - python3-venv
-
-- name: Create group
-  group:
-    name: "{{ heisenbridge_group }}"
-    system: yes
-
-- name: Create user
-  user:
-    name: "{{ heisenbridge_user }}"
-    group: "{{ heisenbridge_group }}"
-    system: yes
-    create_home: no
-    home: "{{ heisenbridge_directory }}"
-
-- name: Create directory
-  file:
-    path: "{{ heisenbridge_directory }}"
-    state: directory
-    owner: "{{ heisenbridge_user }}"
-    group: "{{ heisenbridge_group }}"
-    mode: 0755
-
-- name: Install heisenbridge
-  pip:
-    name: heisenbridge
-    virtualenv: "{{ heisenbridge_directory }}"
-    virtualenv_command: python3 -m venv
-  become: true
-  become_user: "{{ heisenbridge_user }}"
-  environment:
-    MULTIDICT_NO_EXTENSIONS: 1
-    YARL_NO_EXTENSIONS: 1
-
-- name: Create configuration
-  command:
-    cmd: "{{ heisenbridge_directory }}/bin/heisenbridge -c {{ heisenbridge_config }} --generate"
-    creates: "{{ heisenbridge_config }}"
-  become: true
-  become_user: "{{ heisenbridge_user }}"
-  notify: Restart heisenbridge
-
-- name: Install systemd unit
-  template: src=heisenbridge.service.j2 dest=/lib/systemd/system/heisenbridge.service
-  notify:
-  - Reload systemd
-  - Restart heisenbridge
-
-- name: Enable heisenbridge
-  service: name=heisenbridge enabled=yes

roles/heisenbridge/templates/heisenbridge.service.j2

@@ -1,15 +0,0 @@
-[Unit]
-Description=Heisenbridge
-After=network.target
-
-[Service]
-RestartSec=2s
-Type=simple
-User={{ heisenbridge_user }}
-Group={{ heisenbridge_user }}
-WorkingDirectory={{ heisenbridge_directory }}
-ExecStart={{ heisenbridge_directory }}/bin/heisenbridge -c {{ heisenbridge_config }}
-Restart=always
-
-[Install]
-WantedBy=multi-user.target

roles/icinga-monitor/tasks/disk.yml

@@ -1,17 +0,0 @@
----
-
-- name: Configure monitoring for disk
-  template:
-    src: disk.j2
-    dest: /etc/icinga2/conf.d/hosts/{{ inventory_hostname }}.disk
-    owner: "{{ icinga_user }}"
-    group: "{{ icinga_group }}"
-  delegate_to: "{{ icinga_server }}"
-
-- name: Regenerate hosts.conf
-  assemble:
-    src: /etc/icinga2/conf.d/hosts
-    dest: /etc/icinga2/conf.d/hosts.conf
-#   validate: /usr/sbin/icinga2 daemon -c %s --validate
-  notify: Restart icinga2
-  delegate_to: "{{ icinga_server }}"

roles/icinga-monitor/templates/disk.j2

@@ -1,8 +0,0 @@
-{% for disk in disks %}
-
-  vars.disks["disk {{ disk }}"] = {
-    disk_partitions = "{{ disk }}"
-    disk_wfree = "10%"
-    disk_cfree = "5%"
-  }
-{% endfor %}

roles/icinga-monitor/templates/http.j2

@@ -1,6 +1,5 @@
 
   vars.http_vhosts["{{ vhost }}"] = {
-    http_onredirect = "follow"
     http_sni = "true"
     http_ssl = "true"
     http_vhost = "{{ vhost }}"

roles/icinga/tasks/main.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: Enable icinga apt-key
-  apt_key: url="https://packages.icinga.com/icinga.key" keyring="/etc/apt/trusted.gpg.d/icinga.gpg"
+  apt_key: url="https://packages.icinga.com/icinga.key"
 
 - name: Enable icinga repository
   apt_repository:
@@ -110,5 +110,5 @@
   file: src=/etc/nginx/sites-available/icinga dest=/etc/nginx/sites-enabled/icinga state=link
   notify: Restart nginx
 
-- name: Start php8.2-fpm
-  service: name=php8.2-fpm state=started enabled=yes
+- name: Start php7.4-fpm
+  service: name=php7.4-fpm state=started enabled=yes

roles/icinga/templates/vhost.j2

@@ -19,7 +19,7 @@ server {
 	ssl_certificate /etc/nginx/ssl/{{ icinga_domain }}.crt;
 
 	location ~ ^/icingaweb2/index\.php(.*)$ {
-		fastcgi_pass unix:/var/run/php/php8.2-fpm.sock;
+		fastcgi_pass unix:/var/run/php/php7.4-fpm.sock;
 		fastcgi_index index.php;
 		include fastcgi_params;
 		fastcgi_param SCRIPT_FILENAME /usr/share/icingaweb2/public/index.php;

roles/icinga_agent/defaults/main.yml

@@ -1,4 +0,0 @@
----
-
-icinga_user: nagios
-icinga_group: nagios

roles/icinga_agent/handlers/main.yml

@@ -1,10 +0,0 @@
----
-
-- name: Run acertmgr
-  command: /usr/bin/acertmgr
-
-- name: Restart icinga2
-  service: name=icinga2 state=restarted
-
-- name: Restart nginx
-  service: name=nginx state=restarted

roles/icinga_agent/tasks/main.yml

@@ -1,77 +0,0 @@
----
-
-- name: Install icinga
-  apt: name=icinga2
-
-- name: Check if client is already enrolled
-  stat:
-    path: /var/lib/icinga2/certs/{{ ansible_fqdn }}.crt
-  register: cert_file
-
-- name: Enroll agent on master server
-  block:
-  - name: Ensure certificate directory exists
-    file:
-      path: /var/lib/icinga2/certs
-      state: directory
-      owner: "{{ icinga_user }}"
-      group: "{{ icinga_group }}"
-
-  - name: Copy certificate from master
-    fetch:
-      src: /var/lib/icinga2/certs/{{ icinga_server }}.crt
-      dest: /tmp/{{ icinga_server }}.crt
-      flat: true
-    delegate_to: "{{ icinga_server }}"
-
-  - name: Copy certificate to host
-    copy:
-      src: /tmp/{{ icinga_server }}.crt
-      dest: /var/lib/icinga2/certs/{{ icinga_server }}.crt
-      owner: "{{ icinga_user }}"
-      group: "{{ icinga_group }}"
-
-  - name: Get ticket from master
-    shell: "icinga2 pki ticket --cn {{ ansible_fqdn }}"
-    register: "icinga_ticket"
-    changed_when: "False"
-    delegate_to: "{{ icinga_server }}"
-
-  - name: Setup node
-    command:
-      argv:
-      - icinga2
-      - node
-      - setup
-      - --ticket
-      - "{{ icinga_ticket.stdout | trim }}"
-      - --endpoint
-      - "{{ icinga_server }}"
-      - --zone
-      - "{{ ansible_fqdn }}"
-      - --parent_host
-      - "{{ icinga_server }}"
-      - --trustedcert
-      - "/var/lib/icinga2/certs/{{ icinga_server }}.crt"
-      - --accept-commands
-      - --accept-config
-  when: not cert_file.stat.exists
-
-- name: Set agent address on master
-  template: src=hosts.agent.j2 dest=/etc/icinga2/conf.d/hosts/{{ inventory_hostname }}.01_agent owner={{ icinga_user }} group={{ icinga_group }}
-  delegate_to: "{{ icinga_server }}"
-
-- name: Regenerate hosts.conf
-  assemble:
-    src: /etc/icinga2/conf.d/hosts
-    dest: /etc/icinga2/conf.d/hosts.conf
-#   validate: /usr/sbin/icinga2 daemon -c %s --validate
-  notify: Restart icinga2
-  delegate_to: "{{ icinga_server }}"
-
-# TODO expand this to cover more than just the root partition
-- name: Monitor disks
-  include_role: name=icinga-monitor tasks_from=disk
-  vars:
-    disks:
-    - "/"

roles/icinga_agent/templates/hosts.agent.j2

@@ -1,3 +0,0 @@
-
-  /* Set custom variable `agent_endpoint` for use in `services.conf`. */
-  vars.agent_endpoint = "{{ inventory_hostname }}"

roles/ldap_pam/files/mkhomedir

@@ -0,0 +1,6 @@
+Name: Create home directory during login
+Default: yes
+Priority: 900
+Session-Type: Additional
+Session:
+	required	pam_mkhomedir.so umask=0077 skel=/etc/skel

roles/ldap_pam/files/nsswitch.conf

@@ -0,0 +1,20 @@
+# /etc/nsswitch.conf
+#
+# Example configuration of GNU Name Service Switch functionality.
+# If you have the `glibc-doc-reference' and `info' packages installed, try:
+# `info libc "Name Service Switch"' for information about this file.
+
+passwd:         files ldap
+group:          files ldap
+shadow:         files ldap
+gshadow:        files
+
+hosts:          files dns
+networks:       files
+
+protocols:      db files
+services:       db files
+ethers:         db files
+rpc:            db files
+
+netgroup:       nis