feat(ipt-firewall): add ipt-firewall configuration for mm-irights, mm-nd, and mm-rav hosts

delete: remove obsolete postfix configuration files for rate limiting and user info

.vscode/settings.json

@@ -14,5 +14,8 @@
   "ansible.ansible.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible",
   "ansible.python.interpreterPath": "${workspaceFolder}/.venv/bin/python3",
   "ansible.validation.lint.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint",
-  "ansible.ansibleNavigator.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-navigator"
+  "ansible.ansibleNavigator.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-navigator",
+  "yaml.customTags": [
+    "!vault scalar"
+  ]
 }

ansible.cfg

@@ -40,7 +40,7 @@
 inventory = ./hosts
 remote_user = chris
 roles_path = ./roles
-vault_password_file = open_the_vault.sh
+vault_password_file = oopen-server_the_vault.sh
 #retry_files_enabled = False
 #allow_world_readable_tmpfiles = True
 #interpreter_python: auto

apt-migrate-to-trixie.yml

@@ -1,5 +1,4 @@
 ---
-
 # ---
 # deb822 ist das neue Konfigurationsformats für APT-Quellen (Repositories).
 # Es basiert auf der Debian Control Syntax nach RFC 822 – daher der Name
@@ -35,13 +34,12 @@
 
   pre_tasks:
     - name: Sicherstellen, dass wir Debian sind
-      assert:
+      ansible.builtin.assert:
         that:
           - ansible_facts['os_family'] == "Debian"
         fail_msg: "Dieses Playbook ist nur für Debian geeignet."
 
   tasks:
-
     - name: Keyring für Debian-Archive sicherstellen (falls Signed-By genutzt)
       ansible.builtin.apt:
         name: debian-archive-keyring
@@ -54,7 +52,13 @@
         dest: /etc/apt/sources.list.before-trixie
         remote_src: true
         force: false
-      ignore_errors: true
+        owner: root
+        group: root
+        mode: "0644"
+      failed_when:
+        - backup_result.failed
+        - "'No such file or directory' not in backup_result.msg"
+      register: backup_result
 
     - name: Alte /etc/apt/sources.list deaktivieren (leere Kommentar-Datei)
       ansible.builtin.copy:
@@ -90,6 +94,7 @@
         group: root
         mode: "0644"
       when: enable_backports
+
     - name: Backports-Repo entfernen wenn deaktiviert
       ansible.builtin.file:
         path: /etc/apt/sources.list.d/backports.sources
@@ -107,7 +112,7 @@
 
     - name: APT-Cache aktualisieren
       ansible.builtin.apt:
-        update_cache: yes
+        update_cache: true
         cache_valid_time: "{{ apt_cache_valid_time }}"
 
     - name: Verifikation - zeigen, ob Suites auf trixie stehen
@@ -118,4 +123,3 @@
     - name: Ausgabe anzeigen (nur Info)
       ansible.builtin.debug:
         msg: "{{ apt_policy.stdout.split('\n') | select('search', 'trixie') | list | join('\n') }}"
-

decrypt-interactiv.sh

@@ -1,26 +1,203 @@
 #!/usr/bin/env bash
+#
+# decrypt-interactiv.sh
+#
+# Zweck:
+#   - Entschluesselt entweder:
+#       (A) eine komplett mit ansible-vault verschluesselte Datei (ANSIBLE_VAULT Header)
+#       (B) einzelne YAML "!vault |" Bloecke in einer Datei (z.B. group_vars/host_vars)
+#       (C) einen einzelnen verschluesselten String (Argument, Pipe oder interaktiv)
+#
+# Passwort wird einmalig interaktiv abgefragt.
+#
 
-# Prüfen, ob ein Dateiname als Argument übergeben wurde
+set -euo pipefail
-if [ -z "$1" ]; then
+
-  echo "Usage: $0 <filename>"
+# Temporare Datei fuer das einmalig abgefragte Vault-Passwort.
-  exit 1
+VAULT_PASS_FILE=""
+
+cleanup() {
+  # Sicherheitsnetz: Temp-Datei immer entfernen, auch bei Fehler/Abbruch.
+  if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
+    rm -f "${VAULT_PASS_FILE}"
+  fi
+}
+
+ask_vault_password_once() {
+  # Passwort nur einmal pro Lauf abfragen und danach wiederverwenden.
+  if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
+    return 0
   fi
 
-DATEI="$1"
+  if [[ ! -r /dev/tty ]]; then
+    echo "Error: No interactive TTY available for password prompt." >&2
+    return 1
+  fi
+
+  local pw1=""
+
+  # Wichtig: Passwort direkt vom Terminal lesen, nicht von stdin.
+  read -rsp "Vault password: " pw1 < /dev/tty
+  printf '\n' > /dev/tty
+
+  if [[ -z "${pw1}" ]]; then
+    echo "Error: Empty password is not allowed." >&2
+    return 1
+  fi
+
+  # Passwort in Datei speichern, damit ansible-vault es nicht interaktiv erwartet.
+  VAULT_PASS_FILE="$(mktemp)"
+  chmod 600 "${VAULT_PASS_FILE}"
+  printf '%s' "${pw1}" > "${VAULT_PASS_FILE}"
+
+  unset pw1
+}
+
+decrypt_with_prompted_password() {
+  # Alle decrypt-Aufrufe laufen zentral ueber diese Funktion.
+  ask_vault_password_once
+  ansible-vault decrypt --vault-password-file "${VAULT_PASS_FILE}" "$@" 2>/dev/null
+}
+
+########################################
+# Hilfe anzeigen
+########################################
+show_help() {
+  cat <<EOF
+Usage:
+  $(basename "$0") [OPTION] [INPUT]
+
+Decrypt modes:
+
+  1) Full vault-encrypted file (ANSIBLE_VAULT header):
+     $(basename "$0") secrets.vault
+
+  2) YAML file containing one or multiple "!vault |" blocks:
+     $(basename "$0") group_vars/all.yml
+
+  3) Encrypted vault string:
+     $(basename "$0") 'secret: !vault | \$ANSIBLE_VAULT;1.1;AES256 ...'
+     echo 'secret: !vault | ...' | $(basename "$0")
+
+  4) Interactive mode (paste, then Ctrl-D):
+     $(basename "$0")
+
+Options:
+  -h, --help   Show this help and exit
+
+Notes:
+  - This script prints decrypted values to stdout.
+  - Vault password is prompted once per script run.
+EOF
+}
+
+########################################
+# Hauptfunktion
+########################################
+vdecr() {
+  unset IFS
+
+  if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+    show_help
+    return 0
+  fi
 
-# Prüfen, ob ansible-vault existiert und ausführbar ist
   if ! command -v ansible-vault >/dev/null 2>&1; then
-  echo "Fehler: 'ansible-vault' ist nicht installiert oder nicht im PATH."
+    echo "Error: ansible-vault not found in PATH." >&2
-  exit 2
+    return 1
   fi
 
-# Prüfen, ob die angegebene Datei existiert
+  ########################################
-if [ ! -f "$DATEI" ]; then
+  # Wenn ein Argument uebergeben wurde
-  echo "Fehler: Datei '$DATEI' existiert nicht."
+  ########################################
-  exit 3
+  if [[ -n "${1:-}" ]]; then
+
+    # --- Fall 1: Argument ist eine Datei ---
+    if [[ -f "$1" ]]; then
+
+      if [[ "$(head -n1 "$1")" == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
+        decrypt_with_prompted_password "$1"
+        return 0
       fi
 
-# Befehl ausführen
+      printf 'Reading vault values from file...\n\n'
-ansible-vault decrypt --ask-vault-pass "$DATEI"
 
+      local parsing=0
+      local result=""
+      local name=""
+
+      local blue
+      local discard
+      blue="$(tput setaf 4 || true)"
+      discard="$(tput sgr0 || true)"
+
+      # Best-effort Parsing: Datei wird in Tokens zerlegt und !vault-Bloecke
+      # werden gesammelt, dann rekursiv als Stringinput entschluesselt.
+      while IFS= read -r token; do
+
+        if [[ "$(echo "$token" | grep -c "\!vault")" -gt 0 ]] && [[ $parsing -eq 0 ]]; then
+          parsing=1
+
+        elif [[ $parsing -eq 1 ]] && [[ "$(echo "$token" | grep -c ":")" -eq 0 ]]; then
+          result="$(printf "%s\n%s" "$result" "$token")"
+
+        else
+          if [[ -n "$result" ]]; then
+            printf "\n\n%s%s%s\n" "$blue" "$name" "$discard"
+            printf "%s" "$result" | vdecr
+            name=""
+            result=""
+            parsing=0
+          fi
+        fi
+
+        if [[ "$(echo "$token" | grep -c ":")" -eq 1 ]]; then
+          name="$token"
+        fi
+
+      done < <(tr -s '[:space:]' '\n' < "$1")
+
+      return 0
+    fi
+
+    # --- Fall 3: Argument ist ein String ---
+    local str="$1"
+
+  # --- Fall 4: String kommt per Pipe (stdin ist kein TTY) ---
+  elif [[ ! -t 0 ]]; then
+    local str
+    str="$(cat)"
+
+  # --- Fall 5: Interaktiv ---
+  else
+    printf 'Interactive mode. Paste encrypted string and press Ctrl-D two times to confirm.\n'
+    local str
+    str="$(cat)"
+    printf '\n'
+  fi
+
+  ########################################
+  # String entschluesseln
+  ########################################
+  # YAML-Deko entfernen und den Ciphertext in ein Format bringen,
+  # das ansible-vault decrypt direkt verarbeiten kann.
+  printf -- "%s" "$str" | \
+    sed 's/ /\n/g' | \
+    sed '/---\|^.*:\|\!vault\||\|^$/d' | \
+    decrypt_with_prompted_password
+
+  printf '\n'
+}
+
+# Aufraeumen erfolgt automatisch beim Verlassen des Skripts.
+trap cleanup EXIT
+
+########################################
+# Main
+########################################
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  show_help
   exit 0
+fi
+
+vdecr "${1:-}"

decrypt-vault-strings-from-file.sh

@@ -75,6 +75,7 @@ vdecr() {
       if [[ "$(head -n1 "$1")" == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
         # Vollständige Datei entschlüsseln und ausgeben
         ansible-vault decrypt "$1" 2>/dev/null
+        echo "Decrypted file: $1" >&2
         return 0
       fi
 
@@ -133,6 +134,8 @@ vdecr() {
       # Tokenisierung nach Whitespace (ähnlich dem Original)
       done < <(tr -s '[:space:]' '\n' < "$1")
 
+      echo "Processed vault values from file: $1" >&2
+
       return 0
     fi
 

decrypt-vault-strings-from-file.sh.00

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-
-vdecr() {
-  unset IFS
-
-  if [[ -n "$1" ]]; then
-    if [[ -f "$1" ]]; then
-
-      if [[ $(head -n1 "$1") == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
-        cat "$1" | ansible-vault decrypt 2> /dev/null
-        return 0
-      fi
-      printf 'Reading vault values from file...\n\n'
-      local parsing=0
-      local result=""
-      local name=""
-      local blue=$(tput setaf 4)
-      local discard=$(tput sgr0)
-      for line in $(cat $1); do
-        if [[ $(echo "$line" | grep -c "\!vault") -gt 0 ]] && [[ $parsing -eq 0 ]]; then
-          parsing=1
-        elif [[ $parsing -eq 1 ]] && [[ $( echo $line | grep -c ":") -eq 0 ]]; then
-          result=$(printf "${result}\n${line}")
-        else
-          if [[ $result != "" ]]; then
-            printf "\n\n${blue}$name${discard}\n"
-            printf "$result" | vdecr
-            name=""
-            result=""
-            parsing=0
-          fi
-        fi
-        if  [[ $( echo "$line" | grep -c ":") -eq 1 ]]; then
-          name="$line"
-        fi
-      done
-      return 0
-    fi
-    local str="$1"
-  elif [[ ! -t 0 ]]; then
-    local str=$(cat)
-  else
-    printf 'Interactive mode. Paste encrypted string and press Ctrl-D two times to confirm.\n'
-    local str=$(cat)
-    printf '\n'
-  fi
-
-  printf -- "$str" | sed 's/ /\n/g' | \
-  sed '/---\|^.*:\|\!vault\||\|^$/d' | \
-  #ansible-vault decrypt --vault-password-file ~/.vault-pass 2> /dev/null
-  ansible-vault decrypt 2> /dev/null
-  printf '\n'
-}
-
-vdecr $1

encrypt-interactiv.sh

@@ -1,26 +1,244 @@
 #!/usr/bin/env bash
+#
+# encrypt-interactiv.sh
+#
+# Zweck:
+#   - Verschluesselt entweder:
+#       (A) ein komplettes File mit ansible-vault encrypt
+#       (B) YAML key: value Zeilen als key: !vault | Block
+#       (C) einen einzelnen String (Argument, Pipe oder interaktiv)
+#
+# Passwort wird einmalig interaktiv abgefragt.
+#
 
-# Prüfen, ob ein Dateiname als Argument übergeben wurde
+set -euo pipefail
-if [ -z "$1" ]; then
+
-  echo "Usage: $0 <filename>"
+# Temp-Datei fuer das einmalig abgefragte Passwort.
-  exit 1
+VAULT_PASS_FILE=""
+# Vault-ID fuer Encrypt-Operationen (bei Bedarf per ENV ueberschreibbar).
+VAULT_ID_LABEL="${VAULT_ID_LABEL:-default}"
+
+cleanup() {
+  # Temp-Datei immer entfernen, auch bei Fehler/Abbruch.
+  if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
+    rm -f "${VAULT_PASS_FILE}"
+  fi
+}
+
+ask_vault_password_once() {
+  # Passwort nur einmal pro Skriptlauf abfragen.
+  if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
+    return 0
   fi
 
-DATEI="$1"
+  if [[ ! -r /dev/tty ]]; then
+    echo "Error: No interactive TTY available for password prompt." >&2
+    return 1
+  fi
+
+  local pw1=""
+  local pw2=""
+
+  # Wichtig: Passwort immer direkt vom Terminal lesen,
+  # nicht von stdin (stdin kann String/Pipe-Daten enthalten).
+  read -rsp "Vault password: " pw1 < /dev/tty
+  printf '\n' > /dev/tty
+  read -rsp "Confirm password: " pw2 < /dev/tty
+  printf '\n' > /dev/tty
+
+  if [[ -z "${pw1}" ]]; then
+    echo "Error: Empty password is not allowed." >&2
+    return 1
+  fi
+
+  if [[ "${pw1}" != "${pw2}" ]]; then
+    echo "Error: Password confirmation does not match." >&2
+    return 1
+  fi
+
+  VAULT_PASS_FILE="$(mktemp)"
+  chmod 600 "${VAULT_PASS_FILE}"
+  printf '%s' "${pw1}" > "${VAULT_PASS_FILE}"
+
+  unset pw1 pw2
+}
+
+encrypt_with_prompted_password() {
+  ask_vault_password_once
+  ansible-vault encrypt \
+    --encrypt-vault-id "${VAULT_ID_LABEL}" \
+    --vault-password-file "${VAULT_PASS_FILE}" \
+    "$@"
+}
+
+encrypt_string_with_prompted_password() {
+  ask_vault_password_once
+  ansible-vault encrypt_string \
+    --encrypt-vault-id "${VAULT_ID_LABEL}" \
+    --vault-password-file "${VAULT_PASS_FILE}" \
+    "$@"
+}
+
+########################################
+# Hilfe anzeigen
+########################################
+show_help() {
+cat <<EOF
+Usage:
+  $(basename "$0") [OPTION] [INPUT]
+
+Modes:
+
+  1) File encrypt (in-place):
+     $(basename "$0") secrets.txt
+
+  2) YAML file (key: value -> !vault block):
+     $(basename "$0") vars.yml
+     $(basename "$0") -o output.yml vars.yml
+
+  3) String encrypt:
+     $(basename "$0") 'mySecret'
+     echo 'mySecret' | $(basename "$0")
+     $(basename "$0")        (interactive mode)
+
+Options:
+  -o FILE     Write YAML output to FILE instead of stdout
+  -h, --help  Show this help and exit
+
+Notes:
+  - Simple "key: value" YAML lines will be converted.
+  - Already encrypted (!vault) entries are preserved.
+  - Full vault-encrypted files (ANSIBLE_VAULT header) are detected.
+  - Vault password is prompted once per script run.
+  - Vault ID defaults to "default" and can be changed via VAULT_ID_LABEL.
+
+EOF
+}
+
+########################################
+# Hauptfunktion
+########################################
+vencr() {
+
+  unset IFS
+
+  if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+    show_help
+    return 0
+  fi
 
-# Prüfen, ob ansible-vault existiert und ausführbar ist
   if ! command -v ansible-vault >/dev/null 2>&1; then
-  echo "Fehler: 'ansible-vault' ist nicht installiert oder nicht im PATH."
+    echo "Error: ansible-vault not found in PATH." >&2
-  exit 2
+    return 1
   fi
 
-# Prüfen, ob die angegebene Datei existiert
+  ########################################
-if [ ! -f "$DATEI" ]; then
+  # Optionales Output-File (-o)
-  echo "Fehler: Datei '$DATEI' existiert nicht."
+  ########################################
-  exit 3
+  local out_file=""
+  if [[ "${1:-}" == "-o" && -n "${2:-}" ]]; then
+    out_file="$2"
+    shift 2
   fi
 
-# Befehl ausführen
+  ########################################
-ansible-vault encrypt --ask-vault-pass "$DATEI"
+  # 1) File als Argument
+  ########################################
+  if [[ -n "${1:-}" && -f "$1" ]]; then
+    local f="$1"
 
-exit 0
+    if [[ "$(head -n1 "$f")" == "\$ANSIBLE_VAULT;1.1;AES256"* ]]; then
+      echo "File already encrypted (ANSIBLE_VAULT header found): $f" >&2
+      return 0
+    fi
+
+    if grep -Eq '^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*[^#].*$' "$f"; then
+      local tmpout
+      tmpout="$(mktemp)"
+
+      while IFS= read -r line || [[ -n "$line" ]]; do
+
+        if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
+          printf '%s\n' "$line" >> "$tmpout"
+          continue
+        fi
+
+        if echo "$line" | grep -q '\!vault'; then
+          printf '%s\n' "$line" >> "$tmpout"
+          continue
+        fi
+
+        if [[ "$line" =~ ^([[:space:]]*)([A-Za-z0-9_.-]+):[[:space:]]*(.+)$ ]]; then
+          local indent="${BASH_REMATCH[1]}"
+          local key="${BASH_REMATCH[2]}"
+          local value="${BASH_REMATCH[3]}"
+
+          if [[ "$value" == "|" || "$value" == ">" || "$value" == "" ]]; then
+            printf '%s\n' "$line" >> "$tmpout"
+            continue
+          fi
+
+          value="${value%\"}"; value="${value#\"}"
+          value="${value%\'}"; value="${value#\'}"
+
+          # Aus key: value wird ein key: !vault |-Block.
+          while IFS= read -r enc_line; do
+            printf '%s%s\n' "$indent" "$enc_line" >> "$tmpout"
+          done < <(
+            printf '%s' "$value" |
+            encrypt_string_with_prompted_password --stdin-name "$key"
+          )
+
+        else
+          printf '%s\n' "$line" >> "$tmpout"
+        fi
+
+      done < "$f"
+
+      if [[ -n "$out_file" ]]; then
+        mv "$tmpout" "$out_file"
+        echo "Encrypted YAML written to: $out_file" >&2
+      else
+        cat "$tmpout"
+        rm -f "$tmpout"
+      fi
+
+      return 0
+    fi
+
+    encrypt_with_prompted_password "$f"
+    echo "Encrypted file in-place: $f" >&2
+    return 0
+  fi
+
+  ########################################
+  # 2) String-Verschluesselung
+  ########################################
+  local str=""
+  local name="secret"
+
+  if [[ -n "${1:-}" ]]; then
+    str="$1"
+  elif [[ ! -t 0 ]]; then
+    str="$(cat)"
+  else
+    echo "Interactive mode."
+    read -r -p "Variable name (default: secret): " name_in
+    if [[ -n "$name_in" ]]; then
+      name="$name_in"
+    fi
+
+    echo "Paste plaintext and press Ctrl-D to confirm:"
+    str="$(cat)"
+    echo
+  fi
+
+  printf '%s' "$str" | encrypt_string_with_prompted_password --stdin-name "$name"
+}
+
+trap cleanup EXIT
+
+########################################
+# Script starten
+########################################
+vencr "$@"

encrypt-vault-string.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-read -r -s -p "String zum Verschlüsseln: " PLAINTEXT
-echo
-
-printf '%s' "$PLAINTEXT" | ansible-vault encrypt_string --stdin-name 'secret' 

encrypt-vault-strings-from-file.sh

@@ -31,6 +31,9 @@ Modes:
      $(basename "$0") vars.yml
      $(basename "$0") -o output.yml vars.yml
 
+      Force whole-file encryption for a YAML file:
+      $(basename "$0") --full-file vars.yml
+
   3) String encrypt:
      $(basename "$0") 'mySecret'
      echo 'mySecret' | $(basename "$0")
@@ -38,6 +41,7 @@ Modes:
 
 Options:
   -o FILE     Write YAML output to FILE instead of stdout
+  --full-file Encrypt the given file in-place, even if it is .yml/.yaml
   -h, --help  Show this help and exit
 
 Notes:
@@ -62,13 +66,37 @@ vencr() {
   fi
 
   ########################################
-  # Optionales Output-File (-o)
+  # Optionen: Ausgabe-Datei und Vollverschluesselung fuer YAML-Dateien.
   ########################################
   local out_file=""
-  if [[ "${1:-}" == "-o" && -n "${2:-}" ]]; then
+  local force_full_file=0
+  while [[ -n "${1:-}" && "${1:-}" == -* ]]; do
+    case "$1" in
+      -o)
+        if [[ -z "${2:-}" ]]; then
+          echo "Error: -o requires a file name." >&2
+          return 1
+        fi
         out_file="$2"
         shift 2
-  fi
+        ;;
+      --full-file)
+        force_full_file=1
+        shift
+        ;;
+      -h|--help)
+        show_help
+        exit 0
+        ;;
+      --)
+        shift
+        break
+        ;;
+      *)
+        break
+        ;;
+    esac
+  done
 
   ########################################
   # --- 1) File als Argument ---
@@ -82,8 +110,9 @@ vencr() {
       return 0
     fi
 
-    # Fall B: YAML mit key: value Zeilen
+    # Fall B: YAML mit key: value Zeilen nur fuer typische YAML-Dateien
-    if grep -Eq '^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*[^#].*$' "$f"; then
+    # (damit z.B. README.md als normale Datei komplett verschluesselt wird).
+    if [[ $force_full_file -eq 0 ]] && [[ "$f" =~ \.(yml|yaml)$ ]] && grep -Eq '^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*[^#].*$' "$f"; then
       local tmpout
       tmpout="$(mktemp)"
 

files/homedirs/chris/_bashrc

@@ -116,3 +116,9 @@ export EDITOR=vim
 # turn off the beep (only in bash tab-complete ?)
 # only if interactiv shell
 [[ "$-" =~ "i" ]] && bind 'set bell-style none'
+
+# Workaround für cssh/Perl-Tk unter Wayland: "Authorization required, but
+# no authorization protocol specified" (Debian Bug #1028370). Erlaubt dem
+# lokalen User pauschalen X11-Zugriff, ohne fehlerhaftes Cookie-Verfahren.
+#
+#xhost +SI:localuser:$(whoami) >/dev/null 2>&1

ga-eh-gw.oopen.de.yml

@@ -416,4 +416,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

group_vars/all/main.yml

@@ -125,7 +125,6 @@ copy_plain_files_journald:
     dest_path: /etc/systemd/journald.conf.d/50-MaxFileSec.conf
 
 
-
 # copy_plain_files_sysctl: []
 copy_plain_files_sysctl:
 
@@ -159,7 +158,7 @@ apt_manage_sources_list: true
 apt_src_enable: true
 apt_backports_enable: true
 
-apt_debian_mirror: http://ftp2.de.debian.org/debian/
+apt_debian_mirror: http://ftp.de.debian.org/debian/
 apt_debian_contrib_nonfree_enable: true
 
 # Ubuntu mirror
@@ -673,6 +672,7 @@ apt_initial_install_trixie:
   - bash
   - bash-completion
   - bc
+  - bind9-dnsutils
   - bridge-utils
   - btrfs-progs
   - bzip2
@@ -682,7 +682,6 @@ apt_initial_install_trixie:
   - curl
   - dbus
   - debian-keyring
-  - dnsutils
   - dselect
   - ethtool
   - fdisk
@@ -697,7 +696,6 @@ apt_initial_install_trixie:
   - gettext-doc
   - git
   - groff
-  - groff
   - haveged
   - hdparm
   - htop
@@ -731,7 +729,7 @@ apt_initial_install_trixie:
   - lsof
   - lua5.4
   - lynx
-  - man
+  - man-db
   - mawk
   - mc
   - moreutils
@@ -746,6 +744,11 @@ apt_initial_install_trixie:
   - perl
   - perl-doc
   - psmisc
+  - python3
+  - python3-apt
+  - python3-systemd
+  - python-apt-common
+  - python-is-python3
   - quota
   - quotatool
   - rblcheck
@@ -779,7 +782,6 @@ apt_initial_install_trixie:
   - wget
   - whois
   - wipe
-  - wipe
   - zip
   - zsh
 
@@ -1726,87 +1728,88 @@ apt_webserver_pkgs:
 
 
 apt_webserver_pkgs_trixie:
-  - libdb-dev
+  - build-essential
-  - zlib1g
-  - zlib1g-dev
-  - libssl-dev
-  - libneon27-dev
-  - libxml2
-  - libxml2-dev
   - curl
-  - libcurl4-openssl-dev
-  - libqdbm-dev
-  - libgdbm-dev
-  - libpspell-dev
-  - libjpeg-dev
-  - libpng-dev
-  - libxpm-dev
-  - libfreetype6-dev
-  - libwmf-dev
-  - libtiff-dev
-  - libpaper-dev
-  - libmagic-dev
-  - libgraphics-magick-perl
-  - libgraphicsmagick++1-dev
-  - libgraphicsmagick-q16-3
-  - libgraphicsmagick1-dev
-  - libgraphviz-dev
-  - libgsf-1-dev
-  - libilmbase-dev
-  - libvpx-dev
-  - vpx-tools
-  - libgpm-dev
-  - libkpathsea-dev
-  - libopenexr-dev
-  - librsvg2-dev
-  - libdjvulibre-dev
-  - libatm-dev
-  - libexpat-dev
-  - imagemagick
-  - graphicsmagick
-  - exif
-  - libexiv2-dev
-  - re2c
-  - netpbm
-  - libnetpbm-dev
-  - libmcrypt-dev
-  - mcrypt
   - default-libmysqlclient-dev
-  - libpq-dev
+  - exif
-  - postgresql-client
+  - expect
-  - libreadline-dev
+  - expect-dev
-  - libncurses-dev
+  - ffmpeg
+  - graphicsmagick
+  - imagemagick
+  - libaio-dev
+  - libapr1-dev
+  - libaprutil1-dev
+  - libatm-dev
+  - libcrypto++-dev
+  - libcurl4-openssl-dev
   - libdb5.3
   - libdb5.3++
   - libdb5.3++-dev
   - libdb5.3-dev
-  - libxslt1-dev
+  - libdb-dev
-  - libpcre2-dev
+  - libdjvulibre-dev
-  - libicu-dev
+  - libexiv2-dev
-  - libtidy-dev
+  - libexpat-dev
-  - libmm-dev
+  - libexpect-perl
+  - libfreetype6-dev
+  - libgdbm-dev
+  - libgd-dev
+  - libgeoip-dev
   - libgmp-dev
+  - libgpm-dev
+  - libgraphicsmagick++1-dev
+  - libgraphicsmagick1-dev
+  - libgraphics-magick-perl
+  - libgraphicsmagick-q16-3
+  - libgraphviz-dev
+  - libgsf-1-dev
+  - libicu-dev
+  - libilmbase-dev
+  - libjpeg-dev
+  - libkpathsea-dev
   - libkrb5-dev
   - libldap-dev
-  - libmhash-dev
-  - libgd-dev
   - liblua5.3-dev
-  - libapr1-dev
+  - libmagic-dev
-  - libaprutil1-dev
-  - libsctp-dev
-  - libcrypto++-dev
-  - ffmpeg
   - libmagickwand-dev
-  - libgeoip-dev
+  - libmcrypt-dev
-  - libaio-dev
+  - libmhash-dev
-  - tk-dev
+  - libmm-dev
+  - libncurses-dev
+  - libneon27-dev
+  - libnetpbm-dev
+  - libopenexr-dev
+  - libpaper-dev
+  - libpcre2-dev
+  - libpng-dev
+  - libpq-dev
+  - libpspell-dev
+  - libqdbm-dev
+  - libreadline-dev
+  - librsvg2-dev
+  - libsctp-dev
+  - libssl-dev
+  - libtidy-dev
+  - libtiff-dev
+  - libvpx-dev
+  - libwmf-dev
+  - libxml2
+  - libxml2-dev
+  - libxpm-dev
+  - libxslt1-dev
+  - mcrypt
+  - netpbm
+  - poppler-utils
+  - postgresql-client
+  - re2c
   - tcl-dev
   - tclreadline
-  - expect
+  - tk-dev
-  - expect-dev
+  - vpx-tools
-  - libexpect-perl
-  - poppler-utils
   - weasyprint
+  - zlib1g
+  - zlib1g-dev
 
 #  - libc-client2007e-dev
 #  - libc-client-dev
@@ -1915,11 +1918,12 @@ apt_extra_pkgs: []
 apt_install: {}
 apt_install_state: latest
 
-apt_remove:
+apt_remove: []
-  - apt-transport-tor
+# apt_remove:
-  - tor
+#   - apt-transport-tor
-  - tor-geoipdb
+#   - tor
-  - torsocks
+#   - tor-geoipdb
+#   - torsocks
 
 apt_remove_purge: false
 
@@ -2377,9 +2381,6 @@ extra_system_user: []
 
 
 entries_authorized_key: []
-#entries_authorized_key:
-#  - user: root
-#  - key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcc4brtgGW0xP2KiZGq5xsyUKcNiYF72zQ49Z0lqx3iu0zj9oz79oGZY1N9jCeKG30AsbwL+4H6/l2hAekFZu6fIwuiRgCVRAwYrnnlOGDAnYOGHfks23pk2BU0/fb2VnxiK967FvpJ/xDP49t1UC5voX/O2MTkz6NROJPwIClHgnwN1bg+C09UpJNmmdROi8myhiu1/aYbAWDfQzVUnHio0q3vBM16ZUQkoIHxQT4fF8elS408n0jd9WJHyRtLB/mCMI6O3G2yHdPVciqKwgRwRtJ8hDjmFfyeLtxb4ADpa2Q/f6MuJI0elxbxjp8l2XKjVSwPJ8GKomC16HfgFMrnUNQcx9YMrXB26f+lperf9NlwbQtXZffj9M+BxTAFvh+1Q/iIHqRat2Bb/8OUY9JI2zuWUliffqb5Kbzjik4vMqZvI2ED2zphsPcpLST7u+4z40vZliBf1F4P2vDBfIRK87ldfJQQw6saMZznjZPNV7CA+K7IFCpOz0wuoVE3wOka8hdYmMIMno34Zf6P+xuTaAPXJOCubKuhicUlhtX7q72Pln5kuvbO3ZRgEK3XnyIWeAd2rkaU6XVo7W19043e9HkkbG8nZETYu7TGFhufXyloinde5XLyW295BS8fKa1AteJPDLY4ClF2PZiWbxWRjAhlRAlgXgup09rN2HHjw== root@b.ns'
 
 create_sftp_group: false
 
@@ -2598,7 +2599,7 @@ bind9_notify_source: {}
 bind9_gateway_allow_query:
   - local-net
 
-#bind9_gateway_allow_query_cache: {}
+# ind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
   - local-net
 
@@ -2625,6 +2626,8 @@ ntp_server: {}
 # Firewall repository
 # ---
 
+git_default_branch: main
+
 git_firewall_repository: {}
 
 # ---
@@ -2987,6 +2990,14 @@ copy_plain_files_postfwd:
     src_path: mailserver/etc/postfix/postfwd.bl-user
     dest_path: /etc/postfix/postfwd.bl-user
 
+  - name: postfwd.high_rate_ip
+    src_path: mailserver/etc/postfix/postfwd.high_rate_ip
+    dest_path: /etc/postfix/postfwd.high_rate_ip
+
+  - name: postfwd.high_rate_hostname
+    src_path: mailserver/etc/postfix/postfwd.high_rate_hostname
+    dest_path: /etc/postfix/postfwd.high_rate_hostname
+
   - name: postfwd.bl-recipient-exeeds-msg-size-20mb
     src_path: mailserver/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
     dest_path: /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
@@ -3102,7 +3113,7 @@ website_name_postfixadmin:
 # --\n
 # O.OPEN            |   Phone:  +49 30 / 290 484 91\n
 # Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99\n
-#D-10999 Berlin    |   E-MAIL: oo@oopen.de\n
+# -10999 Berlin    |   E-MAIL: oo@oopen.de\n
 # "
 email_welcome_message:
 
@@ -3285,8 +3296,6 @@ redhat_services_active_and_started:
   - tor
 
 
-
-
 # ==============================
 
 

host_vars/172.16.82.197.yml

@@ -1,175 +0,0 @@
----
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-copy_additional_plain_files_sysctl:
-
-  - name: enable-ipv6
-    src_path: etc/sysctl.d/30-enable-ipv6.conf
-    dest_path: /etc/sysctl.d/30-enable-ipv6.conf
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-#sshd_hostkeyalgorithms:
-#  - ssh-ed25519
-#  - ssh-ed25519-cert-v01@openssh.com
-#  - rsa-sha2-256
-#  - rsa-sha2-512
-#  - ecdsa-sha2-nistp256
-#  - rsa-sha2-256-cert-v01@openssh.com
-#  - rsa-sha2-512-cert-v01@openssh.com
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 127.0.0.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - akb.netz
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 194.150.168.168
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-bind9_gateway_listen_on_v6:
-  - none
-
-bind9_gateway_listen_on:
-  - any
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $y$j9T$IVBTpn.OrI6YiQ9q3fA8b1$Y1bmID5yXJbKfoLFt1VmQs6LezeTj5/1M9ppZBD2Pn4
-

host_vars/a.mx.oopen.de/a.mx-common.yml

@@ -107,14 +107,14 @@ insert_root_ssh_keypair: true
 
 root_ssh_keypair:
   - name: id-rsa-dehydrated
-    priv_key_src: a.mx/root/.ssh/a.mx-id_rsa-dehydrated
+    priv_key_src: a.mx.oopen.de/root/.ssh/a.mx-id_rsa-dehydrated
     priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: a.mx/root/.ssh/a.mx-id_rsa-dehydrated.pub
+    pub_key_src: a.mx.oopen.de/root/.ssh/a.mx-id_rsa-dehydrated.pub
     pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
   - name: id-rsa-opendkim
-    priv_key_src: a.mx/root/.ssh/a.mx-id_rsa-opendkim
+    priv_key_src: a.mx.oopen.de/root/.ssh/a.mx-id_rsa-opendkim
     priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: a.mx/root/.ssh/a.mx-id_rsa-opendkim.pub
+    pub_key_src: a.mx.oopen.de/root/.ssh/a.mx-id_rsa-opendkim.pub
     pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
 
 
@@ -151,53 +151,6 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---
 
-copy_plain_files:
-
-  # /root/bin/monitoring
-  #
-  - name: monitoring_check_cert_for_dovecot.conf
-    src_path: a.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf
-    dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: a.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_postfix_add_mailboxes.conf
-    src_path: a.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf
-    dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
-
-  - name: postfix_sent_userinfo_postfix.conf
-    src_path: a.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf
-    dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: a.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfwd_host_specific:
-
-  # Postfix Firewall postfwd
-  #
-  - name: postfwd.wl-user
-    src_path: a.mx/etc/postfix/postfwd.wl-user
-    dest_path: /etc/postfix/postfwd.wl-user
-
-  - name: postfwd.bl-recipient-exeeds-msg-size-20mb
-    src_path: a.mx/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
-    dest_path:  /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
-
-
-#copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-
 
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -231,30 +184,31 @@ si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07e
 #
 website_name_postfixadmin: adm.oopen.de
 
-email_welcome_message: "\n
+email_welcome_message: |
-Hallo,\n
 
-Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+  Hallo,
 
-O.OPEN\n
+  Ihre/Deine neue E-Mail Adresse ist eingerichtet.
 
---\n
+  O.OPEN
-O.OPEN            |   Phone:  +49 30 / 290 484 91\n
+
-Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99\n
+  --
-D-10999 Berlin    |   E-MAIL: oo@oopen.de\n
+  O.OPEN            |   Phone:  +49 30 / 290 484 91
-"
+  Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99
+  D-10999 Berlin    |   E-MAIL: oo@oopen.de
 
 # install_update_dovecot.conf
 #
 dovecot_from_address: "o.open <oo@oopen.de>"
 dovecot_reply_to: "oo@oopen.de"
 webmailer_address: "https://webmail.oopen.de"
-salutation: "O.OPEN\n
+salutation: |
+  O.OPEN
 
---\n
+  --
-O.OPEN           |   Phone:  +49 30 / 290 484 91\n
+  O.OPEN           |   Phone:  +49 30 / 290 484 91
-Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99\n
+  Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99
-D-10999 Berlin   |   http://oopen.de\n"
+  D-10999 Berlin   |   http://oopen.de
 
 # install_upgrade_roundcube-webmail.conf
 #

host_vars/a.mx.oopen.de/a.mx-ipt-server.yml

@@ -42,4 +42,4 @@ fw_jitsi_dovecot_auth: true
 fw_rsync_out_ips: $ext_1_ip
 
 # --- Protection / limits
-fw_per_IP_connection_limit: 250
+fw_per_IP_connection_limit: 250 # noqa: var-naming[pattern]

host_vars/a.ns.oopen.de/a.ns-common.yml

@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length
 
 # ---
 # vars used by roles/ansible_dependencies
@@ -244,13 +245,9 @@ symlink_files:
 # ---
 
 
-
-
-
 # ==============================
 
 
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/ak-plan.oopen.de/ak-plan-common.yml

@@ -139,4 +139,3 @@ resolved_fallback_nameserver:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/anita.wf.netz/anita-common.yml

@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length
 
 # ---
 # vars used by roles/ansible_dependencies
@@ -290,4 +291,3 @@ samba_shares:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/at-10-neu.ak.netz/at-10-neu-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -145,7 +145,6 @@ cron_user_special_time_entries:
     insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/b.mx.oopen.de/b.mx-common.yml

@@ -26,8 +26,6 @@
 
 install_compiler_pkgs: true
 
-install_postgresql_pkgs: true
-
 
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
@@ -107,14 +105,14 @@ insert_root_ssh_keypair: true
 
 root_ssh_keypair:
   - name: id-rsa-dehydrated
-    priv_key_src: d.mx/root/.ssh/d.mx-id_rsa-dehydrated
+    priv_key_src: b.mx.oopen.de/root/.ssh/b.mx-id_rsa-dehydrated
     priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: d.mx/root/.ssh/d.mx-id_rsa-dehydrated.pub
+    pub_key_src: b.mx.oopen.de/root/.ssh/b.mx-id_rsa-dehydrated.pub
     pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
   - name: id-rsa-opendkim
-    priv_key_src: d.mx/root/.ssh/d.mx-id_rsa-opendkim
+    priv_key_src: b.mx.oopen.de/root/.ssh/b.mx-id_rsa-opendkim
     priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: d.mx/root/.ssh/d.mx-id_rsa-opendkim.pub
+    pub_key_src: b.mx.oopen.de/root/.ssh/b.mx-id_rsa-opendkim.pub
     pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
 
 
@@ -151,20 +149,6 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---
 
-copy_plain_files:
-
-  - name: postfix_create_opendkim_key.conf
-    src_path: d.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: d.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-  - name: install_sympa.conf
-    src_path: lists.mx.warenform/usr/local/src/sympa/conf/install_sympa.conf
-    dest_path: /usr/local/src/sympa/conf/install_sympa.conf
-
 
 copy_template_files: []
 #
@@ -173,18 +157,17 @@ copy_template_files: []
 #    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
 
 
-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---
 
-hostname: d.mx.oopen.de
+hostname: b.mx.oopen.de
-ipv4_address: 95.217.204.227
+ipv4_address: 162.55.82.73
-ipv6_address: 2a01:4f9:4a:47e5::227
+ipv6_address: 2a01:4f8:271:1266::73
 
 admin_email: argus@oopen.de
-is_relay_host: false
+is_relay_host: !!str "true"
-is_sympa_list_server: true
+sasl_auth_enable: !!str "yes"
 
 # install_amavis.conf
 #
@@ -194,10 +177,10 @@ si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07e
 
 template_files_mailsystem_script:
 
-  - name: mailsystem_install_postfix_advanced.conf
-    src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
-    dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf
-
   - name: mailsystem_install_amavis.conf
     src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
     dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
+
+  - name: mailsystem_install_postfix_advanced.conf
+    src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
+    dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf

host_vars/b.ns.oopen.de/b.ns-common.yml

@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length
 
 # ---
 # vars used by roles/ansible_dependencies
@@ -240,4 +241,3 @@ symlink_files:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/backup.oopen.de/backup-common.yml

@@ -299,6 +299,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDNIGI5HpfYnZCvDM3bf3UQti8SRhgL7wLu8LfxZLqwB root@meet.akweb.de'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoLG5tE0tHh+iFRzellU80eJTxZfqDB3e6Dg4XRKBrA root@meet.oopen.de'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2bxZZNXrlsvERYo0VyXzdW1AZuGmsTNjgF4oQJNfnn root@mm-irights'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINy+3uf7VKQBQuXPeFSlSG4lcNbkCTysMhIideNTyMKr root@mm-nd'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILpKuS8DFuHHvfQZCHOGiurOvzlFkx1unnMfZWEM3wUY root@mm-rav'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMnwSzzSrAQJN3I0Y3xRU0rjlrO2KlHD3tFMgCqEyk0i root@mm'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILXSGiRst5AQ396FQY6jrr1jTCpwGDLWv5akw6SiMUGq root@nd-gate'
@@ -337,6 +338,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDW54VI+M5SjV6dQLew/IA31RI1GOneIqg5dI1/VZQgJ root@o42'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII2b60T/OXKCoze083GsHXuMFtm8Zo3WnCFb9Q9ofGie root@o43'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPytU2q7RmehrJyRnXRIZp7qcoswSANsClJP8v3zv6D7 root@o44'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFS0XtUKLgDqciQLr64VbtQSTlz7eHuvA8x9QZiAg9RA root@o45'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUnxlKIffm8a5BmoQE40h8ut0R6eCxcm+Iewv3evmE9 root@oolm-shop'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4ylglAkPst7G6kES2lE96ECp0AGXGjzCVkZSqGVru6 root@oolm-shop-dev'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web'
@@ -410,4 +412,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/backup.warenform.de/backup-common.yml

@@ -188,8 +188,6 @@ cron_user_entries:
 insert_ssh_keypair_backup_server: false
 
 
-
-
 default_user:
 
   - name: chris
@@ -308,4 +306,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/bbb-server.b3-bornim.netz/bbb-server-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -156,7 +156,6 @@ cron_user_special_time_entries:
     insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/c.mx.oopen.de/c.mx-common.yml

@@ -107,19 +107,19 @@ insert_root_ssh_keypair: true
 
 root_ssh_keypair:
   - name: id-rsa-dehydrated
-    priv_key_src: c.mx/root/.ssh/c.mx-id_rsa-dehydrated
+    priv_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa-dehydrated
     priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: c.mx/root/.ssh/c.mx-id_rsa-dehydrated.pub
+    pub_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa-dehydrated.pub
     pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
   - name: id-rsa-opendkim
-    priv_key_src: c.mx/root/.ssh/c.mx-id_rsa-opendkim
+    priv_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa-opendkim
     priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: c.mx/root/.ssh/c.mx-id_rsa-opendkim.pub
+    pub_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa-opendkim.pub
     pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
   - name: id-rsa
-    priv_key_src: c.mx/root/.ssh/c.mx-id_rsa
+    priv_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa
     priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: c.mx/root/.ssh/c.mx-id_rsa.pub
+    pub_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa.pub
     pub_key_dest: /root/.ssh/id_rsa.pub
 
 
@@ -156,49 +156,6 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---
 
-copy_plain_files:
-
-  # /root/bin/monitoring
-  #
-  - name: monitoring_check_cert_for_dovecot.conf
-    src_path: c.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf
-    dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: c.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_postfix_add_mailboxes.conf
-    src_path: c.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf
-    dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
-
-  - name: postfix_sent_userinfo_postfix.conf
-    src_path: c.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf
-    dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: c.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfwd_host_specific: []
-
-  # Postfix Firewall postfwd
-  #
-  #- name: postfwd.wl-user
-  #  src_path: c.mx/etc/postfix/postfwd.wl-user
-  #  dest_path: /etc/postfix/postfwd.wl-user
-
-
-#copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-
 
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -230,30 +187,30 @@ si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07e
 #
 website_name_postfixadmin: adm.initiativenserver.de
 
-email_welcome_message: "\n
+email_welcome_message: |
-Hallo,\n
+  Hallo,
 
-Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+  Ihre/Deine neue E-Mail Adresse ist eingerichtet.
 
   Aktionsbündnis gegen Gewalt, Rechtsextremismus und Fremdenfeindlichkeit
 
---\n
+  --
-Initiativenserver  |   phone:  0331 505824-28\n
+  Initiativenserver  |   phone:  0331 505824-28
-Mittelstraße 38/39 |   fax:    0331 505824-29\n
+  Mittelstraße 38/39 |   fax:    0331 505824-29
-14467 Potsdam      |   email:  kontakt@initiativenserver.de\n
+  14467 Potsdam      |   email:  kontakt@initiativenserver.de
-"
 
 # install_update_dovecot.conf
 #
 dovecot_from_address: "Admin Initiativenserver <admin@initiativenserver.de>"
 dovecot_reply_to: "admin@initiativenserver.de"
 webmailer_address: "https://webmail.initiativenserver.de"
-salutation: "Aktionsbündnis gegen Gewalt, Rechtsextremismus und FremdenfeindlichkeitN\n
+salutation: |
+  Aktionsbündnis gegen Gewalt, Rechtsextremismus und Fremdenfeindlichkeit
 
---\n
+  --
-Initiativenserver  |   phone:  0331 505824-28\n
+  Initiativenserver  |   phone:  0331 505824-28
-Mittelstraße 38/39 |   fax:    0331 505824-29\n
+  Mittelstraße 38/39 |   fax:    0331 505824-29
-14467 Potsdam      |   email:  kontakt@initiativenserver.de\n"
+  14467 Potsdam      |   email:  kontakt@initiativenserver.de
 
 # install_upgrade_roundcube-webmail.conf
 #
@@ -295,4 +252,3 @@ template_files_mailsystem_script:
   - name: mailsystem_install_upgrade_roundcube-webmail.conf
     src_path: usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf.j2
     dest_path: /usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf
-

host_vars/cl-01.oopen.de/cl-01-common.yml

@@ -163,4 +163,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-02.oopen.de/cl-02-common.yml

@@ -150,4 +150,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-dissens.oopen.de/cl-dissens-common.yml

@@ -148,4 +148,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-flr.oopen.de/cl-flr-common.yml

@@ -148,4 +148,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-fm.oopen.de/cl-fm-common.yml

@@ -232,4 +232,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-irights-neu.oopen.de.yml

@@ -1,151 +0,0 @@
----
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-sshd_permit_root_login: !!str "prohibit-password"
-
-# ---
-# vars used by apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 185.12.64.2
-  - 2a01:4ff:ff00::add:1
-  - 185.12.64.1
-  - 2a01:4ff:ff00::add:2
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which 
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - oopen.de
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 194.150.168.168
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-sudo_users:
-  - chris
-  - sysadm
-  - localadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-sudoers_file_user_privileges:
-  - name: back
-    entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-

host_vars/cl-irights.oopen.de/cl-irights-common.yml

@@ -232,4 +232,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-lubax.oopen.de/cl-lubax-common.yml

@@ -149,4 +149,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-nd-test.oopen.de/cl-nd-test-common.yml

@@ -0,0 +1,126 @@
+---
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+sshd_permit_root_login: !!str "prohibit-password"
+
+# ---
+# vars used by apt.yml
+# ---
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+resolved_nameserver:
+  - 185.12.64.2
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 2a01:4ff:ff00::add:1
+
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+cron_user_special_time_entries:
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+cron_user_entries:
+  - name: "Check if webservices sre running. Restart if necessary"
+    minute: "*/5"
+    hour: "*"
+    job: /root/bin/monitoring/check_webservice_load.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: "*/5"
+    hour: "*"
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: "*/15"
+    hour: "*"
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
+    minute: "*/5"
+    hour: "*"
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Optimize mysql tables"
+    minute: "53"
+    hour: "04"
+    job: /root/bin/mysql/optimize_mysql_tables.sh
+
+  - name: "Flush query cache for mysql tables"
+    minute: "27"
+    hour: "04"
+    job: /root/bin/mysql/flush_query_cache.sh
+
+  - name: "Flush Host cache"
+    minute: "17"
+    hour: "05"
+    job: /root/bin/mysql/flush_host_cache.sh
+
+  - name: "Run occ file:scan for each cloud account"
+    minute: "02"
+    hour: "23"
+    job: /root/bin/nextcloud/occ_maintenance.sh -s cloud-test.ndhosting.de
+
+  - name: "Background job for nextcloud instance 'cloud-test.ndhosting.de"
+    minute: "*/15"
+    hour: "*"
+    job: sudo -u "www-data" /usr/local/php/bin/php  -f /var/www/cloud-test.ndhosting.de/htdocs/cron.php
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: "23"
+    hour: "05"
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: "33"
+    hour: "05"
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+sudo_users:
+  - chris
+  - sysadm
+  - localadmin
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+
+sudoers_file_user_privileges:
+  - name: back
+    entry: "ALL=(www-data) NOPASSWD: /usr/local/php/bin/php"

host_vars/cl-nd-test.oopen.de/cl-nd-test-ipt-server.yml

@@ -0,0 +1,28 @@
+---
+# ipt-firewall configuration for a.mx.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "135.181.90.132"
+fw_ext_ips_v6:
+  - "2a01:4f9:c014:1ba8::1"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# - Docker-Netzwerk nicht firewallen
+#
+fw_unprotected_ifs: br-euroffice

host_vars/cl-nd.oopen.de/cl-nd-common.yml

@@ -232,4 +232,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-ndm.oopen.de/cl-ndm-common.yml

@@ -232,4 +232,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-opp.oopen.de/cl-opp-common.yml

@@ -143,4 +143,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-test.oopen.de/cl-test-common.yml

@@ -140,4 +140,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cl-vbrg.oopen.de/cl-vbrg-common.yml

@@ -70,4 +70,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cloud-giz.warenform.de/cloud-giz-common.yml

@@ -70,4 +70,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cloud.akweb.de/cloud-common.yml

@@ -144,4 +144,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cp-01.oopen.de/cp-01-common.yml

@@ -158,4 +158,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/cp-flr.oopen.de/cp-flr-common.yml

@@ -156,4 +156,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/d.mx.oopen.de/d.mx-common.yml

@@ -26,6 +26,8 @@
 
 install_compiler_pkgs: true
 
+install_postgresql_pkgs: true
+
 
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
@@ -105,14 +107,14 @@ insert_root_ssh_keypair: true
 
 root_ssh_keypair:
   - name: id-rsa-dehydrated
-    priv_key_src: b.mx/root/.ssh/b.mx-id_rsa-dehydrated
+    priv_key_src: d.mx.oopen.de/root/.ssh/d.mx-id_rsa-dehydrated
     priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: b.mx/root/.ssh/b.mx-id_rsa-dehydrated.pub
+    pub_key_src: d.mx.oopen.de/root/.ssh/d.mx-id_rsa-dehydrated.pub
     pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
   - name: id-rsa-opendkim
-    priv_key_src: b.mx/root/.ssh/b.mx-id_rsa-opendkim
+    priv_key_src: d.mx.oopen.de/root/.ssh/d.mx-id_rsa-opendkim
     priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: b.mx/root/.ssh/b.mx-id_rsa-opendkim.pub
+    pub_key_src: d.mx.oopen.de/root/.ssh/d.mx-id_rsa-opendkim.pub
     pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
 
 
@@ -149,58 +151,18 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---
 
-copy_plain_files:
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: b.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: b.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfix_host_specific:
-
-  - name: relay_domains
-    src_path: b.mx/etc/postfix/relay_domains
-    dest_path: /etc/postfix/relay_domains
-
-
-copy_plain_files_postfwd_host_specific:
-
-  # Postfix Firewall postfwd
-  #
-  - name: postfwd.wl-nets
-    src_path: b.mx/etc/postfix/postfwd.wl-nets
-    dest_path: /etc/postfix/postfwd.wl-nets
-
-  - name: postfwd.wl-sender
-    src_path: b.mx/etc/postfix/postfwd.wl-sender
-    dest_path: /etc/postfix/postfwd.wl-sender
-
-
-copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-
 
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---
 
-hostname: b.mx.oopen.de
+hostname: d.mx.oopen.de
-ipv4_address: 162.55.82.73
+ipv4_address: 95.217.204.227
-ipv6_address: 2a01:4f8:271:1266::73
+ipv6_address: 2a01:4f9:4a:47e5::227
 
 admin_email: argus@oopen.de
-is_relay_host: !!str "true"
+is_relay_host: false
-sasl_auth_enable: !!str "yes"
+is_sympa_list_server: true
 
 # install_amavis.conf
 #
@@ -210,10 +172,10 @@ si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07e
 
 template_files_mailsystem_script:
 
-  - name: mailsystem_install_amavis.conf
-    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
   - name: mailsystem_install_postfix_advanced.conf
     src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
     dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf
+
+  - name: mailsystem_install_amavis.conf
+    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
+    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf

host_vars/dc-opp.oopen.de/dc-opp-common.yml

@@ -139,4 +139,3 @@ resolved_fallback_nameserver:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/devel-cloud.wf.netz/devel-cloud-common.yml

@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length
 
 # ---
 # vars used by roles/ansible_dependencies
@@ -150,4 +151,3 @@ sudo_users:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/devel-db.wf.netz/devel-db-common.yml

@@ -142,15 +142,12 @@ resolved_fallback_nameserver:
 # ---
 
 
-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---
 
 
-
-
 # ==============================
 
 

host_vars/devel-php.wf.netz/devel-php-common.yml

@@ -149,15 +149,12 @@ resolved_fallback_nameserver:
 # ---
 
 
-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---
 
 
-
-
 # ==============================
 
 

host_vars/devel-repos.wf.netz/devel-repos-common.yml

@@ -142,15 +142,12 @@ resolved_fallback_nameserver:
 # ---
 
 
-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---
 
 
-
-
 # ==============================
 
 

host_vars/devel-root.wf.netz/devel-root-common.yml

@@ -142,15 +142,12 @@ resolved_fallback_nameserver:
 # ---
 
 
-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---
 
 
-
-
 # ==============================
 
 

host_vars/devel-wiki.wf.netz/devel-wiki-common.yml

@@ -142,15 +142,12 @@ resolved_fallback_nameserver:
 # ---
 
 
-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---
 
 
-
-
 # ==============================
 
 

host_vars/dns0.warenform.de/dns0-common.yml

@@ -121,4 +121,3 @@ git_firewall_repository: {}
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/dns1.warenform.de/dns1-common.yml

@@ -138,4 +138,3 @@ git_firewall_repository: {}
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-

host_vars/e.mx.oopen.de/e.mx-common.yml

@@ -105,17 +105,17 @@ resolved_fallback_nameserver:
 
 insert_root_ssh_keypair: true
 
-root_ssh_keypair:
+# root_ssh_keypair:
-  - name: id-rsa-dehydrated
+#  - name: id-rsa-dehydrated
-    priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated
+#    priv_key_src: e.mx.oopen.de/root/.ssh/e.mx-id_rsa-dehydrated
-    priv_key_dest: /root/.ssh/id_rsa-dehydrated
+#    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated.pub
+#    pub_key_src: e.mx.oopen.de/root/.ssh/e.mx-id_rsa-dehydrated.pub
-    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
+#    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
-  - name: id-rsa-opendkim
+#  - name: id-rsa-opendkim
-    priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim
+#    priv_key_src: e.mx.oopen.de/root/.ssh/e.mx-id_rsa-opendkim
-    priv_key_dest: /root/.ssh/id_rsa-opendkim
+#    priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim.pub
+#    pub_key_src: e.mx.oopen.de/root/.ssh/e.mx-id_rsa-opendkim.pub
-    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
+#    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
 
 
 # ---
@@ -151,36 +151,6 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---
 
-copy_plain_files:
-
-  - name: monitoring_check_cert_for_dovecot.conf
-    src_path: e.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf
-    dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
-
-  - name: postfix_create_opendkim_key.conf
-    src_path: e.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_postfix_add_mailboxes.conf
-    src_path: e.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf
-    dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
-
-  - name: postfix_sent_userinfo_postfix.conf
-    src_path: e.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf
-    dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: e.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-
 
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -211,30 +181,31 @@ si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07e
 #
 website_name_postfixadmin: adm-e.oopen.de
 
-email_welcome_message: "\n
+email_welcome_message: |
-Hallo,\n
 
-Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+  Hallo,
 
-O.OPEN\n
+  Ihre/Deine neue E-Mail Adresse ist eingerichtet.
 
---\n
+  O.OPEN
-O.OPEN            |   Phone:  +49 30 / 290 484 91\n
+
-Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99\n
+  --
-D-10999 Berlin    |   E-MAIL: oo@oopen.de\n
+  O.OPEN            |   Phone:  +49 30 / 290 484 91
-"
+  Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99
+  D-10999 Berlin    |   E-MAIL: oo@oopen.de
 
 # install_update_dovecot.conf
 #
 dovecot_from_address: "o.open <oo@oopen.de>"
 dovecot_reply_to: "oo@oopen.de"
 webmailer_address: "https://webmail-e.oopen.de"
-salutation: "O.OPEN\n
+salutation: |
+  O.OPEN
 
---\n
+  --
-O.OPEN           |   Phone:  +49 30 / 290 484 91\n
+  O.OPEN           |   Phone:  +49 30 / 290 484 91
-Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99\n
+  Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99
-D-10999 Berlin   |   http://oopen.de"
+  D-10999 Berlin   |   http://oopen.de
 
 # install_upgrade_roundcube-webmail.conf
 #

host_vars/file-ah.kanzlei-kiel.netz/file-ah-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -233,7 +233,6 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItQLQ7lhBY2USF4Jcp4teF+1NydI73VeHYbQW8q4Mcw root@gw-ah'
 
 
-
 # ---
 # vars used by roles/common/tasks/cron.yml
 # ---
@@ -281,7 +280,6 @@ cron_user_special_time_entries:
 #    insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -474,6 +472,13 @@ samba_user:
       - gubitz-partner
     password: '20-heckert.22%'
 
+  - name: bauhofer
+    groups:
+      - buero
+      - intern
+      - verwaltung
+    password: '20-bau.hofer-26'
+
   - name: schultheis
     groups:
       - intern

host_vars/file-blkr-alt.blkr.netz/file-blkr-alt-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -177,7 +177,6 @@ cron_user_special_time_entries:
     insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/file-blkr.blkr.netz/file-blkr-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -177,7 +177,6 @@ cron_user_special_time_entries:
     insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -392,6 +391,26 @@ samba_user:
       - verwaltung
     password: 'q.Y-q/3r9j.E'
 
+  - name: buchhaltung
+    groups:
+      - buero
+    password: '7RcK/j3Sez-y'
+
+  - name: wimi
+    groups:
+      - buero
+    password: 'c2F.v.xd49-I'
+
+  - name: refa1
+    groups:
+      - buero
+    password: '3hp-hf7Pym.J'
+
+  - name: refi-m40
+    groups:
+      - buero
+    password: 'VX.S.3zKr446'
+
 
 #  - name: lap-02
 #    groups:

host_vars/file-dissens.dissens.netz/file-dissens-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:

host_vars/file-ebs.ebs.netz/file-ebs-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -247,7 +247,6 @@ cron_user_special_time_entries:
     insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -305,7 +304,6 @@ nfs_exports:
     use_fsid_option: true
 
 
-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
@@ -557,7 +555,6 @@ samba_shares:
     vfs_object_recycle: false
 
 
-
 # ==============================
 
 

host_vars/file-fhxb.fhxb.netz/file-fhxb-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -156,7 +156,6 @@ cron_user_special_time_entries:
     insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -225,7 +224,6 @@ nfs_exports:
     use_fsid_option: true
 
 
-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
@@ -963,7 +961,6 @@ samba_shares:
     recycle_path: '@Recycle'
 
 
-
 # ==============================
 
 

host_vars/file-fm.fm.netz/file-fm-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:

host_vars/file-ipa.local.netz/file-ipa-common.yml

@@ -73,7 +73,6 @@ install_compiler_pkgs: true
 #    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
 
 
-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---

host_vars/file-kb.anw-kb.netz/file-kb-common.yml

@@ -112,7 +112,6 @@ cron_user_special_time_entries:
     insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/file-km-alt.anw-km.netz/file-km-alt-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -214,7 +214,6 @@ cron_user_entries:
     job: /root/bin/monitoring/check_ntpsec_service.sh
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -287,7 +286,6 @@ samba_groups:
     group_id: 1190
 
 
-
 samba_user:
 
   - name: advoware
@@ -591,7 +589,6 @@ samba_user:
     password: 'uJ5gF/m53p.P'
 
 
-
   - name: aphex2
     groups:
       - alle

host_vars/file-km.anw-km.netz.yml.BAK.2026-04-18-1218

@@ -1,774 +0,0 @@
----
-
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-
-network_interfaces:
-
-  - device: br0
-    # use only once per device (for the first device entry)
-    headline: br0 - bridge over device enp97s0
-
-    # auto & allow are only used for the first device entry
-    allow: [] # array of allow-[stanzas] eg. allow-hotplug
-    auto: true
-
-    family: inet
-    method: static
-    description:
-    address: 192.168.122.10
-    netmask: 24
-    gateway: 192.168.122.254
-
-    # optional dns settings nameservers: []
-    #
-    #    nameservers:
-    #      - 194.150.168.168  # dns.as250.net
-    #      - 91.239.100.100   # anycast.censurfridns.dk
-    #    search: warenform.de
-    #
-
-    # optional bridge parameters bridge: {}
-    # bridge:
-    #   ports:
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
-    bridge:
-      ports: enp97s0 # for mor devices support a blank separated list
-      stp: !!str off
-      fd: 5
-      hello: 2
-      maxage: 12
-
-    # inline hook scripts
-    pre-up:
-      - !!str "ip link set dev enp97s0 up" # pre-up script lines
-    up: [] #up script lines
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: [] # pre-down script lines (alias for down)
-    down: [] # down script lines
-    post-down: [] # post-down script lines
-
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 192.168.122.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - anw-km.netz
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 172.16.122.254
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart DNS Cache service 'systemd-resolved'"
-    special_time: reboot
-    job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
-    insertafter: PATH
-
-  - name: "Activate ksm support"
-    special_time: reboot
-    job: "echo 1 > /sys/kernel/mm/ksm/run"
-    insertafter: PATH
-
-
-cron_user_entries:
-
-  - name: "Check if SSH service is running. Restart service if needed."
-    minute: '*/5'
-    hour: '*'
-    job: /root/bin/monitoring/check_ssh.sh
-
-  - name: "Check if postfix mailservice is running. Restart service if needed."
-    minute: "*/5"
-    hour: "*"
-    job: /root/bin/monitoring/check_postfix.sh
-
-  - name: "Check Postfix E-Mail LOG file for 'fatal' errors."
-    minute: "*/30"
-    hour: "*"
-    job: /root/bin/postfix/check-postfix-fatal-errors.sh
-
-  - name: "Clean up Samba Trash Dirs"
-    minute: "02"
-    hour: "23"
-    job: /root/bin/samba/clean_samba_trash.sh
-
-  - name: "Set (group and access) Permissons for Samba shares"
-    minute: "14"
-    hour: "23"
-    job: /root/bin/samba/set_permissions_samba_shares.sh
-
-  - name: "Check if ntpsec is running. Restart service if needed."
-    minute: "*/6"
-    hour: "*"
-    job: /root/bin/monitoring/check_ntpsec_service.sh
-
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-sudoers_file_user_back_mount_privileges:
-  - 'ALL=(root) NOPASSWD: /usr/bin/mount'
-  - 'ALL=(root) NOPASSWD: /usr/bin/umount'
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/samba-config-server.yml
-# vars used by roles/common/tasks/samba-user.yml
-# ---
-
-samba_server_ip: 192.168.122.10
-samba_server_cidr_prefix: 24
-
-samba_workgroup: WORKGROUP
-
-samba_netbios_name: FILE-KM
-
-samba_server_min_protocol: !!str NT1
-
-samba_groups:
-  - name: kanzlei
-    group_id: 1100
-  - name: a-jur
-    group_id: 1110
-  - name: intern
-    group_id: 1120
-  - name: wildvang
-    group_id: 1130
-  #- name: aulmann
-  #  group_id: 1130
-  #- name: howe
-  #  group_id: 1140
-  - name: stahmann
-    group_id: 1150
-  - name: traine
-    group_id: 1160
-  - name: public
-    group_id: 1170
-  - name: alle
-    group_id: 1180
-
-
-
-samba_user:
-
-  - name: advoware
-    groups:
-      - advoware
-    password: '9WNRbc49m3'
-
-  - name: a-jur
-    groups:
-      - a-jur
-      - alle
-      - intern
-      - kanzlei
-    password: 'a-jur'
-
-  - name: andrea
-    groups:
-      - advoware
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'fXc3bmK9gj'
-
-  - name: andreas
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - kanzlei
-    password: 'YKQRa.M9-6rL'
-
-  - name: aphex2
-    groups:
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'J3KMRprK9H'
-
-  - name: berenice
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'berenice'
-
-  - name: beuster
-    groups:
-      - advoware
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-      - alle
-    password: 'zlm17Kx'
-
-  - name: buero
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero'
-
-  - name: buero2
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero2'
-
-  - name: buero3
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero3'
-
-  - name: buero4
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero4'
-
-  - name: buero7
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero7'
-
-  - name: chris
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - aulmann
-      - intern
-      - kanzlei
-      - stahmann
-      - traine
-      - public
-    password: !vault |
-          $ANSIBLE_VAULT;1.1;AES256
-          30383265366434633965346530666535363761396165393434643665393137353765653739636364
-          6330623334353763613065343336306434376335646666380a363030363335656261656236636562
-          63663763616630383264303039336562626537366634303636356237323630666635356130383165
-          3837613337343533650a663061366230353531316535656433643162353063383534323833323138
-          3430
-
-  - name: christina
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'qvR7zX4Lhs'
-
-  - name: federico
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'zHfj9g3NcC'
-
-#  - name: gerhard
-#    groups:
-#      - advoware
-#      - alle
-#      - aulmann
-#      - howe
-#      - stahmann
-#      - traine
-#      - public
-#    password: 'bHdhzWnTj9'
-
-  - name: ho-st1
-    groups:
-      - alle
-      - howe
-      - stahmann
-    password: '44-Ro-440'
-
-#  - name: howe-staff-1
-#    groups:
-#      - advoware
-#      - alle
-#      - aulmann
-#      - howe
-#    password: ''
-
-  - name: irina
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'W9NKv39pXW'
-
-  - name: jessica
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'bV3pjPtjkR'
-
-#  - name: laura
-#    groups:
-#      - alle
-#      - aulmann
-#      - howe
-#      - stahmann
-#      - traine
-#    password: '99-Hamburg-990'
-
-  - name: lenovo3
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'fndvLmrt7W'
-
-  - name: lenovo4
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'tpCMmTKj7H'
-
-  - name: lenovo5
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'L5Hannover51'
-
-  - name: lenovo6
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-    password: '66koeln66'
-
-  - name: rm-buero1
-    groups:
-      - advoware
-      - alle
-      - a-jur
-      - kanzlei
-    password: ''
-
-  - name: rm-buero2
-    groups:
-      - advoware
-      - alle
-      - a-jur
-      - kanzlei
-    password: ''
-
-  - name: rolf
-    groups:
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: '4xNVNFXgP4'
-
-  - name: sysadm
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - aulmann
-      - intern
-      - kanzlei
-      - stahmann
-      - traine
-      - public
-    password: 'Ax_GSHh5'
-
-  - name: thomas
-    groups:
-      - advoware
-      - alle
-      - traine
-    password: '55-tho-mas-550'
-
-  - name: Tresen
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - kanzlei
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'maltzwo2'
-
-  - name: wiebke
-    groups:
-      - alle
-      - wildvang
-      - public
-    password: '4xNVNFXgP4'
-
-  - name: winadm
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - intern
-      - kanzlei
-      - public
-    password: 'Ax_GSHh5'
-
-
-
-base_home: /data/home
-
-remove_samba_users:
-  - name: howe-staff-1
-  - name: gerhard
-  - name: laura
-
-#remove_samba_users: []
-#remove_samba_users:
-#  - name: evren
-
-samba_shares:
-
-  - name: a-jur
-    comment: a-jur Dokumente
-    path: /data/samba/a-jur
-    group_valid_users: a-jur
-    group_write_list: a-jur
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: kanzlei
-    comment: Kanzlei auf Fileserver
-    path: /data/samba/kanzlei
-    group_valid_users: kanzlei
-    group_write_list: kanzlei
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: install
-    comment: Install auf Fileserver
-    path: /data/samba/no-backup-shares/install
-    group_valid_users: intern
-    group_write_list: intern
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: false
-
-  - name: wildvang
-    comment: Traine auf Fileserver
-    path: /data/samba/Wildvang
-    group_valid_users: wildvang
-    group_write_list: wildvang
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-#  - name: aulmann
-#    comment: Aulmann auf Fileserver
-#    path: /data/samba/Aulmann
-#    group_valid_users: aulmann
-#    group_write_list: aulmann
-#    file_create_mask: !!str 660
-#    dir_create_mask: !!str 2770
-#    vfs_object_recycle: true
-#    recycle_path: '@Recycle'
-#    vfs_object_recycle_is_visible: true
-
-#  - name: howe
-#    comment: Howe auf Fileserver
-#    path: /data/samba/Howe
-#    group_valid_users: howe
-#    group_write_list: howe
-#    file_create_mask: !!str 660
-#    dir_create_mask: !!str 2770
-#    vfs_object_recycle: true
-#    recycle_path: '@Recycle'
-#    vfs_object_recycle_is_visible: true
-
-  - name: stahmann
-    comment: Stahmann auf Fileserver
-    path: /data/samba/Stahmann
-    group_valid_users: stahmann
-    group_write_list: stahmann
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: traine
-    comment: Traine auf Fileserver
-    path: /data/samba/Traine
-    group_valid_users: traine
-    group_write_list: traine
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: public
-    comment: Public auf Fileserver
-    path: /data/samba/public
-    group_valid_users: public
-    group_write_list: public
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: Advoware-Schriftverkehr
-    comment: Advoware Dokumente
-    path: /data/samba/Advoware-Schriftverkehr
-    group_valid_users: advoware
-    group_write_list: advoware
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: Advoware-Backup
-    comment: Advoware Dokumente
-    path: /data/samba/Advoware-Backup
-    group_valid_users: intern
-    group_write_list: intern
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: false
-
-  - name: alle
-    comment: Alle auf Fileserver
-    path: /data/samba/Alle
-    group_valid_users: alle
-    group_write_list: alle
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-#  - name: web
-#    comment: Web auf Fileserver
-#    path: /data/samba/Web
-#    group_valid_users: web
-#    group_write_list: web
-#    file_create_mask: !!str 660
-#    dir_create_mask: !!str 2770
-#    vfs_object_recycle: true
-#    recycle_path: '@Recycle'
-
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/file-km.anw-km.netz/file-km-common.yml

@@ -4,10 +4,10 @@
 # ---
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -630,7 +630,6 @@ samba_user:
     password: "uJ5gF/m53p.P"
 
 
-
   - name: aphex2
     groups:
       - alle
@@ -843,6 +842,8 @@ samba_shares:
     file_create_mask: !!str 660
     dir_create_mask: !!str 2770
     vfs_object_virusfilter: true
+    vfs_object_virusfilter_include_files:
+      - eml
     vfs_object_recycle: false
 
   - name: eibelshaeuser
@@ -901,6 +902,10 @@ samba_shares:
     file_create_mask: !!str 660
     dir_create_mask: !!str 2770
     vfs_object_virusfilter: true
+    vfs_object_virusfilter_include_files:
+      - eml
+      - exe
+      - msi
     vfs_object_recycle: true
     recycle_path: "@Recycle"
     vfs_object_recycle_is_visible: true
@@ -925,6 +930,9 @@ samba_shares:
     file_create_mask: !!str 660
     dir_create_mask: !!str 2770
     vfs_object_virusfilter: true
+    vfs_object_virusfilter_exclude_files:
+      - docx
+      - pdf
     vfs_object_recycle: true
     recycle_path: "@Recycle"
     vfs_object_recycle_is_visible: true
@@ -949,7 +957,7 @@ samba_shares:
     file_create_mask: !!str 660
     dir_create_mask: !!str 2770
     vfs_object_virusfilter: true
-    vfs_object_recycle: true
+    vfs_object_recycle: false
     recycle_path: "@Recycle"
     vfs_object_recycle_is_visible: false
 
@@ -965,6 +973,16 @@ samba_shares:
     recycle_path: "@Recycle"
     vfs_object_recycle_is_visible: true
 
+  - name: Windows-Server-2025-Backup
+    comment: Windows-Server-2025-Backup  on Fileserver
+    path: /data/samba/Windows-Server-2025-Backup
+    group_valid_users: sysadm
+    group_write_list: sysadm
+    file_create_mask: !!str 664
+    dir_create_mask: !!str 2775
+    guest_ok: !!str yes
+    vfs_object_recycle: false
+
 #  - name: web
 #    comment: Web auf Fileserver
 #    path: /data/samba/Web

host_vars/formbricks-nd.oopen.de/formbricks-nd-common.yml

@@ -132,7 +132,6 @@ cron_user_entries:
     job: /root/bin/monitoring/check_ssh.sh
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -197,4 +196,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/g.mx.oopen.de/g.mx-common.yml

@@ -105,14 +105,14 @@ resolved_fallback_nameserver:
 #
 # root_ssh_keypair:
 #  - name: id-rsa-dehydrated
-#    priv_key_src: b.mx/root/.ssh/b.mx-id_rsa-dehydrated
+#    priv_key_src: g.mx.oopen.de/root/.ssh/b.mx-id_rsa-dehydrated
 #    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-#    pub_key_src: b.mx/root/.ssh/b.mx-id_rsa-dehydrated.pub
+#    pub_key_src: g.mx.oopen.de/root/.ssh/b.mx-id_rsa-dehydrated.pub
 #    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
 #  - name: id-rsa-opendkim
-#    priv_key_src: b.mx/root/.ssh/b.mx-id_rsa-opendkim
+#    priv_key_src: g.mx.oopen.de/root/.ssh/b.mx-id_rsa-opendkim
 #    priv_key_dest: /root/.ssh/id_rsa-opendkim
-#    pub_key_src: b.mx/root/.ssh/b.mx-id_rsa-opendkim.pub
+#    pub_key_src: g.mx.oopen.de/root/.ssh/b.mx-id_rsa-opendkim.pub
 #    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
 
 
@@ -149,42 +149,6 @@ resolved_fallback_nameserver:
 # vars used by roles/common/tasks/copy_files.yml
 # ---
 
-copy_plain_files:
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: g.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: g.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfix_host_specific:
-
-  - name: relay_domains
-    src_path: g.mx/etc/postfix/relay_domains
-    dest_path: /etc/postfix/relay_domains
-
-
-copy_plain_files_postfwd_host_specific:
-
-  # Postfix Firewall postfwd
-  #
-  - name: postfwd.wl-nets
-    src_path: g.mx/etc/postfix/postfwd.wl-nets
-    dest_path: /etc/postfix/postfwd.wl-nets
-
-
-copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-
 
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml

host_vars/ga-al-gw.oopen.de/ga-al-gw-common.yml

@@ -5,10 +5,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -482,7 +482,6 @@ bind9_gateway_acl:
       - 192.168.10.2
 
 
-
 bind9_gateway_listen_on_v6:
   - none
 
@@ -529,4 +528,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-al-kvm2.ga.netz/ga-al-kvm2-common.yml

@@ -82,8 +82,8 @@ default_user:
 
 sudo_users:
   - chris
-  - maadmin
   - sysadm
+  - maadmin
   - wadmin
 
 
@@ -123,7 +123,6 @@ sshd_permit_root_login: !!str "prohibit-password"
 # ---
 
 
-
 # ==============================
 
 

host_vars/ga-al-kvm3.ga.netz/ga-al-kvm3-common.yml

@@ -82,9 +82,9 @@ default_user:
 
 sudo_users:
   - chris
+  - maadmin
   - sysadm
   - wadmin
-  - maadmin
 
 
 # ---
@@ -123,7 +123,6 @@ sshd_permit_root_login: !!str "prohibit-password"
 # ---
 
 
-
 # ==============================
 
 

host_vars/ga-al-relay.ga.netz/ga-al-relay-common.yml

@@ -163,14 +163,14 @@ insert_root_ssh_keypair: true
 
 root_ssh_keypair:
   - name: id-rsa-dehydrated
-    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated
+    priv_key_src: ga-al-relay.ga.netz/root/.ssh/ga-st-mail-id_rsa-dehydrated
     priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
+    pub_key_src: ga-al-relay.ga.netz/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
     pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
   - name: id-rsa-opendkim
-    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim
+    priv_key_src: ga-al-relay.ga.netz/root/.ssh/ga-st-mail-id_rsa-opendkim
     priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
+    pub_key_src: ga-al-relay.ga.netz/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
     pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
 
 
@@ -233,7 +233,6 @@ bind9_gateway_acl:
       - 192.168.10.2
 
 
-
 bind9_gateway_listen_on_v6:
   - none
 
@@ -273,21 +272,6 @@ bind9_gateway_allow_recursion:
 # ---
 
 
-copy_plain_files_postfix_host_specific:
-
-  - name: relay_domains
-    src_path: ga-al-relay/etc/postfix/relay_domains
-    dest_path: /etc/postfix/relay_domains
-
-
-copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-
-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---
@@ -301,7 +285,6 @@ is_relay_host: !!str "false"
 sasl_auth_enable: !!str "yes"
 
 
-
 template_files_mailsystem_script:
 
   - name: mailsystem_install_postfix_advanced.conf

host_vars/ga-campus-gw-temp.ga.netz/ga-campus-gw-temp-common.yml

@@ -5,10 +5,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -45,7 +45,6 @@ network_interfaces:
       - /sbin/ip route add 10.9.131.0/24 via 192.168.100.253
 
 
-
   - device: eno3
     family: inet
     method: manual
@@ -109,7 +108,6 @@ network_interfaces:
     netmask: 24
 
 
-
 # ---
 # vars used by roles/ansible_dependencies
 # ---
@@ -391,4 +389,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-gh-gw.oopen.de/ga-gh-gw-common.yml

@@ -5,10 +5,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -404,4 +404,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-nh-gw.oopen.de/ga-nh-gw-common.yml

@@ -5,10 +5,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -408,4 +408,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-st-gw-ersatz.ga.netz/ga-st-gw-ersatz-common.yml

@@ -102,7 +102,6 @@ resolved_fallback_nameserver:
   - 127.0.0.1
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -285,4 +284,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-st-gw-neu.ga.netz.yml.00

@@ -1,591 +0,0 @@
----
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-network_interfaces:
-
-  - device: eno1np0
-    headline: eno1np0 - Temporary LAN network
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.18
-    netmask: 24
-
-  - device: enp129s0f2
-    headline: enp129s0f2 - Uplink static line (radio) to Altenschlirf
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.111.254
-    netmask: 24
-    up:
-      # - For management Antennas
-      - /sbin/ip link add link enp129s0f2 name enp129s0f2.111 type vlan id 111
-    post-up:
-      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
-      # -
-      # - Telefon Altenshlirf
-      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
-      # User Network Altenshlirf
-      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
-      # Management Network Altenschlirf
-      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
-      # WLan Router (Accesspoints) Altenshlirf
-      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
-      # # WLan Networks Altenshlirf
-      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
-      # DSL via Fritzbox Altenschlirf
-      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
-      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
-      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
-      # VPN home Network Altenschlirf
-      #
-      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
-      # VPN 'gw-ckubu' Network Altenschlirf
-      #
-      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
-      # private networks 'ckubu'
-      #
-      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
-      # so we route them back to that gateway..
-      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
-      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
-
-
-  - device: enp129s0f2.111
-    headline: enp129s0f2.111 - network 10.10.111.0 (management antennas)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.111.254
-    netmask: 24
-
-
-  - device: enp1s0f0 
-    headline: enp1s0f0 - holds VLAN 211 device for Network Telefons Stockhausen
-    auto: false
-    family: inet
-    method: manual
-    up:
-      - /sbin/ip link add link enp1s0f0 name enp1s0f0.211 type vlan id 211
-
-
-  - device: enp1s0f0.211
-    headline: enp1s0f0.211 - Network Telefons Stockhausen
-    auto: true
-    family: inet
-    method: static
-    # Note:
-    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
-    #       This LANCom Router IS NOT pngable                                 !!
-    address: 172.16.211.1
-    netmask: 24
-    pre-up:
-      - /sbin/ifconfig enp1s0f0 up
-
-
-  - device: enp1s0f2
-    headline: enp1s0f2 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.11.1
-    netmask: 24
-    gateway: 172.16.11.254
-
-
-  - device: enp1s0f3
-    headline: enp1s0f3 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.13.1
-    netmask: 24
-    gateway: 172.16.13.254
-
-
-  - device: enp1s0f1
-    headline: enp1s0f1 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.12.1
-    netmask: 24
-    gateway: 172.16.12.254
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond0
-    headline: bond0 - LAG (Link Aggregation) on devices enp129s0f0 and enp194s0f0
-    auto: true
-    family: inet
-    method: static
-    address: 10.1.9.254
-    netmask: 24
-    bond:
-      slaves: enp129s0f0 enp194s0f0
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
-      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
-      # VLAN 78 for network Georgshaus 192.168.78.0/24
-      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
-
-
-  - device: bond0.11
-    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.11.254
-    netmask: 24
-
-
-  - device: bond0.78
-    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.78.254
-    netmask: 24
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond1
-    headline: bond1 - LAG (Link Aggregation) on devices enp129s0f1 and enp194s0f1 - Main Network Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.254
-    netmask: 24
-    nameservers:
-      - 192.168.11.1
-      - 192.168.10.3
-    search: ga.netz ga.intra
-    bond:
-      slaves: enp129s0f1 enp194s0f1
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints
-      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
-      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
-      # Route ???
-      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
-      # Route to management network campus
-      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
-      # Route to LAN campus
-      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
-      # Route to WLAN campus
-      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
-
-
-  - device: bond1.121
-    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.121.15.254
-    netmask: 20
-
-
-  - device: bond1.131
-    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.131.15.254
-    netmask: 20
-
-
-  - device: bond1:ns
-    headline: bond1:ns - Alias IP on bond1 device for Nameservice
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.1
-    netmask: 32
-
-
-  - device: bond1:1
-    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.9.254
-    netmask: 24
-
-
-  - device: bond1:ap
-    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
-    auto: true
-    family: inet
-    method: static
-    address: 10.112.1.254
-    netmask: 24
-    post-up:
-      # - Wireless Networks routed through appropriate Accesspoints
-      # -
-      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
-      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
-      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
-      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
-      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
-      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
-      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
-      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
-      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
-      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
-      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
-      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
-      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
-      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
-      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
-
-
-  - device: bond1:ipmi
-    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 10.11.11.254
-    netmask: 24
-
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 127.0.0.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - ga.netz
-  - ga.intra
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 192.168.10.1
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-insert_ssh_keypair_backup_server: false
-ssh_keypair_backup_server:
-  - name: backup
-    backup_user: back
-    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
-    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
-    pub_key_dest: /root/.ssh/id_rsa.pub
-
-insert_keypair_backup_client: true
-ssh_keypair_backup_client:
-  - name: backup
-    priv_key_src: root/.ssh/id_ed25519.oopen-server
-    priv_key_dest: /root/.ssh/id_ed25519
-    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
-    pub_key_dest: /root/.ssh/id_ed25519.pub
-    target: backup.oopen.de
-
-default_user:
-
-  - name: chris
-    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: maadmin
-    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-
-  - name: wadmin
-    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - maadmin
-  - wadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-bind9_gateway_acl:
-  - local-net:
-    name: local-net
-    entries:
-      - 127.0.0.0/8
-      - 172.16.0.0/12
-      - 192.168.0.0/16
-      - 10.0.0.0/8
-      - fc00::/7
-      - fe80::/10
-      - ::1/128
-  - internaldns:
-    name: internaldns
-    entries:
-      - '# Nameserver Gateway Stockhausen'
-      - 192.168.11.1
-      - '# Domain Controller Stockhausen'
-      - 192.168.10.3
-      - '# Nameserver Gateway Altenschlirf'
-      - 192.168.10.1
-      - '# Domain Controller Altenschlirf'
-      - 192.168.10.3
-      - 192.168.10.6
-      - 172.16.0.1
-      - '# Nameserver Gateway Novalishaus'
-      - 192.168.81.1
-      - 10.2.11.2
-      - '# Nameserver wolle'
-      - 10.113.12.3
-      - '# Postfix Mailserver'
-      - 192.168.11.2
-      - '# Mail Relay System'
-      - 192.168.10.2
-
-bind9_gateway_listen_on_v6:
-   - none
-
-bind9_gateway_listen_on:
-  - any
-
-#bind9_gateway_allow_transfer: {}
-bind9_gateway_allow_transfer:
-   - internaldns
-
-bind9_transfer_source:  !!str "192.168.11.1"
-bind9_notify_source: !!str "192.168.11.1"
-
-#bind9_gateway_allow_query: {}
-bind9_gateway_allow_query:
-  - local-net
-
-#bind9_gateway_allow_query_cache: {}
-bind9_gateway_allow_query_cache:
-  - local-net
-
-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
-bind9_gateway_allow_recursion:
-  - local-net
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-st-gw-neu.ga.netz.yml.01

@@ -1,592 +0,0 @@
----
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-network_interfaces:
-
-  - device: lan0
-    headline: lan0 - Temporary LAN network
-    auto: false
-    family: inet
-    method: static
-    address: 192.168.11.18
-    gateway: 192.168.11.254
-    netmask: 24
-
-  - device: lan4
-    headline: lan4 - Uplink static line (radio) to Altenschlirf
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.111.254
-    netmask: 24
-    up:
-      # - For management Antennas
-      - /sbin/ip link add link lan4 name lan4.111 type vlan id 111
-    post-up:
-      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
-      # -
-      # - Telefon Altenshlirf
-      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
-      # User Network Altenshlirf
-      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
-      # Management Network Altenschlirf
-      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
-      # WLan Router (Accesspoints) Altenshlirf
-      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
-      # # WLan Networks Altenshlirf
-      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
-      # DSL via Fritzbox Altenschlirf
-      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
-      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
-      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
-      # VPN home Network Altenschlirf
-      #
-      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
-      # VPN 'gw-ckubu' Network Altenschlirf
-      #
-      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
-      # private networks 'ckubu'
-      #
-      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
-      # so we route them back to that gateway..
-      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
-      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
-
-
-  - device: lan4.111
-    headline: lan4.111 - network 10.10.111.0 (management antennas)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.111.254
-    netmask: 24
-
-
-  - device: lan6 
-    headline: lan6 - holds VLAN 211 device for Network Telefons Stockhausen
-    auto: false
-    family: inet
-    method: manual
-    up:
-      - /sbin/ip link add link lan6 name lan6.211 type vlan id 211
-
-
-  - device: lan6.211
-    headline: lan6.211 - Network Telefons Stockhausen
-    auto: true
-    family: inet
-    method: static
-    # Note:
-    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
-    #       This LANCom Router IS NOT pngable                                 !!
-    address: 172.16.211.1
-    netmask: 24
-    pre-up:
-      - /sbin/ifconfig lan6 up
-
-
-  - device: lan8
-    headline: lan8 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.11.1
-    netmask: 24
-    gateway: 172.16.11.254
-
-
-  - device: lan9
-    headline: lan9 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.13.1
-    netmask: 24
-    gateway: 172.16.13.254
-
-
-  - device: lan7
-    headline: lan7 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.12.1
-    netmask: 24
-    gateway: 172.16.12.254
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond0
-    headline: bond0 - LAG (Link Aggregation) on devices lan2 and lan10
-    auto: true
-    family: inet
-    method: static
-    address: 10.1.9.254
-    netmask: 24
-    bond:
-      slaves: lan2 lan10
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
-      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
-      # VLAN 78 for network Georgshaus 192.168.78.0/24
-      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
-
-
-  - device: bond0.11
-    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.11.254
-    netmask: 24
-
-
-  - device: bond0.78
-    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.78.254
-    netmask: 24
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond1
-    headline: bond1 - LAG (Link Aggregation) on devices lan3 and lan11 - Main Network Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.254
-    netmask: 24
-    nameservers:
-      - 192.168.11.1
-      - 192.168.10.3
-    search: ga.netz ga.intra
-    bond:
-      slaves: lan3 lan11
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints
-      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
-      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
-      # Route ???
-      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
-      # Route to management network campus
-      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
-      # Route to LAN campus
-      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
-      # Route to WLAN campus
-      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
-
-
-  - device: bond1.121
-    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.121.15.254
-    netmask: 20
-
-
-  - device: bond1.131
-    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.131.15.254
-    netmask: 20
-
-
-  - device: bond1:ns
-    headline: bond1:ns - Alias IP on bond1 device for Nameservice
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.1
-    netmask: 32
-
-
-  - device: bond1:1
-    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.9.254
-    netmask: 24
-
-
-  - device: bond1:ap
-    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
-    auto: true
-    family: inet
-    method: static
-    address: 10.112.1.254
-    netmask: 24
-    post-up:
-      # - Wireless Networks routed through appropriate Accesspoints
-      # -
-      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
-      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
-      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
-      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
-      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
-      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
-      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
-      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
-      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
-      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
-      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
-      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
-      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
-      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
-      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
-
-
-  - device: bond1:ipmi
-    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 10.11.11.254
-    netmask: 24
-
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 127.0.0.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - ga.netz
-  - ga.intra
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 192.168.10.1
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-insert_ssh_keypair_backup_server: false
-ssh_keypair_backup_server:
-  - name: backup
-    backup_user: back
-    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
-    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
-    pub_key_dest: /root/.ssh/id_rsa.pub
-
-insert_keypair_backup_client: true
-ssh_keypair_backup_client:
-  - name: backup
-    priv_key_src: root/.ssh/id_ed25519.oopen-server
-    priv_key_dest: /root/.ssh/id_ed25519
-    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
-    pub_key_dest: /root/.ssh/id_ed25519.pub
-    target: backup.oopen.de
-
-default_user:
-
-  - name: chris
-    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: maadmin
-    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-
-  - name: wadmin
-    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - maadmin
-  - wadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-bind9_gateway_acl:
-  - local-net:
-    name: local-net
-    entries:
-      - 127.0.0.0/8
-      - 172.16.0.0/12
-      - 192.168.0.0/16
-      - 10.0.0.0/8
-      - fc00::/7
-      - fe80::/10
-      - ::1/128
-  - internaldns:
-    name: internaldns
-    entries:
-      - '# Nameserver Gateway Stockhausen'
-      - 192.168.11.1
-      - '# Domain Controller Stockhausen'
-      - 192.168.10.3
-      - '# Nameserver Gateway Altenschlirf'
-      - 192.168.10.1
-      - '# Domain Controller Altenschlirf'
-      - 192.168.10.3
-      - 192.168.10.6
-      - 172.16.0.1
-      - '# Nameserver Gateway Novalishaus'
-      - 192.168.81.1
-      - 10.2.11.2
-      - '# Nameserver wolle'
-      - 10.113.12.3
-      - '# Postfix Mailserver'
-      - 192.168.11.2
-      - '# Mail Relay System'
-      - 192.168.10.2
-
-bind9_gateway_listen_on_v6:
-   - none
-
-bind9_gateway_listen_on:
-  - any
-
-#bind9_gateway_allow_transfer: {}
-bind9_gateway_allow_transfer:
-   - internaldns
-
-bind9_transfer_source:  !!str "192.168.11.1"
-bind9_notify_source: !!str "192.168.11.1"
-
-#bind9_gateway_allow_query: {}
-bind9_gateway_allow_query:
-  - local-net
-
-#bind9_gateway_allow_query_cache: {}
-bind9_gateway_allow_query_cache:
-  - local-net
-
-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
-bind9_gateway_allow_recursion:
-  - local-net
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-st-gw.ga.netz.yml.00

@@ -1,583 +0,0 @@
----
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-network_interfaces:
-
-  - device: eth2
-    headline: eth2 - Uplink static line (radio) to Altenschlirf
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.111.254
-    netmask: 24
-    up:
-      # - For management Antennas
-      - /sbin/ip link add link eth2 name eth2.111 type vlan id 111
-    post-up:
-      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
-      # -
-      # - Telefon Altenshlirf
-      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
-      # User Network Altenshlirf
-      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
-      # Management Network Altenschlirf
-      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
-      # WLan Router (Accesspoints) Altenshlirf
-      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
-      # # WLan Networks Altenshlirf
-      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
-      # DSL via Fritzbox Altenschlirf
-      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
-      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
-      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
-      # VPN home Network Altenschlirf
-      #
-      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
-      # VPN 'gw-ckubu' Network Altenschlirf
-      #
-      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
-      # private networks 'ckubu'
-      #
-      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
-      # so we route them back to that gateway..
-      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
-      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
-
-
-  - device: eth2.111
-    headline: eth2.111 - network 10.10.111.0 (management antennas)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.111.254
-    netmask: 24
-
-
-  - device: eth8 
-    headline: eth8 - holds VLAN 211 device for Network Telefons Stockhausen
-    auto: false
-    family: inet
-    method: manual
-    up:
-      - /sbin/ip link add link eth8 name eth8.211 type vlan id 211
-
-
-  - device: eth8.211
-    headline: eth8.211 - Network Telefons Stockhausen
-    auto: true
-    family: inet
-    method: static
-    # Note:
-    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
-    #       This LANCom Router IS NOT pngable                                 !!
-    address: 172.16.211.1
-    netmask: 24
-    pre-up:
-      - /sbin/ifconfig eth8 up
-
-
-  - device: eth9
-    headline: eth9 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.11.1
-    netmask: 24
-    gateway: 172.16.11.254
-
-
-  - device: eth10
-    headline: eth10 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.13.1
-    netmask: 24
-    gateway: 172.16.13.254
-
-
-  - device: eth11
-    headline: eth11 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.12.1
-    netmask: 24
-    gateway: 172.16.12.254
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond0
-    headline: bond0 - LAG (Link Aggregation) on devices eth0 and eth4
-    auto: true
-    family: inet
-    method: static
-    address: 10.1.9.254
-    netmask: 24
-    bond:
-      slaves: eth0 eth4
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
-      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
-      # VLAN 78 for network Georgshaus 192.168.78.0/24
-      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
-
-
-  - device: bond0.11
-    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.11.254
-    netmask: 24
-
-
-  - device: bond0.78
-    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.78.254
-    netmask: 24
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond1
-    headline: bond1 - LAG (Link Aggregation) on devices eth3 and eth5 - Main Network Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.254
-    netmask: 24
-    nameservers:
-      - 192.168.11.1
-      - 192.168.10.3
-    search: ga.netz ga.intra
-    bond:
-      slaves: eth3 eth5
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints
-      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
-      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
-      # Route ???
-      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
-      # Route to management network campus
-      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
-      # Route to LAN campus
-      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
-      # Route to WLAN campus
-      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
-
-
-  - device: bond1.121
-    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.121.15.254
-    netmask: 20
-
-
-  - device: bond1.131
-    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.131.15.254
-    netmask: 20
-
-
-  - device: bond1:ns
-    headline: bond1:ns - Alias IP on bond1 device for Nameservice
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.1
-    netmask: 32
-
-
-  - device: bond1:1
-    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.9.254
-    netmask: 24
-
-
-  - device: bond1:ap
-    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
-    auto: true
-    family: inet
-    method: static
-    address: 10.112.1.254
-    netmask: 24
-    post-up:
-      # - Wireless Networks routed through appropriate Accesspoints
-      # -
-      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
-      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
-      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
-      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
-      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
-      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
-      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
-      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
-      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
-      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
-      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
-      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
-      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
-      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
-      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
-
-
-  - device: bond1:ipmi
-    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 10.11.11.254
-    netmask: 24
-
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 127.0.0.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - ga.netz
-  - ga.intra
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 192.168.10.1
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-insert_ssh_keypair_backup_server: false
-ssh_keypair_backup_server:
-  - name: backup
-    backup_user: back
-    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
-    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
-    pub_key_dest: /root/.ssh/id_rsa.pub
-
-insert_keypair_backup_client: true
-ssh_keypair_backup_client:
-  - name: backup
-    priv_key_src: root/.ssh/id_ed25519.oopen-server
-    priv_key_dest: /root/.ssh/id_ed25519
-    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
-    pub_key_dest: /root/.ssh/id_ed25519.pub
-    target: backup.oopen.de
-
-default_user:
-
-  - name: chris
-    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: maadmin
-    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-
-  - name: wadmin
-    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - maadmin
-  - wadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-bind9_gateway_acl:
-  - local-net:
-    name: local-net
-    entries:
-      - 127.0.0.0/8
-      - 172.16.0.0/12
-      - 192.168.0.0/16
-      - 10.0.0.0/8
-      - fc00::/7
-      - fe80::/10
-      - ::1/128
-  - internaldns:
-    name: internaldns
-    entries:
-      - '# Nameserver Gateway Stockhausen'
-      - 192.168.11.1
-      - '# Domain Controller Stockhausen'
-      - 192.168.10.3
-      - '# Nameserver Gateway Altenschlirf'
-      - 192.168.10.1
-      - '# Domain Controller Altenschlirf'
-      - 192.168.10.3
-      - 192.168.10.6
-      - 172.16.0.1
-      - '# Nameserver Gateway Novalishaus'
-      - 192.168.81.1
-      - 10.2.11.2
-      - '# Nameserver wolle'
-      - 10.113.12.3
-      - '# Postfix Mailserver'
-      - 192.168.11.2
-      - '# Mail Relay System'
-      - 192.168.10.2
-
-bind9_gateway_listen_on_v6:
-   - none
-
-bind9_gateway_listen_on:
-  - any
-
-#bind9_gateway_allow_transfer: {}
-bind9_gateway_allow_transfer:
-   - internaldns
-
-bind9_transfer_source:  !!str "192.168.11.1"
-bind9_notify_source: !!str "192.168.11.1"
-
-#bind9_gateway_allow_query: {}
-bind9_gateway_allow_query:
-  - local-net
-
-#bind9_gateway_allow_query_cache: {}
-bind9_gateway_allow_query_cache:
-  - local-net
-
-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
-bind9_gateway_allow_recursion:
-  - local-net
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-st-gw.ga.netz/ga-st-gw-common.yml

@@ -5,10 +5,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -451,7 +451,6 @@ cron_user_special_time_entries:
     insertafter: PATH
 
 
-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -632,4 +631,3 @@ git_firewall_repository:
 root_user:
   name: root
   password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/ga-st-kvm1.ga.netz/ga-st-kvm1-common.yml

@@ -83,8 +83,8 @@ default_user:
 sudo_users:
   - chris
   - sysadm
-  - maadmin
   - wadmin
+  - maadmin
 
 
 # ---
@@ -123,7 +123,6 @@ sshd_permit_root_login: !!str "prohibit-password"
 # ---
 
 
-
 # ==============================
 
 

host_vars/ga-st-kvm5.ga.netz/ga-st-kvm5-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -195,7 +195,6 @@ sshd_permit_root_login: !!str "prohibit-password"
 # ---
 
 
-
 # ==============================
 
 

host_vars/ga-st-lxc1.ga.netz/ga-st-lxc1-common.yml

@@ -6,10 +6,10 @@
 
 
 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true
 
 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false
 
 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -311,4 +311,3 @@ sudo_users:
 # ---
 
 root_user: {}
-

host_vars/ga-st-mail.ga.netz/ga-st-mail-common.yml

@@ -108,14 +108,14 @@ insert_root_ssh_keypair: true
 
 root_ssh_keypair:
   - name: id-rsa-dehydrated
-    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated
+    priv_key_src: ga-st-mail.ga.netz/root/.ssh/ga-st-mail-id_rsa-dehydrated
     priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
+    pub_key_src: ga-st-mail.ga.netz/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
     pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
   - name: id-rsa-opendkim
-    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim
+    priv_key_src: ga-st-mail.ga.netz/root/.ssh/ga-st-mail-id_rsa-opendkim
     priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
+    pub_key_src: ga-st-mail.ga.netz/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
     pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
 
 default_user:
@@ -206,49 +206,6 @@ sudo_users:
 # vars used by roles/common/tasks/copy_files.yml
 # ---
 
-copy_plain_files:
-
-  # /root/bin/monitoring
-  #
-  - name: monitoring_check_cert_for_dovecot.conf
-    src_path: ga-st-mail/root/bin/monitoring/conf/check_cert_for_dovecot.conf
-    dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: ga-st-mail/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_postfix_add_mailboxes.conf
-    src_path: ga-st-mail/root/bin/postfix/conf/postfix_add_mailboxes.conf
-    dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
-
-  - name: postfix_sent_userinfo_postfix.conf
-    src_path: ga-st-mail/root/bin/postfix/conf/sent_userinfo_postfix.conf
-    dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: ga-st-mail/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfwd_host_specific:
-
-  # Postfix Firewall postfwd
-  #
-  - name: postfwd.wl-user
-    src_path: ga-st-mail/etc/postfix/postfwd.cf
-    dest_path: /etc/postfix/postfwd.cf
-
-
-#copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-
 
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -282,31 +239,33 @@ si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07e
 #
 website_name_postfixadmin: adm.gemeinschaft-altenschlirf.de
 
-email_welcome_message: "\n
+email_welcome_message: |
-Hallo,\n
 
-Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+  Hallo,
 
-IT Team Gemeinschaft Altenschlirf\n
+  Ihre/Deine neue E-Mail Adresse ist eingerichtet.
 
---\n
+  IT Team Gemeinschaft Altenschlirf
-Gemeinschaft Altenschlirf  |   Phone:  +49 6647 / 9606 0\n
+
-Müser Straße 1             |   Fax:    +49 6647 / 9606 179\n
+  --
-D-36358 Herbstein          |   E-Mail: it@gemeinschaft-altenschlirf.de\n
+
-"
+  Gemeinschaft Altenschlirf  |   Phone:  +49 6647 / 9606 0
+  Müser Straße 1             |   Fax:    +49 6647 / 9606 179
+  D-36358 Herbstein          |   E-Mail: it@gemeinschaft-altenschlirf.de
 
 # install_update_dovecot.conf
 #
 dovecot_from_address: "Administrator E-Mail <postmaster@gemeinschaft-altenschlirf.de>"
 dovecot_reply_to: "postmaster@gemeinschaft-altenschlirf.de"
 webmailer_address: "https://webmail.gemeinschaft-altenschlirf.de"
-salutation: "IT Team Gemeinschaft Altenschlirf\n
+salutation: |
+  IT Team Gemeinschaft Altenschlirf
 
---\n
+  --
-Gemeinschaft Altenschlirf  |   Phone:  +49 6647 / 9606 0\n
+
-Müser Straße 1             |   Fax:    +49 6647 / 9606 179\n
+  Gemeinschaft Altenschlirf  |   Phone:  +49 6647 / 9606 0
-D-36358 Herbstein          |   E-Mail: it@gemeinschaft-altenschlirf.de\n
+  Müser Straße 1             |   Fax:    +49 6647 / 9606 179
-"
+  D-36358 Herbstein          |   E-Mail: it@gemeinschaft-altenschlirf.de
 
 # install_upgrade_roundcube-webmail.conf
 #

host_vars/ga-st-mm.ga.netz/ga-st-mm-common.yml

@@ -209,7 +209,6 @@ sudo_users:
 # ---
 
 
-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---

host_vars/ga-st-services.ga.netz/ga-st-services-common.yml

@@ -207,7 +207,6 @@ sudo_users:
 #    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
 
 
-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---