Add support of insecure wide links

ansible-dependencies-ububtu-noble-sudo.yml

@@ -0,0 +1,8 @@
+---
+
+- hosts: initial_setup
+  gather_facts: false
+
+  roles:
+     - ansible_dependencies-ubuntu-noble
+     - ansible_user_debian

environments/ubuntu-server/files

@@ -0,0 +1 @@
+../../files

environments/ubuntu-server/inventory

@@ -0,0 +1,37 @@
+[ansible_dependencies]
+formbricks-nd.oopen.de
+
+[initial_setup]
+formbricks-nd.oopen.de
+
+[lxc_guest]
+formbricks-nd.oopen.de
+
+
+[lxc_host]
+
+
+
+[docker_host]
+
+[kvm_host]
+
+[oopen_office_server]
+
+[samba_server]
+
+[jitsi_meet_server]
+
+[mysql_server]
+
+[postgresql_server]
+
+[apache2_webserver]
+
+[nextcloud_server]
+
+[dns_server]
+
+[mail_server]
+
+[webadmin]

files/homedirs/back/_bashrc

@@ -111,3 +111,7 @@ export EDITOR=vim
 ## - set beep more quiet
 ## -
 #xset b 10 500 50
+
+# turn off the beep (only in bash tab-complete ?)
+# only if interactiv shell
+[[ "$-" =~ "i" ]] && bind 'set bell-style none'

files/homedirs/back/_vimrc

@@ -171,3 +171,4 @@ set statusline=\ %F\ %(\|\ flags:\ %R%M%H%W\ %)%(\|\ type:\ %Y\ %)%(\|\ format:\
 set laststatus=2
 highlight StatusLine cterm=none ctermfg=white ctermbg=blue
 
+set belloff=all

files/homedirs/chris/.vimrc

@@ -1,178 +0,0 @@
-" An example for a vimrc file.
-"
-" Maintainer:   Bram Moolenaar <Bram@vim.org>
-" Last change:  1999 Sep 09
-"
-" To use it, copy it to
-"     for Unix and OS/2:  ~/.vimrc
-"             for Amiga:  s:.vimrc
-"  for MS-DOS and Win32:  $VIM\_vimrc
-
-" This line should not be removed as it ensures that various options are
-" properly set to work with the Vim-related packages available in Debian.
-runtime! debian.vim
-
-set nocompatible        " Use Vim defaults (much better!)
-set bs=2                " allow backspacing over everything in insert mode
-set ai                  " always set autoindenting on
-" set backup            " keep a backup file
-"set viminfo='20,\"50    " read/write a .viminfo file, don't store more
-                        " than 50 lines of registers
-set viminfo='20,\"50,:20,%,n~/.viminfo
-set history=50          " keep 50 lines of command line history
-set ruler               " show the cursor position all the time
-set ignorecase          " suchen case-insenitiv
-set showmatch           " zeige passende klammern
-set shell=/bin/bash     " shell to start with !
-set expandtab           " tabs --> blanks
-set showmode            " anzeige INSERT/REPLACE/...
-
-" set smartcase           " Do smart case matching
-
-set incsearch           " Incremental search
-                        " Start searching when you type the first character of 
-                        " the search string. As you type in more characters, the 
-                        " search is refined.
-
-set t_Co=256            " To enable 256 colors in vim, put this your .vimrc before setting the colorscheme
-
-" einrueckung
-"set noexpandtab
-set expandtab
-set shiftwidth=3
-set tabstop=3
-set softtabstop=3
-" Round indent to multiple of 'shiftwidth' for > and < commands
-set shiftround
-"set number
-
-" For Win32 GUI: remove 't' flag from 'guioptions': no tearoff menu entries
-" let &guioptions = substitute(&guioptions, "t", "", "g")
-
-" Don't use Ex mode, use Q for formatting
-map Q gq
-
-" Make p in isual Visual mode replace the selected text with the "" register.
-vnoremap p <Esc>:let current_reg = @"<CR>gvdi<C-R>=current_reg<CR><Esc>
-
-" Switch syntax highlighting on, when the terminal has colors
-" Also switch on highlighting the last used search pattern.
-if &t_Co > 2 || has("gui_running")
-  syntax on
-  set hlsearch
-endif
-
-" Only do this part when compiled with support for autocommands.
-if has("autocmd")
-
-" In text files, always limit the width of text to 78 characters
- autocmd BufRead *.txt set tw=78
-
- augroup cprog
-  " Remove all cprog autocommands
-  au!
-
-  " When starting to edit a file:
-  "   For C and C++ files set formatting of comments and set C-indenting on.
-  "   For other files switch it off.
-  "   Don't change the order, it's important that the line with * comes first.
-  autocmd FileType *      set formatoptions=tcql nocindent comments&
-  autocmd FileType c,cpp  set formatoptions=croql cindent comments=sr:/*,mb:*,el:*/,://
- augroup END
-
- augroup gzip
-  " Remove all gzip autocommands
-  au!
-
-  " Enable editing of gzipped files
-  " set binary mode before reading the file
-  autocmd BufReadPre,FileReadPre        *.gz,*.bz2 set bin
-  autocmd BufReadPost,FileReadPost      *.gz call GZIP_read("gunzip")
-  autocmd BufReadPost,FileReadPost      *.bz2 call GZIP_read("bunzip2")
-  autocmd BufWritePost,FileWritePost    *.gz call GZIP_write("gzip")
-  autocmd BufWritePost,FileWritePost    *.bz2 call GZIP_write("bzip2")
-  autocmd FileAppendPre                 *.gz call GZIP_appre("gunzip")
-  autocmd FileAppendPre                 *.bz2 call GZIP_appre("bunzip2")
-  autocmd FileAppendPost                *.gz call GZIP_write("gzip")
-  autocmd FileAppendPost                *.bz2 call GZIP_write("bzip2")
-
-  " After reading compressed file: Uncompress text in buffer with "cmd"
-  fun! GZIP_read(cmd)
-    let ch_save = &ch
-    set ch=2
-    execute "'[,']!" . a:cmd
-    set nobin
-    let &ch = ch_save
-    execute ":doautocmd BufReadPost " . expand("%:r")
-  endfun
-
-  " After writing compressed file: Compress written file with "cmd"
-  fun! GZIP_write(cmd)
-    if rename(expand("<afile>"), expand("<afile>:r")) == 0
-      execute "!" . a:cmd . " <afile>:r"
-    endif
-  endfun
-
-  " Before appending to compressed file: Uncompress file with "cmd"
-  fun! GZIP_appre(cmd)
-    execute "!" . a:cmd . " <afile>"
-    call rename(expand("<afile>:r"), expand("<afile>"))
-  endfun
-
- augroup END
-
- " This is disabled, because it changes the jumplist.  Can't use CTRL-O to go
- " back to positions in previous files more than once.
- if 0
-  " When editing a file, always jump to the last cursor position.
-  " This must be after the uncompress commands.
-   autocmd BufReadPost * if line("'\"") && line("'\"") <= line("$") | exe "normal `\"" | endif
- endif
-
-endif " has("autocmd")
-
-" toggle syntax highlighting
-map <F12> :if exists("syntax_on") <Bar> syntax off <Bar> else <Bar> syntax on <Bar> endif <CR><ESC>
-map <F11> :nohls <CR>
-
-" use <F6> to toggle line numbers
-nmap <silent> <F6> :set number!<CR>
-
-
-" If using a dark background within the editing area and syntax highlighting
-" turn on this option as well
-set background=dark
-
-
-" set color for search
-hi clear search
-hi search term=bold,reverse cterm=bold,reverse gui=bold,reverse
-
-" set color for Comment
-hi clear Comment
-"highlight Comment term=bold cterm=bold ctermfg=LightBlue guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=LightBlue guifg=#80a0ff gui=bold
-"highlight Comment term=bold cterm=bold ctermfg=grey guifg=#80a0ff gui=bold
-highlight Comment term=none cterm=none ctermfg=grey guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=177 guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=215 guifg=#80a0ff gui=bold
-
-" Go back to the position the cursor was on the last time this file was edited
-au BufReadPost * if line("'\"") > 0 && line("'\"") <= line("$")|execute("normal `\"")|endif
-
-" visual shifting (does not exit Visual mode)
-vnoremap < <gv
-vnoremap > >gv
-
-" Scroll when cursor gets within 3 characters of top/bottom edge
-set scrolloff=3
-
-" Show line, column number, and relative position within a file in the status line
-" set statusline=%F%m%r%h%w\ [FORMAT=%{&ff}]\ [TYPE=%Y]\ [ASCII=\%03.3b]\ [HEX=\%02.2B]\ [POS=%04l,%04v][%p%%]\ [LEN=%L]
-"set statusline=\ %F\ %(\|\ flags:\ %R%M%H%W\ %)%(\|\ type:\ %Y\ %)%(\|\ format:\ %{&ff}\ %)%(\|\ syntax:\ %{synIDattr(synID(line('.'),col('.'),0),'name')}%)\ \ %=line:\ %l/%L\ \|\ column:\ %c%V\ \|\ relative\:\ %p%%\
-set statusline=\ %F\ %(\|\ flags:\ %R%M%H%W\ %)%(\|\ type:\ %Y\ %)%(\|\ format:\ %{&ff}\ %)\ \ %=line:\ %l/%L\ \|\ col:\ %c%V\ \|\ %p%%
-" Always show status line, even for one window
-set laststatus=2
-highlight StatusLine cterm=none ctermfg=white ctermbg=blue
-
-colorscheme PaperColor

files/homedirs/chris/.vimrc.BAK

@@ -1,178 +0,0 @@
-" An example for a vimrc file.
-"
-" Maintainer:   Bram Moolenaar <Bram@vim.org>
-" Last change:  1999 Sep 09
-"
-" To use it, copy it to
-"     for Unix and OS/2:  ~/.vimrc
-"             for Amiga:  s:.vimrc
-"  for MS-DOS and Win32:  $VIM\_vimrc
-
-" This line should not be removed as it ensures that various options are
-" properly set to work with the Vim-related packages available in Debian.
-runtime! debian.vim
-
-set nocompatible        " Use Vim defaults (much better!)
-set bs=2                " allow backspacing over everything in insert mode
-set ai                  " always set autoindenting on
-" set backup            " keep a backup file
-"set viminfo='20,\"50    " read/write a .viminfo file, don't store more
-                        " than 50 lines of registers
-set viminfo='20,\"50,:20,%,n~/.viminfo
-set history=50          " keep 50 lines of command line history
-set ruler               " show the cursor position all the time
-set ignorecase          " suchen case-insenitiv
-set showmatch           " zeige passende klammern
-set shell=/bin/bash     " shell to start with !
-set expandtab           " tabs --> blanks
-set showmode            " anzeige INSERT/REPLACE/...
-
-" set smartcase           " Do smart case matching
-
-set incsearch           " Incremental search
-                        " Start searching when you type the first character of 
-                        " the search string. As you type in more characters, the 
-                        " search is refined.
-
-set t_Co=256            " To enable 256 colors in vim, put this your .vimrc before setting the colorscheme
-
-" einrueckung
-"set noexpandtab
-set expandtab
-set shiftwidth=3
-set tabstop=3
-set softtabstop=3
-" Round indent to multiple of 'shiftwidth' for > and < commands
-set shiftround
-"set number
-
-" For Win32 GUI: remove 't' flag from 'guioptions': no tearoff menu entries
-" let &guioptions = substitute(&guioptions, "t", "", "g")
-
-" Don't use Ex mode, use Q for formatting
-map Q gq
-
-" Make p in isual Visual mode replace the selected text with the "" register.
-vnoremap p <Esc>:let current_reg = @"<CR>gvdi<C-R>=current_reg<CR><Esc>
-
-" Switch syntax highlighting on, when the terminal has colors
-" Also switch on highlighting the last used search pattern.
-if &t_Co > 2 || has("gui_running")
-  syntax on
-  set hlsearch
-endif
-
-" Only do this part when compiled with support for autocommands.
-if has("autocmd")
-
-" In text files, always limit the width of text to 78 characters
- autocmd BufRead *.txt set tw=78
-
- augroup cprog
-  " Remove all cprog autocommands
-  au!
-
-  " When starting to edit a file:
-  "   For C and C++ files set formatting of comments and set C-indenting on.
-  "   For other files switch it off.
-  "   Don't change the order, it's important that the line with * comes first.
-  autocmd FileType *      set formatoptions=tcql nocindent comments&
-  autocmd FileType c,cpp  set formatoptions=croql cindent comments=sr:/*,mb:*,el:*/,://
- augroup END
-
- augroup gzip
-  " Remove all gzip autocommands
-  au!
-
-  " Enable editing of gzipped files
-  " set binary mode before reading the file
-  autocmd BufReadPre,FileReadPre        *.gz,*.bz2 set bin
-  autocmd BufReadPost,FileReadPost      *.gz call GZIP_read("gunzip")
-  autocmd BufReadPost,FileReadPost      *.bz2 call GZIP_read("bunzip2")
-  autocmd BufWritePost,FileWritePost    *.gz call GZIP_write("gzip")
-  autocmd BufWritePost,FileWritePost    *.bz2 call GZIP_write("bzip2")
-  autocmd FileAppendPre                 *.gz call GZIP_appre("gunzip")
-  autocmd FileAppendPre                 *.bz2 call GZIP_appre("bunzip2")
-  autocmd FileAppendPost                *.gz call GZIP_write("gzip")
-  autocmd FileAppendPost                *.bz2 call GZIP_write("bzip2")
-
-  " After reading compressed file: Uncompress text in buffer with "cmd"
-  fun! GZIP_read(cmd)
-    let ch_save = &ch
-    set ch=2
-    execute "'[,']!" . a:cmd
-    set nobin
-    let &ch = ch_save
-    execute ":doautocmd BufReadPost " . expand("%:r")
-  endfun
-
-  " After writing compressed file: Compress written file with "cmd"
-  fun! GZIP_write(cmd)
-    if rename(expand("<afile>"), expand("<afile>:r")) == 0
-      execute "!" . a:cmd . " <afile>:r"
-    endif
-  endfun
-
-  " Before appending to compressed file: Uncompress file with "cmd"
-  fun! GZIP_appre(cmd)
-    execute "!" . a:cmd . " <afile>"
-    call rename(expand("<afile>:r"), expand("<afile>"))
-  endfun
-
- augroup END
-
- " This is disabled, because it changes the jumplist.  Can't use CTRL-O to go
- " back to positions in previous files more than once.
- if 0
-  " When editing a file, always jump to the last cursor position.
-  " This must be after the uncompress commands.
-   autocmd BufReadPost * if line("'\"") && line("'\"") <= line("$") | exe "normal `\"" | endif
- endif
-
-endif " has("autocmd")
-
-" toggle syntax highlighting
-map <F12> :if exists("syntax_on") <Bar> syntax off <Bar> else <Bar> syntax on <Bar> endif <CR><ESC>
-map <F11> :nohls <CR>
-
-" use <F6> to toggle line numbers
-nmap <silent> <F6> :set number!<CR>
-
-
-" If using a dark background within the editing area and syntax highlighting
-" turn on this option as well
-set background=dark
-
-
-" set color for search
-hi clear search
-hi search term=bold,reverse cterm=bold,reverse gui=bold,reverse
-
-" set color for Comment
-hi clear Comment
-"highlight Comment term=bold cterm=bold ctermfg=LightBlue guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=LightBlue guifg=#80a0ff gui=bold
-"highlight Comment term=bold cterm=bold ctermfg=grey guifg=#80a0ff gui=bold
-highlight Comment term=none cterm=none ctermfg=grey guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=177 guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=215 guifg=#80a0ff gui=bold
-
-" Go back to the position the cursor was on the last time this file was edited
-au BufReadPost * if line("'\"") > 0 && line("'\"") <= line("$")|execute("normal `\"")|endif
-
-" visual shifting (does not exit Visual mode)
-vnoremap < <gv
-vnoremap > >gv
-
-" Scroll when cursor gets within 3 characters of top/bottom edge
-set scrolloff=3
-
-" Show line, column number, and relative position within a file in the status line
-" set statusline=%F%m%r%h%w\ [FORMAT=%{&ff}]\ [TYPE=%Y]\ [ASCII=\%03.3b]\ [HEX=\%02.2B]\ [POS=%04l,%04v][%p%%]\ [LEN=%L]
-"set statusline=\ %F\ %(\|\ flags:\ %R%M%H%W\ %)%(\|\ type:\ %Y\ %)%(\|\ format:\ %{&ff}\ %)%(\|\ syntax:\ %{synIDattr(synID(line('.'),col('.'),0),'name')}%)\ \ %=line:\ %l/%L\ \|\ column:\ %c%V\ \|\ relative\:\ %p%%\
-set statusline=\ %F\ %(\|\ flags:\ %R%M%H%W\ %)%(\|\ type:\ %Y\ %)%(\|\ format:\ %{&ff}\ %)\ \ %=line:\ %l/%L\ \|\ col:\ %c%V\ \|\ %p%%
-" Always show status line, even for one window
-set laststatus=2
-highlight StatusLine cterm=none ctermfg=white ctermbg=blue
-
-colorscheme PaperColor

files/homedirs/chris/_bashrc

@@ -113,3 +113,7 @@ export EDITOR=vim
 ## - set beep more quiet
 ## -
 #xset b 10 500 50
+
+# turn off the beep (only in bash tab-complete ?)
+# only if interactiv shell
+[[ "$-" =~ "i" ]] && bind 'set bell-style none'

files/homedirs/chris/_vimrc

@@ -178,4 +178,6 @@ highlight StatusLine cterm=none ctermfg=white ctermbg=blue
 "Remove all trailing whitespace by pressing F5
 nnoremap <F5> :let _s=@/<Bar>:%s/\s\+$//e<Bar>:let @/=_s<Bar><CR>
 
+set belloff=all
+
 colorscheme PaperColor

files/homedirs/root/_bashrc

@@ -76,3 +76,7 @@ export LINES=64
 ## - set beep more quiet
 ## -
 #xset b 10 500 50
+
+# turn off the beep (only in bash tab-complete ?)
+# only if interactiv shell
+[[ "$-" =~ "i" ]] && bind 'set bell-style none'

files/homedirs/root/_vimrc

@@ -178,4 +178,6 @@ highlight StatusLine cterm=none ctermfg=white ctermbg=blue
 "Remove all trailing whitespace by pressing F5
 nnoremap <F5> :let _s=@/<Bar>:%s/\s\+$//e<Bar>:let @/=_s<Bar><CR>
 
+set belloff=all
+
 colorscheme PaperColor

files/homedirs/root/_vimrc.BAK

@@ -1,173 +0,0 @@
-" An example for a vimrc file.
-"
-" Maintainer:   Bram Moolenaar <Bram@vim.org>
-" Last change:  1999 Sep 09
-"
-" To use it, copy it to
-"     for Unix and OS/2:  ~/.vimrc
-"             for Amiga:  s:.vimrc
-"  for MS-DOS and Win32:  $VIM\_vimrc
-
-" This line should not be removed as it ensures that various options are
-" properly set to work with the Vim-related packages available in Debian.
-runtime! debian.vim
-
-set nocompatible        " Use Vim defaults (much better!)
-set bs=2                " allow backspacing over everything in insert mode
-set ai                  " always set autoindenting on
-" set backup            " keep a backup file
-"set viminfo='20,\"50    " read/write a .viminfo file, don't store more
-                        " than 50 lines of registers
-set viminfo='20,\"50,:20,%,n~/.viminfo
-set history=50          " keep 50 lines of command line history
-set ruler               " show the cursor position all the time
-set ignorecase          " suchen case-insenitiv
-set showmatch           " zeige passende klammern
-set shell=/bin/bash     " shell to start with !
-set expandtab           " tabs --> blanks
-set showmode            " anzeige INSERT/REPLACE/...
-
-" set smartcase           " Do smart case matching
-
-set incsearch           " Incremental search
-                        " Start searching when you type the first character of 
-                        " the search string. As you type in more characters, the 
-                        " search is refined.
-
-set t_Co=256            " To enable 256 colors in vim, put this your .vimrc before setting the colorscheme
-
-" einrueckung
-set shiftwidth=3
-set tabstop=3
-" Round indent to multiple of 'shiftwidth' for > and < commands
-set shiftround
-
-" For Win32 GUI: remove 't' flag from 'guioptions': no tearoff menu entries
-" let &guioptions = substitute(&guioptions, "t", "", "g")
-
-" Don't use Ex mode, use Q for formatting
-map Q gq
-
-" Make p in isual Visual mode replace the selected text with the "" register.
-vnoremap p <Esc>:let current_reg = @"<CR>gvdi<C-R>=current_reg<CR><Esc>
-
-" Switch syntax highlighting on, when the terminal has colors
-" Also switch on highlighting the last used search pattern.
-if &t_Co > 2 || has("gui_running")
-  syntax on
-  set hlsearch
-endif
-
-" Only do this part when compiled with support for autocommands.
-if has("autocmd")
-
-" In text files, always limit the width of text to 78 characters
- autocmd BufRead *.txt set tw=78
-
- augroup cprog
-  " Remove all cprog autocommands
-  au!
-
-  " When starting to edit a file:
-  "   For C and C++ files set formatting of comments and set C-indenting on.
-  "   For other files switch it off.
-  "   Don't change the order, it's important that the line with * comes first.
-  autocmd FileType *      set formatoptions=tcql nocindent comments&
-  autocmd FileType c,cpp  set formatoptions=croql cindent comments=sr:/*,mb:*,el:*/,://
- augroup END
-
- augroup gzip
-  " Remove all gzip autocommands
-  au!
-
-  " Enable editing of gzipped files
-  " set binary mode before reading the file
-  autocmd BufReadPre,FileReadPre        *.gz,*.bz2 set bin
-  autocmd BufReadPost,FileReadPost      *.gz call GZIP_read("gunzip")
-  autocmd BufReadPost,FileReadPost      *.bz2 call GZIP_read("bunzip2")
-  autocmd BufWritePost,FileWritePost    *.gz call GZIP_write("gzip")
-  autocmd BufWritePost,FileWritePost    *.bz2 call GZIP_write("bzip2")
-  autocmd FileAppendPre                 *.gz call GZIP_appre("gunzip")
-  autocmd FileAppendPre                 *.bz2 call GZIP_appre("bunzip2")
-  autocmd FileAppendPost                *.gz call GZIP_write("gzip")
-  autocmd FileAppendPost                *.bz2 call GZIP_write("bzip2")
-
-  " After reading compressed file: Uncompress text in buffer with "cmd"
-  fun! GZIP_read(cmd)
-    let ch_save = &ch
-    set ch=2
-    execute "'[,']!" . a:cmd
-    set nobin
-    let &ch = ch_save
-    execute ":doautocmd BufReadPost " . expand("%:r")
-  endfun
-
-  " After writing compressed file: Compress written file with "cmd"
-  fun! GZIP_write(cmd)
-    if rename(expand("<afile>"), expand("<afile>:r")) == 0
-      execute "!" . a:cmd . " <afile>:r"
-    endif
-  endfun
-
-  " Before appending to compressed file: Uncompress file with "cmd"
-  fun! GZIP_appre(cmd)
-    execute "!" . a:cmd . " <afile>"
-    call rename(expand("<afile>:r"), expand("<afile>"))
-  endfun
-
- augroup END
-
- " This is disabled, because it changes the jumplist.  Can't use CTRL-O to go
- " back to positions in previous files more than once.
- if 0
-  " When editing a file, always jump to the last cursor position.
-  " This must be after the uncompress commands.
-   autocmd BufReadPost * if line("'\"") && line("'\"") <= line("$") | exe "normal `\"" | endif
- endif
-
-endif " has("autocmd")
-
-" toggle syntax highlighting
-map <F12> :if exists("syntax_on") <Bar> syntax off <Bar> else <Bar> syntax on <Bar> endif <CR><ESC>
-map <F11> :nohls <CR>
-
-" use <F6> to toggle line numbers
-nmap <silent> <F6> :set number!<CR>
-
-
-" If using a dark background within the editing area and syntax highlighting
-" turn on this option as well
-set background=dark
-
-
-" set color for search
-hi clear search
-hi search term=bold,reverse cterm=bold,reverse gui=bold,reverse
-
-" set color for Comment
-hi clear Comment
-"highlight Comment term=bold cterm=bold ctermfg=LightBlue guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=LightBlue guifg=#80a0ff gui=bold
-"highlight Comment term=bold cterm=bold ctermfg=grey guifg=#80a0ff gui=bold
-highlight Comment term=none cterm=none ctermfg=grey guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=177 guifg=#80a0ff gui=bold
-"highlight Comment term=none cterm=none ctermfg=215 guifg=#80a0ff gui=bold
-
-" Go back to the position the cursor was on the last time this file was edited
-au BufReadPost * if line("'\"") > 0 && line("'\"") <= line("$")|execute("normal `\"")|endif
-
-" visual shifting (does not exit Visual mode)
-vnoremap < <gv
-vnoremap > >gv
-
-" Scroll when cursor gets within 3 characters of top/bottom edge
-set scrolloff=3
-
-" Show line, column number, and relative position within a file in the status line
-" set statusline=%F%m%r%h%w\ [FORMAT=%{&ff}]\ [TYPE=%Y]\ [ASCII=\%03.3b]\ [HEX=\%02.2B]\ [POS=%04l,%04v][%p%%]\ [LEN=%L]
-"set statusline=\ %F\ %(\|\ flags:\ %R%M%H%W\ %)%(\|\ type:\ %Y\ %)%(\|\ format:\ %{&ff}\ %)%(\|\ syntax:\ %{synIDattr(synID(line('.'),col('.'),0),'name')}%)\ \ %=line:\ %l/%L\ \|\ column:\ %c%V\ \|\ relative\:\ %p%%\
-set statusline=\ %F\ %(\|\ flags:\ %R%M%H%W\ %)%(\|\ type:\ %Y\ %)%(\|\ format:\ %{&ff}\ %)\ \ %=line:\ %l/%L\ \|\ col:\ %c%V\ \|\ %p%%
-" Always show status line, even for one window
-set laststatus=2
-highlight StatusLine cterm=none ctermfg=white ctermbg=blue
-

files/homedirs/sysadm/_bashrc

@@ -73,3 +73,7 @@ export LINES=64
 ## - set beep more quiet
 ## -
 #xset b 10 500 50
+
+# turn off the beep (only in bash tab-complete ?)
+# only if interactiv shell
+[[ "$-" =~ "i" ]] && bind 'set bell-style none'

files/homedirs/sysadm/_vimrc

@@ -175,4 +175,6 @@ set statusline=\ %F\ %(\|\ flags:\ %R%M%H%W\ %)%(\|\ type:\ %Y\ %)%(\|\ format:\
 set laststatus=2
 highlight StatusLine cterm=none ctermfg=white ctermbg=blue
 
+set belloff=all
+
 colorscheme PaperColor

group_vars/all/main.yml

@@ -976,6 +976,122 @@ apt_initial_install_jammy:
   - ifupdown
   - socat
 
+apt_initial_install_ubuntu_noble:
+  - cryptsetup
+  - dbus
+  - openssh-server
+  - rush
+  - bash
+  - bash-completion
+  - vim
+  - vim-common
+  - vim-doc
+  - mc
+  - screen
+  - tmux
+  - cron
+  - bc
+  - figlet
+  - sudo
+  - rsync
+  - dselect
+  - iputils-ping
+  - apt-utils
+  - aptitude
+  - zip
+  - unzip
+  - bzip2
+  - arj
+  - locate
+  - curl
+  - gawk
+  - mawk
+  - lynx
+  - links
+  - w3m
+  - universal-ctags
+  - file
+  - coreutils
+  - moreutils
+  - less
+  - sipcalc
+  - psmisc
+  - dnsutils
+  - rblcheck
+  - whois
+  - gettext
+  - gettext-base
+  - gettext-doc
+  - debian-keyring
+  - patch
+  - patchutils
+  - recode
+  - recode-doc
+  - librecode0
+  - librecode-dev
+  - sharutils
+  - perl
+  - perl-modules
+  - perl-doc
+  - libperl-dev
+  - libreadline-dev
+  - libterm-readline-gnu-perl
+  - libterm-readline-perl-perl
+  - libterm-readkey-perl
+  - libmail-imapclient-perl
+  - libtime-duration-perl
+  - libtimedate-perl
+  - libwww-perl
+  - libpcre3
+  - libio-compress-perl
+  - re2c
+  - util-linux
+  - parted
+  - lshw
+  - gdisk
+  - smartmontools
+  - tcpdump
+  - unhide
+  - lsof
+  - hdparm
+  - groff
+  - iproute2
+  - bridge-utils
+  - vlan
+  - ethtool
+  - wipe
+  - iperf
+  - mtr
+  - iptraf
+  - wget
+  - logrotate
+  - rsyslog
+  - haveged
+  - rdate
+  - ntpdate
+  - wipe
+  - man
+  - groff
+  - iptables
+  - shellcheck
+  - ssl-cert
+  - ssl-cert-check
+  - git
+  - ftp
+  - htop
+  - net-tools
+  - lsb-release
+  - attr
+  - acl
+  - quota
+  - quotatool
+  - needrestart
+  - socat
+  - zsh
+  - lua5.4
+  - btrfs-progs
+  - fdisk
+
 install_compiler_pkgs: false
 apt_compiler_pkgs:
   - g++
@@ -1918,11 +2034,11 @@ tor_hidden_service_port:
 # vars used by modify-munin-ip.yml
 # ---
 
-munin_remote_ipv4: 135.181.136.84
+munin_remote_ipv4: 37.27.121.227
-munin_remote_ipv6: 2a01:4f9:3a:1051::84
+munin_remote_ipv6: 2a01:4f9:3070:2bda::227
 
-munin_remote_ipv4_old: 95.217.64.122
+munin_remote_ipv4_old: 135.181.136.84
-munin_remote_ipv6_old: 2a01:4f9:4a:2b57::122
+munin_remote_ipv6_old: 2a01:4f9:3a:1051::84
 
 
 # ---
@@ -1978,7 +2094,7 @@ root_ssh_keypair: []
 default_user:
 
   - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
+    password: $y$j9T$RY2Nt/UmjMjxuyAhKXxMV0$IPvnS5XkNBluEiOARFmyQLp6GzXA1tY96rW.S9H7U84
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
@@ -1988,7 +2104,7 @@ default_user:
     user_id: 1050
     group_id: 1050
     group: sysadm
-    password: $y$j9T$LIF1RrShGDGdCXkUubRPR/$N8M5c/dhBdJkJrLP3/Lchyosjg0FxaQ2M4epvuzTI78
+    password: $y$j9T$1WH8G2UkuN1jjp4QLuoeC0$dXpOnJUfMMAqAXlwN8XD0pq78r.a4UZOgt3LY4afxy/
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
@@ -1997,7 +2113,8 @@ default_user:
   - name: localadmin
     user_id: 1051
     group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
+    group: sysadm
+    password: $y$j9T$1WH8G2UkuN1jjp4QLuoeC0$dXpOnJUfMMAqAXlwN8XD0pq78r.a4UZOgt3LY4afxy/
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
@@ -2007,25 +2124,13 @@ default_user:
     user_id: 1060
     group_id: 1060
     group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
+    password: $y$j9T$FLeyg8Xy09ppHGVbKOr5l1$XJbJdjX7XlS5QeiTzBvl2dMYcC0AxIylkvayJgFR3CC
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMvy+IDUeoVwLg+cJNcKzls5guOrVUretsf05v3Y2N+Y root@default-oopen-server'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcEPd+MDJKzWqWStt3XpJU1OpJ0uxmipacIGkm6k3MS root@default-warenform-server'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/eGKbdxPYu7L/b/DjZrWek50e0AnkHFZS+zV12o5jy root@borg-client-key-warenform'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ6Sra1D8JU2A68G4rSny7D0ukYKy89NVMXbdxrtdZwr root@borg-client-key-oopen'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
 
 extra_user: []
 
@@ -2273,6 +2378,15 @@ bind9_gateway_allow_recursion:
 # vars used by roles/common/tasks/git.yml
 # ---
 
+
+# ---
+# vars used by roles/common/tasks/ntp.yml
+# ---
+
+local_ntp_service: false
+
+ntp_server: {}
+
 # ---
 # Firewall repository
 # ---
@@ -2827,6 +2941,10 @@ samba_netbios_name:
 #
 samba_server_min_protocol: []
 
+# samba_allow_insecure_wide_links
+#
+samba_allow_insecure_wide_links: !!str no
+
 samba_groups: []
 
 # samba_user:

group_vars/gateway_server.yml

@@ -74,6 +74,9 @@ default_user:
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5LudM+Bg/onOgBrdcLfJcZ7s2manrQa2P4D74tGSa9 root@o26-backup'
 
 sudo_users:
   - chris

group_vars/oopen_office.yml

@@ -73,9 +73,11 @@ default_user:
     password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
     shell: /bin/bash
     ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5LudM+Bg/onOgBrdcLfJcZ7s2manrQa2P4D74tGSa9 root@o26-backup'
 
 sudo_users:
   - chris
@@ -108,6 +110,12 @@ sudo_users:
 # vars used by roles/common/tasks/git.yml
 # ---
 
+
+# ---
+# vars used by roles/common/tasks/ntp.yml
+# ---
+
+
 # ==============================
 
 

group_vars/oopen_office_ga.yml

@@ -96,7 +96,9 @@ default_user:
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5LudM+Bg/onOgBrdcLfJcZ7s2manrQa2P4D74tGSa9 root@o26-backup'
 
 sudo_users:
   - chris

group_vars/oopen_server.yml

@@ -48,21 +48,30 @@ ssh_keypair_backup_client:
     target: backup.oopen.de
 
 
+
 default_user:
 
   - name: chris
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
 
   - name: sysadm
-
     user_id: 1050
     group_id: 1050
     group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
+    password: $y$j9T$LIF1RrShGDGdCXkUubRPR/$N8M5c/dhBdJkJrLP3/Lchyosjg0FxaQ2M4epvuzTI78
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: localadmin
+    user_id: 1051
+    group_id: 1051
+    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
@@ -72,10 +81,13 @@ default_user:
     user_id: 1060
     group_id: 1060
     group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
+    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5LudM+Bg/onOgBrdcLfJcZ7s2manrQa2P4D74tGSa9 root@o26-backup'
 
 
 sudo_users:

group_vars/warenform_office.yml

@@ -81,7 +81,10 @@ default_user:
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5LudM+Bg/onOgBrdcLfJcZ7s2manrQa2P4D74tGSa9 root@o26-backup'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID5v9m8a7zcMqIjm+faCYK9CdyHZjS8poMZrsUODzTSL root@devel-root'
 
 sudo_users:
   - chris

group_vars/warenform_server.yml

@@ -87,7 +87,9 @@ default_user:
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA5LudM+Bg/onOgBrdcLfJcZ7s2manrQa2P4D74tGSa9 root@o26-backup'
 
 sudo_users:
   - chris

host_vars/135.181.79.202.yml

@@ -1,335 +0,0 @@
----
-
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-  - rcconf
-
-
-network_interfaces:
-
-  # Many device configurations are possible (as many as needed)
-  #
-  - device: enp35s0
-    # use only once per device (for the first device entry)
-    headline: enp35s0 - primary device
-
-    # auto & allow are only used for the first entry of that devicei-name)
-    #
-    allow: [] # array of allow-[stanzas] eg. allow-hotplug
-    auto: true
-
-    family: inet
-    
-    # The statisc Mode
-    #    Options
-    #       address        <dotted quad address[/netmask]>
-    #       gateway        <dotted quad address>
-    #       pointopoint    <Address of other end point (dotted quad). Note the spelling of "point-to">
-    #       hwaddress      <mac-address>
-    #       mtu            <size>
-    #       scope          <Address validity scope. Possible values: global, link, host>
-    #
-    # The manual Method
-    #    Options
-    #       hwaddress      <mac-address>
-    #       mtu            <size>
-    #
-    # The dhcp Method
-    #    Options
-    #       hwaddress      <mac-address>
-    #       hostname       <Hostname to be requested (pump, dhcpcd, udhcpc)>
-    #       metric         <metric>
-    #       leasehours     <Preferred lease time in hours (pump)>
-    #       leasetime      <Preferred lease time in seconds (dhcpcd)>
-    #       vendor         <Vendor class identifier (dhcpcd)>
-    #       client         <Client identifier (dhcpcd), or "no" (dhclient)>
-    #    
-    # The bootp Method  
-    #    Options
-    #       bootfile:      <file: Tell the server to use 'file' as the bootfile.>
-    #       server:        <address: Use the IP address 'address' to communicate with the server.>
-    #       hwaddr         <mac-address: Use addr as the hardware address instead of whatever it really is.>
-    #    
-    method: static
-    
-    hwaddress: 
-    description:
-    address: 135.181.79.202
-    # dotted quad or number of bits
-    #
-    # the entry will be: address/netmask
-    netmask: 255.255.255.192
-    gateway: 135.181.79.193
-    metric: 
-    pointopoint: 
-    mtu: 
-    scope: 
-
-    # additional user by dhcp method
-    #
-    hostname:
-    leasehours:
-    leasetime:
-    vendor:
-    client:
-
-    # additional used by bootp method
-    #
-    bootfile:
-    server:
-    hwaddr:
- 
-
-    # optional dns settings nameservers: []
-    # nameservers:
-    #  - "194.150.168.168"  # dns.as250.net
-    #  - "91.239.100.100"   # anycast.censurfridns.dk
-
-    # optional additional subnets/ips subnets: []
-    # subnets: 
-    #   - '192.168.123.0/24'
-    #   - '192.168.124.11/32'
-
-    # optional bridge parameters bridge: {}
-    # bridge:
-    #   ports:
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
-    bridge: {}
-
-    #  optional bonding parameters bond: {}
-    #  bond:
-    #    master
-    #    primary
-    #    slave
-    #    mode:
-    #    miimon:
-    #    lacp-rate:
-    #    ad-select-rate:
-    #    master:
-    #    slaves:
-    bond: {}
-
-    # optional vlan settings | vlan: {}
-    # vlan: {}
-    #   raw-device: 'eth0'
-    vlan: {}
-
-    # inline hook scripts
-    #
-    # example:
-    #
-    # up:
-    #   - !!str "route add -net 135.181.79.192 netmask 255.255.255.192 gw 135.181.79.193 dev enp35s0"
-    #
-    pre-up: [] # pre-up script lines
-    up:
-      - !!str "route add -net 135.181.79.192 netmask 255.255.255.192 gw 135.181.79.193 dev enp35s0"
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: [] # pre-down script lines (alias for down)
-    down: [] # down script lines
-    post-down: [] # post-down script lines
-
-  - device: enp35s0
-    # use only once per device (for the first device entry)
-    headline:
-
-    # auto & allow are only used for the first device entry
-    allow: [] # array of allow-[stanzas] eg. allow-hotplug
-    auto: 
-
-    family: inet6
-    method: static
-    description:
-    address: 2a01:4f9:4b:17ce::2
-    netmask: 64
-    gateway: fe80::1
-
-    # optional dns settings nameservers: []
-    # nameservers:
-    #  - "194.150.168.168"  # dns.as250.net
-    #  - "91.239.100.100"   # anycast.censurfridns.dk
-
-    # optional additional subnets/ips subnets: []
-    # subnets: 
-    #   - '192.168.123.0/24'
-    #   - '192.168.124.11/32'
-
-    # optional bridge parameters bridge: {}
-    # bridge:
-    #   ports:
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
-    bridge: {}
-
-    #  optional bonding parameters bond: {}
-    #  bond:
-    #    mode:
-    #    miimon:
-    #    master:
-    #    slaves:
-    #    lacp-rate:
-    bond: {}
-
-    # optional vlan settings | vlan: {}
-    # vlan: {}
-    #   raw-device: 'eth0'
-    vlan: {}
-
-    # inline hook scripts
-    pre-up: []# pre-up script lines
-    up: [] # up script lines
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: [] # pre-down script lines (alias for down)
-    down: [] # down script lines
-    post-down: [] # post-down script lines
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-#apt_manage_sources_list: false
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-create_sftp_group: true
-
-
-default_user:
-
-  - name: chris
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFkl+5aVg4l40bxmf6k2dpopV8oAXyLhGGmKfzspW3GTfD29WjhuGS/mefrqr3tZRYrybPA5GDQ1QdwwRL16+6xfjAt/B62p3dMXnjsHalk74DTcQCZDlsj0UxTV1+gfOYzcB/CAqRd2wtB+vqGWRP+oGP3E7AIgoBlE44MaEDDuMP0Vvm8hNQ5N+/3zcrE626yDHAa4qmOd5d+J/HWrHLeJ4915g9VcCYCNGCgepb//4RdCpzEqUJiBGwihb/iJk3RoHcAv3L+tht8vmBF7Wz0iJ9BtLRTsJGFCkET0i50E18mU3bfaa7ov/PY/+UcE8FZSWZcoZ6AtmoBy0Zg2mp6/F9serfe67qtILNAbWD+qNRC7GjW3c5UvF5GJM6WvG8OZRvwarovZOU8uw1NLL3unY8O1bdihXmCXatXz+MvHCOvmZekUolKMBu7mziH5wificprUY9YeGX1FHVh4/hsL04zZdu/Q8Rr/BxM8+mJCCPsrkEoNnZNJfxCSwynd3jjqkhBpzZkEW9EGDBG5qnx4f6QPtcf/sv7eoNjzhEUs5k9GstbgW0ZD6381Ws/EpIdRbZUl52wFXalE8N/Z9hU6vfBC1xk0DIardUkZk+6lTsS8orBZkmPDNhX5hT8nmwNszQI0WgHPs+xDAdFskMcB/j20G5NupZm+2QgNXoww== jonas@meurer.it'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCzd5rFYvV5/V2NZE4jxL09qZ4TTsgmhbfSHpsj9wX89+j7ZrfTAkAkAFxyrWs8FR3CQ11DGkrXW059a0ppRQ7R8bUW9CniXS/RaRAvqX9AMM9Xo/lmL4pXNM0sV4nHJWphi5Bc+zTIM2I4PSbHYw+5dDnj8ZIQ8ucBff+k29Zd90JRuKx72tk0pQNf7sQbWVKNCT/B4g4MJV84NvnO+ExCWvGM95Cy5NCTnQfO94/OSkN72R//tIR7Nd/aK7hEj69MoVJZrFy4qzE9KskLhKeUYCqoz86XOQ6Dfag/B2adTeG3r9DEacG3ao/ACZKQChj0X12LEV/PZUHLORqYpWIwMuIx54vhbxarSwlKhoOCv1XQJwo9BTavMhFNsMtZpAJYdvAakRCbf18bDrHyqYYqjAyYOp+L+G+wlSh3tz0qQL8aAnaV3RPN0fDd7Zu1dpMGAM2gMnBEMJ+k82V7EtACp1jf37LW11Lbv2o+dRUJEgsrU9TNGxaGSTWqGc65TuP9PUfDXq1ZNOPQWSK/KseqB0WUx6ePfZzkgkr7kGXT/d9hUSCq2+iprhfwQpYLcXE9XtCdo1aivIKQ8zCuR44q11HePyNtEMaJfq33p4uDTVOy7UOtuACzSbk6vs7h6h8CUGPwU9aw+PRiWY4Jdm0caJ8trFfH1R8XaIe3SaUEw== t@NB-003258-RLS'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-
-extra_system_user:
-  - name: www-data
-    home: /var/www
-    groups: sftp_users
-
-sudo_users:
-  - chris
-  - sysadm
-  - localadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-server
-  repo: https://git.oopen.de/firewall/ipt-server
-  dest: /usr/local/src/ipt-server
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/172.16.63.32.yml

@@ -1,115 +0,0 @@
----
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-copy_additional_plain_files_sysctl:
-
-  - name: enable-ipv6
-    src_path: etc/sysctl.d/30-enable-ipv6.conf
-    dest_path: /etc/sysctl.d/30-enable-ipv6.conf
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-default_user:
-
-  - name: chris
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/172.16.82.197.yml

@@ -0,0 +1,175 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+copy_additional_plain_files_sysctl:
+
+  - name: enable-ipv6
+    src_path: etc/sysctl.d/30-enable-ipv6.conf
+    dest_path: /etc/sysctl.d/30-enable-ipv6.conf
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+#sshd_hostkeyalgorithms:
+#  - ssh-ed25519
+#  - ssh-ed25519-cert-v01@openssh.com
+#  - rsa-sha2-256
+#  - rsa-sha2-512
+#  - ecdsa-sha2-nistp256
+#  - rsa-sha2-256-cert-v01@openssh.com
+#  - rsa-sha2-512-cert-v01@openssh.com
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 127.0.0.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - akb.netz
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_user_special_time_entries:
+
+  - name: "Restart NTP service 'ntpsec'"
+    special_time: reboot
+    job: "sleep 15 ; /bin/systemctl restart ntpsec"
+    insertafter: PATH
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+git_firewall_repository:
+  name: ipt-gateway
+  repo: https://git.oopen.de/firewall/ipt-gateway
+  dest: /usr/local/src/ipt-gateway
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+install_bind_packages: true
+
+bind9_gateway_listen_on_v6:
+  - none
+
+bind9_gateway_listen_on:
+  - any
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $y$j9T$IVBTpn.OrI6YiQ9q3fA8b1$Y1bmID5yXJbKfoLFt1VmQs6LezeTj5/1M9ppZBD2Pn4
+

host_vars/37.27.121.218.yml

@@ -1,523 +0,0 @@
----
-
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-
-network_interfaces:
-
-  # Many device configurations are possible (as many as needed)
-  #
-  - device: enp6s0
-    # use only once per device (for the first device entry)
-    headline: enp6s0 - primary device
-
-    # auto & allow are only used for the first entry of that devicei-name)
-    #
-    allow: [] # array of allow-[stanzas] eg. allow-hotplug
-    auto: true
-
-    family: inet
-    
-    # The statisc Mode
-    #    Options
-    #       address        <dotted quad address[/netmask]>
-    #       gateway        <dotted quad address>
-    #       pointopoint    <Address of other end point (dotted quad). Note the spelling of "point-to">
-    #       hwaddress      <mac-address>
-    #       mtu            <size>
-    #       scope          <Address validity scope. Possible values: global, link, host>
-    #
-    # The manual Method
-    #    Options
-    #       hwaddress      <mac-address>
-    #       mtu            <size>
-    #
-    # The dhcp Method
-    #    Options
-    #       hwaddress      <mac-address>
-    #       hostname       <Hostname to be requested (pump, dhcpcd, udhcpc)>
-    #       metric         <metric>
-    #       leasehours     <Preferred lease time in hours (pump)>
-    #       leasetime      <Preferred lease time in seconds (dhcpcd)>
-    #       vendor         <Vendor class identifier (dhcpcd)>
-    #       client         <Client identifier (dhcpcd), or "no" (dhclient)>
-    #    
-    # The bootp Method  
-    #    Options
-    #       bootfile:      <file: Tell the server to use 'file' as the bootfile.>
-    #       server:        <address: Use the IP address 'address' to communicate with the server.>
-    #       hwaddr         <mac-address: Use addr as the hardware address instead of whatever it really is.>
-    #    
-    method: static
-    
-    hwaddress: 
-    description:
-    address: 37.27.129.85
-    # dotted quad or number of bits
-    #
-    # the entry will be: address/netmask
-    netmask: 26
-    gateway: 37.27.129.65
-    metric: 
-    pointopoint: 
-    mtu: 
-    scope: 
-
-    # additional user by dhcp method
-    #
-    hostname:
-    leasehours:
-    leasetime:
-    vendor:
-    client:
-
-    # additional used by bootp method
-    #
-    bootfile:
-    server:
-    hwaddr:
-
-    # optional dns settings nameservers: []
-    #
-    #    nameservers:
-    #      - 194.150.168.168  # dns.as250.net
-    #      - 91.239.100.100   # anycast.censurfridns.dk
-    #    search: warenform.de
-    #
-    #nameservers:
-    #  - 185.12.64.1
-    #  - a01:4ff:ff00::add:2
-    #search:
-
-    # optional additional subnets/ips subnets: []
-    # subnets: 
-    #   - '192.168.123.0/24'
-    #   - '192.168.124.11/32'
-
-    # optional bridge parameters bridge: {}
-    # bridge:
-    #   ports:
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
-    bridge: {}
-
-    #  optional bonding parameters bond: {}
-    #  bond:
-    #    master
-    #    primary
-    #    slave
-    #    mode:
-    #    miimon:
-    #    lacp-rate:
-    #    ad-select-rate:
-    #    master:
-    #    slaves:
-    bond: {}
-
-    # optional vlan settings | vlan: {}
-    # vlan: {}
-    #   raw-device: 'eth0'
-    vlan: {}
-
-    # inline hook scripts
-    #
-    # example:
-    #
-    # up:
-    #   - !!str "route add -net 135.181.79.192 netmask 255.255.255.192 gw 135.181.79.193 dev enp6s0"
-    #
-    pre-up: [] # pre-up script lines
-    up:
-      - !!str "route add -net 37.27.129.64 netmask 255.255.255.192 gw 37.27.129.65 dev enp6s0"
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: [] # pre-down script lines (alias for down)
-    down: [] # down script lines
-    post-down: [] # post-down script lines
-
-  - device: enp6s0
-    # use only once per device (for the first device entry)
-    headline:
-
-    # auto & allow are only used for the first device entry
-    allow: [] # array of allow-[stanzas] eg. allow-hotplug
-    auto: 
-
-    family: inet6
-    method: static
-    address: 2a01:4f9:3071:1141::2
-    netmask: 64
-    gateway: fe80::1
-    metric:
-    pointopoint:
-    mtu:
-    scope:
-
-    # additional user by dhcp method
-    #
-    hostname:
-    leasehours:
-    leasetime:
-    vendor:
-    client:
-
-    # additional used by bootp method
-    #
-    bootfile:
-    server:
-    hwaddr:
-
-    # optional dns settings nameservers: []
-    #
-    #    nameservers:
-    #      - 194.150.168.168  # dns.as250.net
-    #      - 91.239.100.100   # anycast.censurfridns.dk
-    #    search: warenform.de
-    #
-    nameservers:
-    search:
-
-    # optional additional subnets/ips subnets: []
-    # subnets: 
-    #   - '192.168.123.0/24'
-    #   - '192.168.124.11/32'
-
-    # optional bridge parameters bridge: {}
-    # bridge:
-    #   ports:
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
-    bridge: {}
-
-    #  optional bonding parameters bond: {}
-    #  bond:
-    #    mode:
-    #    miimon:
-    #    master:
-    #    slaves:
-    #    lacp-rate:
-    bond: {}
-
-    # optional vlan settings | vlan: {}
-    # vlan: {}
-    #   raw-device: 'eth0'
-    vlan: {}
-
-    # inline hook scripts
-    pre-up: []# pre-up script lines
-    up: [] # up script lines
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: [] # pre-down script lines (alias for down)
-    down: [] # down script lines
-    post-down: [] # post-down script lines
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-#apt_manage_sources_list: false
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 185.12.64.1
-  - 2a01:4ff:ff00::add:2
-  - 185.12.64.2
-  - 2a01:4ff:ff00::add:1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - oopen.de
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 194.150.168.168
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_env_entries:
-  - name: PATH
-    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/mysql/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-
-  - name: SHELL
-    job: /bin/bash
-    insertafter: PATH
-
-
-cron_user_special_time_entries:
-
-  - name: "Restart DNS Cache service 'systemd-resolved'"
-    special_time: reboot
-    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
-    insertafter: PATH
-
-  - name: "Check if postfix mailservice is running. Restart service if needed."
-    special_time: reboot
-    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
-    insertafter: PATH
-
-
-cron_user_entries:
-
-  - name: "Remote Borg Backup"
-    minute: '04'
-    hour: '00'
-    job: /root/crontab/backup-rborg/rborg.sh
-
-  - name: "Check if SSH service is running. Restart service if needed."
-    minute: '*/5'
-    hour: '*'
-    job: /root/bin/monitoring/check_ssh.sh
-
-  - name: "Check connectifity - reboot if needed"
-    minute: '*/10'
-    hour: '*'
-    job: /root/bin/admin-stuff/check-connectivity.sh
-
-  - name: "Check if Postfix Mailservice is up and running?"
-    minute: '*/15'
-    hour: '*'
-    job: /root/bin/monitoring/check_postfix.sh
-
-  - name: "Check if NTP service 'ntpsec' is up and running?"
-    minute: '*/30'
-    hour: '*'
-    job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
-
-#  - name: "Backup internet hosts and then print out hdd-usage for all backuped hosts"
-#    minute: '16'
-#    hour: '00'
-#    weekday: '1-6'
-#    job: /root/crontab/backup-rcopy/rcopy.sh -B ; /root/crontab/backup-rcopy/rcopy.sh -N
-#
-#  - name: "On sunday morning also determin diskspace usage"
-#    minute: '16'
-#    hour: '00'
-#    weekday: 7
-#    job: /root/crontab/backup-rcopy/rcopy.sh -B ; /root/crontab/backup-rcopy/rcopy.sh -N ; /root/bin/admin-stuff/disk-space_usage.sh -q -o /root/disk-space_usage /backup
-#
-#  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
-#    minute: '23'
-#    hour: '05'
-#    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
-#
-#  - name: "Check whether all certificates are included in the VHOST configurations"
-#    minute: '33'
-#    hour: '05'
-#    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
-
-  - name: "Check hard disc usage."
-    minute: '43'
-    hour: '6'
-    job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-create_sftp_group: true
-
-
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$LIF1RrShGDGdCXkUubRPR/$N8M5c/dhBdJkJrLP3/Lchyosjg0FxaQ2M4epvuzTI78
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-
-extra_system_user:
-  - name: www-data
-    home: /var/www
-    groups: sftp_users
-
-sudo_users:
-  - chris
-  - sysadm
-  - localadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-server
-  repo: https://git.oopen.de/firewall/ipt-server
-  dest: /usr/local/src/ipt-server
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-

host_vars/anita.wf.netz.yml

@@ -55,14 +55,6 @@ extra_user:
     ssh_keys:
       - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5IhVprsvVOcFPbZzD9xR0nCjZ/9qVG6RhLJ7QBSts81nRvLwnmvcMBHSf5Rfaigey7Ff5dLHfJnxRE0KDATn6n2yd/5mXpn2GAA8hDVfhdsmsb5U7bROjZNr8MmIUrP7c3msUGx1FtvzhwxtyvIWOFQpWx+W5biBa6hFjIxT1pkUJqe6fclp7xbGYKZiqZRBS4qKG5CpKnisuOYDsqYPND+OkU+PShoxGVzp1JywIVze7qeKv6GyYbRA9SP9Np+5Mit6B21Io4zOI81c2Rz6sPX7mwEAQEs7iCm2hzG8qJws45Lb4ERqDkVEVhGNUyHjHgGebS1sZx1mLExdurXlPm1l/EamkncDFDCutHXtLP7lsFFiym7fKUjSEgiiLmyu5Xm+mwZvesKa1FYNaeiFWfYZpCJrNzIk+ffs+mgg3kmL4Sd4Ooy7jXPX+WJe5Xyh1KLU/+Wj2TVrhN+LbmupYAti/Wgd3DA1v601svmG82aLmyJRtKC0rGMePH3kDbtqU72kYpzI8mXERe1TIQ00Z77kQBR/7BF/9y5/0YmYDcXt1wNCoSie+mzz3xYcEdLAc7T+DhYpd4M6VgWnuz/exzRzhQwoSdEKkEED8CpEoBrEWEiMdrlElGmlkVomLU7P9i9j1rshX/pAq0asnqeSoPdC3vNbU3keiJQnhIHECvw== chris@luna'
 
-  - name: christian
-    user_id: 1005
-    group_id: 1005
-    password: $6$2paWmEea$G51JZDzjjDNE75aBl/xuM1dyH.FWYHwNCRHeKWkHhxjUmRRC/v.hhNh5jOk5EbVWDeVh7r5dz1tO2HTZUMftb1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCb6ngLE9Vh0H6IqiHF2yeQX11kCeVE4QaK8Ca0Ogqtz8drC4/3Ugl9ZDtJR+UH+GpP/bOQZDTGF6f+p8dNlfpeoHZ92Yg62yMeD9qx9iQT8NeloLvpHk3B3NV10Lrff/zoeTGP7U8zKvLQsYnCwSPEodKEsxbf5mFcJN13/m+PW3tW0veRtYGvBwhimxidpSr+DLcRTZrZGs2Jf8BVqqAL0BIdH7exuLeKpACQzDAk10+DfLTNEXPgZ5jNBu3MBXqjyNRTTU+wEGAyUmHxv+ZJfjeBIM2Hgkl+lp2Bi5qQlsUduYtbXXrPQZzbgzIk+Rr0yY7/mfYSEXR41Uqv1QLScs2+Dpf713Lyr7H97bf64m1mzLd5vrps94JlqHSmcRzqENsW7HpdRmnpD7R+2lJe2faVX1HIT/mh/PjMItefbOhgV5FtcHcUiINVqi/4bmK68fPTXD+OBLuOHRkp1rYME6Z9pxXa6H6Ji8rIGOAHf2XyGqbvR80pG8n/jMk8AmaZLlvzCk1YAocphZDFAV/jm5zwFiUCzrND6mz4xCWJ8lJb2ZPoQpuGUppg/agoASFPeimbJp5zRuUp9tLL1xra0b9NjAA42M6ju1CkDvvNnRGEk/E9AD/G6v4AxHP5dzzmIlLSS6sNIDADPkdIfRhwe1Y7aF3TrYNq/P97Z1whtQ== schroeder@Christians-MacBook-Pro.local'
-
   - name: annette
     user_id: 1006
     group_id: 1006
@@ -72,6 +64,76 @@ extra_user:
       - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5IhVprsvVOcFPbZzD9xR0nCjZ/9qVG6RhLJ7QBSts81nRvLwnmvcMBHSf5Rfaigey7Ff5dLHfJnxRE0KDATn6n2yd/5mXpn2GAA8hDVfhdsmsb5U7bROjZNr8MmIUrP7c3msUGx1FtvzhwxtyvIWOFQpWx+W5biBa6hFjIxT1pkUJqe6fclp7xbGYKZiqZRBS4qKG5CpKnisuOYDsqYPND+OkU+PShoxGVzp1JywIVze7qeKv6GyYbRA9SP9Np+5Mit6B21Io4zOI81c2Rz6sPX7mwEAQEs7iCm2hzG8qJws45Lb4ERqDkVEVhGNUyHjHgGebS1sZx1mLExdurXlPm1l/EamkncDFDCutHXtLP7lsFFiym7fKUjSEgiiLmyu5Xm+mwZvesKa1FYNaeiFWfYZpCJrNzIk+ffs+mgg3kmL4Sd4Ooy7jXPX+WJe5Xyh1KLU/+Wj2TVrhN+LbmupYAti/Wgd3DA1v601svmG82aLmyJRtKC0rGMePH3kDbtqU72kYpzI8mXERe1TIQ00Z77kQBR/7BF/9y5/0YmYDcXt1wNCoSie+mzz3xYcEdLAc7T+DhYpd4M6VgWnuz/exzRzhQwoSdEKkEED8CpEoBrEWEiMdrlElGmlkVomLU7P9i9j1rshX/pAq0asnqeSoPdC3vNbU3keiJQnhIHECvw== chris@luna'
 
 
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.52.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - wf.netz
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
 # ---

host_vars/backup.oopen.de.yml

@@ -22,6 +22,21 @@ root_ssh_keypair:
     priv_key_dest: /root/.ssh/id_ed25519-borg-backup
     pub_key_src: backup.oopen.de/root/.ssh/id_ed25519-borg-backup.pub
     pub_key_dest: /root/.ssh/id_ed25519-borg-backup.pub
+  - name: id_ed25519-backup
+    priv_key_src: backup.oopen.de/root/.ssh/id_ed25519-backup
+    priv_key_dest: /root/.ssh/id_ed25519-backup
+    pub_key_src: backup.oopen.de/root/.ssh/id_ed25519-backup.pub
+    pub_key_dest: /root/.ssh/id_ed25519-backup.pub
+  - name: id_ed25519-gitea
+    priv_key_src: backup.oopen.de/root/.ssh/id_ed25519-gitea
+    priv_key_dest: /root/.ssh/id_ed25519-gitea
+    pub_key_src: backup.oopen.de/root/.ssh/id_ed25519-gitea.pub
+    pub_key_dest: /root/.ssh/id_ed25519-gitea.pub
+#  - name: id_rsa
+#    priv_key_src: backup.oopen.de/root/.ssh/id_rsa
+#    priv_key_dest: /root/.ssh/id_rsa
+#    pub_key_src: backup.oopen.de/root/.ssh/id_rsa.pub
+#    pub_key_dest: /root/.ssh/id_rsa.pub
 
 
 # ---
@@ -226,11 +241,9 @@ default_user:
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMvy+IDUeoVwLg+cJNcKzls5guOrVUretsf05v3Y2N+Y root@default-oopen-server'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcEPd+MDJKzWqWStt3XpJU1OpJ0uxmipacIGkm6k3MS root@default-warenform-server'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/eGKbdxPYu7L/b/DjZrWek50e0AnkHFZS+zV12o5jy root@borg-client-key-warenform'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ6Sra1D8JU2A68G4rSny7D0ukYKy89NVMXbdxrtdZwr root@borg-client-key-oopen'
 
   - name: borg
     user_id: 1065
@@ -249,8 +262,10 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMtIXFS9OrKBvBl+fKtYN/lOOKpPuuc02H8HV+++LeBU root@backup'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZkez42c+5KVt/ZOhwslO321ibzV02oMImImRGNBIRD root@backup.warenform.de'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKT+QOy+R6O4ojAeB7y/CRMmfbB19rFstvEW7saHpHMX root@c.mx'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDXaxrm1MdUsiGviWJX/LaaaTaHga7+GKXYZPjUr5aBV root@chamaesiphon'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPrJu40Up1x9VCTTac6+ANjJ2NFXfDb5v3dP4pVgm+c root@cl-01'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7JBJ0qQJsTlADj/zMoxGlzPCGlnh0ngDS5+tkyVqgf root@cl-02'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIORi7e7u0KhCkCB8iCmPud0hzCwnJVhxpPmy8vFFkFgY root@cl-dissens'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN3VloFw13vVt8UAV5h0860Wq/vFJEm5EazOqM+cVe17 root@cl-flr'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGRaUsGqBvZBDzyh1kuldC/jdbtuoXFgBZ7PbgSqytSn root@cl-fm'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvmOpsiL+eiJ3qZVDJiUCFVZge0OQJ1hpZgw7pJ8sq5 root@cl-irights'
@@ -264,10 +279,13 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDNzUe1NSR+r3RTQ11QMUudiyrAWVwWzsgAlxvxx43wN root@dc-opp'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMHxvK5kzKgypVi8ZvshveSpyo0eSXiBCnAC5Pcjdgv root@discourse'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDy5WM1qsLE2SRwWG1Y38WJcMYUpL8MuQiraqiXfHzaH root@e.mx'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOvOkCWNKUJ5o9e+0NhY4IFZv8LA7tkkkEFjr8nqFKhe root@formbricks-nd'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJPbony+4g4iFS32Cv/Bkmet4FsCAsrGTffwWm2eM16x root@git.warenform'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqqmBWh3qmnx41NiLCn1LhVG0mn4++IUvRNC0OMh6h6 root@gitoea'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICR9o0+6jnfmXKOedKP6IZgt5lRIPFSJJ4FbMjz2SPkH root@gw-campus'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFEm1P7Pg3Tlm02bxkropKf3CcyTCAB3YCMxPSjai2lc root@gw-dissens'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBYFe6i0UdPRyENvfaJSJVCHtmnlJmhbqGEsdIlTapsj root@initiativenserver'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ54/I+TdZUA+Xc6bixSa3f0hN5y4kWW+xl9kqSZPBYS root@keycloak-nd'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO886BNZ/o9aBwkKqHku+MjS5/GEVRBbXXSF76ry7oZR root@mail-cadus'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsPJQGHl1GVZ3yPl3Oi3xlH+EUsN1/EWDY2XAohag/P root@mail-fm'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICM4+Zvs5SY3E2cAMdnta1BujzudGg/97nz+nE5sipVD root@matomo-01'
@@ -285,6 +303,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMTxl1BwIslVhsiFCZeRlgwoSO2ahaHWwMeiKAIRFJm6 root@o13-pad'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBHl2xONyeBX/gnJ4iVeSVoxu/W6ku2VorA5gxAbp95q root@o13-staging-board'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaXEVvhblxX045H2/B/6RJmoW77WOKJM5FQfvMUPCIs root@o13-web'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAp24VDXOsa0MuzGFaFa3CPDUsnA/ASojHAiN344m+dP root@o14'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICcQ9MFqTMOmjnec4ftUJAYiAe8p7pp7a5EBSIM0A5ji root@o17'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFstQOOM/U18SV27+XTtBhso+vICK5L4aOGC83QnvS8+ root@o19'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC85aj16Ow1ZPutkp5TmZdxjMsECkhnO64ktc3OYZJHc root@o25-board'
@@ -294,6 +313,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEM1SI7Lwk0G8UycysL7ZPdXm1DRGgPnr01B0ewRGEKi root@o24'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJKfPInE9VjXVe+6DQ+4/H1nQJwXljYEK6gwfmTDgGy root@o26'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIES9ftVcNMv6pW2HDM12fIbOOEvq1fcd74kbO4LHfhGH root@o28'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDtACieGFf34NDepB9GqJjVqji6bf6xrO1LevXgm3aN+ root@o29'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE70FVVu2bsdH2qJITFVSDEPraiI4uSCuzEkYlbl6pRW root@o30'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF0+aRoMxzmiQCAIMajNhbTZEumtZ9yCG2Nb4ucqK8lo root@o31'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOJvhepf3kho9zJz1QO52aLbr4/Rim/FLdENg1GNKCPx root@o32'
@@ -309,6 +329,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMUnxlKIffm8a5BmoQE40h8ut0R6eCxcm+Iewv3evmE9 root@oolm-shop'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF4ylglAkPst7G6kES2lE96ECp0AGXGjzCVkZSqGVru6 root@oolm-shop-dev'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJJCzTmrRp0s0qpkf9HYyx4lL+zs1jTAYcCsvqpJ72p root@super-opferhilfefonds'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID82UUUkYKYFbJdmTcMYu+vl3M0FVQznXFbngqPoumP+ root@prometheus-nd'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJU5HzfGYZwWeaoAGGFF7/3VQP19ce6Rgn5wcOR98Q3o root@server26'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBRfCFz6mPdn3TKVCgffHQAKt3LN/0srS/gBsMoOyZpi root@shop-agr'

host_vars/backup.warenform.de.yml

@@ -17,17 +17,37 @@
 insert_root_ssh_keypair: true
 
 root_ssh_keypair:
+
+  - name: id_ed25519-gitea
+    priv_key_src: backup.warenform.de/root/.ssh/id_ed25519-gitea
+    priv_key_dest: /root/.ssh/id_ed25519-gitea
+    pub_key_src: backup.warenform.de/root/.ssh/id_ed25519-gitea.pub
+    pub_key_dest: /root/.ssh/id_ed25519-gitea.pub
+
   - name: borg-client_key
     priv_key_src: backup.warenform.de/root/.ssh/borg-client_key
     priv_key_dest: /root/.ssh/borg-client_key
     pub_key_src: backup.warenform.de/root/.ssh/borg-client_key.pub
     pub_key_dest: /root/.ssh/borg-client_key.pub
+
   - name: id_ed25519-borg-backup
     priv_key_src: backup.warenform.de/root/.ssh/id_ed25519-borg-backup
     priv_key_dest: /root/.ssh/id_ed25519-borg-backup
     pub_key_src: backup.warenform.de/root/.ssh/id_ed25519-borg-backup.pub
     pub_key_dest: /root/.ssh/id_ed25519-borg-backup.pub
 
+  - name: id_ed25519-backup
+    priv_key_src: backup.warenform.de/root/.ssh/id_ed25519-backup
+    priv_key_dest: /root/.ssh/id_ed25519-backup
+    pub_key_src: backup.warenform.de/root/.ssh/id_ed25519-backup.pub
+    pub_key_dest: /root/.ssh/id_ed25519-backup.pub
+
+#  - name: id_rsa
+#    priv_key_src: backup.warenform.de/root/.ssh/id_rsa
+#    priv_key_dest: /root/.ssh/id_rsa
+#    pub_key_src: backup.warenform.de/root/.ssh/id_rsa.pub
+#    pub_key_dest: /root/.ssh/id_rsa.pub
+
 
 # ---
 # vars used by roles/common/tasks/basic.yml
@@ -150,16 +170,6 @@ cron_user_entries:
     hour: '*'
     job: /root/bin/postfix/check-postfix-fatal-errors.sh
 
-  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
-    minute: '23'
-    hour: '05'
-    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
-
-  - name: "Check whether all certificates are included in the VHOST configurations"
-    minute: '33'
-    hour: '05'
-    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
-
   - name: "Check if remote website is online"
     minute: '*/15'
     hour: '7-23'
@@ -176,22 +186,8 @@ cron_user_entries:
 # ---
 
 insert_ssh_keypair_backup_server: false
-ssh_keypair_backup_server:
-  - name: backup
-    backup_user: back
-    priv_key_src: root/.ssh/id_rsa.backup.warenform.de
-    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: root/.ssh/id_rsa.backup.warenform.de.pub
-    pub_key_dest: /root/.ssh/id_rsa.pub
 
-insert_keypair_backup_client: true
+
-ssh_keypair_backup_client:
-  - name: backup
-    priv_key_src: root/.ssh/id_ed25519.warenform-server
-    priv_key_dest: /root/.ssh/id_ed25519
-    pub_key_src: root/.ssh/id_ed25519.warenform-server.pub
-    pub_key_dest: /root/.ssh/id_ed25519.pub
-    target: backup.warenform.de
 
 
 default_user:
@@ -237,11 +233,9 @@ default_user:
     shell: /bin/bash
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMvy+IDUeoVwLg+cJNcKzls5guOrVUretsf05v3Y2N+Y root@default-oopen-server'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcEPd+MDJKzWqWStt3XpJU1OpJ0uxmipacIGkm6k3MS root@default-warenform-server'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/eGKbdxPYu7L/b/DjZrWek50e0AnkHFZS+zV12o5jy root@borg-client-key-warenform'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ6Sra1D8JU2A68G4rSny7D0ukYKy89NVMXbdxrtdZwr root@borg-client-key-oopen'
 
   - name: borg
     user_id: 1065
@@ -258,6 +252,9 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE1RkJYM8qcEagoKt9gNVaeBbXZEJscqIBNnhL/KZfSA root@munin.oopen.de'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIj2SdZgxG4NCjUiCXY7msCG+Vn6MQ5jsGxrs2qn1QZh root@mx'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQAvCK/h7+8h8hPm3WyeEdBbhY4SdOSWJYxuFW24XbM root@nd'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICwG3cYT1S5ttaf7OCB2dfBAg4FFA3OO3HPTkiclaVFi root@server22'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJyse/Fby2JiHjM10uotVfsBYO0W1EgmtFG2q+Q1xe38 root@server24'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIH9V1aqgZSqu7vfK9e5qGKm+ICHd8VglRr0Brm4kXfu root@server25'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBOOYhdtNPAQP8BlgSYBaMfWl8Yv4Y9ww7SWeLOn0HXH root@web0'
 
 

host_vars/bbb-server.b3-bornim.netz.yml

@@ -161,54 +161,6 @@ cron_user_special_time_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$LIF1RrShGDGdCXkUubRPR/$N8M5c/dhBdJkJrLP3/Lchyosjg0FxaQ2M4epvuzTI78
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
 
 sudo_users:
   - chris

host_vars/cl-dissens.oopen.de.yml

@@ -0,0 +1,151 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+sshd_permit_root_login: !!str "prohibit-password"
+
+# ---
+# vars used by apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+sudo_users:
+  - chris
+  - sysadm
+  - localadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+sudoers_file_user_privileges:
+  - name: back
+    entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+

host_vars/cl-irights-neu.oopen.de.yml

@@ -0,0 +1,151 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+sshd_permit_root_login: !!str "prohibit-password"
+
+# ---
+# vars used by apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+sudo_users:
+  - chris
+  - sysadm
+  - localadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+sudoers_file_user_privileges:
+  - name: back
+    entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+

host_vars/cl-irights.oopen.de.yml

@@ -99,6 +99,90 @@ resolved_fallback_nameserver:
    - 194.150.168.168
 
 
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if webservices sre running. Restart if necessary"
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_webservice_load.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Optimize mysql tables"
+    minute: '53'
+    hour: '04'
+    job: /root/bin/mysql/optimize_mysql_tables.sh
+
+  - name: "Flush query cache for mysql tables"
+    minute: '27'
+    hour: '04'
+    job: /root/bin/mysql/flush_query_cache.sh
+
+  - name: "Flush Host cache"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/mysql/flush_host_cache.sh
+
+  - name: "Run occ file:scan for each cloud account"
+    minute: '02'
+    hour: '23'
+    job: /root/bin/nextcloud/occ_maintenance.sh -s cloud-irights.oopen.de
+
+  - name: "Background job for nextcloud instance 'cloud-irights.oopen.de"
+    minute: '*/15'
+    hour: '*'
+    job: sudo -u "www-data" /usr/local/php/bin/php  -f /var/www/cloud-irights.oopen.de/htdocs/cron.php
+
+  - name: "Check if certificates for coolwsd service are up to date"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/nextcloud/check_cert_coolwsd.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '23'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/devel-db.wf.netz.yml

@@ -0,0 +1,163 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.52.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - wf.netz
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/nfs.yml
+# ---
+
+
+
+# ---
+# vars used by roles/common/tasks/samba-config-server.yml
+# vars used by roles/common/tasks/samba-user.yml
+# ---
+
+
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/devel-php.wf.netz.yml

@@ -0,0 +1,163 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.52.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - wf.netz
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/nfs.yml
+# ---
+
+
+
+# ---
+# vars used by roles/common/tasks/samba-config-server.yml
+# vars used by roles/common/tasks/samba-user.yml
+# ---
+
+
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/devel-repos.wf.netz.yml

@@ -0,0 +1,163 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.52.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - wf.netz
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/nfs.yml
+# ---
+
+
+
+# ---
+# vars used by roles/common/tasks/samba-config-server.yml
+# vars used by roles/common/tasks/samba-user.yml
+# ---
+
+
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/devel-wiki.wf.netz.yml

@@ -0,0 +1,163 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.52.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - wf.netz
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/nfs.yml
+# ---
+
+
+
+# ---
+# vars used by roles/common/tasks/samba-config-server.yml
+# vars used by roles/common/tasks/samba-user.yml
+# ---
+
+
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/file-ah.kanzlei-kiel.netz.yml

@@ -168,6 +168,68 @@ resolved_fallback_nameserver:
    - 194.150.168.168
 
 
+# ---
+# vars used by roles/common/tasks/users
+# ---
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$sHxqz7NyYdn38ZegSbewO.$PPHR0n.XeMcS3AQ9KybllBT.2hxpYlQ7AiVhxHgUOX8
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: localadmin
+    user_id: 1051
+    group_id: 1051
+    group: localadmin
+    home: /home/localadmin
+    password: $y$j9T$1WH8G2UkuN1jjp4QLuoeC0$dXpOnJUfMMAqAXlwN8XD0pq78r.a4UZOgt3LY4afxy/
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$WmitGB98lhPLJ39Iy4YfH.$irv0LP1bB5ImQKBUr1acEif6Ed6zDu6gLQuGQd/i5s0
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
+
+
+  - name: borg
+    user_id: 1065
+    group_id: 1065
+    group: borg
+    home: /home/borg
+    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF7MKFmJ2kJrNs5DhlPqfizZgz3wNpzFAITo63p/VBOe root@file-ah'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItQLQ7lhBY2USF4Jcp4teF+1NydI73VeHYbQW8q4Mcw root@gw-ah'
+
+
+
 # ---
 # vars used by roles/common/tasks/cron.yml
 # ---
@@ -185,59 +247,6 @@ resolved_fallback_nameserver:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$1X6iXiYz2fIQcfKWSSzno1$9Uos8SGn/8V3oHWwiR6kaRPfUuIrxKP8kRNUZ1.da3/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - localadmin
-  - sysadm
-
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
 # ---

host_vars/file-blkr-alt.blkr.netz.yml

@@ -182,59 +182,6 @@ cron_user_special_time_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$qmeacaq0WLATk6o7374lj1$1MrdyEubi5m4E9MCNZWrS04nZi1Qgk4vHu.J5LwKrJB:19757
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - localadmin
-  - sysadm
-
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
 # ---

host_vars/file-blkr.blkr.netz.yml

@@ -182,59 +182,6 @@ cron_user_special_time_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$qmeacaq0WLATk6o7374lj1$1MrdyEubi5m4E9MCNZWrS04nZi1Qgk4vHu.J5LwKrJB:19757
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - localadmin
-  - sysadm
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
@@ -254,7 +201,7 @@ sudo_users:
 
 sudoers_file_user_aliases:
    - name: MAIN_USER
-     entry: 'josephine, julius, julius-e, sebastian'
+     entry: 'josephine, julius, julius-e, leonie,  buero1, buero2, buero3, referendariat, refa, ref1, sebastian, buero-05, buero-06, lap-01'
 
 sudoers_file_cmnd_aliases:
    - name: REBOOT 
@@ -392,6 +339,10 @@ samba_user:
     groups:
       - buero
     password: '4/zCNXnVF7+i'
+  - name: refa
+    groups:
+      - buero
+    password: 'Mehringdamm40'
   - name: ref1
     groups:
       - buero
@@ -409,6 +360,14 @@ samba_user:
     groups:
       - buero
     password: 'N-ba2R+i/2eM'
+  - name: lap-01
+    groups:
+      - buero
+    password: 'X_2yYs2AIo.E'
+#  - name: lap-02
+#    groups:
+#      - buero
+#    password: 'N.i/_UXcG5C9'
 
 base_home: /data/home
 

host_vars/file-dissens.dissens.netz.yml

@@ -0,0 +1,588 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+
+network_interfaces:
+
+  - device: eno1np0
+    # use only once per device (for the first device entry)
+    headline: eno1 - LAN
+
+    # auto & allow are only used for the first device entry
+    allow: [] # array of allow-[stanzas] eg. allow-hotplug
+    auto: true
+
+    family: inet
+    method: static
+    description:
+    address: 192.168.132.10
+    netmask: 24
+    gateway: 192.168.132.254
+
+    # optional dns settings nameservers: []
+    #
+    #    nameservers:
+    #      - 194.150.168.168  # dns.as250.net
+    #      - 91.239.100.100   # anycast.censurfridns.dk
+    #    search: warenform.de
+    #
+    #nameservers:
+    #  - 192.168.132.1
+    #search: blkr.netz
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.132.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.132.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - dissens.netz
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users
+# ---
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$sHxqz7NyYdn38ZegSbewO.$PPHR0n.XeMcS3AQ9KybllBT.2hxpYlQ7AiVhxHgUOX8
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: localadmin
+    user_id: 1051
+    group_id: 1051
+    group: localadmin
+    home: /home/localadmin
+    password: $y$j9T$1WH8G2UkuN1jjp4QLuoeC0$dXpOnJUfMMAqAXlwN8XD0pq78r.a4UZOgt3LY4afxy/
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$WmitGB98lhPLJ39Iy4YfH.$irv0LP1bB5ImQKBUr1acEif6Ed6zDu6gLQuGQd/i5s0
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
+
+#extra_user:
+#
+#  - name: borg
+#    user_id: 1065
+#    group_id: 1065
+#    group: borg
+#    home: /home/borg
+#    password: $y$j9T$SZty9T8ZWbnyHR2S85xaG.$GhxHOKG9fKErT9s5TAehXXyZJSkNaIcXY18Rg1iMyhC
+#    shell: /bin/bash
+#    ssh_keys:
+#      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+#      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+#      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHXrNhcgNtZykTgzcwX/L1cL8qpSyQQy75M01UpjdSmA root@file-dissens'
+#      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFEm1P7Pg3Tlm02bxkropKf3CcyTCAB3YCMxPSjai2lc root@gw-dissens'
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_user_entries:
+
+  - name: "Daily Backup "
+    minute: "03"
+    hour: "00"
+    job: /root/crontab/backup-rborg2/rborg2.sh
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    minute: "*/5"
+    hour: "*"
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors."
+    minute: "*/30"
+    hour: "*"
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Clean up Samba Trash Dirs"
+    minute: "02"
+    hour: "23"
+    job: /root/bin/samba/clean_samba_trash.sh
+
+  - name: "Set (group and access) Permissons for Samba shares"
+    minute: "14"
+    hour: "23"
+    job: /root/bin/samba/set_permissions_samba_shares.sh
+
+  - name: "Check if ntpsec is running. Restart service if needed."
+    minute: "*/6"
+    hour: "*"
+    job: /root/bin/monitoring/check_ntpsec_service.sh
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+sudoers_file_user_aliases:
+   - name: MAIN_USER
+     entry: 'malte.taeubrich, ulla.wittenzellner, sarah.klemm, bernard.koennecke, elenor.faellgren, mario.freidank '
+
+sudoers_file_cmnd_aliases:
+   - name: REBOOT 
+     entry: '/sbin/reboot'
+   - name: MANAGE_SERVICE
+     entry: '/usr/bin/systemctl'
+
+
+sudoers_file_user_privileges:
+  - name: MAIN_USER
+    entry: ALL = REBOOT
+  - name: MAIN_USER
+    entry: ALL = MANAGE_SERVICE
+
+#  - name: julius
+#    entry: 'ALL=(root) NOPASSWD: /sbin/reboot'
+#  - name: josephine
+#    entry: 'ALL=(root) NOPASSWD: /sbin/reboot'
+#  - name: sebastian
+#    entry: 'ALL=(root) NOPASSWD: /sbin/reboot'
+#  - name: julius-e
+#    entry: 'ALL=(root) NOPASSWD: /sbin/reboot'
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/ntp.yml
+# ---
+
+local_ntp_service: true
+
+ntp_server: gw-dissens.dissens.netz
+
+
+# ---
+# vars used by roles/common/tasks/nfs.yml
+# ---
+
+nfs_server: 192.168.132.10
+
+# Set 'fs_encrypted' to true if filesystem lives on an encrypted
+# partition.
+#
+# NOTE !!
+#    Take car to increase 'fsid' in case of more than one export
+#
+nfs_exports:
+   - src: 192.168.132.10:/data/samba/shares
+     path: /data/samba/shares
+     mount_opts: users,rsize=8192,wsize=8192,hard,intr
+     export_opt: rw,root_squash,sync,subtree_check
+     export_networks:
+       - 192.168.132.0/24
+       - 10.0.192.0/24
+       - 10.1.192.0/24
+       - 192.168.63.0/24
+     use_fsid_option: true
+
+
+# ---
+# vars used by roles/common/tasks/samba-config-server.yml
+# vars used by roles/common/tasks/samba-user.yml
+# ---
+
+samba_server_ip: 192.168.132.10
+samba_server_cidr_prefix: 24
+
+samba_workgroup: DISSENS
+
+samba_netbios_name: FILE-DISSENS
+
+samba_server_min_protocol: !!str NT1
+
+samba_groups:
+  - name: team
+    group_id: 1100
+  - name: projekte
+    group_id: 1110
+  - name: verwaltung
+    group_id: 1200
+  - name: gf
+    group_id: 1300
+
+samba_user:
+  - name: bernard.koennecke
+    groups:
+      - gf
+      - projekte
+      - team
+      - verwaltung
+    password: '20.ber-n4rd.ko3n-3cke-24!'
+
+  - name: chris
+    groups:
+      - gf
+      - projekte
+      - team
+      - verwaltung
+    password: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          63643330373231636537366333326630333265303265653933613835656262323863363038653234
+          3462653135633266373439626263356636646637643035340a653466356235346663626163306363
+          61313164643061306433643738643563303036646334376536626531383965303036386162393832
+          6631333038306462610a356535633265633563633962333137326533633834636331343562633765
+          3631
+
+  - name: david.gelhaar
+    groups:
+      - projekte
+      - team
+      - verwaltung
+    password: '20-dav1d.g3lh44r_24%'
+
+  - name: elenor.faellgren
+    groups:
+      - projekte
+      - team
+      - verwaltung
+    password: '20/3l3n0r-fa3llg3em/24?'
+
+  - name: johanna.hess
+    groups:
+      - projekte
+      - team
+    password: '20_j0h4nn4_h3ss-24+'
+
+  - name: johanna.ruekgauer
+    groups:
+      - projekte
+    password: '20.j0hanna.ru3kgau3r+24!'
+
+  - name: laura.sasse
+    groups:
+      - projekte
+      - team
+    password: '20/l4ur4-s4sse-24?'
+
+  - name: lino.koehler
+    groups:
+      - projekte
+    password: '20.l1no-ko3hl3r_25/'
+
+  - name: maite.gabriel
+    groups:
+      - projekte
+    password: '20+m4ite.g4briel-24+'
+
+  - name: malte.taeubrich
+    groups:
+      - gf
+      - projekte
+      - team
+      - verwaltung
+    password: '20%m4lt3-t3ubrich+24!'
+
+  - name: mario.freidank
+    groups:
+      - projekte
+      - team
+      - verwaltung
+    password: '20-mar1o.fr31dank-24+'
+
+  - name: olaf.stuve
+    groups:
+      - projekte
+    password: '20-0l4f_stuve_24?"'
+
+  - name: ralph.klesch
+    groups:
+      - projekte
+      - team
+      - verwaltung
+    password: '20/r4lph-kl3sch.24-'
+
+  - name: rositsa.mahdi
+    groups:
+      - projekte
+    password: '20.ros1tsa-mahd1+24+'
+
+  - name: selma.albrecht
+    groups:
+      - projekte
+    password: '20-sel-ma.al-brecht/25!'
+
+  - name: sarah.klemm
+    groups:
+      - gf
+      - projekte
+      - team
+      - verwaltung
+    password: '20.s4r4h_kl3mm-24!'
+
+  - name: selma.albrecht
+    groups:
+      - projekte
+    password: '20-sel-ma.al-brecht/25!'
+
+  - name: scan
+    groups:
+      - team
+    password: '20-sc4n.25!'
+
+  - name: sebastian.scheele
+    groups:
+      - projekte
+      - team
+    password: '20/s3-bast1an+sch33l3_24-'
+
+  - name: simon.krugmann
+    groups:
+      - projekte
+    password: '20%sim0n.krugm4nn.24?'
+
+  - name: tabea.koepp
+    groups:
+      - projekte
+      - team
+    password: '20?tab3a/ko3pp.24/'
+
+  - name: till.dahlmueller
+    groups:
+      - projekte
+      - team
+    password: '20.t1ll/d4hlmueller-24!'
+
+  - name: ulla.wittenzellner
+    groups:
+      - gf
+      - projekte
+      - team
+      - verwaltung
+    password: '20+ull4_w1tt3nz3lln3r_24-'
+
+  - name: yannik.markhof
+    groups:
+      - projekte
+      - team
+    password: '20.y4nnik/m4rkhof_24/'
+
+base_home: /data/home
+
+# remove_samba_users:
+#   - name: name1
+#   - name: name2
+#
+remove_samba_users: []
+#remove_samba_users: 
+#  - name: elenor.faellgrem
+#  - name: maiken.schiele
+
+samba_shares:
+
+  - name: GF
+    comment: GF auf Fileserver
+    path: /data/samba/shares/GF
+    group_valid_users: gf
+    group_write_list: gf
+    file_create_mask: !!str 660
+    dir_create_mask: !!str 2770
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+  - name: Projekte
+    comment: verwaltung auf Fileserver
+    path: /data/samba/shares/Projekte
+    group_valid_users: projekte
+    group_write_list: projekte
+    file_create_mask: !!str 664
+    dir_create_mask: !!str 2775
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+  - name: Team
+    comment: verwaltung auf Fileserver
+    path: /data/samba/shares/Team
+    group_valid_users: team
+    group_write_list: team
+    file_create_mask: !!str 664
+    dir_create_mask: !!str 2775
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+  - name: Verwaltung
+    comment: verwaltung auf Fileserver
+    path: /data/samba/shares/Verwaltung
+    group_valid_users: verwaltung
+    group_write_list: verwaltung
+    file_create_mask: !!str 660
+    dir_create_mask: !!str 2770
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/file-ebs.ebs.netz.yml

@@ -174,6 +174,67 @@ resolved_fallback_nameserver:
    - 172.16.182.254
 
 
+# ---
+# vars used by roles/common/tasks/users
+# ---
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$sHxqz7NyYdn38ZegSbewO.$PPHR0n.XeMcS3AQ9KybllBT.2hxpYlQ7AiVhxHgUOX8
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: localadmin
+    user_id: 1051
+    group_id: 1051
+    group: localadmin
+    home: /home/localadmin
+    password: $y$j9T$1WH8G2UkuN1jjp4QLuoeC0$dXpOnJUfMMAqAXlwN8XD0pq78r.a4UZOgt3LY4afxy/
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$WmitGB98lhPLJ39Iy4YfH.$irv0LP1bB5ImQKBUr1acEif6Ed6zDu6gLQuGQd/i5s0
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
+
+
+  - name: borg
+    user_id: 1065
+    group_id: 1065
+    group: borg
+    home: /home/borg
+    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAMFUnBjVV0WjUlhd2FT49nXlpHUDPEwaJ7bAvRJfB56 root@file-ebs'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBK8Ngbtl8Yjtk1JkT0Xn1HVIAHKdtfh0qicnnJTa3Kx root@gw-ebs'
+
+
 # ---
 # vars used by roles/common/tasks/cron.yml
 # ---
@@ -191,59 +252,6 @@ cron_user_special_time_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$WWsYp2DSIw4jNx5/IaKzY1$VjvTQYvSaQtJDiiNYxOUDEx9QdIPTZ1YWXSSaS1whH/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - localadmin
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
@@ -314,6 +322,9 @@ samba_netbios_name: FILE-EBS
 
 samba_groups:
 
+  - name: sysadm
+    group_id: 1050
+
   - name: admin
     group_id: 1100
 
@@ -365,6 +376,12 @@ samba_user:
       - recherche
     password: 'IrcR3uo-QJ.5'
 
+  - name: winadm
+    groups:
+      - admin
+      - sysadm
+    password: 'ZbPS.Lh6d-9E'
+
   - name: buero
     groups:
       - alle
@@ -505,6 +522,21 @@ samba_shares:
     vfs_object_recycle: false
 
 
+    # ---
+    # - This share will be written by Windows Server 2016 configured at
+    # - "Windows Zubehör" -> "Windows Server-Sicherung"
+    # ---
+  - name: WinServer2022-Backup
+    comment: WinServer2022-Backup on Fileserver
+    path: /data/samba/shares/WinServer2022-Backup
+    group_valid_users: sysadm
+    group_write_list: sysadm
+    file_create_mask: !!str 664
+    dir_create_mask: !!str 2775
+    guest_ok: !!str yes
+    vfs_object_recycle: false
+
+
 
 # ==============================
 

host_vars/file-fhxb.fhxb.netz.yml

@@ -161,39 +161,6 @@ cron_user_special_time_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$2aYNjVAaYCJ7KuKYMjX3o1$M7E8/NkOHJnmmVcx0zD27oYExIf2aEergJ1KBnVbn92
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/file-fm.fm.netz.yml

@@ -0,0 +1,527 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+
+network_interfaces:
+
+  - device: eno1np0
+    # use only once per device (for the first device entry)
+    headline: eno1 - LAN
+
+    # auto & allow are only used for the first device entry
+    allow: [] # array of allow-[stanzas] eg. allow-hotplug
+    auto: true
+
+    family: inet
+    method: static
+    description:
+    address: 192.168.222.10
+    netmask: 24
+    gateway: 192.168.222.254
+
+    # optional dns settings nameservers: []
+    #
+    #    nameservers:
+    #      - 194.150.168.168  # dns.as250.net
+    #      - 91.239.100.100   # anycast.censurfridns.dk
+    #    search: warenform.de
+    #
+    #nameservers:
+    #  - 192.168.222.1
+    #search: blkr.netz
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.222.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.132.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.222.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - fm.netz
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users
+# ---
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$UHsnOrOT5qXnAwrPCzB7A1$jnqz4CHvLEaIke3RxnresjAOS6NfcTxyDH/fbKnXTC/
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: localadmin
+    user_id: 1051
+    group_id: 1051
+    group: localadmin
+    home: /home/localadmin
+    password: $y$j9T$1WH8G2UkuN1jjp4QLuoeC0$dXpOnJUfMMAqAXlwN8XD0pq78r.a4UZOgt3LY4afxy/
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$WmitGB98lhPLJ39Iy4YfH.$irv0LP1bB5ImQKBUr1acEif6Ed6zDu6gLQuGQd/i5s0
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
+
+
+  - name: borg
+    user_id: 1065
+    group_id: 1065
+    group: borg
+    home: /home/borg
+    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHUvk8+UduCcBbQO1YxXSU8SaGIl8x+TBmIFmPb9JQu8 root@gw-fm'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0ibOee8TvYlrEzKno5J6h3ZQs79i0wPElqYvQxAymK root@file-fm'
+
+#extra_user:
+#
+#  - name: borg
+#    user_id: 1065
+#    group_id: 1065
+#    group: borg
+#    home: /home/borg
+#    password: $y$j9T$SZty9T8ZWbnyHR2S85xaG.$GhxHOKG9fKErT9s5TAehXXyZJSkNaIcXY18Rg1iMyhC
+#    shell: /bin/bash
+#    ssh_keys:
+#      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+#      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+#      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHXrNhcgNtZykTgzcwX/L1cL8qpSyQQy75M01UpjdSmA root@file-dissens'
+#      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFEm1P7Pg3Tlm02bxkropKf3CcyTCAB3YCMxPSjai2lc root@gw-dissens'
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_user_entries:
+
+  - name: "Daily Backup "
+    minute: "03"
+    hour: "00"
+    job: /root/crontab/backup-rborg2/rborg2.sh
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    minute: "*/11"
+    hour: "*"
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check if ntpsec is running. Restart service if needed."
+    minute: "*/7"
+    hour: "*"
+    job: /root/bin/monitoring/check_ntpsec_service.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: "*/13"
+    hour: "*"
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if systemd-resolved service is running. Restart service if needed."
+    minute: "*/17"
+    hour: "*"
+    job: /root/bin/monitoring/check_systemd_service.sh systemd-resolved
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors."
+    minute: "*/30"
+    hour: "*"
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Clean up Samba Trash Dirs"
+    minute: "02"
+    hour: "23"
+    job: /root/bin/samba/clean_samba_trash.sh
+
+  - name: "Set (group and access) Permissons for Samba shares"
+    minute: "14"
+    hour: "23"
+    job: /root/bin/samba/set_permissions_samba_shares.sh
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+sudoers_file_user_aliases:
+   - name: MAIN_USER
+     entry: 'sysadm'
+
+sudoers_file_cmnd_aliases:
+   - name: REBOOT 
+     entry: '/sbin/reboot'
+   - name: MANAGE_SERVICE
+     entry: '/usr/bin/systemctl'
+
+
+sudoers_file_user_privileges:
+  - name: MAIN_USER
+    entry: ALL = REBOOT
+  - name: MAIN_USER
+    entry: ALL = MANAGE_SERVICE
+
+#  - name: julius
+#    entry: 'ALL=(root) NOPASSWD: /sbin/reboot'
+#  - name: josephine
+#    entry: 'ALL=(root) NOPASSWD: /sbin/reboot'
+#  - name: sebastian
+#    entry: 'ALL=(root) NOPASSWD: /sbin/reboot'
+#  - name: julius-e
+#    entry: 'ALL=(root) NOPASSWD: /sbin/reboot'
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/ntp.yml
+# ---
+
+local_ntp_service: true
+
+ntp_server: gw-fm.fm.netz
+
+
+# ---
+# vars used by roles/common/tasks/nfs.yml
+# ---
+
+nfs_server: 192.168.222.10
+
+# Set 'fs_encrypted' to true if filesystem lives on an encrypted
+# partition.
+#
+# NOTE !!
+#    Take car to increase 'fsid' in case of more than one export
+#
+nfs_exports:
+   - src: 192.168.222.10:/data/samba/shares
+     path: /data/samba/shares
+     mount_opts: users,rsize=8192,wsize=8192,hard,intr
+     export_opt: rw,root_squash,sync,subtree_check
+     export_networks:
+       - 192.168.222.0/24
+       - 10.0.222.0/24
+       - 10.1.222.0/24
+       - 192.168.63.0/24
+     use_fsid_option: true
+
+
+# ---
+# vars used by roles/common/tasks/samba-config-server.yml
+# vars used by roles/common/tasks/samba-user.yml
+# ---
+
+samba_server_ip: 192.168.222.10
+samba_server_cidr_prefix: 24
+
+samba_workgroup: FM
+
+samba_netbios_name: FILE-FM
+
+samba_server_min_protocol: !!str NT1
+
+samba_groups:
+  - name: buero
+    group_id: 1100
+  - name: projekte
+    group_id: 1200
+  - name: verwaltung
+    group_id: 1300
+
+samba_user:
+  - name: sysadm
+    groups:
+      - buero
+      - projekte
+      - verwaltung
+    password: 'k6-C5.X-/YGm'
+
+  - name: chris
+    groups:
+      - buero
+      - projekte
+      - verwaltung
+    password: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          63643330373231636537366333326630333265303265653933613835656262323863363038653234
+          3462653135633266373439626263356636646637643035340a653466356235346663626163306363
+          61313164643061306433643738643563303036646334376536626531383965303036386162393832
+          6631333038306462610a356535633265633563633962333137326533633834636331343562633765
+          3631
+
+  - name: agnieszka
+    groups:
+      - buero
+    password: '20%4gni_eszk4-25-'
+
+  - name: anja
+    groups:
+      - buero
+      - projekte
+      - verwaltung
+    password: '20-4nj4.m4y3r_25?'
+
+  - name: anna
+    groups:
+      - buero
+      - projekte
+    password: '20.4n.n4-25!'
+
+  - name: barbara
+    groups:
+      - buero
+      - projekte
+      - verwaltung
+    password: '20.b4rb4r4-25?'
+
+  - name: dominique
+    groups:
+      - buero
+      - projekte
+      - verwaltung
+    password: '20/do-m1-ni1que/25?'
+
+  - name: franziska
+    groups:
+      - buero
+      - projekte
+      - verwaltung
+    password: '20-fr4nzisk4.25%'
+
+  - name: karina
+    groups:
+      - buero
+    password: '20_k4-ri-n4/25.'
+
+  - name: linda
+    groups:
+      - buero
+      - projekte
+    password: '20-l1n-d4.25%'
+
+  - name: michael
+    groups:
+      - buero
+    password: '20.m1cha-3l/25/'
+
+  - name: stephanie
+    groups:
+      - buero
+      - projekte
+      - verwaltung
+    password: '20.st3pha-ni3_25%'
+
+base_home: /data/home
+
+# remove_samba_users:
+#   - name: name1
+#   - name: name2
+#
+remove_samba_users: []
+#remove_samba_users: 
+#  - name: elenor.faellgrem
+#  - name: maiken.schiele
+
+samba_shares:
+
+  - name: Buero
+    comment: Buero auf Fileserver
+    path: /data/samba/shares/Buero
+    group_valid_users: buero
+    group_write_list: buero
+    file_create_mask: !!str 660
+    dir_create_mask: !!str 2770
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+  - name: Projekte
+    comment: Projekte auf Fileserver
+    path: /data/samba/shares/Projekte
+    group_valid_users: projekte
+    group_write_list: projekte
+    file_create_mask: !!str 664
+    dir_create_mask: !!str 2775
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+  - name: Verwaltung
+    comment: Verwaltung auf Fileserver
+    path: /data/samba/shares/Verwaltung
+    group_valid_users: verwaltung
+    group_write_list: verwaltung
+    file_create_mask: !!str 660
+    dir_create_mask: !!str 2770
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/file-kb.anw-kb.netz.yml

@@ -117,39 +117,6 @@ cron_user_special_time_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$LIF1RrShGDGdCXkUubRPR/$N8M5c/dhBdJkJrLP3/Lchyosjg0FxaQ2M4epvuzTI78
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/file-km.anw-km.netz.yml

@@ -181,59 +181,6 @@ cron_user_special_time_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$ypzdcD.iMXQGS4W1nCJvn1$pzQKmc6Y6rej4ZRBRGzAyHIyWHFhsUkTK2WYEi/a9s1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - localadmin
-  - sysadm
-
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
 # ---
@@ -332,7 +279,7 @@ samba_user:
       - advoware
       - alle
       - kanzlei
-    password: ''
+    password: 'YKQRa.M9-6rL'
 
   - name: aphex2
     groups:
@@ -438,16 +385,16 @@ samba_user:
       - public
     password: 'zHfj9g3NcC'
 
-  - name: gerhard
+#  - name: gerhard
-    groups:
+#    groups:
-      - advoware
+#      - advoware
-      - alle
+#      - alle
-      - aulmann
+#      - aulmann
-      - howe
+#      - howe
-      - stahmann
+#      - stahmann
-      - traine
+#      - traine
-      - public
+#      - public
-    password: 'bHdhzWnTj9'
+#    password: 'bHdhzWnTj9'
 
   - name: ho-st1
     groups:
@@ -456,16 +403,17 @@ samba_user:
       - stahmann
     password: '44-Ro-440'
 
-  - name: howe-staff-1
+#  - name: howe-staff-1
-    groups:
+#    groups:
-      - advoware
+#      - advoware
-      - alle
+#      - alle
-      - aulmann
+#      - aulmann
-      - howe
+#      - howe
-    password: ''
+#    password: ''
 
   - name: irina
     groups:
+      - advoware
       - alle
       - aulmann
       - howe
@@ -476,6 +424,7 @@ samba_user:
 
   - name: jessica
     groups:
+      - advoware
       - alle
       - aulmann
       - howe
@@ -484,14 +433,14 @@ samba_user:
       - public
     password: 'bV3pjPtjkR'
 
-  - name: laura
+#  - name: laura
-    groups:
+#    groups:
-      - alle
+#      - alle
-      - aulmann
+#      - aulmann
-      - howe
+#      - howe
-      - stahmann
+#      - stahmann
-      - traine
+#      - traine
-    password: '99-Hamburg-990'
+#    password: '99-Hamburg-990'
 
   - name: lenovo3
     groups:
@@ -606,11 +555,12 @@ samba_user:
 
 base_home: /data/home
 
-# remove_samba_users:
+remove_samba_users:
-#   - name: name1
+  - name: howe-staff-1
-#   - name: name2
+  - name: gerhard
-#
+  - name: laura
-remove_samba_users: []
+
+#remove_samba_users: []
 #remove_samba_users:
 #  - name: evren
 

host_vars/formbricks-nd.oopen.de.yml

@@ -0,0 +1,200 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+extra_user:
+
+  - name: nd-admin
+    user_id: 1045
+    group_id: 1045
+    group: nd-admin
+    password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de'
+
+sudo_users:
+  - chris
+  - sysadm
+  - nd-admin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/ga-al-gw.oopen.de.yml

@@ -44,6 +44,7 @@ network_interfaces:
     post-up:
       # - VLAN 221 (Ubiquiti UniFi Accesspoints)
       - /sbin/ip link add link eth2 name eth2.221 type vlan id 221
+      - /sbin/ip link add link eth2 name eth2.231 type vlan id 231
 
   - device: eth2:ns
     headline: eth2:ns - Alias on eth2 (Nameserver)
@@ -81,7 +82,7 @@ network_interfaces:
 
   - device: eth2.221
     # use only once per device (for the first device entry)
-    headline: eth2 -  VLAN 221 (Ubiquiti UniFi Accesspoints)
+    headline: eth2 -  VLAN 221 (Ubiquiti UniFi Accesspoints Guest NET)
 
     # auto & allow are only used for the first device entry
     allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -99,6 +100,14 @@ network_interfaces:
     mtu:
     scope:
 
+  - device: eth2.231
+    headline: eth2 -  VLAN 231 (Ubiquiti UniFi Accesspoints private NET)
+    auto: true
+    family: inet
+    method: static
+    address: 10.231.15.254
+    netmask: 20
+
     # additional user by dhcp method
     #
     hostname:
@@ -175,6 +184,9 @@ network_interfaces:
       # User Networks Stockhausen
       - /sbin/ip route add 192.168.11.0/24 via 172.16.111.254
       - /sbin/ip route add 192.168.78.0/24 via 172.16.111.254
+      # User Networks Campus
+      #- /sbin/ip route add 192.168.72.0/24 via 172.16.111.254
+      #- /sbin/ip route add 192.168.73.0/24 via 172.16.111.254
       # User Network Novalishaus
       - /sbin/ip route add 192.168.81.0/24 via 172.16.111.254
       # Management Network Stockhausen
@@ -183,12 +195,20 @@ network_interfaces:
       - /sbin/ip route add 10.10.9.0/24 via 172.16.111.254
       # IPMI Stockhausen
       - /sbin/ip route add 10.11.11.0/24 via 172.16.111.254
+      # WLAN Gast Novalishaus
+      - /sbin/ip route add 10.21.0.0/20 via 172.16.111.254
+      # WLAN privat Novalishaus
+      - /sbin/ip route add 10.31.0.0/20 via 172.16.111.254
+      # Management Netork Campus
+      #- /sbin/ip route add 10.72.1.0/24 via 172.16.111.254
       # WLan Router Stockhausen
       - /sbin/ip route add 10.112.1.0/24 via 172.16.111.254
       # WLan Netz
       - /sbin/ip route add 10.113.0.0/16 via 172.16.111.254
-      # Unifi WLan Netz Stockhausen
+      # Unifi WLan Netz Stockhausen Gast
       - /sbin/ip route add 10.121.0.0/20 via 172.16.111.254
+      # Unifi WLan Netz Stockhausen privat
+      - /sbin/ip route add 10.131.0.0/20 via 172.16.111.254
       # Richtfunkantennen Stockhausen (2) / Schlechtenwegen / Kirschbaumhaus
       - /sbin/ip route add 10.10.111.0/24 via 172.16.111.254
       # VPN Netz Stockhausen - Novalishaus (Schlechtenwegen)
@@ -353,60 +373,6 @@ ssh_keypair_backup_client:
     pub_key_dest: /root/.ssh/id_ed25519.pub
     target: backup.oopen.de
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: maadmin
-    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-
-  - name: wadmin
-    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - maadmin
-  - wadmin
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/ga-campus-gw-temp.ga.netz.yml

@@ -0,0 +1,394 @@
+---
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+network_interfaces:
+
+  - device: eno1
+    headline: eno1 - Uplink DSL via (static) line to Fritz!Box 7490
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.72.1
+    netmask: 24
+    gateway: 172.16.72.254
+    #nameservers:
+    #  - 192.168.81.1
+    #  - 172.16.81.254
+    #search: ga.netz ga.intra
+
+  - device: eno2
+    headline: eno2 - Uplink Lehrer-und Schülerdatenbank (LUSD)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.100.254
+    netmask: 24
+    post-up:
+      # Traffic zur ehrer-und Schülerdatenbank (LUSD)
+      - /sbin/ip route add 10.9.131.0/24 via 192.168.100.253
+
+
+
+  - device: eno3
+    family: inet
+    method: manual
+    post-up:
+      # VLAN 10 LAN 1 Campus
+      - /sbin/ip link add link eno3 name eno3.10 type vlan id 10
+
+  - device: eno3:ns
+    headline: eno3:ns - Alias on eno3 (Nameserver)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.72.1
+    netmask: 32
+
+  - device: eno3.10
+    headline: eno3.10 - LAN 1 Campus - network 192.168.72.0/24
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.72.254
+    netmask: 24
+    pre-up:
+      - /sbin/ifconfig eno3 up
+
+
+  - device: eno4
+    family: inet
+    method: manual
+    post-up:
+      # VLAN 20 - LAN 2 Campus including UniFi Accesspoints 
+      - /sbin/ip link add link eno4 name eno4.20 type vlan id 20
+
+  - device: eno4.20
+    headline: eno4.20 - LAN 2 Campus - network 192.168.73.0/24
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.73.254
+    netmask: 24
+    pre-up:
+      - /sbin/ifconfig eno4 up
+
+
+  - device: eno6
+    headline: eno6 -  Management Network Campus - network 10.72.1.0/24
+    auto: true
+    family: inet
+    method: static
+    address: 10.72.1.254
+    netmask: 24
+
+
+  - device: eno7
+    headline: eno7 - network 192.168.11.0/24 (LAN Stockhausen)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.72/24
+    gateway: 192.168.11.254
+    netmask: 24
+
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 127.0.0.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - campus.netz
+  - campus.intra
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_ssh_keypair_backup_server: false
+ssh_keypair_backup_server:
+  - name: backup
+    backup_user: back
+    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
+    priv_key_dest: /root/.ssh/id_rsa
+    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
+    pub_key_dest: /root/.ssh/id_rsa.pub
+
+insert_keypair_backup_client: true
+ssh_keypair_backup_client:
+  - name: backup
+    priv_key_src: root/.ssh/id_ed25519.oopen-server
+    priv_key_dest: /root/.ssh/id_ed25519
+    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
+    pub_key_dest: /root/.ssh/id_ed25519.pub
+    target: backup.oopen.de
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: maadmin
+    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - maadmin
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+install_bind_packages: true
+
+bind9_gateway_acl:
+  - local-net:
+    name: local-net
+    entries:
+      - 127.0.0.0/8
+      - 172.16.0.0/12
+      - 192.168.0.0/16
+      - 10.0.0.0/8
+      - fc00::/7
+      - fe80::/10
+      - ::1/128
+  - internaldns:
+    name: internaldns
+    entries:
+      - '# Nameserver Gateway Stockhausen'
+      - 192.168.11.1
+      - '# Domain Controller Stockhausen'
+      - 192.168.10.3
+      - '# Nameserver Gateway Altenschlirf'
+      - 192.168.10.1
+      - '# Domain Controller Altenschlirf'
+      - 192.168.10.3
+      - 192.168.10.6
+      - 172.16.0.1
+      - '# Nameserver Gateway Novalishaus'
+      - 192.168.81.1
+      - 10.2.11.2
+      - '# Nameserver wolle'
+      - 10.113.12.3
+      - '# Postfix Mailserver'
+      - 192.168.11.2
+      - '# Mail Relay System'
+      - 192.168.10.2
+
+bind9_gateway_listen_on_v6:
+   - none
+
+bind9_gateway_listen_on:
+  - any
+
+#bind9_gateway_allow_transfer: {}
+bind9_gateway_allow_transfer:
+   - none
+
+bind9_transfer_source:  !!str "192.168.81.1"
+bind9_notify_source: !!str "192.168.81.1"
+
+#bind9_gateway_allow_query: {}
+bind9_gateway_allow_query:
+  - local-net
+
+#bind9_gateway_allow_query_cache: {}
+bind9_gateway_allow_query_cache:
+  - local-net
+
+bind9_gateway_recursion:  !!str "yes"
+#bind9_gateway_allow_recursion: {}
+bind9_gateway_allow_recursion:
+  - local-net
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-gateway
+  repo: https://git.oopen.de/firewall/ipt-gateway
+  dest: /usr/local/src/ipt-gateway
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/ga-nh-gw.oopen.de.yml

@@ -51,6 +51,28 @@ network_interfaces:
     method: static
     address: 192.168.81.254
     netmask: 24
+    post-up:
+      # VLAN 321 - for Ubiquiti UniFi Accesspoints Guest NET
+      - /sbin/ip link add link eno5 name eno5.21 type vlan id 21
+      # VLAN 331 - for Ubiquiti UniFi Accesspoints private NET
+      - /sbin/ip link add link eno5 name eno5.31 type vlan id 31
+
+
+  - device: eno5.21
+    headline: eno5 -  VLAN 321 (Ubiquiti UniFi Accesspoints Guest NET)
+    auto: true
+    family: inet
+    method: static
+    address: 10.21.15.254
+    netmask: 20
+
+  - device: eno5.31
+    headline: eno5 -  VLAN 331 (Ubiquiti UniFi Accesspoints private NET)
+    auto: true
+    family: inet
+    method: static
+    address: 10.31.15.254
+    netmask: 20
 
 
   - device: eno5:ns

host_vars/ga-st-gw-neu.ga.netz.yml.00

@@ -0,0 +1,591 @@
+---
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+network_interfaces:
+
+  - device: eno1np0
+    headline: eno1np0 - Temporary LAN network
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.18
+    netmask: 24
+
+  - device: enp129s0f2
+    headline: enp129s0f2 - Uplink static line (radio) to Altenschlirf
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.111.254
+    netmask: 24
+    up:
+      # - For management Antennas
+      - /sbin/ip link add link enp129s0f2 name enp129s0f2.111 type vlan id 111
+    post-up:
+      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
+      # -
+      # - Telefon Altenshlirf
+      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
+      # User Network Altenshlirf
+      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
+      # Management Network Altenschlirf
+      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
+      # WLan Router (Accesspoints) Altenshlirf
+      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
+      # # WLan Networks Altenshlirf
+      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
+      # DSL via Fritzbox Altenschlirf
+      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
+      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
+      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
+      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
+      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
+      # VPN home Network Altenschlirf
+      #
+      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
+      # VPN 'gw-ckubu' Network Altenschlirf
+      #
+      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
+      # private networks 'ckubu'
+      #
+      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
+      # so we route them back to that gateway..
+      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
+      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
+
+
+  - device: enp129s0f2.111
+    headline: enp129s0f2.111 - network 10.10.111.0 (management antennas)
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.111.254
+    netmask: 24
+
+
+  - device: enp1s0f0 
+    headline: enp1s0f0 - holds VLAN 211 device for Network Telefons Stockhausen
+    auto: false
+    family: inet
+    method: manual
+    up:
+      - /sbin/ip link add link enp1s0f0 name enp1s0f0.211 type vlan id 211
+
+
+  - device: enp1s0f0.211
+    headline: enp1s0f0.211 - Network Telefons Stockhausen
+    auto: true
+    family: inet
+    method: static
+    # Note:
+    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
+    #       This LANCom Router IS NOT pngable                                 !!
+    address: 172.16.211.1
+    netmask: 24
+    pre-up:
+      - /sbin/ifconfig enp1s0f0 up
+
+
+  - device: enp1s0f2
+    headline: enp1s0f2 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.11.1
+    netmask: 24
+    gateway: 172.16.11.254
+
+
+  - device: enp1s0f3
+    headline: enp1s0f3 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.13.1
+    netmask: 24
+    gateway: 172.16.13.254
+
+
+  - device: enp1s0f1
+    headline: enp1s0f1 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.12.1
+    netmask: 24
+    gateway: 172.16.12.254
+
+
+    # ----------
+    # Note: Install the 'ifenslave' package, necessary to enable bonding:
+    # 
+    #    apt-get install ifenslave
+    # ----------
+  - device: bond0
+    headline: bond0 - LAG (Link Aggregation) on devices enp129s0f0 and enp194s0f0
+    auto: true
+    family: inet
+    method: static
+    address: 10.1.9.254
+    netmask: 24
+    bond:
+      slaves: enp129s0f0 enp194s0f0
+      # Mode 4 (802.3ad)
+      #
+      #    also possible here:
+      #       - Mode 5: balance-tlb
+      #       - Mode 6: balance-alb
+      mode: 4
+      miimon: 100
+      lacp-rate: 1
+      ad-select: count
+      downdelay: 200
+      updelay: 200
+    post-up:
+      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
+      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
+      # VLAN 78 for network Georgshaus 192.168.78.0/24
+      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
+
+
+  - device: bond0.11
+    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.11.254
+    netmask: 24
+
+
+  - device: bond0.78
+    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.78.254
+    netmask: 24
+
+
+    # ----------
+    # Note: Install the 'ifenslave' package, necessary to enable bonding:
+    # 
+    #    apt-get install ifenslave
+    # ----------
+  - device: bond1
+    headline: bond1 - LAG (Link Aggregation) on devices enp129s0f1 and enp194s0f1 - Main Network Stockhausen
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.254
+    netmask: 24
+    nameservers:
+      - 192.168.11.1
+      - 192.168.10.3
+    search: ga.netz ga.intra
+    bond:
+      slaves: enp129s0f1 enp194s0f1
+      # Mode 4 (802.3ad)
+      #
+      #    also possible here:
+      #       - Mode 5: balance-tlb
+      #       - Mode 6: balance-alb
+      mode: 4
+      miimon: 100
+      lacp-rate: 1
+      ad-select: count
+      downdelay: 200
+      updelay: 200
+    post-up:
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints
+      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
+      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
+      # Route ???
+      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
+      # Route to management network campus
+      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
+      # Route to LAN campus
+      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
+      # Route to WLAN campus
+      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
+
+
+  - device: bond1.121
+    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
+    auto: true
+    family: inet
+    method: static
+    address: 10.121.15.254
+    netmask: 20
+
+
+  - device: bond1.131
+    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
+    auto: true
+    family: inet
+    method: static
+    address: 10.131.15.254
+    netmask: 20
+
+
+  - device: bond1:ns
+    headline: bond1:ns - Alias IP on bond1 device for Nameservice
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.1
+    netmask: 32
+
+
+  - device: bond1:1
+    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.9.254
+    netmask: 24
+
+
+  - device: bond1:ap
+    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
+    auto: true
+    family: inet
+    method: static
+    address: 10.112.1.254
+    netmask: 24
+    post-up:
+      # - Wireless Networks routed through appropriate Accesspoints
+      # -
+      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
+      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
+      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
+      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
+      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
+      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
+      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
+      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
+      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
+      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
+      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
+      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
+      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
+      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
+      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
+
+
+  - device: bond1:ipmi
+    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
+    auto: true
+    family: inet
+    method: static
+    address: 10.11.11.254
+    netmask: 24
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 127.0.0.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - ga.netz
+  - ga.intra
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 192.168.10.1
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_user_special_time_entries:
+
+  - name: "Restart NTP service 'ntpsec'"
+    special_time: reboot
+    job: "sleep 15 ; /bin/systemctl restart ntpsec"
+    insertafter: PATH
+
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_ssh_keypair_backup_server: false
+ssh_keypair_backup_server:
+  - name: backup
+    backup_user: back
+    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
+    priv_key_dest: /root/.ssh/id_rsa
+    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
+    pub_key_dest: /root/.ssh/id_rsa.pub
+
+insert_keypair_backup_client: true
+ssh_keypair_backup_client:
+  - name: backup
+    priv_key_src: root/.ssh/id_ed25519.oopen-server
+    priv_key_dest: /root/.ssh/id_ed25519
+    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
+    pub_key_dest: /root/.ssh/id_ed25519.pub
+    target: backup.oopen.de
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: maadmin
+    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - maadmin
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+install_bind_packages: true
+
+bind9_gateway_acl:
+  - local-net:
+    name: local-net
+    entries:
+      - 127.0.0.0/8
+      - 172.16.0.0/12
+      - 192.168.0.0/16
+      - 10.0.0.0/8
+      - fc00::/7
+      - fe80::/10
+      - ::1/128
+  - internaldns:
+    name: internaldns
+    entries:
+      - '# Nameserver Gateway Stockhausen'
+      - 192.168.11.1
+      - '# Domain Controller Stockhausen'
+      - 192.168.10.3
+      - '# Nameserver Gateway Altenschlirf'
+      - 192.168.10.1
+      - '# Domain Controller Altenschlirf'
+      - 192.168.10.3
+      - 192.168.10.6
+      - 172.16.0.1
+      - '# Nameserver Gateway Novalishaus'
+      - 192.168.81.1
+      - 10.2.11.2
+      - '# Nameserver wolle'
+      - 10.113.12.3
+      - '# Postfix Mailserver'
+      - 192.168.11.2
+      - '# Mail Relay System'
+      - 192.168.10.2
+
+bind9_gateway_listen_on_v6:
+   - none
+
+bind9_gateway_listen_on:
+  - any
+
+#bind9_gateway_allow_transfer: {}
+bind9_gateway_allow_transfer:
+   - internaldns
+
+bind9_transfer_source:  !!str "192.168.11.1"
+bind9_notify_source: !!str "192.168.11.1"
+
+#bind9_gateway_allow_query: {}
+bind9_gateway_allow_query:
+  - local-net
+
+#bind9_gateway_allow_query_cache: {}
+bind9_gateway_allow_query_cache:
+  - local-net
+
+bind9_gateway_recursion:  !!str "yes"
+#bind9_gateway_allow_recursion: {}
+bind9_gateway_allow_recursion:
+  - local-net
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-gateway
+  repo: https://git.oopen.de/firewall/ipt-gateway
+  dest: /usr/local/src/ipt-gateway
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/ga-st-gw-neu.ga.netz.yml.01

@@ -0,0 +1,592 @@
+---
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+network_interfaces:
+
+  - device: lan0
+    headline: lan0 - Temporary LAN network
+    auto: false
+    family: inet
+    method: static
+    address: 192.168.11.18
+    gateway: 192.168.11.254
+    netmask: 24
+
+  - device: lan4
+    headline: lan4 - Uplink static line (radio) to Altenschlirf
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.111.254
+    netmask: 24
+    up:
+      # - For management Antennas
+      - /sbin/ip link add link lan4 name lan4.111 type vlan id 111
+    post-up:
+      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
+      # -
+      # - Telefon Altenshlirf
+      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
+      # User Network Altenshlirf
+      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
+      # Management Network Altenschlirf
+      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
+      # WLan Router (Accesspoints) Altenshlirf
+      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
+      # # WLan Networks Altenshlirf
+      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
+      # DSL via Fritzbox Altenschlirf
+      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
+      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
+      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
+      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
+      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
+      # VPN home Network Altenschlirf
+      #
+      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
+      # VPN 'gw-ckubu' Network Altenschlirf
+      #
+      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
+      # private networks 'ckubu'
+      #
+      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
+      # so we route them back to that gateway..
+      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
+      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
+
+
+  - device: lan4.111
+    headline: lan4.111 - network 10.10.111.0 (management antennas)
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.111.254
+    netmask: 24
+
+
+  - device: lan6 
+    headline: lan6 - holds VLAN 211 device for Network Telefons Stockhausen
+    auto: false
+    family: inet
+    method: manual
+    up:
+      - /sbin/ip link add link lan6 name lan6.211 type vlan id 211
+
+
+  - device: lan6.211
+    headline: lan6.211 - Network Telefons Stockhausen
+    auto: true
+    family: inet
+    method: static
+    # Note:
+    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
+    #       This LANCom Router IS NOT pngable                                 !!
+    address: 172.16.211.1
+    netmask: 24
+    pre-up:
+      - /sbin/ifconfig lan6 up
+
+
+  - device: lan8
+    headline: lan8 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.11.1
+    netmask: 24
+    gateway: 172.16.11.254
+
+
+  - device: lan9
+    headline: lan9 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.13.1
+    netmask: 24
+    gateway: 172.16.13.254
+
+
+  - device: lan7
+    headline: lan7 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.12.1
+    netmask: 24
+    gateway: 172.16.12.254
+
+
+    # ----------
+    # Note: Install the 'ifenslave' package, necessary to enable bonding:
+    # 
+    #    apt-get install ifenslave
+    # ----------
+  - device: bond0
+    headline: bond0 - LAG (Link Aggregation) on devices lan2 and lan10
+    auto: true
+    family: inet
+    method: static
+    address: 10.1.9.254
+    netmask: 24
+    bond:
+      slaves: lan2 lan10
+      # Mode 4 (802.3ad)
+      #
+      #    also possible here:
+      #       - Mode 5: balance-tlb
+      #       - Mode 6: balance-alb
+      mode: 4
+      miimon: 100
+      lacp-rate: 1
+      ad-select: count
+      downdelay: 200
+      updelay: 200
+    post-up:
+      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
+      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
+      # VLAN 78 for network Georgshaus 192.168.78.0/24
+      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
+
+
+  - device: bond0.11
+    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.11.254
+    netmask: 24
+
+
+  - device: bond0.78
+    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.78.254
+    netmask: 24
+
+
+    # ----------
+    # Note: Install the 'ifenslave' package, necessary to enable bonding:
+    # 
+    #    apt-get install ifenslave
+    # ----------
+  - device: bond1
+    headline: bond1 - LAG (Link Aggregation) on devices lan3 and lan11 - Main Network Stockhausen
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.254
+    netmask: 24
+    nameservers:
+      - 192.168.11.1
+      - 192.168.10.3
+    search: ga.netz ga.intra
+    bond:
+      slaves: lan3 lan11
+      # Mode 4 (802.3ad)
+      #
+      #    also possible here:
+      #       - Mode 5: balance-tlb
+      #       - Mode 6: balance-alb
+      mode: 4
+      miimon: 100
+      lacp-rate: 1
+      ad-select: count
+      downdelay: 200
+      updelay: 200
+    post-up:
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints
+      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
+      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
+      # Route ???
+      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
+      # Route to management network campus
+      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
+      # Route to LAN campus
+      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
+      # Route to WLAN campus
+      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
+
+
+  - device: bond1.121
+    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
+    auto: true
+    family: inet
+    method: static
+    address: 10.121.15.254
+    netmask: 20
+
+
+  - device: bond1.131
+    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
+    auto: true
+    family: inet
+    method: static
+    address: 10.131.15.254
+    netmask: 20
+
+
+  - device: bond1:ns
+    headline: bond1:ns - Alias IP on bond1 device for Nameservice
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.1
+    netmask: 32
+
+
+  - device: bond1:1
+    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
+    auto: true
+    family: inet
+    method: static
+    address: 10.10.9.254
+    netmask: 24
+
+
+  - device: bond1:ap
+    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
+    auto: true
+    family: inet
+    method: static
+    address: 10.112.1.254
+    netmask: 24
+    post-up:
+      # - Wireless Networks routed through appropriate Accesspoints
+      # -
+      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
+      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
+      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
+      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
+      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
+      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
+      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
+      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
+      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
+      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
+      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
+      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
+      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
+      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
+      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
+
+
+  - device: bond1:ipmi
+    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
+    auto: true
+    family: inet
+    method: static
+    address: 10.11.11.254
+    netmask: 24
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 127.0.0.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - ga.netz
+  - ga.intra
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 192.168.10.1
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_user_special_time_entries:
+
+  - name: "Restart NTP service 'ntpsec'"
+    special_time: reboot
+    job: "sleep 15 ; /bin/systemctl restart ntpsec"
+    insertafter: PATH
+
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_ssh_keypair_backup_server: false
+ssh_keypair_backup_server:
+  - name: backup
+    backup_user: back
+    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
+    priv_key_dest: /root/.ssh/id_rsa
+    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
+    pub_key_dest: /root/.ssh/id_rsa.pub
+
+insert_keypair_backup_client: true
+ssh_keypair_backup_client:
+  - name: backup
+    priv_key_src: root/.ssh/id_ed25519.oopen-server
+    priv_key_dest: /root/.ssh/id_ed25519
+    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
+    pub_key_dest: /root/.ssh/id_ed25519.pub
+    target: backup.oopen.de
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: maadmin
+    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - maadmin
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+install_bind_packages: true
+
+bind9_gateway_acl:
+  - local-net:
+    name: local-net
+    entries:
+      - 127.0.0.0/8
+      - 172.16.0.0/12
+      - 192.168.0.0/16
+      - 10.0.0.0/8
+      - fc00::/7
+      - fe80::/10
+      - ::1/128
+  - internaldns:
+    name: internaldns
+    entries:
+      - '# Nameserver Gateway Stockhausen'
+      - 192.168.11.1
+      - '# Domain Controller Stockhausen'
+      - 192.168.10.3
+      - '# Nameserver Gateway Altenschlirf'
+      - 192.168.10.1
+      - '# Domain Controller Altenschlirf'
+      - 192.168.10.3
+      - 192.168.10.6
+      - 172.16.0.1
+      - '# Nameserver Gateway Novalishaus'
+      - 192.168.81.1
+      - 10.2.11.2
+      - '# Nameserver wolle'
+      - 10.113.12.3
+      - '# Postfix Mailserver'
+      - 192.168.11.2
+      - '# Mail Relay System'
+      - 192.168.10.2
+
+bind9_gateway_listen_on_v6:
+   - none
+
+bind9_gateway_listen_on:
+  - any
+
+#bind9_gateway_allow_transfer: {}
+bind9_gateway_allow_transfer:
+   - internaldns
+
+bind9_transfer_source:  !!str "192.168.11.1"
+bind9_notify_source: !!str "192.168.11.1"
+
+#bind9_gateway_allow_query: {}
+bind9_gateway_allow_query:
+  - local-net
+
+#bind9_gateway_allow_query_cache: {}
+bind9_gateway_allow_query_cache:
+  - local-net
+
+bind9_gateway_recursion:  !!str "yes"
+#bind9_gateway_allow_recursion: {}
+bind9_gateway_allow_recursion:
+  - local-net
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-gateway
+  repo: https://git.oopen.de/firewall/ipt-gateway
+  dest: /usr/local/src/ipt-gateway
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/ga-st-gw.ga.netz.yml

@@ -20,8 +20,17 @@ network_interface_required_packages:
 
 network_interfaces:
 
-  - device: eth2
+  - device: lan0
-    headline: eth2 - Uplink static line (radio) to Altenschlirf
+    headline: lan0 - Temporary LAN network
+    auto: false
+    family: inet
+    method: static
+    address: 192.168.11.18
+    #gateway: 192.168.11.254
+    netmask: 24
+
+  - device: lan4
+    headline: lan4 - Uplink static line (radio) to Altenschlirf
     auto: true
     family: inet
     method: static
@@ -29,7 +38,7 @@ network_interfaces:
     netmask: 24
     up:
       # - For management Antennas
-      - /sbin/ip link add link eth2 name eth2.111 type vlan id 111
+      - /sbin/ip link add link lan4 name lan4.111 type vlan id 111
     post-up:
       # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
       # -
@@ -45,11 +54,16 @@ network_interfaces:
       - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
       # DSL via Fritzbox Altenschlirf
       - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf (Unifi routet Network)
+      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
       - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
+      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
+      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
       # VPN home Network Altenschlirf
       #
       - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
+      # VPN 'gw-ckubu' Network Altenschlirf
+      #
+      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
       # private networks 'ckubu'
       #
       # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
@@ -58,8 +72,8 @@ network_interfaces:
       - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
 
 
-  - device: eth2.111
+  - device: lan4.111
-    headline: eth2.111 - network 10.10.111.0 (management antennas)
+    headline: lan4.111 - network 10.10.111.0 (management antennas)
     auto: true
     family: inet
     method: static
@@ -67,17 +81,17 @@ network_interfaces:
     netmask: 24
 
 
-  - device: eth8 
+  - device: lan6 
-    headline: eth8 - holds VLAN 211 device for Network Telefons Stockhausen
+    headline: lan6 - holds VLAN 211 device for Network Telefons Stockhausen
     auto: false
     family: inet
     method: manual
     up:
-      - /sbin/ip link add link eth8 name eth8.211 type vlan id 211
+      - /sbin/ip link add link lan6 name lan6.211 type vlan id 211
 
 
-  - device: eth8.211
+  - device: lan6.211
-    headline: eth8.211 - Network Telefons Stockhausen
+    headline: lan6.211 - Network Telefons Stockhausen
     auto: true
     family: inet
     method: static
@@ -87,11 +101,11 @@ network_interfaces:
     address: 172.16.211.1
     netmask: 24
     pre-up:
-      - /sbin/ifconfig eth8 up
+      - /sbin/ifconfig lan6 up
 
 
-  - device: eth9
+  - device: lan8
-    headline: eth9 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
+    headline: lan8 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
     auto: true
     family: inet
     method: static
@@ -100,8 +114,8 @@ network_interfaces:
     gateway: 172.16.11.254
 
 
-  - device: eth10
+  - device: lan9
-    headline: eth10 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
+    headline: lan9 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
     auto: true
     family: inet
     method: static
@@ -110,8 +124,8 @@ network_interfaces:
     gateway: 172.16.13.254
 
 
-  - device: eth11
+  - device: lan7
-    headline: eth11 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
+    headline: lan7 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
     auto: true
     family: inet
     method: static
@@ -126,14 +140,14 @@ network_interfaces:
     #    apt-get install ifenslave
     # ----------
   - device: bond0
-    headline: bond0 - LAG (Link Aggregation) on devices eth0 and eth4
+    headline: bond0 - LAG (Link Aggregation) on devices lan2 and lan10
     auto: true
     family: inet
     method: static
     address: 10.1.9.254
     netmask: 24
     bond:
-      slaves: eth0 eth4
+      slaves: lan2 lan10
       # Mode 4 (802.3ad)
       #
       #    also possible here:
@@ -175,8 +189,8 @@ network_interfaces:
     # 
     #    apt-get install ifenslave
     # ----------
-  - device: bond1
+  - device: sfp0
-    headline: bond1 - LAG (Link Aggregation) on devices eth1 and eth5 - Main Network Stockhausen
+    headline: sfp0 - Main Network Stockhausen
     auto: true
     family: inet
     method: static
@@ -186,28 +200,36 @@ network_interfaces:
       - 192.168.11.1
       - 192.168.10.3
     search: ga.netz ga.intra
-    bond:
+    #bond:
-      slaves: eth1 eth5
+    #  slaves: lan3 lan11
-      # Mode 4 (802.3ad)
+    #  # Mode 4 (802.3ad)
-      #
+    #  #
-      #    also possible here:
+    #  #    also possible here:
-      #       - Mode 5: balance-tlb
+    #  #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
+    #  #       - Mode 6: balance-alb
-      mode: 4
+    #  mode: 4
-      miimon: 100
+    #  miimon: 100
-      lacp-rate: 1
+    #  lacp-rate: 1
-      ad-select: count
+    #  ad-select: count
-      downdelay: 200
+    #  downdelay: 200
-      updelay: 200
+    #  updelay: 200
     post-up:
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints)
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints
-      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
+      - /sbin/ip link add link sfp0 name sfp0.121 type vlan id 121
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
+      - /sbin/ip link add link sfp0 name sfp0.131 type vlan id 131
       # Route ???
       - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
+      # Route to management network campus
+      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
+      # Route to LAN campus
+      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
+      # Route to WLAN campus
+      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
 
 
-  - device: bond1.121
+  - device: sfp0.121
-    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints
+    headline: sfp0.121 - VLAN 121 on interface sfp0 for Ubiquiti UniFi Accesspoints Guest NET
     auto: true
     family: inet
     method: static
@@ -215,8 +237,17 @@ network_interfaces:
     netmask: 20
 
 
-  - device: bond1:ns
+  - device: sfp0.131
-    headline: bond1:ns - Alias IP on bond1 device for Nameservice
+    headline: sfp0.131 - VLAN 131 on interface sfp0 for Ubiquiti UniFi Accesspoints private NET
+    auto: true
+    family: inet
+    method: static
+    address: 10.131.15.254
+    netmask: 20
+
+
+  - device: sfp0:ns
+    headline: sfp0:ns - Alias IP on sfp0 device for Nameservice
     auto: true
     family: inet
     method: static
@@ -224,8 +255,8 @@ network_interfaces:
     netmask: 32
 
 
-  - device: bond1:1
+  - device: sfp0:1
-    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
+    headline: sfp0:1 - Alias IP on sfp0 device for (depricated) Management Network
     auto: true
     family: inet
     method: static
@@ -233,8 +264,8 @@ network_interfaces:
     netmask: 24
 
 
-  - device: bond1:ap
+  - device: sfp0:ap
-    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
+    headline: sfp0:ap - Alias IP on sfp0 device for Network Accesspoints
     auto: true
     family: inet
     method: static
@@ -260,8 +291,8 @@ network_interfaces:
       - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
 
 
-  - device: bond1:ipmi
+  - device: sfp0:ipmi
-    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
+    headline: sfp0:ipmi - Alias IP on sfp0 for IPMI Addresses Servr Stockhausen
     auto: true
     family: inet
     method: static

host_vars/ga-st-gw.ga.netz.yml.00

@@ -45,11 +45,16 @@ network_interfaces:
       - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
       # DSL via Fritzbox Altenschlirf
       - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf (Unifi routet Network)
+      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
       - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
+      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
+      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
       # VPN home Network Altenschlirf
       #
       - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
+      # VPN 'gw-ckubu' Network Altenschlirf
+      #
+      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
       # private networks 'ckubu'
       #
       # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
@@ -176,7 +181,7 @@ network_interfaces:
     #    apt-get install ifenslave
     # ----------
   - device: bond1
-    headline: bond1 - LAG (Link Aggregation) on devices eth1 and eth5 - Main Network Stockhausen
+    headline: bond1 - LAG (Link Aggregation) on devices eth3 and eth5 - Main Network Stockhausen
     auto: true
     family: inet
     method: static
@@ -187,7 +192,7 @@ network_interfaces:
       - 192.168.10.3
     search: ga.netz ga.intra
     bond:
-      slaves: eth1 eth5
+      slaves: eth3 eth5
       # Mode 4 (802.3ad)
       #
       #    also possible here:
@@ -200,14 +205,22 @@ network_interfaces:
       downdelay: 200
       updelay: 200
     post-up:
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints)
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints
       - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
+      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
+      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
       # Route ???
       - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
+      # Route to management network campus
+      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
+      # Route to LAN campus
+      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
+      # Route to WLAN campus
+      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
 
 
   - device: bond1.121
-    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints
+    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
     auto: true
     family: inet
     method: static
@@ -215,6 +228,15 @@ network_interfaces:
     netmask: 20
 
 
+  - device: bond1.131
+    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
+    auto: true
+    family: inet
+    method: static
+    address: 10.131.15.254
+    netmask: 20
+
+
   - device: bond1:ns
     headline: bond1:ns - Alias IP on bond1 device for Nameservice
     auto: true
@@ -365,6 +387,18 @@ resolved_fallback_nameserver:
    - 192.168.10.1
 
 
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_user_special_time_entries:
+
+  - name: "Restart NTP service 'ntpsec'"
+    special_time: reboot
+    job: "sleep 15 ; /bin/systemctl restart ntpsec"
+    insertafter: PATH
+
+
 
 # ---
 # vars used by roles/common/tasks/users.yml
@@ -388,8 +422,6 @@ ssh_keypair_backup_client:
     pub_key_dest: /root/.ssh/id_ed25519.pub
     target: backup.oopen.de
 
-
-
 default_user:
 
   - name: chris
@@ -441,8 +473,8 @@ default_user:
 sudo_users:
   - chris
   - sysadm
-  - wadmin
   - maadmin
+  - wadmin
 
 
 # ---

host_vars/ga-st-mm.ga.netz.yml

@@ -0,0 +1,215 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+install_compiler_pkgs: true
+
+install_postgresql_pkgs: true
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 192.168.11.1
+   - 192.168.10.3
+  - 192.168.10.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - ga.netz
+  - ga.intra
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 192.168.11.3
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_root_ssh_keypair: true
+
+root_ssh_keypair:
+  - name: id-rsa-dehydrated
+    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated
+    priv_key_dest: /root/.ssh/id_rsa-dehydrated
+    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
+    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
+  - name: id-rsa-opendkim
+    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim
+    priv_key_dest: /root/.ssh/id_rsa-opendkim
+    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
+    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: maadmin
+    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - maadmin
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/copy_files.yml
+# ---
+
+
+
+# ---
+# vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
+# ---

host_vars/gw-ah.oopen.de.yml

@@ -140,59 +140,6 @@ ssh_keypair_backup_client:
     pub_key_dest: /root/.ssh/id_ed25519.pub
     target: backup.oopen.de
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$1X6iXiYz2fIQcfKWSSzno1$9Uos8SGn/8V3oHWwiR6kaRPfUuIrxKP8kRNUZ1.da3/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - localadmin
-  - sysadm
-
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
 # ---

host_vars/gw-akb.oopen.de.yml

@@ -26,14 +26,14 @@ copy_additional_plain_files_sysctl:
 # vars used by roles/common/tasks/sshd.yml
 # ---
 
-sshd_hostkeyalgorithms:
+#sshd_hostkeyalgorithms:
-  - ssh-ed25519
+#  - ssh-ed25519
-  - ssh-ed25519-cert-v01@openssh.com
+#  - ssh-ed25519-cert-v01@openssh.com
-  - rsa-sha2-256
+#  - rsa-sha2-256
-  - rsa-sha2-512
+#  - rsa-sha2-512
-  - ecdsa-sha2-nistp256
+#  - ecdsa-sha2-nistp256
-  - rsa-sha2-256-cert-v01@openssh.com
+#  - rsa-sha2-256-cert-v01@openssh.com
-  - rsa-sha2-512-cert-v01@openssh.com
+#  - rsa-sha2-512-cert-v01@openssh.com
 
 
 # ---
@@ -128,60 +128,6 @@ cron_user_special_time_entries:
 # ---
 
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$K/AHoqM8bynaxxgb6l3a41$my3J.c2hXYxkHgQviZZww5OP6ZgaaPsNscKPRSRT5E5
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$d5p0SWRwuW2CDvpMdtFcQ0$fKsGolV/38OZzTDRq00wjrbw3MfnJkUAWMreb3xNgT2
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$K/AHoqM8bynaxxgb6l3a41$my3J.c2hXYxkHgQviZZww5OP6ZgaaPsNscKPRSRT5E5
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$QczbPLpIHiEZFf7FChcTC0$9SoBJzI8k/j5gjRdfK/x3vc/h73sNRGyAmr0KninMn0
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - localadmin
-
-
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
 # ---

host_vars/gw-blkr.oopen.de.yml

@@ -249,59 +249,6 @@ ssh_keypair_backup_client:
     pub_key_dest: /root/.ssh/id_ed25519.pub
     target: backup.oopen.de
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$qmeacaq0WLATk6o7374lj1$1MrdyEubi5m4E9MCNZWrS04nZi1Qgk4vHu.J5LwKrJB:19757
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - localadmin
-  - sysadm
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/gw-campus.oopen.de.yml

@@ -0,0 +1,394 @@
+---
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+network_interfaces:
+
+  - device: eno1
+    headline: eno1 - Uplink DSL via (static) line to Fritz!Box 7490
+    auto: true
+    family: inet
+    method: static
+    address: 172.16.72.1
+    netmask: 24
+    gateway: 172.16.72.254
+    #nameservers:
+    #  - 192.168.81.1
+    #  - 172.16.81.254
+    #search: ga.netz ga.intra
+
+  - device: eno2
+    headline: eno2 - Uplink Lehrer-und Schülerdatenbank (LUSD)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.100.254
+    netmask: 24
+    post-up:
+      # Traffic zur ehrer-und Schülerdatenbank (LUSD)
+      - /sbin/ip route add 10.9.131.0/24 via 192.168.100.253
+
+
+
+  - device: eno3
+    family: inet
+    method: manual
+    post-up:
+      # VLAN 10 LAN 1 Campus
+      - /sbin/ip link add link eno3 name eno3.10 type vlan id 10
+
+  - device: eno3:ns
+    headline: eno3:ns - Alias on eno3 (Nameserver)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.72.1
+    netmask: 32
+
+  - device: eno3.10
+    headline: eno3.10 - LAN 1 Campus - network 192.168.72.0/24
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.72.254
+    netmask: 24
+    pre-up:
+      - /sbin/ifconfig eno3 up
+
+
+  - device: eno4
+    family: inet
+    method: manual
+    post-up:
+      # VLAN 20 - LAN 2 Campus including UniFi Accesspoints 
+      - /sbin/ip link add link eno4 name eno4.20 type vlan id 20
+
+  - device: eno4.20
+    headline: eno4.20 - LAN 2 Campus - network 192.168.73.0/24
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.73.254
+    netmask: 24
+    pre-up:
+      - /sbin/ifconfig eno4 up
+
+
+  - device: eno6
+    headline: eno6 -  Management Network Campus - network 10.72.1.0/24
+    auto: true
+    family: inet
+    method: static
+    address: 10.72.1.254
+    netmask: 24
+
+
+  - device: eno7
+    headline: eno7 - network 192.168.11.0/24 (LAN Stockhausen)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.11.72
+    #gateway: 192.168.11.254
+    netmask: 24
+
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 127.0.0.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - campus.netz
+  - campus.intra
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+insert_ssh_keypair_backup_server: false
+ssh_keypair_backup_server:
+  - name: backup
+    backup_user: back
+    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
+    priv_key_dest: /root/.ssh/id_rsa
+    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
+    pub_key_dest: /root/.ssh/id_rsa.pub
+
+insert_keypair_backup_client: true
+ssh_keypair_backup_client:
+  - name: backup
+    priv_key_src: root/.ssh/id_ed25519.oopen-server
+    priv_key_dest: /root/.ssh/id_ed25519
+    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
+    pub_key_dest: /root/.ssh/id_ed25519.pub
+    target: backup.oopen.de
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: maadmin
+    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+
+  - name: wadmin
+    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+
+sudo_users:
+  - chris
+  - sysadm
+  - maadmin
+  - wadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+install_bind_packages: true
+
+bind9_gateway_acl:
+  - local-net:
+    name: local-net
+    entries:
+      - 127.0.0.0/8
+      - 172.16.0.0/12
+      - 192.168.0.0/16
+      - 10.0.0.0/8
+      - fc00::/7
+      - fe80::/10
+      - ::1/128
+  - internaldns:
+    name: internaldns
+    entries:
+      - '# Nameserver Gateway Stockhausen'
+      - 192.168.11.1
+      - '# Domain Controller Stockhausen'
+      - 192.168.10.3
+      - '# Nameserver Gateway Altenschlirf'
+      - 192.168.10.1
+      - '# Domain Controller Altenschlirf'
+      - 192.168.10.3
+      - 192.168.10.6
+      - 172.16.0.1
+      - '# Nameserver Gateway Novalishaus'
+      - 192.168.81.1
+      - 10.2.11.2
+      - '# Nameserver wolle'
+      - 10.113.12.3
+      - '# Postfix Mailserver'
+      - 192.168.11.2
+      - '# Mail Relay System'
+      - 192.168.10.2
+
+bind9_gateway_listen_on_v6:
+   - none
+
+bind9_gateway_listen_on:
+  - any
+
+#bind9_gateway_allow_transfer: {}
+bind9_gateway_allow_transfer:
+   - none
+
+bind9_transfer_source:  !!str "192.168.81.1"
+bind9_notify_source: !!str "192.168.81.1"
+
+#bind9_gateway_allow_query: {}
+bind9_gateway_allow_query:
+  - local-net
+
+#bind9_gateway_allow_query_cache: {}
+bind9_gateway_allow_query_cache:
+  - local-net
+
+bind9_gateway_recursion:  !!str "yes"
+#bind9_gateway_allow_recursion: {}
+bind9_gateway_allow_recursion:
+  - local-net
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-gateway
+  repo: https://git.oopen.de/firewall/ipt-gateway
+  dest: /usr/local/src/ipt-gateway
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/gw-ckubu.local.netz.yml

@@ -118,39 +118,6 @@ cron_user_special_time_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$KUDlIDddLeymNRsoS7Z51/$eelMaGW/JhVsCjl6nducJmjxrHpuyLStWuOGrohKZZD
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$1SUeBB9jQKPnG9JPt30O5/$aiZOeMJbJqE.cEKkFdSBxeuhma8n1thBVn00SClT3C/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$n17mARf7i72xHDBW0lfT40$2WQMFPops.4.T3H7mk7Kzh3sRt3YfJtlhtn0Vl.uU37
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-sudo_users:
-  - chris
-  - sysadm
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/gw-dissens.oopen.de.yml

@@ -82,6 +82,53 @@ sshd_hostkeyalgorithms:
 # ---
 
 
+# ---
+# vars used by roles/common/tasks/users
+# ---
+
+default_user:
+
+  - name: chris
+    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: sysadm
+    user_id: 1050
+    group_id: 1050
+    group: sysadm
+    password: $y$j9T$sHxqz7NyYdn38ZegSbewO.$PPHR0n.XeMcS3AQ9KybllBT.2hxpYlQ7AiVhxHgUOX8
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: localadmin
+    user_id: 1051
+    group_id: 1051
+    group: localadmin
+    home: /home/localadmin
+    password: $y$j9T$1WH8G2UkuN1jjp4QLuoeC0$dXpOnJUfMMAqAXlwN8XD0pq78r.a4UZOgt3LY4afxy/
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+
+  - name: back
+    user_id: 1060
+    group_id: 1060
+    group: back
+    password: $y$j9T$WmitGB98lhPLJ39Iy4YfH.$irv0LP1bB5ImQKBUr1acEif6Ed6zDu6gLQuGQd/i5s0
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
+
+
 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
 # ---
@@ -186,40 +233,6 @@ ssh_keypair_backup_client:
     pub_key_dest: /root/.ssh/id_ed25519.pub
     target: backup.oopen.de
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$JLezdt23fYO1OVfqTGPLG.$0WZW1GBGvIs7aITanCemuvZ9CbHwCFg1uxMynQiO7Y/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$daq5sPNG0I8/BEqIRc8tq0$gLVISkrP7ziAnQUbBD6ZROpU2ud0/Y1Vmkqkq/yPH09
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$Sc6W8dHBquFeXxNvdaB9r1$S.yGBl7KHTvmlSNncI6cJ.2dHHg8LCoy.JSfJaZneH7
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/gw-ebs.oopen.de.yml

@@ -186,59 +186,6 @@ ssh_keypair_backup_client:
     pub_key_dest: /root/.ssh/id_ed25519.pub
     target: backup.oopen.de
 
-default_user:
-
-  - name: chris
-    password: $y$j9T$t0OK33lTuB/3TME5h/GHn.$4EjhvjhelkpUB2vqWPBdDCV3xCwBcJHpDobTkkuHxy.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$WWsYp2DSIw4jNx5/IaKzY1$VjvTQYvSaQtJDiiNYxOUDEx9QdIPTZ1YWXSSaS1whH/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$bqr.c39mSZOjjhVo/qmM2.$riPJ81SHLqfJMQ6/ZdeWNP7ma8R5nehI9mo5K8oUkw1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$uYqbl2A6vQ6WsLinzhUfG0$/w02iPud/LURbhY19DGtKWgKNFTpNEP7J.jOu5CZPh.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - localadmin
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/gw-fm.oopen.de.yml

@@ -1,4 +1,5 @@
 ---
+
 # ---
 # vars used by roles/network_interfaces
 # ---
@@ -25,9 +26,9 @@ network_interfaces:
     auto: true
     family: inet
     method: static
-    address: 172.16.122.2
+    address: 172.16.222.1
     netmask: 24
-    gateway: 172.16.122.254
+    gateway: 172.16.222.254
 
 
   - device: eno2
@@ -35,16 +36,36 @@ network_interfaces:
     auto: true
     family: inet
     method: static
-    address: 192.168.122.253
+    address: 192.168.222.254
     netmask: 24
+    post-up:
+      # VLAN 13 Guest Net
+      - /sbin/ip link add link eno2 name eno2.13 type vlan id 13
 
 
   - device: eno2:ns
-    headline: eno2:ns - Alias on eno5 (Nameserver)
+    headline: eno2:ns - Alias on eno2 (Nameserver)
     auto: true
     family: inet
     method: static
-    address: 192.168.122.2
+    address: 192.168.222.1
+    netmask: 32
+
+
+  - device: eno2.13
+    headline: eno2.13 - Guest Network
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.223.254
+    netmask: 24
+
+  - device: eno2.13:ns
+    headline: eno2.13:ns - alias on eno2.13 (Guest Network)
+    auto: true
+    family: inet
+    method: static
+    address: 192.168.223.1
     netmask: 32
 
 
@@ -63,62 +84,6 @@ network_interfaces:
 # ---
 
 
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_entries:
-
-  - name: "Check if Postfix Mailservice is up and running?"
-    minute: '*/15'
-    hour: '*'
-    job: /root/bin/monitoring/check_postfix.sh
-
-  - name: "Check if SSH service is up and running?"
-    minute: '*/15'
-    hour: '*'
-    job: /root/bin/monitoring/check_ssh.sh
-
-  - name: "Check if OpenVPN service is up and running?"
-    minute: '*/30'
-    hour: '*'
-    job: /root/bin/monitoring/check_vpn.sh
-
-  - name: "Check if nameservice (bind) is running?"
-    minute: '*/10'
-    hour: '*'
-    job: /root/bin/monitoring/check_dns.sh
-
-  - name: "Check forwarding ( /proc/sys/net/ipv4/ip_forward contains \"1\" )"
-    minute: '0-59/2'
-    hour: '*'
-    job: /root/bin/monitoring/check_forwarding.sh
-
-  - name: "Copy gateway configuration"
-    minute: '09'
-    hour: '3'
-    job: /root/bin/manage-gw-config/copy_gateway-config.sh ANW-KM
-
-
-#cron_user_special_time_entries: []
-cron_user_special_time_entries:
-
-  - name: "Check if Postfix Service is running at boot time"
-    special_time: reboot
-    job: "sleep 7 ; /root/bin/monitoring/check_postfix.sh"
-    insertafter: PATH
-
-  - name: "Restart Systemd's resolved at boottime."
-    special_time: reboot
-    job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
-    insertafter: PATH
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
 # ---
 # vars used by roles/common/tasks/sshd.yml
 # ---
@@ -198,16 +163,77 @@ resolved_nameserver:
 #resolved_domains: []
 resolved_domains:
   - ~.
-  - anw-km.netz
+  - fm.netz
 
 resolved_dnssec: false
 
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
+   - 172.16.222.254
    - 194.150.168.168
 
 
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_user_entries:
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check if SSH service is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if OpenVPN service is up and running?"
+    minute: '*/30'
+    hour: '*'
+    job: /root/bin/monitoring/check_vpn.sh
+
+  - name: "Check if nameservice (bind) is running?"
+    minute: '*/10'
+    hour: '*'
+    job: /root/bin/monitoring/check_dns.sh
+
+  - name: "Check forwarding ( /proc/sys/net/ipv4/ip_forward contains \"1\" )"
+    minute: '0-59/2'
+    hour: '*'
+    job: /root/bin/monitoring/check_forwarding.sh
+
+#  - name: "Speedtest"
+#    minute: '17'
+#    hour: '*0-8'
+#    job: /root/bin/admin-stuff/speedtest.sh
+
+  - name: "Copy gateway configuration"
+    minute: '09'
+    hour: '3'
+    job: /root/bin/manage-gw-config/copy_gateway-config.sh FM
+
+
+cron_user_special_time_entries:
+
+  - name: "Check if Postfix Service is running at boot time"
+    special_time: reboot
+    job: "sleep 7 ; /root/bin/monitoring/check_postfix.sh"
+    insertafter: PATH
+
+  - name: "Restart Systemd's resolved at boottime."
+    special_time: reboot
+    job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Restart NTP service 'ntpsec'"
+    special_time: reboot
+    job: "sleep 15 ; /bin/systemctl restart ntpsec"
+    insertafter: PATH
+
+
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -230,38 +256,6 @@ ssh_keypair_backup_client:
     pub_key_dest: /root/.ssh/id_ed25519.pub
     target: backup.oopen.de
 
-default_user:
-
-  - name: chris
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/gw-kb.oopen.de.yml

@@ -230,38 +230,6 @@ ssh_keypair_backup_client:
     pub_key_dest: /root/.ssh/id_ed25519.pub
     target: backup.oopen.de
 
-default_user:
-
-  - name: chris
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/keycloak-nd.oopen.de.yml

@@ -0,0 +1,225 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check if cert for Keycloak service is up-to-date"
+    minute: '51'
+    hour: '05'
+    job: /root/bin/monitoring/check_cert_for_keycloak.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '23'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+extra_user:
+
+  - name: nd-admin
+    user_id: 1045
+    group_id: 1045
+    group: nd-admin
+    password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de'
+
+sudo_users:
+  - chris
+  - sysadm
+  - nd-admin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/mm-irights.oopen.de.yml

@@ -75,12 +75,10 @@ systemd_resolved: true
 #    Servername für DNS-over-TLS: dot.ffmuc.net
 #    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
 resolved_nameserver:
-  - 213.133.98.98
+  - 185.12.64.2
-  - 2a01:4f8:0:1::add:9999
+  - 2a01:4ff:ff00::add:1
-  - 213.133.99.99
+  - 185.12.64.1
-  - 2a01:4f8:0:a111::add:9898
+  - 2a01:4ff:ff00::add:2
-  - 213.133.100.100
-  - 2a01:4f8:0:a0a1::add:1010
 
 # search domains
 #
@@ -100,6 +98,60 @@ resolved_fallback_nameserver:
    - 194.150.168.168
 
 
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if mattermost service ist running - Restart Service if needed."
+    minute: '*/6'
+    hour: '*'
+    job: /root/bin/monitoring/check_local_mattermost_service.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '01'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

host_vars/mm-migration.oopen.de.yml

@@ -0,0 +1,141 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+sshd_permit_root_login: !!str "prohibit-password"
+
+# ---
+# vars used by apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 195.201.179.131
+  - 95.217.204.204
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+

host_vars/mm-rav.oopen.de.yml

@@ -123,11 +123,16 @@ cron_user_special_time_entries:
     job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
     insertafter: PATH
 
+  - name: "Check if mattermost service is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_local_mattermost_service.sh > /dev/null 2>&1"
+    insertafter: PATH
+
 
 cron_user_entries:
 
   - name: "Check if mattermost service ist running - Restart Service if needed."
-    minute: '*/6'
+    minute: '*/16'
     hour: '*'
     job: /root/bin/monitoring/check_local_mattermost_service.sh
 

host_vars/o12.oopen.de.yml

@@ -273,6 +273,11 @@ cron_user_entries:
     hour: '*'
     job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
 
+  - name: "Check if all autostart LX-Container are running.?"
+    minute: '*/10'
+    hour: '*'
+    job: /root/bin/LXC/boot-autostart-lx-container.sh
+
 
 
 # ---

host_vars/o13-alt.oopen.de.yml

@@ -1,187 +0,0 @@
----
-
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-
-network_interfaces:
-
-  - device: br0
-    # use only once per device (for the first device entry)
-    headline: br0 - bridge over device ens3
-
-    # auto & allow are only used for the first device entry
-    allow: [] # array of allow-[stanzas] eg. allow-hotplug
-    auto: true
-
-    family: inet
-    method: manual
-    hwaddress: 52:54:00:62:fb:9c
-    description:
-    address:
-    netmask:
-    gateway:
-    metric:
-    pointopoint:
-    mtu:
-    scope:
-
-    # additional user by dhcp method
-    #
-    hostname:
-    leasehours:
-    leasetime:
-    vendor:
-    client:
-
-    # additional used by bootp method
-    #
-    bootfile:
-    server:
-    hwaddr:
-
-    # optional dns settings nameservers: []
-    #
-    #    nameservers:
-    #      - 194.150.168.168  # dns.as250.net
-    #      - 91.239.100.100   # anycast.censurfridns.dk
-    #    search: warenform.de
-    #
-    #nameservers:
-    #  - 195.201.179.131
-    #  - 95.217.204.204
-    #search:
-
-    # optional additional subnets/ips subnets: []
-    # subnets: 
-    #   - '192.168.123.0/24'
-    #   - '192.168.124.11/32'
-
-    # optional bridge parameters bridge: {}
-    # bridge:
-    #   ports:
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
-    bridge:
-      ports: ens3 # for mor devices support a blank separated list
-      stp: !!str off
-      fd: 1
-      hello: 2
-      maxage: 12
-
-    #  optional bonding parameters bond: {}
-    #  bond:
-    #    master
-    #    primary
-    #    slave
-    #    method:
-    #    miimon:
-    #    lacp-rate:
-    #    ad-select-rate:
-    #    master:
-    #    slaves:
-    bond: {}
-
-    # optional vlan settings | vlan: {}
-    # vlan: {}
-    #   raw-device: 'eth0'
-    vlan: {}
-
-    # inline hook scripts
-    pre-up: [] # pre-up script lines
-    up: 
-      - !!str "ip addr add 83.223.86.200/24 dev br0"
-      - !!str "ip route add default via 83.223.86.1"
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: [] # pre-down script lines (alias for down)
-    down: [] # down script lines
-    post-down: [] # post-down script lines
-  
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-server
-  repo: https://git.oopen.de/firewall/ipt-server
-  dest: /usr/local/src/ipt-server
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/o13-board.oopen.de.yml

@@ -1,73 +0,0 @@
----
-  
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-server
-  repo: https://git.oopen.de/firewall/ipt-server
-  dest: /usr/local/src/ipt-server
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/o13-cryptpad.oopen.de.yml

@@ -100,67 +100,30 @@ resolved_fallback_nameserver:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
+extra_user:
 
-  - name: chris
+  - name: marsupilami
-    password: $y$j9T$KUDlIDddLeymNRsoS7Z51/$eelMaGW/JhVsCjl6nducJmjxrHpuyLStWuOGrohKZZD
+    password: $y$j9T$guTT3egsLUFwxUGCnDJ0o0$WCQt3gXcYIpArTxbn2BunvIWG6w7GZLx./fFGJYCsd/
     shell: /bin/bash
+    group: marsupilami
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4wVpkMrF4M5wKBxRAonR4gVngO9+yhBEAyhV03l6Is'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$1SUeBB9jQKPnG9JPt30O5/$aiZOeMJbJqE.cEKkFdSBxeuhma8n1thBVn00SClT3C/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $y$j9T$/TGIkTdH5zV4wTPsrZNko0$nGIMPM7WhOaeg4qUrwqiJ4Fvmn7He0bmYdZlXQ4ow80
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$n17mARf7i72xHDBW0lfT40$2WQMFPops.4.T3H7mk7Kzh3sRt3YfJtlhtn0Vl.uU37
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: cryptpad
-    user_id: 2010
-    group_id: 2010
-    group: cryptpad
-    home: /var/www/cryptpad
-    password: $y$j9T$TUSURhYNq5B1eWlxis.xy.$YfCpyp24dmaZwiIEMaJvX7u3P.MEdAyz8YXMusM4lu7
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
 
   - name: c3po
     password: $6$z0yywBoF$VtusXNrSvL4s4kQSeCl/6rZoCcAOz0aSINm0ArntILNvLnurVDGk9nJz42ZMya/DFe8snlf5kLymeAmNRiyDK/
     shell: /bin/bash
+    group: c3po
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
       - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDinfnbnVooKT0iFpkZeRZMj8JpYJk+EkgGHyK2xhb0HNoYvDoG06Clckm0vauuRlSYnWkZC0dLIbqHlACA+jbCKa2w/5yOjCXmJiJEO04YCMhkQH08It+wpWZb/Bx2O6DB3cY+3mHwPocp/la8caYW4NIE5+67AnHxIQifJLXM44TgkmFEhXSBMIZj8b8wL+MA0zKD0LXwgEH9Wllcccq6D5lfsrUSLvTRHq362pE+ZtVXh2peVkS4r98HNtYVUjBMgOIIPEypopceUzXC0L+vB7s2SolAsh3CGjqyjYW8x3fWnAewlfa5TbgIC+11e+KJKFr5+tVfwSgHC+TtfuXDU5Ws80ETejbuwx2iRVfHG0fDcjPzaVUXGmY+j8OR4jACz5KY5+VMJgMuXJTbZBEf1C5O3lCTaEf/Pmw50SHrshT/bhdrMBUaS+AOTFHrI3WOu+ujWMXJK3pRdROXDFDtPfc1afaJkMuKO5Uay/qwTEKd8NwXNoAGkXjowKBerNgJRy5JwhmbHMA6xsCDEjXMVy+yiMw+58JE76g5HVVu7dpyz0bjXD3LrpB+lclQHRLxNajWAjVsAu/eI2zQDDS7YHi1IZVUGdYD0g0qXdeNQ//KA7FVr22VFUP8xtbseZfOZpKFGVEMVkIOcYHZoYhOYxZDVNNmvle13F4PU1zOiQ== c3po@riseup.net'
 
 sudo_users:
   - chris
+  - c3po
+  - marsupilami
   - sysadm
   - localadmin
-  - c3po
 
 
 # ---

host_vars/o13-mumble.oopen.de.yml

@@ -100,53 +100,28 @@ resolved_fallback_nameserver:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
+extra_user:
 
-  - name: chris
+  - name: marsupilami
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    password: $y$j9T$guTT3egsLUFwxUGCnDJ0o0$WCQt3gXcYIpArTxbn2BunvIWG6w7GZLx./fFGJYCsd/
     shell: /bin/bash
+    group: marsupilami
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4wVpkMrF4M5wKBxRAonR4gVngO9+yhBEAyhV03l6Is'
 
   - name: c3po
     password: $6$z0yywBoF$VtusXNrSvL4s4kQSeCl/6rZoCcAOz0aSINm0ArntILNvLnurVDGk9nJz42ZMya/DFe8snlf5kLymeAmNRiyDK/
     shell: /bin/bash
+    group: c3po
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
       - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDinfnbnVooKT0iFpkZeRZMj8JpYJk+EkgGHyK2xhb0HNoYvDoG06Clckm0vauuRlSYnWkZC0dLIbqHlACA+jbCKa2w/5yOjCXmJiJEO04YCMhkQH08It+wpWZb/Bx2O6DB3cY+3mHwPocp/la8caYW4NIE5+67AnHxIQifJLXM44TgkmFEhXSBMIZj8b8wL+MA0zKD0LXwgEH9Wllcccq6D5lfsrUSLvTRHq362pE+ZtVXh2peVkS4r98HNtYVUjBMgOIIPEypopceUzXC0L+vB7s2SolAsh3CGjqyjYW8x3fWnAewlfa5TbgIC+11e+KJKFr5+tVfwSgHC+TtfuXDU5Ws80ETejbuwx2iRVfHG0fDcjPzaVUXGmY+j8OR4jACz5KY5+VMJgMuXJTbZBEf1C5O3lCTaEf/Pmw50SHrshT/bhdrMBUaS+AOTFHrI3WOu+ujWMXJK3pRdROXDFDtPfc1afaJkMuKO5Uay/qwTEKd8NwXNoAGkXjowKBerNgJRy5JwhmbHMA6xsCDEjXMVy+yiMw+58JE76g5HVVu7dpyz0bjXD3LrpB+lclQHRLxNajWAjVsAu/eI2zQDDS7YHi1IZVUGdYD0g0qXdeNQ//KA7FVr22VFUP8xtbseZfOZpKFGVEMVkIOcYHZoYhOYxZDVNNmvle13F4PU1zOiQ== c3po@riseup.net'
 
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
 sudo_users:
   - chris
+  - c3po
+  - marsupilami
   - sysadm
   - localadmin
 

host_vars/o13-pad.oopen.de.yml

@@ -100,64 +100,28 @@ resolved_fallback_nameserver:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
+extra_user:
 
-  - name: chris
+  - name: marsupilami
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    password: $y$j9T$guTT3egsLUFwxUGCnDJ0o0$WCQt3gXcYIpArTxbn2BunvIWG6w7GZLx./fFGJYCsd/
     shell: /bin/bash
+    group: marsupilami
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4wVpkMrF4M5wKBxRAonR4gVngO9+yhBEAyhV03l6Is'
 
   - name: c3po
     password: $6$z0yywBoF$VtusXNrSvL4s4kQSeCl/6rZoCcAOz0aSINm0ArntILNvLnurVDGk9nJz42ZMya/DFe8snlf5kLymeAmNRiyDK/
     shell: /bin/bash
+    group: c3po
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
       - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDinfnbnVooKT0iFpkZeRZMj8JpYJk+EkgGHyK2xhb0HNoYvDoG06Clckm0vauuRlSYnWkZC0dLIbqHlACA+jbCKa2w/5yOjCXmJiJEO04YCMhkQH08It+wpWZb/Bx2O6DB3cY+3mHwPocp/la8caYW4NIE5+67AnHxIQifJLXM44TgkmFEhXSBMIZj8b8wL+MA0zKD0LXwgEH9Wllcccq6D5lfsrUSLvTRHq362pE+ZtVXh2peVkS4r98HNtYVUjBMgOIIPEypopceUzXC0L+vB7s2SolAsh3CGjqyjYW8x3fWnAewlfa5TbgIC+11e+KJKFr5+tVfwSgHC+TtfuXDU5Ws80ETejbuwx2iRVfHG0fDcjPzaVUXGmY+j8OR4jACz5KY5+VMJgMuXJTbZBEf1C5O3lCTaEf/Pmw50SHrshT/bhdrMBUaS+AOTFHrI3WOu+ujWMXJK3pRdROXDFDtPfc1afaJkMuKO5Uay/qwTEKd8NwXNoAGkXjowKBerNgJRy5JwhmbHMA6xsCDEjXMVy+yiMw+58JE76g5HVVu7dpyz0bjXD3LrpB+lclQHRLxNajWAjVsAu/eI2zQDDS7YHi1IZVUGdYD0g0qXdeNQ//KA7FVr22VFUP8xtbseZfOZpKFGVEMVkIOcYHZoYhOYxZDVNNmvle13F4PU1zOiQ== c3po@riseup.net'
 
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: cryptpad
-    user_id: 2010
-    group_id: 2010
-    group: cryptpad
-    home: /var/www/cryptpad
-    password: $y$j9T$TUSURhYNq5B1eWlxis.xy.$YfCpyp24dmaZwiIEMaJvX7u3P.MEdAyz8YXMusM4lu7
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
 sudo_users:
   - chris
+  - c3po
+  - marsupilami
   - sysadm
   - localadmin
 

host_vars/o13-schleuder.oopen.de.yml

@@ -1,120 +0,0 @@
----
-  
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-default_user:
-
-  - name: chris
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: c3po
-    password: $6$z0yywBoF$VtusXNrSvL4s4kQSeCl/6rZoCcAOz0aSINm0ArntILNvLnurVDGk9nJz42ZMya/DFe8snlf5kLymeAmNRiyDK/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDinfnbnVooKT0iFpkZeRZMj8JpYJk+EkgGHyK2xhb0HNoYvDoG06Clckm0vauuRlSYnWkZC0dLIbqHlACA+jbCKa2w/5yOjCXmJiJEO04YCMhkQH08It+wpWZb/Bx2O6DB3cY+3mHwPocp/la8caYW4NIE5+67AnHxIQifJLXM44TgkmFEhXSBMIZj8b8wL+MA0zKD0LXwgEH9Wllcccq6D5lfsrUSLvTRHq362pE+ZtVXh2peVkS4r98HNtYVUjBMgOIIPEypopceUzXC0L+vB7s2SolAsh3CGjqyjYW8x3fWnAewlfa5TbgIC+11e+KJKFr5+tVfwSgHC+TtfuXDU5Ws80ETejbuwx2iRVfHG0fDcjPzaVUXGmY+j8OR4jACz5KY5+VMJgMuXJTbZBEf1C5O3lCTaEf/Pmw50SHrshT/bhdrMBUaS+AOTFHrI3WOu+ujWMXJK3pRdROXDFDtPfc1afaJkMuKO5Uay/qwTEKd8NwXNoAGkXjowKBerNgJRy5JwhmbHMA6xsCDEjXMVy+yiMw+58JE76g5HVVu7dpyz0bjXD3LrpB+lclQHRLxNajWAjVsAu/eI2zQDDS7YHi1IZVUGdYD0g0qXdeNQ//KA7FVr22VFUP8xtbseZfOZpKFGVEMVkIOcYHZoYhOYxZDVNNmvle13F4PU1zOiQ== c3po@riseup.net'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFkl+5aVg4l40bxmf6k2dpopV8oAXyLhGGmKfzspW3GTfD29WjhuGS/mefrqr3tZRYrybPA5GDQ1QdwwRL16+6xfjAt/B62p3dMXnjsHalk74DTcQCZDlsj0UxTV1+gfOYzcB/CAqRd2wtB+vqGWRP+oGP3E7AIgoBlE44MaEDDuMP0Vvm8hNQ5N+/3zcrE626yDHAa4qmOd5d+J/HWrHLeJ4915g9VcCYCNGCgepb//4RdCpzEqUJiBGwihb/iJk3RoHcAv3L+tht8vmBF7Wz0iJ9BtLRTsJGFCkET0i50E18mU3bfaa7ov/PY/+UcE8FZSWZcoZ6AtmoBy0Zg2mp6/F9serfe67qtILNAbWD+qNRC7GjW3c5UvF5GJM6WvG8OZRvwarovZOU8uw1NLL3unY8O1bdihXmCXatXz+MvHCOvmZekUolKMBu7mziH5wificprUY9YeGX1FHVh4/hsL04zZdu/Q8Rr/BxM8+mJCCPsrkEoNnZNJfxCSwynd3jjqkhBpzZkEW9EGDBG5qnx4f6QPtcf/sv7eoNjzhEUs5k9GstbgW0ZD6381Ws/EpIdRbZUl52wFXalE8N/Z9hU6vfBC1xk0DIardUkZk+6lTsS8orBZkmPDNhX5hT8nmwNszQI0WgHPs+xDAdFskMcB/j20G5NupZm+2QgNXoww== jonas@meurer.it'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCzd5rFYvV5/V2NZE4jxL09qZ4TTsgmhbfSHpsj9wX89+j7ZrfTAkAkAFxyrWs8FR3CQ11DGkrXW059a0ppRQ7R8bUW9CniXS/RaRAvqX9AMM9Xo/lmL4pXNM0sV4nHJWphi5Bc+zTIM2I4PSbHYw+5dDnj8ZIQ8ucBff+k29Zd90JRuKx72tk0pQNf7sQbWVKNCT/B4g4MJV84NvnO+ExCWvGM95Cy5NCTnQfO94/OSkN72R//tIR7Nd/aK7hEj69MoVJZrFy4qzE9KskLhKeUYCqoz86XOQ6Dfag/B2adTeG3r9DEacG3ao/ACZKQChj0X12LEV/PZUHLORqYpWIwMuIx54vhbxarSwlKhoOCv1XQJwo9BTavMhFNsMtZpAJYdvAakRCbf18bDrHyqYYqjAyYOp+L+G+wlSh3tz0qQL8aAnaV3RPN0fDd7Zu1dpMGAM2gMnBEMJ+k82V7EtACp1jf37LW11Lbv2o+dRUJEgsrU9TNGxaGSTWqGc65TuP9PUfDXq1ZNOPQWSK/KseqB0WUx6ePfZzkgkr7kGXT/d9hUSCq2+iprhfwQpYLcXE9XtCdo1aivIKQ8zCuR44q11HePyNtEMaJfq33p4uDTVOy7UOtuACzSbk6vs7h6h8CUGPwU9aw+PRiWY4Jdm0caJ8trFfH1R8XaIe3SaUEw== t@NB-003258-RLS'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-server
-  repo: https://git.oopen.de/firewall/ipt-server
-  dest: /usr/local/src/ipt-server
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

host_vars/o13-staging-board.oopen.de.yml

@@ -106,40 +106,30 @@ resolved_fallback_nameserver:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
+extra_user:
 
-  - name: chris
+  - name: marsupilami
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    password: $y$j9T$guTT3egsLUFwxUGCnDJ0o0$WCQt3gXcYIpArTxbn2BunvIWG6w7GZLx./fFGJYCsd/
     shell: /bin/bash
+    group: marsupilami
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4wVpkMrF4M5wKBxRAonR4gVngO9+yhBEAyhV03l6Is'
 
-  - name: sysadm
+  - name: c3po
-
+    password: $6$z0yywBoF$VtusXNrSvL4s4kQSeCl/6rZoCcAOz0aSINm0ArntILNvLnurVDGk9nJz42ZMya/DFe8snlf5kLymeAmNRiyDK/
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
     shell: /bin/bash
+    group: c3po
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDinfnbnVooKT0iFpkZeRZMj8JpYJk+EkgGHyK2xhb0HNoYvDoG06Clckm0vauuRlSYnWkZC0dLIbqHlACA+jbCKa2w/5yOjCXmJiJEO04YCMhkQH08It+wpWZb/Bx2O6DB3cY+3mHwPocp/la8caYW4NIE5+67AnHxIQifJLXM44TgkmFEhXSBMIZj8b8wL+MA0zKD0LXwgEH9Wllcccq6D5lfsrUSLvTRHq362pE+ZtVXh2peVkS4r98HNtYVUjBMgOIIPEypopceUzXC0L+vB7s2SolAsh3CGjqyjYW8x3fWnAewlfa5TbgIC+11e+KJKFr5+tVfwSgHC+TtfuXDU5Ws80ETejbuwx2iRVfHG0fDcjPzaVUXGmY+j8OR4jACz5KY5+VMJgMuXJTbZBEf1C5O3lCTaEf/Pmw50SHrshT/bhdrMBUaS+AOTFHrI3WOu+ujWMXJK3pRdROXDFDtPfc1afaJkMuKO5Uay/qwTEKd8NwXNoAGkXjowKBerNgJRy5JwhmbHMA6xsCDEjXMVy+yiMw+58JE76g5HVVu7dpyz0bjXD3LrpB+lclQHRLxNajWAjVsAu/eI2zQDDS7YHi1IZVUGdYD0g0qXdeNQ//KA7FVr22VFUP8xtbseZfOZpKFGVEMVkIOcYHZoYhOYxZDVNNmvle13F4PU1zOiQ== c3po@riseup.net'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
 
 sudo_users:
   - chris
+  - c3po
+  - marsupilami
   - sysadm
+  - localadmin
 
 
 # ---

host_vars/o13-web.oopen.de.yml

@@ -100,54 +100,28 @@ resolved_fallback_nameserver:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-default_user:
+extra_user:
 
-  - name: chris
+  - name: marsupilami
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
+    password: $y$j9T$guTT3egsLUFwxUGCnDJ0o0$WCQt3gXcYIpArTxbn2BunvIWG6w7GZLx./fFGJYCsd/
     shell: /bin/bash
+    group: marsupilami
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL4wVpkMrF4M5wKBxRAonR4gVngO9+yhBEAyhV03l6Is'
 
   - name: c3po
     password: $6$z0yywBoF$VtusXNrSvL4s4kQSeCl/6rZoCcAOz0aSINm0ArntILNvLnurVDGk9nJz42ZMya/DFe8snlf5kLymeAmNRiyDK/
     shell: /bin/bash
+    group: c3po
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
       - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDinfnbnVooKT0iFpkZeRZMj8JpYJk+EkgGHyK2xhb0HNoYvDoG06Clckm0vauuRlSYnWkZC0dLIbqHlACA+jbCKa2w/5yOjCXmJiJEO04YCMhkQH08It+wpWZb/Bx2O6DB3cY+3mHwPocp/la8caYW4NIE5+67AnHxIQifJLXM44TgkmFEhXSBMIZj8b8wL+MA0zKD0LXwgEH9Wllcccq6D5lfsrUSLvTRHq362pE+ZtVXh2peVkS4r98HNtYVUjBMgOIIPEypopceUzXC0L+vB7s2SolAsh3CGjqyjYW8x3fWnAewlfa5TbgIC+11e+KJKFr5+tVfwSgHC+TtfuXDU5Ws80ETejbuwx2iRVfHG0fDcjPzaVUXGmY+j8OR4jACz5KY5+VMJgMuXJTbZBEf1C5O3lCTaEf/Pmw50SHrshT/bhdrMBUaS+AOTFHrI3WOu+ujWMXJK3pRdROXDFDtPfc1afaJkMuKO5Uay/qwTEKd8NwXNoAGkXjowKBerNgJRy5JwhmbHMA6xsCDEjXMVy+yiMw+58JE76g5HVVu7dpyz0bjXD3LrpB+lclQHRLxNajWAjVsAu/eI2zQDDS7YHi1IZVUGdYD0g0qXdeNQ//KA7FVr22VFUP8xtbseZfOZpKFGVEMVkIOcYHZoYhOYxZDVNNmvle13F4PU1zOiQ== c3po@riseup.net'
 
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
 sudo_users:
   - chris
   - c3po
+  - marsupilami
   - sysadm
   - localadmin
 

host_vars/o17.oopen.de.yml

@@ -63,8 +63,6 @@ network_interfaces:
     #    search: warenform.de
     #
     nameservers:
-      - 195.201.179.131
-      - 95.217.204.204
     search: oopen.de warenform.de
 
     # optional additional subnets/ips subnets: []
@@ -105,6 +103,13 @@ network_interfaces:
     vlan: {}
 
     # inline hook scripts
+    #
+    # example:
+    #
+    #    up:
+    #       - !!str "ip addr add 83.223.86.115/24 dev br0"
+    #       - !!str "ip route add default via 83.223.86.1"
+    #
     pre-up: [] # pre-up script lines
     up: 
       - !!str "ip addr add 83.223.85.203/24 dev br0"
@@ -113,6 +118,7 @@ network_interfaces:
     pre-down: [] # pre-down script lines (alias for down)
     down: [] # down script lines
     post-down: [] # post-down script lines
+
   
 # ---
 # vars used by roles/ansible_dependencies
@@ -139,6 +145,76 @@ network_interfaces:
 # ---
 
 
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 195.201.179.131
+  - 95.217.204.204
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
 # ---
 # vars used by roles/common/tasks/cron.yml
 # ---
@@ -156,7 +232,7 @@ cron_user_special_time_entries:
 
   - name: "Restart DNS Cache service 'systemd-resolved'"
     special_time: reboot
-    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved > /dev/null 2>&1"
     insertafter: PATH
 
   - name: "Check if postfix mailservice is running. Restart service if needed."
@@ -250,210 +326,6 @@ git_firewall_repository:
 # vars used by roles/common/tasks/samba-user.yml
 # ---
 
-samba_server_ip: 83.223.85.203
-samba_server_cidr_prefix: 24
-
-samba_workgroup: AH
-
-samba_netbios_name: FILE-AH
-
-samba_groups:
-  - name: verwaltung
-    group_id: 1200
-  - name: intern
-    group_id: 1210
-  - name: hoffmann-elberling
-    group_id: 1220
-  - name: gubitz-partner
-    group_id: 1230
-
-samba_user:
-  - name: buero
-    groups:
-      - verwaltung
-      - intern
-    password: 'buero2011'
-  - name: axel
-    groups:
-      - intern
-      - verwaltung
-      - hoffmann-elberling
-    password: 'ah-kiel.2018'
-  - name: bjoern
-    groups:
-      - intern
-      - verwaltung
-      - hoffmann-elberling
-    password: 'bjoern2011'
-  - name: gubitz
-    groups:
-      - intern
-      - verwaltung
-      - gubitz-partner
-    password: '20gubitz12'
-  - name: schaar
-    groups:
-      - intern
-      - verwaltung
-      - gubitz-partner
-    password: '20schaar12'
-  - name: molkentin
-    groups:
-      - intern
-      - verwaltung
-      - gubitz-partner
-    password: 20molkentin12
-  - name: buerooben
-    groups:
-      - intern
-      - verwaltung
-      - hoffmann-elberling
-    password: 'buero2013'
-  - name: back
-    groups: []
-    password: !vault |
-          $ANSIBLE_VAULT;1.1;AES256
-          63643330373231636537366333326630333265303265653933613835656262323863363038653234
-          3462653135633266373439626263356636646637643035340a653466356235346663626163306363
-          61313164643061306433643738643563303036646334376536626531383965303036386162393832
-          6631333038306462610a356535633265633563633962333137326533633834636331343562633765
-          3631
-  - name: buchholz
-    groups:
-      - buero
-      - intern
-      - verwaltung
-    password: '20-buch_holz-20'
-  - name: schmidt
-    groups:
-      - intern
-      - verwaltung
-      - gubitz-partner
-    password: '20-schmidt_21%'
-  - name: kiel-nb1
-    groups:
-      - buero
-      - intern
-      - verwaltung
-      - gubitz-partner
-      - hoffmann-elberling
-    password: '20-note%book1-20'
-  - name: kiel-nb2
-    groups:
-      - buero
-      - intern
-      - verwaltung
-      - gubitz-partner
-      - hoffmann-elberling
-    password: '20-note%book2-20'
-  - name: chris
-    groups:
-      - buero
-      - intern
-      - verwaltung
-      - gubitz-partner
-      - hoffmann-elberling
-    password: !vault |
-          $ANSIBLE_VAULT;1.1;AES256
-          63643330373231636537366333326630333265303265653933613835656262323863363038653234
-          3462653135633266373439626263356636646637643035340a653466356235346663626163306363
-          61313164643061306433643738643563303036646334376536626531383965303036386162393832
-          6631333038306462610a356535633265633563633962333137326533633834636331343562633765
-          3631
-
-base_home: /home
-
-# remove_samba_users:
-#   - name: name1
-#   - name: name2
-#
-remove_samba_users: []
-
-samba_shares:
-  - name: profiles-RDP
-    comment: Users profiles RDP
-    path: /data/samba/profiles-RDP
-    guest_ok: !!str no
-    browseable: !!str no
-    valid_users: '%S'
-    file_create_mask: !!str 600
-    dir_create_mask:  !!str 700
-
-  - name: Buero
-    path: /data/samba/shares/Buero
-    group_valid_users: intern
-    group_write_list: intern
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    vfs_object_recycle: true
-    recycle_path: recycle
-
-  - name: Verwaltung
-    path: /data/samba/shares/Verwaltung
-    group_valid_users: verwaltung
-    group_write_list: verwaltung
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: recycle
-
-  - name: Scans_schnell 
-    path: /data/samba/shares/Scans_schnell
-    group_valid_users: intern
-    group_write_list: intern
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    vfs_object_recycle: true
-    recycle_path: recycle
-
-  - name: Hoffmann-Elberling
-    path: /data/samba/shares/Hoffmann-Elberling
-    group_valid_users: hoffmann-elberling
-    group_write_list: hoffmann-elberling
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    vfs_object_recycle: true
-    recycle_path: recycle
-
-  - name: Gubitz-Partner
-    path: /data/samba/shares/Gubitz-Partner
-    group_valid_users: gubitz-partner
-    group_write_list: gubitz-partner
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    vfs_object_recycle: true
-    recycle_path: recycle
-
-  - name: Gubitz-Backup
-    path: /data/samba/shares/Gubitz-Backup
-    group_valid_users: gubitz
-    group_write_list: gubitz
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: recycle
-
-  - name: WinServer2016-Backup
-    comment: WinServer2016-Backup on Fileserver
-    path: /data/samba/shares/WinServer2016-Backup
-    group_valid_users: {}
-    group_write_list: {}
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    guest_ok: !!str yes
-    vfs_object_recycle: true
-    recycle_path: {}
-
-  - name: Advoware-Backup
-    comment: Advoware-Backup (only read) on Fileserver
-    path: /data/samba/shares/Advoware-Backup
-    group_valid_users: back
-    group_write_list: back
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    guest_ok: !!str yes
-    vfs_object_recycle: true
-
 
 
 # ==============================

host_vars/o23.oopen.de.yml

@@ -24,7 +24,7 @@ network_interfaces:
 
   - device: br0
     # use only once per device (for the first device entry)
-    headline: br0 - bridge over device enp6s0
+    headline: br0 - bridge over device enp27s0
 
     # auto & allow are only used for the first device entry
     allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -32,7 +32,7 @@ network_interfaces:
 
     family: inet
     method: static
-    hwaddress: 88:d7:f6:7d:e6:ef
+    hwaddress: 30:9c:23:63:40:b5
     description: 
     address: 159.69.74.150
     netmask: 26
@@ -63,10 +63,10 @@ network_interfaces:
     #      - 91.239.100.100   # anycast.censurfridns.dk
     #    search: warenform.de
     #
-    nameservers:
+    #nameservers:
-      - 195.201.179.131
+    #  - 195.201.179.131
-      - 95.217.204.204
+    #  - 95.217.204.204
-    search:
+    #search:
 
     # optional additional subnets/ips subnets: []
     # subnets: 
@@ -81,7 +81,7 @@ network_interfaces:
     #   maxwait:
     #   waitport:
     bridge:
-      ports: enp6s0 # for mor devices support a blank separated list
+      ports: enp27s0 # for mor devices support a blank separated list
       stp: !!str off
       fd: 5
       hello: 2

host_vars/o24.oopen.de.yml

@@ -24,7 +24,7 @@ network_interfaces:
 
   - device: br0
     # use only once per device (for the first device entry)
-    headline: br0 - bridge over device enp7s0
+    headline: br0 - bridge over device enp193s0f0np0
 
     # auto & allow are only used for the first device entry
     allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -32,11 +32,11 @@ network_interfaces:
 
     family: inet
     method: static
-    hwaddress: 7c:10:c9:9e:bd:51
+    hwaddress: 9c:6b:00:4e:fc:15
     description:
-    address: 168.119.70.7
+    address: 157.90.140.173
     netmask: 26
-    gateway: 168.119.70.1
+    gateway: 157.90.140.129
     metric:
     pointopoint:
     mtu:
@@ -81,7 +81,7 @@ network_interfaces:
     #   maxwait:
     #   waitport:
     bridge:
-      ports: enp7s0 # for mor devices support a blank separated list
+      ports: enp193s0f0np0 # for mor devices support a blank separated list
       stp: !!str off
       fd: 1
       hello: 2
@@ -108,7 +108,7 @@ network_interfaces:
     # inline hook scripts
     pre-up: [] # pre-up script lines
     up: 
-      - !!str "route add -net 168.119.70.0 netmask 255.255.255.192 gw 168.119.70.1 dev br0" # up script lines
+      - !!str "route add -net 157.90.140.128 netmask 255.255.255.192 gw 157.90.140.129 dev br0" # up script lines
     post-up: [] # post-up script lines (alias for up)
     pre-down: [] # pre-down script lines (alias for down)
     down: [] # down script lines
@@ -119,7 +119,7 @@ network_interfaces:
   - device: br0
     family: inet6
     method: static
-    address: 2a01:4f8:242:1822::2
+    address: 2a01:4f8:2220:37c3::2
     netmask: 64
     gateway: fe80::1
 
@@ -200,9 +200,9 @@ systemd_resolved: true
 #    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
 resolved_nameserver:
   - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
   - 185.12.64.1
   - 2a01:4ff:ff00::add:2
-  - 2a01:4ff:ff00::add:1
 
 # search domains
 #
@@ -265,10 +265,10 @@ cron_user_entries:
     hour: '*'
     job: /root/bin/monitoring/check_ssh.sh
 
-  - name: "Check connectifity - reboot if needed"
+#  - name: "Check connectifity - reboot if needed"
-    minute: '*/10'
+#    minute: '*/10'
-    hour: '*'
+#    hour: '*'
-    job: /root/bin/admin-stuff/check-connectivity.sh
+#    job: /root/bin/admin-stuff/check-connectivity.sh
 
   - name: "Check if Postfix Mailservice is up and running?"
     minute: '*/15'

host_vars/o26.oopen.de.yml

@@ -253,6 +253,16 @@ root_ssh_keypair:
     priv_key_dest: /root/.ssh/id_ed25519-borg-backup
     pub_key_src: o26.oopen.de/root/.ssh/id_ed25519-borg-backup.pub
     pub_key_dest: /root/.ssh/id_ed25519-borg-backup.pub
+  - name: id_ed25519-gitea
+    priv_key_src: o26.oopen.de/root/.ssh/id_ed25519-gitea
+    priv_key_dest: /root/.ssh/id_ed25519-gitea
+    pub_key_src: o26.oopen.de/root/.ssh/id_ed25519-gitea.pub
+    pub_key_dest: /root/.ssh/id_ed25519-gitea.pub
+  - name: id_ed25519-backup
+    priv_key_src: o26.oopen.de/root/.ssh/id_ed25519-backup
+    priv_key_dest: /root/.ssh/id_ed25519-backup
+    pub_key_src: o26.oopen.de/root/.ssh/id_ed25519-backup.pub
+    pub_key_dest: /root/.ssh/id_ed25519-backup
 
 
 # ---
@@ -469,10 +479,9 @@ default_user:
     ssh_keys:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMvy+IDUeoVwLg+cJNcKzls5guOrVUretsf05v3Y2N+Y root@default-oopen-server'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcEPd+MDJKzWqWStt3XpJU1OpJ0uxmipacIGkm6k3MS root@default-warenform-server'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/eGKbdxPYu7L/b/DjZrWek50e0AnkHFZS+zV12o5jy root@borg-client-key-warenform'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ6Sra1D8JU2A68G4rSny7D0ukYKy89NVMXbdxrtdZwr root@borg-client-key-oopen'
 
   - name: borg
     user_id: 1065

host_vars/o29.oopen.de.yml

@@ -23,7 +23,7 @@ network_interfaces:
 
   - device: br0
     # use only once per device (for the first device entry)
-    headline: br0 - bridge over device enp35s0
+    headline: br0 - bridge over device enp8s0
 
     # auto & allow are only used for the first device entry
     allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -31,11 +31,11 @@ network_interfaces:
 
     family: inet
     method: static
-    hwaddress: a8:a1:59:3e:bd:b8
+    hwaddress: 9c:6b:00:6d:f5:a1
     description:
-    address: 135.181.136.120
+    address: 65.21.220.154
     netmask: 26
-    gateway: 135.181.136.65
+    gateway: 65.21.220.129
     metric:
     pointopoint:
     mtu:
@@ -80,7 +80,7 @@ network_interfaces:
     #   maxwait:
     #   waitport:
     bridge:
-      ports: enp35s0 # for mor devices support a blank separated list
+      ports: enp8s0 # for mor devices support a blank separated list
       stp: !!str off
       fd: 1
       hello: 2
@@ -107,7 +107,7 @@ network_interfaces:
     # inline hook scripts
     pre-up: [] # pre-up script lines
     up: 
-      - !!str "route add -net 135.181.136.64 netmask 255.255.255.192 gw 135.181.136.65 dev br0" # up script lines
+      - !!str "route add -net 65.21.220.128 netmask 255.255.255.192 gw 65.21.220.129 dev br0" # up script lines
     post-up: [] # post-up script lines (alias for up)
     pre-down: [] # pre-down script lines (alias for down)
     down: [] # down script lines
@@ -118,7 +118,7 @@ network_interfaces:
   - device: br0
     family: inet6
     method: static
-    address: 2a01:4f9:3a:1051::2
+    address: 2a01:4f9:3080:318c::2
     netmask: 64
     gateway: fe80::1
 

host_vars/o34.oopen.de.yml

@@ -345,6 +345,8 @@ cron_user_entries:
 sudoers_file_user_privileges:
   - name: back
     entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
+  - name: www-data
+    entry: 'ALL=(root) NOPASSWD: /root/bin/nextcloud/add-new-account.sh'
 
 
 # ---

host_vars/o40.oopen.de.yml

@@ -24,7 +24,7 @@ network_interfaces:
 
   - device: br0
     # use only once per device (for the first device entry)
-    headline: br0 - bridge over device enp5s0
+    headline: br0 - bridge over device enp6s0
 
     # auto & allow are only used for the first device entry
     allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -32,7 +32,7 @@ network_interfaces:
 
     family: inet
     method: static
-    hwaddress: 9c:6b:00:0b:fe:2f
+    hwaddress: 9c:6b:00:08:9a:30
     description:
     address: 176.9.125.12
     netmask: 27
@@ -76,7 +76,7 @@ network_interfaces:
     #   maxwait:
     #   waitport:
     bridge:
-      ports: enp5s0 # for mor devices support a blank separated list
+      ports: enp6s0 # for mor devices support a blank separated list
       stp: !!str off
       fd: 5
       hello: 2

host_vars/o43.oopen.de.yml

@@ -249,7 +249,7 @@ cron_user_special_time_entries:
 
   - name: "Restart NTP service 'ntpsec'"
     special_time: reboot
-    job: "sleep 2 ; /bin/systemctl restart ntpsec"
+    job: "sleep 2 ; /bin/systemctl restart ntpsec > /dev/null 2>&1"
     insertafter: PATH
 
 

host_vars/prometheus-nd.oopen.de.yml

@@ -147,6 +147,24 @@ cron_user_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
+extra_user:
+
+  - name: nd-admin
+    user_id: 1045
+    group_id: 1045
+    group: nd-admin
+    password: $y$j9T$1YJwHY0qdLimgtdOKlTxR1$/O9QWTpr0Y41TduR2GZ0FMCiIxFqOaXWSM9hmHRnv80
+    shell: /bin/bash
+    ssh_keys:
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKTjd4XFBdF/V9VdSZjy9G7nupBwaMqsrtQSP4Uctkrz org@rdsgn.de'
+
+sudo_users:
+  - chris
+  - sysadm
+  - nd-admin
+
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/server28.warenform.de.yml

@@ -235,11 +235,6 @@ cron_env_entries:
 
 cron_user_special_time_entries:
 
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 2 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
   - name: "Restart DNS Cache service 'systemd-resolved'"
     special_time: reboot
     job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
@@ -309,78 +304,6 @@ cron_user_entries:
 # vars used by roles/common/tasks/users.yml
 # ---
 
-insert_ssh_keypair_backup_server: false
-ssh_keypair_backup_server:
-  - name: backup
-    backup_user: back
-    priv_key_src: root/.ssh/id_rsa.backup.warenform.de
-    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: root/.ssh/id_rsa.backup.warenform.de.pub
-    pub_key_dest: /root/.ssh/id_rsa.pub
-
-insert_keypair_backup_client: true
-ssh_keypair_backup_client:
-  - name: backup
-    priv_key_src: root/.ssh/id_ed25519.warenform-server
-    priv_key_dest: /root/.ssh/id_ed25519
-    pub_key_src: root/.ssh/id_ed25519.warenform-server.pub
-    pub_key_dest: /root/.ssh/id_ed25519.pub
-    target: backup.warenform.de
-
-
-default_user:
-
-  - name: chris
-    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: axel
-    password: $6$zUWC465e$XblctxwnBIOa7mPcN6foEQrwChjpwoY7lLtacXJrSsvjZS3I6Ox1mYUtN3/gzkvpbzOPx/9PlRJV.mbl939mD.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOPnP788dlfeFi9oo8UkS0Chi/jcxUGjsOuQnxW/GR+ axel@wf.netz'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    password: $6$vvccwrTc$Sz1HaSb3ujObprltiG7D6U1Rr3fpgfjkKuDDWYdHzPkPx/0pEofCWC.vyTn78hcemkntl.6wVUOnJnNloKt/E/
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOPnP788dlfeFi9oo8UkS0Chi/jcxUGjsOuQnxW/GR+ axel@wf.netz'
-
-  - name: localadmin
-    user_id: 1051
-    group_id: 1051
-    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFkl+5aVg4l40bxmf6k2dpopV8oAXyLhGGmKfzspW3GTfD29WjhuGS/mefrqr3tZRYrybPA5GDQ1QdwwRL16+6xfjAt/B62p3dMXnjsHalk74DTcQCZDlsj0UxTV1+gfOYzcB/CAqRd2wtB+vqGWRP+oGP3E7AIgoBlE44MaEDDuMP0Vvm8hNQ5N+/3zcrE626yDHAa4qmOd5d+J/HWrHLeJ4915g9VcCYCNGCgepb//4RdCpzEqUJiBGwihb/iJk3RoHcAv3L+tht8vmBF7Wz0iJ9BtLRTsJGFCkET0i50E18mU3bfaa7ov/PY/+UcE8FZSWZcoZ6AtmoBy0Zg2mp6/F9serfe67qtILNAbWD+qNRC7GjW3c5UvF5GJM6WvG8OZRvwarovZOU8uw1NLL3unY8O1bdihXmCXatXz+MvHCOvmZekUolKMBu7mziH5wificprUY9YeGX1FHVh4/hsL04zZdu/Q8Rr/BxM8+mJCCPsrkEoNnZNJfxCSwynd3jjqkhBpzZkEW9EGDBG5qnx4f6QPtcf/sv7eoNjzhEUs5k9GstbgW0ZD6381Ws/EpIdRbZUl52wFXalE8N/Z9hU6vfBC1xk0DIardUkZk+6lTsS8orBZkmPDNhX5hT8nmwNszQI0WgHPs+xDAdFskMcB/j20G5NupZm+2QgNXoww== jonas@meurer.it'
-      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCzd5rFYvV5/V2NZE4jxL09qZ4TTsgmhbfSHpsj9wX89+j7ZrfTAkAkAFxyrWs8FR3CQ11DGkrXW059a0ppRQ7R8bUW9CniXS/RaRAvqX9AMM9Xo/lmL4pXNM0sV4nHJWphi5Bc+zTIM2I4PSbHYw+5dDnj8ZIQ8ucBff+k29Zd90JRuKx72tk0pQNf7sQbWVKNCT/B4g4MJV84NvnO+ExCWvGM95Cy5NCTnQfO94/OSkN72R//tIR7Nd/aK7hEj69MoVJZrFy4qzE9KskLhKeUYCqoz86XOQ6Dfag/B2adTeG3r9DEacG3ao/ACZKQChj0X12LEV/PZUHLORqYpWIwMuIx54vhbxarSwlKhoOCv1XQJwo9BTavMhFNsMtZpAJYdvAakRCbf18bDrHyqYYqjAyYOp+L+G+wlSh3tz0qQL8aAnaV3RPN0fDd7Zu1dpMGAM2gMnBEMJ+k82V7EtACp1jf37LW11Lbv2o+dRUJEgsrU9TNGxaGSTWqGc65TuP9PUfDXq1ZNOPQWSK/KseqB0WUx6ePfZzkgkr7kGXT/d9hUSCq2+iprhfwQpYLcXE9XtCdo1aivIKQ8zCuR44q11HePyNtEMaJfq33p4uDTVOy7UOtuACzSbk6vs7h6h8CUGPwU9aw+PRiWY4Jdm0caJ8trFfH1R8XaIe3SaUEw== t@NB-003258-RLS'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-sudo_users:
-  - chris
-  - axel
-  - sysadm
-  - localadmin
-
 
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml

host_vars/shop-dev.aufstehen-gegen-rassismus.de.yml

@@ -0,0 +1,207 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: false
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 2a01:4ff:ff00::add:2
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 185.12.64.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+#cron_user_special_time_entries:
+#
+#  - name: "Restart DNS Cache service 'systemd-resolved'"
+#    special_time: reboot
+#    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+#    insertafter: PATH
+#
+#  - name: "Check if postfix mailservice is running. Restart service if needed."
+#    special_time: reboot
+#    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+#    insertafter: PATH
+#
+#  - name: "Check if Check if all autostart LX-Container are running."
+#    special_time: reboot
+#    job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh"
+#    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+#  - name: "Check connectifity - reboot if needed"
+#    minute: '*/10'
+#    hour: '*'
+#    job: /root/bin/admin-stuff/check-connectivity.sh
+#
+#  - name: "Check if Postfix Mailservice is up and running?"
+#    minute: '*/15'
+#    hour: '*'
+#    job: /root/bin/monitoring/check_postfix.sh
+#
+#  - name: "Check if NTP service 'ntpsec' is up and running?"
+#    minute: '*/30'
+#    hour: '*'
+#    job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
+
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/verdi-django.warenform.de.yml

@@ -0,0 +1,165 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+apt_install_extra_pkgs: true
+apt_extra_pkgs:
+  - subversion
+  - subversion-tools
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 213.133.100.100
+  - 2a01:4f8:0:1::add:9898
+  - 213.133.99.99
+  - 2a01:4f8:0:1::add:1010
+  - 213.133.98.98
+  - 2a01:4f8:0:1::add:9999
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - warenform.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/copy_files.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

host_vars/web0.warenform.de.yml

@@ -142,6 +142,28 @@ ssh_keypair_backup_client:
 #
 # see: roles/common/tasks/vars
 
+sudoers_file_user_aliases:
+   - name: WEB_USER
+     entry: 'webadmin, axel, chris'
+   - name: MAIN_USER
+     entry: 'sysadm, axel, chris'
+
+sudoers_file_cmnd_aliases:
+  - name: REBOOT
+    entry: '/sbin/reboot'
+  - name: MANAGE_SERVICE
+    entry: '/usr/bin/systemctl'
+
+sudoers_file_user_privileges:
+  - name: MAIN_USER
+    entry: ALL = REBOOT, MANAGE_SERVICE
+  - name: WEB_USER
+    entry: ALL = MANAGE_SERVICE
+
+
+
+
+
 
 # ---
 # vars used by roles/common/tasks/caching-nameserver.yml

host_vars/zapata.opp.netz.yml

@@ -203,6 +203,8 @@ samba_netbios_name: ZAPATA
 
 samba_server_min_protocol: !!str NT1
 
+samba_allow_insecure_wide_links: !!str yes
+
 samba_groups:
   - name: buero
     group_id: 1100
@@ -384,6 +386,7 @@ samba_user:
     groups:
       - buero
       - beratung
+      - verwaltung
     password: '20_simon_18!'
 
   - name: ute
@@ -411,6 +414,7 @@ samba_shares:
     group_write_list: buero
     file_create_mask: !!str 660
     dir_create_mask: !!str 2770
+    wide_links: !!str yes
     vfs_object_recycle: true
     recycle_path: '@Recycle'
 
@@ -439,8 +443,8 @@ samba_shares:
     path: /data/backup
     browseable: !!str yes
     read_only: !!str yes
-    writeable: !!str  no
+    writeable: !!str no
-    guest_ok: !!str  no
+    guest_ok: !!str no
     file_create_mask: !!str 0664
     dir_create_mask: !!str 0755
     vfs_object_recycle: false

hosts

@@ -1,5 +1,4 @@
-
+formbricks-nd.oopen.de
-
 #[so36_server_dehydrated]
 #comm.so36.net ansible_user=ckubu
 #noc.so36.net ansible_user=ckubu
@@ -17,13 +16,17 @@ rage.so36.net ansible_user=ckubu
 [no_ipt_firewall]
 
 lxc-host-kb.anw-kb.netz
+o13-git.oopen.de
 o13-staging-board.oopen.de
 o25.oopen.de
 o33.oopen.de
 o41.oopen.de
 dc-opp.oopen.de
 discourse.oopen.de
+test-nd.oopen.de
+formbricks-nd.oopen.de
 
+ga-st-mm.ga.netz
 
 [dns_sinma]
 
@@ -31,7 +34,6 @@ dns1.warenform.de
 
 
 [extra_hosts]
-backup.oopen.de
 
 devel-root.wf.netz
 
@@ -39,9 +41,10 @@ gw-123.oopen.de
 gw-ah.oopen.de
 gw-ak.oopen.de
 gw-akb.oopen.de
-gw-dissens.oopen.de
+172.16.82.2
 gw-dissens.oopen.de
 gw-ebs.oopen.de
+gw-fm.oopen.de
 gw-elster.oopen.de
 gw-fhxb.oopen.de
 gw-ckubu.local.netz
@@ -59,10 +62,12 @@ gw-kb.oopen.de
 bbb-server.b3-bornim.netz
 file-ah.kanzlei-kiel.netz
 file-ebs.ebs.netz
+file-fm.fm.netz
 file-fhxb.fhxb.netz
 file-km.anw-km.netz
 file-kb.anw-kb.netz
 file-blkr.blkr.netz
+file-dissens.dissens.netz
 zapata.opp.netz
 
 gw-replacement.local.netz
@@ -74,10 +79,13 @@ at-10-neu.ak.netz
 
 ga-st-gw-ersatz.ga.netz
 ga-st-gw.ga.netz
+ga-st-gw-neu.ga.netz
 ga-al-gw.oopen.de
 ga-nh-gw.oopen.de
+gw-campus.oopen.de
 ga-st-lxc1.ga.netz
 ga-st-mail.ga.netz
+ga-st-mm.ga.netz
 ga-al-relay.ga.netz
 ga-st-kvm1.ga.netz
 ga-al-kvm2.ga.netz
@@ -133,12 +141,20 @@ o13-pad.oopen.de
 o13-cryptpad.oopen.de
 o13-web.oopen.de
 
+# Freiheit für daniela
+o14.oopen.de
+
+# VBRG - Opferhilfefonds
+o15.oopen.de
+
 o17.oopen.de
 test.mx.oopen.de
 
 # Backup Server O.OPEN
 o19.oopen.de
-37.27.121.218
+backup.oopen.de
+git.oopen.de
+munin.oopen.de
 
 o20.oopen.de
 
@@ -158,9 +174,11 @@ cp-01.oopen.de
 meet.oopen.de
 mm.oopen.de
 discourse.oopen.de
+mm-migration.oopen.de
 
 o24.oopen.de
 cl-irights.oopen.de
+cl-irights-neu.oopen.de
 mm-irights.oopen.de
 
 # IL - PAD
@@ -177,10 +195,9 @@ mail.faire-mobilitaet.de
 o28.oopen.de
 o26.oopen.de
 
-# - o29.oopen.de Backup Server
+# - o29.oopen.de Dissens Host System
 o29.oopen.de
-backup.oopen.de
+cl-dissens.oopen.de
-git.oopen.de
 
 # AK - Server Nextcloud/Jitsi Meet
 o30.oopen.de
@@ -190,12 +207,8 @@ cloud.akweb.de
 # o31.oopen.de - Cadus e.V.
 o31.oopen.de
 mail.cadus.org
-135.181.22.161
 web.cadus.org
 
-# etventure
-o32.oopen.de
-
 # BigBlueButton - O.OPEN
 o33.oopen.de
 
@@ -248,8 +261,11 @@ mm-rav.oopen.de
 
 # ND - prometheus, web
 o43.oopen.de
+formbricks-nd.oopen.de
+keycloak-nd.oopen.de
 prometheus-nd.oopen.de
 web-nd.oopen.de
+test-nd.oopen.de
 
 
 lxc-host-kb.anw-kb.netz
@@ -323,13 +339,21 @@ o13-cryptpad.oopen.de
 o13-web.oopen.de
 o13-git.oopen.de
 
+# Freiheit für daniela
+o14.oopen.de
+
+# VBRG - Opferhilfefonds
+o15.oopen.de
+
 o17.oopen.de
 test.mx.oopen.de
 test.mariadb.oopen.de
 
 # Backup Server O.OPEN
 o19.oopen.de
-37.27.121.218
+backup.oopen.de
+git.oopen.de
+munin.oopen.de
 
 # - o20.oopen.de (srv-cityslang.cityslang.com)
 o20.oopen.de
@@ -352,11 +376,13 @@ cp-01.oopen.de
 meet.oopen.de
 mm.oopen.de
 discourse.oopen.de
+mm-migration.oopen.de
 
 # - o24.oopen.de
 o24.oopen.de
 cl-irights.oopen.de
-mm-irights.oopen.de
+cl-irights-neu.oopen.de
+ga-st-mm.ga.netz
 
 # IL - PAD
 o25.oopen.de
@@ -374,9 +400,7 @@ o26.oopen.de
 
 # - o29.oopen.de
 o29.oopen.de
-backup.oopen.de
+cl-dissens.oopen.de
-git.oopen.de
-munin.oopen.de
 
 # AK - Server Nextcloud/Jitsi Meet
 o30.oopen.de
@@ -386,12 +410,8 @@ cloud.akweb.de
 # o31.oopen.de - Cadus e.V.
 o31.oopen.de
 mail.cadus.org
-135.181.22.161
 web.cadus.org
 
-# etventure
-o32.oopen.de
-
 # BigBlueButton - O.OPEN
 o33.oopen.de
 
@@ -445,8 +465,11 @@ mm-rav.oopen.de
 
 # ND - prometheus, web
 o43.oopen.de
+formbricks-nd.oopen.de
+keycloak-nd.oopen.de
 prometheus-nd.oopen.de
 web-nd.oopen.de
+test-nd.oopen.de
 
 
 lxc-host-kb.anw-kb.netz
@@ -472,6 +495,7 @@ gw-ak.oopen.de
 
 # AKB
 gw-akb.oopen.de
+172.16.82.2
 
 # Dissens
 gw-dissens.oopen.de
@@ -499,10 +523,18 @@ file-kb.anw-kb.netz
 gw-blkr.oopen.de
 file-blkr.blkr.netz
 
+# Dissens
+file-dissens.dissens.netz
+
 # - Kanzlei EBS Leipzig
 gw-ebs.oopen.de
 file-ebs.ebs.netz
 
+# Faire Mobilitaet
+gw-fm.oopen.de
+file-fm.fm.netz
+
+
 # Kanzlei Elster Jena
 gw-elster.oopen.de
 
@@ -529,11 +561,14 @@ gw-d11.oopen.de
 # - GA - Gemeinschaft Altensclirf
 ga-st-gw-ersatz.ga.netz
 ga-st-gw.ga.netz
+ga-st-gw-neu.ga.netz
 ga-al-gw.oopen.de
 ga-nh-gw.oopen.de
+gw-campus.oopen.de
 
 ga-st-lxc1.ga.netz
 ga-st-mail.ga.netz
+ga-st-mm.ga.netz
 ga-al-relay.ga.netz
 ga-st-services.ga.netz
 ga-al-ws1.ga.netz
@@ -548,9 +583,7 @@ ga-al-kvm3.ga.netz
 
 devel-root.wf.netz
 anita.wf.netz
-devel-cloud.wf.netz
 devel-db.wf.netz
-devel-git.wf.netz
 devel-repos.wf.netz
 devel-php.wf.netz
 devel-todo.wf.netz
@@ -563,6 +596,9 @@ devel-ruby.wf.netz
 # o13.oopen.de
 o13-web.oopen.de
 
+# Freiheit für daniela
+o14.oopen.de
+
 # o20.oopen.de (srv-cityslang.cityslang.com)
 o20.oopen.de
 
@@ -620,16 +656,16 @@ o13-mail.oopen.de
 o13-mumble.oopen.de
 o13-web.oopen.de
 
+# Freiheit für daniela
+o14.oopen.de
+
 # o17.oopen.de
 test.mariadb.oopen.de
 test.mx.oopen.de
 
 # o19.oopen.de
-37.27.121.218
-munin.oopen.de
-
-# o29.oopen.de
 backup.oopen.de
+munin.oopen.de
 
 # o20.oopen.de (srv-cityslang.cityslang.com)
 o20.oopen.de
@@ -637,7 +673,6 @@ o20.oopen.de
 # o31.oopen.de
 web.cadus.org
 mail.cadus.org
-135.181.22.161
 
 # o22.oopen.de
 oolm-shop-dev.oopen.de
@@ -649,6 +684,7 @@ cl-01.oopen.de
 
 # o24.oopen.de
 cl-irights.oopen.de
+cl-irights-neu.oopen.de
 
 # o27.oopen.de
 cl-fm.oopen.de
@@ -659,7 +695,7 @@ o28.oopen.de
 o26.oopen.de
 
 # o29.oopen.de
-backup.oopen.de
+cl-dissens.oopen.de
 
 # o30.oopen.de - AK server Jitsi Meet/Nextcloud
 cloud.akweb.de
@@ -749,7 +785,6 @@ verdi-es.warenform.de
 
 devel-php.wf.netz
 devel-todo.wf.netz
-devel-repos.wf.netz
 devel-wiki.wf.netz
 devel-ruby.wf.netz
 
@@ -812,14 +847,16 @@ o13-cryptpad.oopen.de
 cp-01.oopen.de
 meet.oopen.de
 mm.oopen.de
+mm-migration.oopen.de
 
 # o24.oopen.de
 mm-irights.oopen.de
+ga-st-mm.ga.netz
 
 # Hetzner Cloud CX31 - AK
 
-# etventure
+# o29.oopen.de . Dissens
-o32.oopen.de
+cl-dissens.oopen.de
 
 # Nextcloud / DokuWiki VBER
 o34.oopen.de
@@ -848,11 +885,13 @@ cp-flr.oopen.de
 mm-rav.oopen.de
 
 # o43 - ND prometheus, web
+keycloak-nd.oopen.de
 prometheus-nd.oopen.de
 web-nd.oopen.de
 
 # GA - Gemeinschaft Altensclirf
 ga-st-services.ga.netz
+ga-st-mm.ga.netz
 
 # ---
 # Warenform server
@@ -861,6 +900,11 @@ ga-st-services.ga.netz
 # server22
 nd.warenform.de
 
+# ---
+# - Warenform Office
+# ---
+devel-repos.wf.netz
+
 
 [mail_server]
 
@@ -879,7 +923,6 @@ test.mx.oopen.de
 
 # o31.oopen.de
 mail.cadus.org
-135.181.22.161
 
 # o27.oopen.de
 mail.faire-mobilitaet.de
@@ -938,9 +981,11 @@ o13-mail.oopen.de
 
 # o23.oopen.de
 mm.oopen.de
+mm-migration.oopen.de
 
 # o24.oopen.de
 mm-irights.oopen.de
+ga-st-mm.ga.netz
 
 # o27.oopen.de
 mail.faire-mobilitaet.de
@@ -965,6 +1010,7 @@ g.mx.oopen.de
 
 # - GA - Gemeinschaft Altensclirf
 ga-st-mail.ga.netz
+ga-st-mm.ga.netz
 ga-al-relay.ga.netz
 
 # ---
@@ -984,6 +1030,7 @@ verdi-django.warenform.de
 mm-rav.oopen.de
 
 # o43 - ND app
+keycloak-nd.oopen.de
 prometheus-nd.oopen.de
 
 
@@ -1003,13 +1050,17 @@ o13-staging-board.oopen.de
 o13-mail.oopen.de
 o13-web.oopen.de
 
+# Freiheit für daniela
+o14.oopen.de
+
 # o17.oopen.de
 test.mx.oopen.de
 test.mariadb.oopen.de
 
 # o19.oopen.de
 munin.oopen.de
-37.27.121.218
+backup.oopen.de
+
 
 # o20.oopen.de (srv-cityslang.cityslang.com)
 o20.oopen.de
@@ -1024,10 +1075,13 @@ oolm-web.oopen.de
 # o23.oopen.de
 cl-01.oopen.de
 mm.oopen.de
+mm-migration.oopen.de
 
 # o24.oopen.de
 cl-irights.oopen.de
+cl-irights-neu.oopen.de
 mm-irights.oopen.de
+ga-st-mm.ga.netz
 
 # Hetzner Cloud CX31 - AK
 
@@ -1038,8 +1092,8 @@ cl-fm.oopen.de
 o28.oopen.de
 o26.oopen.de
 
-# o29.oopen.de
+# o29.oopen.de - Dissens
-backup.oopen.de
+cl-dissens.oopen.de
 
 # o30.oopen.de - AK server Jitsi Meet/Nextcloud
 cloud.akweb.de
@@ -1047,10 +1101,6 @@ cloud.akweb.de
 # o31.oopen.de - Cadus e.V.
 web.cadus.org
 mail.cadus.org
-135.181.22.161
-
-# etventure
-o32.oopen.de
 
 # Nextcloud / DokuWiki VBER
 o34.oopen.de
@@ -1132,13 +1182,14 @@ ga-al-ws1.ga.netz
 # ---
 
 # o19.oopen.de
-37.27.121.218
+backup.oopen.de
 
 # o23.oopen.de
 cl-01.oopen.de
 
 # o24.oopen.de
 cl-irights.oopen.de
+cl-irights-neu.oopen.de
 
 # o27.oopen.de
 cl-fm.oopen.de
@@ -1149,8 +1200,8 @@ o28.oopen.de
 # o26.oopen.de
 o26.oopen.de
 
-# o29.oopen.de
+# o29.oopen.de - Dissens
-backup.oopen.de
+cl-dissens.oopen.de
 
 # o30.oopen.de - AK server Jitsi Meet/Nextcloud
 cloud.akweb.de
@@ -1208,7 +1259,6 @@ test.mx.oopen.de
 
 # o31.oopen.de
 mail.cadus.org
-135.181.22.161
 
 
 # o27.oopen.de
@@ -1269,7 +1319,6 @@ gateway_server
 # - O.OPEN Server
 # ---
 
-37.27.121.218
 backup.oopen.de
 devel-root.wf.netz
 
@@ -1300,10 +1349,12 @@ at-10-neu.ak.netz
 bbb-server.b3-bornim.netz
 file-ah.kanzlei-kiel.netz
 file-ebs.ebs.netz
+file-fm.fm.netz
 file-fhxb.fhxb.netz
 file-km.anw-km.netz
 file-kb.anw-kb.netz
 file-blkr.blkr.netz
+file-dissens.dissens.netz
 zapata.opp.netz
 
 
@@ -1311,8 +1362,10 @@ zapata.opp.netz
 [nfs_server]
 
 file-blkr.blkr.netz
+file-dissens.dissens.netz
 file-ah.kanzlei-kiel.netz
 file-ebs.ebs.netz
+file-fm.fm.netz
 file-fhxb.fhxb.netz
 
 
@@ -1366,6 +1419,9 @@ ga-al-kvm3.ga.netz
 # Kotti-Coop e.V.
 o41.oopen.de
 
+# o43 - ND App
+formbricks-nd.oopen.de
+test-nd.oopen.de
 
 [lxc_host]
 
@@ -1377,6 +1433,9 @@ o12.oopen.de
 o13.oopen.de
 o17.oopen.de
 
+# Freiheit für daniela
+o14.oopen.de
+
 # Backup Server O.OPEN
 o19.oopen.de
 
@@ -1389,7 +1448,6 @@ o27.oopen.de
 o29.oopen.de
 o30.oopen.de
 o31.oopen.de
-o32.oopen.de
 o34.oopen.de
 o35.oopen.de
 o36.oopen.de
@@ -1467,13 +1525,12 @@ test.mx.oopen.de
 test.mariadb.oopen.de
 
 # o19.oopen.de
-37.27.121.218
+backup.oopen.de
 git.oopen.de
 munin.oopen.de
 
 # - o31.oopen.de
 mail.cadus.org
-135.181.22.161
 web.cadus.org
 
 # o21.oopen.de
@@ -1492,10 +1549,13 @@ cp-01.oopen.de
 meet.oopen.de
 mm.oopen.de
 discourse.oopen.de
+mm-migration.oopen.de
 
 # - o24.oopen.de
 cl-irights.oopen.de
+cl-irights-neu.oopen.de
 mm-irights.oopen.de
+ga-st-mm.ga.netz
 
 # - o27.oopen.de
 cl-fm.oopen.de
@@ -1503,16 +1563,13 @@ mail.faire-mobilitaet.de
 
 # Hetzner Cloud CX31 - AK
 
-# o29.oopen.de
+# o29.oopen.de - Dissens
-backup.oopen.de
+cl-dissens.oopen.de
 
 # o30.oopen.de - AK Server Nextcloud/Jitsi Meet
 meet.akweb.de
 cloud.akweb.de
 
-# etventure
-o32.oopen.de
-
 # BigBlueButton - O.OPEN
 o33.oopen.de
 
@@ -1556,8 +1613,10 @@ cp-flr.oopen.de
 mm-rav.oopen.de
 
 # o43 - ND 
+keycloak-nd.oopen.de
 prometheus-nd.oopen.de
 web-nd.oopen.de
+test-nd.oopen.de
 
 # ---
 #  O.OPEN office network
@@ -1567,15 +1626,18 @@ at-10-neu.ak.netz
 bbb-server.b3-bornim.netz
 file-ah.kanzlei-kiel.netz
 file-ebs.ebs.netz
+file-fm.fm.netz
 file-fhxb.fhxb.netz
 file-km.anw-km.netz
 file-kb.anw-kb.netz
 file-blkr.blkr.netz
+file-dissens.dissens.netz
 zapata.opp.netz
 
 
 # - GA - Gemeinschaft Altensclirf
 ga-st-mail.ga.netz
+ga-st-mm.ga.netz
 ga-al-relay.ga.netz
 ga-st-services.ga.netz
 
@@ -1627,9 +1689,7 @@ dns1.warenform.de
 
 # devel-root
 anita.wf.netz
-devel-cloud.wf.netz
 devel-db.wf.netz
-devel-git.wf.netz
 devel-php.wf.netz
 devel-repos.wf.netz
 devel-todo.wf.netz
@@ -1656,6 +1716,9 @@ o13-cryptpad.oopen.de
 o13-web.oopen.de
 o13-git.oopen.de
 
+# Freiheit für daniela
+o14.oopen.de
+
 # - o17.oopen.de
 o17.oopen.de
 test.mx.oopen.de
@@ -1663,7 +1726,7 @@ test.mariadb.oopen.de
 
 # Backup Server O.OPEN
 o19.oopen.de
-37.27.121.218
+backup.oopen.de
 git.oopen.de
 munin.oopen.de
 
@@ -1688,10 +1751,12 @@ cp-01.oopen.de
 meet.oopen.de
 mm.oopen.de
 discourse.oopen.de
+mm-migration.oopen.de
 
 # - o24.oopen.de
 o24.oopen.de
 cl-irights.oopen.de
+cl-irights-neu.oopen.de
 mm-irights.oopen.de
 
 # IL - PAD
@@ -1708,9 +1773,9 @@ mail.faire-mobilitaet.de
 o28.oopen.de
 o26.oopen.de
 
-# - o29.oopen.de
+# o29.oopen.de
 o29.oopen.de
-backup.oopen.de
+cl-dissens.oopen.de
 
 # AK - Server Nextcloud/Jitsi Meet
 o30.oopen.de
@@ -1720,12 +1785,8 @@ cloud.akweb.de
 # - o31.oopen.de
 o31.oopen.de
 mail.cadus.org
-135.181.22.161
 web.cadus.org
 
-# etventure
-o32.oopen.de
-
 # BigBlueButton - O.OPEN
 o33.oopen.de
 
@@ -1779,9 +1840,14 @@ mm-rav.oopen.de
 
 # ND - prometheus, web
 o43.oopen.de
+formbricks-nd.oopen.de
+keycloak-nd.oopen.de
 prometheus-nd.oopen.de
 web-nd.oopen.de
+test-nd.oopen.de
 
+# Gemeinchaft Altenschlirf
+ga-st-mm.ga.netz
 
 
 lxc-host-kb.anw-kb.netz
@@ -1793,10 +1859,12 @@ at-10-neu.ak.netz
 bbb-server.b3-bornim.netz
 file-ah.kanzlei-kiel.netz
 file-ebs.ebs.netz
+file-fm.fm.netz
 file-fhxb.fhxb.netz
 file-km.anw-km.netz
 file-kb.anw-kb.netz
 file-blkr.blkr.netz
+file-dissens.dissens.netz
 zapata.opp.netz
 
 
@@ -1815,10 +1883,12 @@ gw-b3.oopen.de
 gw-d11.oopen.de
 gw-dissens.oopen.de
 gw-ebs.oopen.de
+gw-fm.oopen.de
 gw-elster.oopen.de
 gw-blkr.oopen.de
 gw-ak.oopen.de
 gw-akb.oopen.de
+172.16.82.2
 gw-dissens.oopen.de
 gw-ckubu.local.netz
 gw-flr.oopen.de
@@ -1837,8 +1907,10 @@ k1371.dyndns.org
 
 ga-st-gw-ersatz.ga.netz
 ga-st-gw.ga.netz
+ga-st-gw-neu.ga.netz
 ga-al-gw.oopen.de
 ga-nh-gw.oopen.de
+gw-campus.oopen.de
 
 
 # Gateway/Firewall Server office network
@@ -1904,8 +1976,6 @@ dns1.warenform.de
 anita.wf.netz
 devel-root.wf.netz
 devel-db.wf.netz
-devel-cloud.wf.netz
-devel-git.wf.netz
 devel-php.wf.netz
 devel-repos.wf.netz
 devel-todo.wf.netz
@@ -1915,13 +1985,17 @@ devel-ruby.wf.netz
 [oopen_office_ga]
 
 # - GA - Gemeinschaft Altensclirf
-ga-st-lxc1.ga.netz
+ga-al-gw.oopen.de
-ga-st-mail.ga.netz
-ga-al-relay.ga.netz
-ga-st-services.ga.netz
-ga-st-kvm1.ga.netz
 ga-al-kvm2.ga.netz
 ga-al-kvm3.ga.netz
+ga-al-relay.ga.netz
+ga-nh-gw.oopen.de.yml
+gw-campus.oopen.de
+ga-st-lxc1.ga.netz
+ga-st-mail.ga.netz
+ga-st-services.ga.netz
+ga-st-kvm1.ga.netz
+ga-st-kvm5.ga.netz
 
 
 [o13_server]

main.yml

@@ -1908,11 +1908,11 @@ tor_hidden_service_port:
 # vars used by modify-munin-ip.yml
 # ---
 
-munin_remote_ipv4: 135.181.136.84
+munin_remote_ipv4: 37.27.121.227
-munin_remote_ipv6: 2a01:4f9:3a:1051::84
+munin_remote_ipv6: 2a01:4f9:3070:2bda::22
 
-munin_remote_ipv4_old: 95.217.64.122
+munin_remote_ipv4_old: 135.181.136.84
-munin_remote_ipv6_old: 2a01:4f9:4a:2b57::122
+munin_remote_ipv6_old: 2a01:4f9:3a:1051::84
 
 
 # ---

mm-irights-migration.oopen.de.yml

@@ -0,0 +1,147 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

playbook.yml

@@ -0,0 +1,58 @@
+---
+
+# Intended to be run once for every new server to secure the ssh connection allowing the team access
+# with their public keys. This script will lock itself out from every server it is run on.
+# Further playbooks are intended to be run by logging in as one of the created users.
+# It also ensures python2 is installed as it's necessary for the modules used in this playbook at
+# the time of this writing.
+
+# The used login data depends on the used server provider. In most cases the ansible_user will be
+# root, but we can't safely assume anything.
+# The following line is an example for securing a new vagrant maching, after running `vagrant up`:
+# ansible-playbook first_run.yml -i hosts -u vagrant --private-key='~/.vagrant.d/insecure_private_key'
+# For real providers it could look like:
+# ansible-playbook first_run.yml -i hosts -u root --private-key='~/.ssh/id_rsa'
+# If you don't have a ssh-key on the server and the server expects password authentication use:
+# ansible-playbook first_run.yml -i hosts -u root --ask-pass
+
+#- hosts: all
+#  strategy: free
+#
+##  vars_prompt:
+##
+##  - name: ansible_become_password
+##    prompt: "Give your local Password here:"
+#
+#  roles:
+#    - common
+
+- hosts: ansible_dependencies
+  strategy: free
+  gather_facts: false
+
+  roles:
+     - ansible_dependencies-ubuntu-noble
+     - ansible_user_debian
+
+- hosts: initial_setup
+  strategy: free
+
+#  vars_prompt:
+#
+#  - name: ansible_become_password
+#    prompt: "Give your local Password here:"
+
+  roles:
+    - ubuntu-server
+
+#- hosts: debian-server
+#  strategy: free
+#
+##  vars_prompt:
+##
+##  - name: ansible_become_password
+##    prompt: "Give your local Password here:"
+#
+#  roles:
+#    - common
+

roles/ansible_dependencies-ubuntu-noble/tasks/main.yml

@@ -0,0 +1,47 @@
+---
+
+- name: re-synchronize the package index files from their sources
+  raw: apt-get update
+  
+- name: Ensure aptitude is present
+  raw: test -e /usr/bin/aptitude || apt-get install aptitude -y
+
+- name: Ensure python3 is present (This is necessary for ansible to work properly)
+  raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3)
+
+- name: Ensure python-is-python3 is present (This is necessary for ansible to work properly)
+  raw: test -e /usr/bin/python3 && (apt -y update && apt install -y python-is-python3)
+
+- name: Ensure python-apt-common is present (This is necessary for ansible to work properly)
+  raw: test -e  /usr/bin/python && (apt -y update && apt install -y python-apt-common)
+
+- name: Ensure python-apt is present (This is necessary for ansible to work properly)
+  raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-apt)
+
+- name: dpkg --configure -a
+  command: >
+    dpkg --configure -a
+  args:
+    warn: false
+  changed_when: _dpkg_configure.stdout_lines | length
+  register: _dpkg_configure
+  when: apt_dpkg_configure|bool
+  tags:
+    - ansible-dependencies
+
+- name: apt upgrade
+  apt:
+    upgrade: "{{ apt_upgrade_type }}"
+    update_cache: true
+    dpkg_options: "{{ apt_upgrade_dpkg_options | join(',') }}"
+  when: apt_upgrade|bool
+  tags:
+    - ansible-dependencies
+
+- name: apt install ansible dependencies
+  apt:
+    name: "{{ apt_ansible_dependencies }}"
+    state: "{{ apt_install_state }}"
+  tags:
+    - ansible-dependencies
+

roles/common/files/backup.oopen.de/root/.ssh/id_ed25519

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACCHBD3fjAySs1qlkrbd16SVNTqSdLsZoqWnCBpJupNzEgAAAJDPLbb2zy22
+9gAAAAtzc2gtZWQyNTUxOQAAACCHBD3fjAySs1qlkrbd16SVNTqSdLsZoqWnCBpJupNzEg
+AAAEBJe9jEXHRRNKsWRZnEC6gkT+68rSus6TQsWoCIo1f+S4cEPd+MDJKzWqWStt3XpJU1
+OpJ0uxmipacIGkm6k3MSAAAACmNocmlzQGx1bmEBAgM=
+-----END OPENSSH PRIVATE KEY-----

roles/common/files/backup.oopen.de/root/.ssh/id_ed25519-backup

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACCndAMEx2wwSuA4LPiGVprZwwY6FSKIDlL5CyGL7H39cgAAAJCPEfpPjxH6
+TwAAAAtzc2gtZWQyNTUxOQAAACCndAMEx2wwSuA4LPiGVprZwwY6FSKIDlL5CyGL7H39cg
+AAAEAU6QJe7XCLoBUkLQQfUIO6lqRS8eG0Aya2mMuIfU9Vo6d0AwTHbDBK4Dgs+IZWmtnD
+BjoVIogOUvkLIYvsff1yAAAAC3Jvb3RAYmFja3VwAQI=
+-----END OPENSSH PRIVATE KEY-----

roles/common/files/backup.oopen.de/root/.ssh/id_ed25519-backup.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de

roles/common/files/backup.oopen.de/root/.ssh/id_ed25519-gitea

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBU37L4v/+x8EYXdiUkOQkPGyAn6chLuAOngZrLfWFQuAAAAJDKBGM4ygRj
+OAAAAAtzc2gtZWQyNTUxOQAAACBU37L4v/+x8EYXdiUkOQkPGyAn6chLuAOngZrLfWFQuA
+AAAECu7UCHp5+im+P8jO8/179MkQ79d7Vpq+iO7LXMueQ8hlTfsvi//7HwRhd2JSQ5CQ8b
+ICfpyEu4A6eBmst9YVC4AAAAC3Jvb3RAYmFja3VwAQI=
+-----END OPENSSH PRIVATE KEY-----

roles/common/files/backup.oopen.de/root/.ssh/id_ed25519-gitea.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFTfsvi//7HwRhd2JSQ5CQ8bICfpyEu4A6eBmst9YVC4 root@backup-git.oopen.de