update..

group_vars/all/main.yml

@@ -1723,6 +1723,94 @@ apt_webserver_pkgs:
   - expect-dev
   - libexpect-perl
   - poppler-utils
+  - weasyprint
+
+
+apt_webserver_pkgs_trixie:
+  - libdb-dev
+  - zlib1g
+  - zlib1g-dev
+  - libssl-dev
+  - libneon27-dev
+  - libxml2
+  - libxml2-dev
+  - curl
+  - libcurl4-openssl-dev
+  - libqdbm-dev
+  - libgdbm-dev
+  - libpspell-dev
+  - libjpeg-dev
+  - libpng-dev
+  - libxpm-dev
+  - libfreetype6-dev
+  - libwmf-dev
+  - libtiff-dev
+  - libpaper-dev
+  - libmagic-dev
+  - libgraphics-magick-perl
+  - libgraphicsmagick++1-dev
+  - libgraphicsmagick-q16-3
+  - libgraphicsmagick1-dev
+  - libgraphviz-dev
+  - libgsf-1-dev
+  - libilmbase-dev
+  - libvpx-dev
+  - vpx-tools
+  - libgpm-dev
+  - libkpathsea-dev
+  - libopenexr-dev
+  - librsvg2-dev
+  - libdjvulibre-dev
+  - libatm-dev
+  - libexpat-dev
+  - imagemagick
+  - graphicsmagick
+  - exif
+  - libexiv2-dev
+  - re2c
+  - netpbm
+  - libnetpbm-dev
+  - libmcrypt-dev
+  - mcrypt
+  - default-libmysqlclient-dev
+  - libpq-dev
+  - postgresql-client
+  - libreadline-dev
+  - libncurses-dev
+  - libdb5.3
+  - libdb5.3++
+  - libdb5.3++-dev
+  - libdb5.3-dev
+  - libxslt1-dev
+  - libpcre2-dev
+  - libicu-dev
+  - libtidy-dev
+  - libmm-dev
+  - libgmp-dev
+  - libkrb5-dev
+  - libldap-dev
+  - libmhash-dev
+  - libgd-dev
+  - liblua5.3-dev
+  - libapr1-dev
+  - libaprutil1-dev
+  - libsctp-dev
+  - libcrypto++-dev
+  - ffmpeg
+  - libmagickwand-dev
+  - libgeoip-dev
+  - libaio-dev
+  - tk-dev
+  - tcl-dev
+  - tclreadline
+  - expect
+  - expect-dev
+  - libexpect-perl
+  - poppler-utils
+  - weasyprint
+
+#  - libc-client2007e-dev
+#  - libc-client-dev
 
 install_postgresql_pkgs: false
 apt_postgresql_pkgs:

host_vars/backup.oopen.de.yml

@@ -266,9 +266,11 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICPrJu40Up1x9VCTTac6+ANjJ2NFXfDb5v3dP4pVgm+c root@cl-01'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7JBJ0qQJsTlADj/zMoxGlzPCGlnh0ngDS5+tkyVqgf root@cl-02'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIORi7e7u0KhCkCB8iCmPud0hzCwnJVhxpPmy8vFFkFgY root@cl-dissens'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPx9aKkZp3qAdehTY+mdCsB+/c9yDExkg5y1lASCXRmL root@cl-exil'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN3VloFw13vVt8UAV5h0860Wq/vFJEm5EazOqM+cVe17 root@cl-flr'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGRaUsGqBvZBDzyh1kuldC/jdbtuoXFgBZ7PbgSqytSn root@cl-fm'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvmOpsiL+eiJ3qZVDJiUCFVZge0OQJ1hpZgw7pJ8sq5 root@cl-irights'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjr0aBl2KQTJnlVK03DOs0u+IXSon4VewwAzzSBsmVW root@cl-lubax'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL7h6rR+q5bRh/qgzA7ZyiZcRr9vMbo7cxhQsoukWmUn root@cl-vbrg'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcHQfSVG8DM1qHp2ce73ZBWXknZGZFur5s27V58T7ON root@cl-opp'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClnyNS5RQsbXmgOX7NU7i154DElOlha3y0ybF6FwScT root@cl-test'
@@ -307,6 +309,7 @@ default_user:
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBaXEVvhblxX045H2/B/6RJmoW77WOKJM5FQfvMUPCIs root@o13-web'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAp24VDXOsa0MuzGFaFa3CPDUsnA/ASojHAiN344m+dP root@o14'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICcQ9MFqTMOmjnec4ftUJAYiAe8p7pp7a5EBSIM0A5ji root@o17'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINgEHwpZASRfcpAEesr8qnytu6pj7qNrQ35i7h/uTUoK root@o18'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFstQOOM/U18SV27+XTtBhso+vICK5L4aOGC83QnvS8+ root@o19'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC85aj16Ow1ZPutkp5TmZdxjMsECkhnO64ktc3OYZJHc root@o25-board'
       - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICurG4lWMuEercht716M3x2KgsUYKIwku4VdF52sBu41 root@o21-oolm-db'

host_vars/cl-lubax.oopen.de.yml

@@ -0,0 +1,152 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+#sshd_permit_root_login: !!str "prohibit-password"
+sshd_permit_root_login: !!str "no"
+
+# ---
+# vars used by apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: false
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+sudo_users:
+  - chris
+  - sysadm
+  - localadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+sudoers_file_user_privileges:
+  - name: back
+    entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+

host_vars/ga-st-gw.ga.netz.yml

@@ -124,8 +124,8 @@ network_interfaces:
     gateway: 172.16.13.254
 
 
-  - device: lan7
+  - device: lan11
-    headline: lan7 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
+    headline: lan11 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
     auto: true
     family: inet
     method: static

host_vars/o18.oopen.de.yml

@@ -0,0 +1,325 @@
+---
+
+# ---
+# vars used by roles/network_interfaces
+# ---
+
+
+# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
+network_manage_devices: True
+
+# Should the interfaces be reloaded after config change?
+network_interface_reload: False
+
+network_interface_path: /etc/network/interfaces.d
+network_interface_required_packages:
+  - vlan
+  - bridge-utils
+  - ifmetric
+  - ifupdown
+  - ifenslave
+
+
+network_interfaces:
+
+  - device: br0
+    # use only once per device (for the first device entry)
+    headline: br0 - bridge over device enp6s0
+
+    # auto & allow are only used for the first device entry
+    allow: [] # array of allow-[stanzas] eg. allow-hotplug
+    auto: true
+
+    family: inet
+    method: static
+    hwaddress: 9c:6b:00:3e:9a:88
+    description:
+    address: 5.9.97.103
+    netmask: 27
+    gateway: 5.9.97.97
+    metric:
+    pointopoint:
+    mtu:
+    scope:
+
+    # additional user by dhcp method
+    #
+    hostname:
+    leasehours:
+    leasetime:
+    vendor:
+    client:
+
+    # additional used by bootp method
+    #
+    bootfile:
+    server:
+    hwaddr:
+
+    # optional dns settings nameservers: []
+    #
+    #    nameservers:
+    #      - 194.150.168.168  # dns.as250.net
+    #      - 91.239.100.100   # anycast.censurfridns.dk
+    #    search: warenform.de
+    #
+    # ** MOVED TO systemd-resolved
+    #
+    nameservers:
+    search:
+
+    # optional bridge parameters bridge: {}
+    # bridge:
+    #   ports:
+    #   stp:
+    #   fd:
+    #   maxwait:
+    #   waitport:
+    bridge:
+      ports: enp6s0 # for mor devices support a blank separated list
+      stp: !!str off
+      fd: 5
+      hello: 2
+      maxage: 12
+
+    #  optional bonding parameters bond: {}
+    #  bond:
+    #    master
+    #    primary
+    #    slave
+    #    method:
+    #    miimon:
+    #    lacp-rate:
+    #    ad-select-rate:
+    #    master:
+    #    slaves:
+    bond: {}
+
+    # optional vlan settings | vlan: {}
+    # vlan: {}
+    #   raw-device: 'eth0'
+    vlan: {}
+
+    # inline hook scripts
+    pre-up: [] # pre-up script lines
+    up: 
+      - !!str "route add -net 5.9.97.96 netmask 255.255.255.224 gw 5.9.97.97 dev br0" # up script lines
+    post-up: [] # post-up script lines (alias for up)
+    pre-down: [] # pre-down script lines (alias for down)
+    down: [] # down script lines
+    post-down: [] # post-down script lines
+
+
+
+  - device: br0
+    family: inet6
+    method: static
+    address: '2a01:4f8:162:2477::2'
+    netmask: 64
+    gateway: 'fe80::1'
+
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001 
+# 
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9  
+#      IPv6: 2620:fe::fe 
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de 
+#      IPv4: 94.16.114.254  - ns28.de 
+#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+# 
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which 
+# the resolver should also search them
+#
+#resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+   - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+  - name: "Check if postfix mailservice is running. Restart service if needed."
+    special_time: reboot
+    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
+    insertafter: PATH
+
+  - name: "Check if Check if all autostart LX-Container are running."
+    special_time: reboot
+    job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+#  - name: "Check connectifity - reboot if needed"
+#    minute: '*/10'
+#    hour: '*'
+#    job: /root/bin/admin-stuff/check-connectivity.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check if NTP service 'ntpsec' is up and running?"
+    minute: '*/30'
+    hour: '*'
+    job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1
+
+  - name: "Check hard disc usage."
+    minute: '43'
+    hour: '6'
+    job: /root/bin/admin-stuff/check-disc-usage.sh -c 85
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
+

hosts

@@ -151,6 +151,10 @@ o15.oopen.de
 o17.oopen.de
 test.mx.oopen.de
 
+# Exil e.V.
+o18.oopen.de
+cl-exil.oopen.de
+
 # Backup Server O.OPEN
 o19.oopen.de
 backup.oopen.de
@@ -170,7 +174,7 @@ oolm-web.oopen.de
 
 o23.oopen.de
 a.ns.oopen.de
-cl-01.oopen.de
+cl-test.oopen.de
 cp-01.oopen.de
 meet.oopen.de
 mm.oopen.de
@@ -210,6 +214,9 @@ o31.oopen.de
 mail.cadus.org
 web.cadus.org
 
+# o32.oopen.de / cl-lubax.oopen.de
+cl-lubax.oopen.de
+
 # BigBlueButton - O.OPEN
 o33.oopen.de
 
@@ -232,7 +239,7 @@ matomo-01.oopen.de
 web-01.oopen.de
 web-03.oopen.de
 web-04.oopen.de
-cl-test.oopen.de
+cl-01.oopen.de
 
 # OPP - dc-01.oopen.de 
 o38.oopen.de
@@ -346,10 +353,18 @@ o14.oopen.de
 # VBRG - Opferhilfefonds
 o15.oopen.de
 
+# Exil e.V.
+o18.oopen.de
+cl-exil.oopen.de
+
 o17.oopen.de
 test.mx.oopen.de
 test.mariadb.oopen.de
 
+# Exil e.V.
+o18.oopen.de
+cl-exil.oopen.de
+
 # Backup Server O.OPEN
 o19.oopen.de
 backup.oopen.de
@@ -372,7 +387,7 @@ oolm-web.oopen.de
 # - o23.oopen.de
 o23.oopen.de
 a.ns.oopen.de
-cl-01.oopen.de
+cl-test.oopen.de
 cp-01.oopen.de
 meet.oopen.de
 mm.oopen.de
@@ -413,6 +428,9 @@ o31.oopen.de
 mail.cadus.org
 web.cadus.org
 
+# o32.oopen.de / cl-lubax.oopen.de
+cl-lubax.oopen.de
+
 # BigBlueButton - O.OPEN
 o33.oopen.de
 
@@ -436,7 +454,7 @@ matomo-01.oopen.de
 web-01.oopen.de
 web-03.oopen.de
 web-04.oopen.de
-cl-test.oopen.de
+cl-01.oopen.de
 
 # OPP - dc-01.oopen.de 
 o38.oopen.de
@@ -665,6 +683,9 @@ o14.oopen.de
 test.mariadb.oopen.de
 test.mx.oopen.de
 
+# o18.oopen.de
+cl-exil.oopen.de
+
 # o19.oopen.de
 backup.oopen.de
 munin.oopen.de
@@ -682,7 +703,7 @@ oolm-shop.oopen.de
 oolm-web.oopen.de
 
 # o23.oopen.de
-cl-01.oopen.de
+cl-test.oopen.de
 
 # o24.oopen.de
 cl-irights.oopen.de
@@ -702,6 +723,9 @@ cl-dissens.oopen.de
 # o30.oopen.de - AK server Jitsi Meet/Nextcloud
 cloud.akweb.de
 
+# o32.oopen.de / cl-lubax.oopen.de
+cl-lubax.oopen.de
+
 # Nextcloud / DokuWiki VBER
 o34.oopen.de
 
@@ -718,7 +742,7 @@ web-01.oopen.de
 web-03.oopen.de
 web-04.oopen.de
 b.mx.oopen.de
-cl-test.oopen.de
+cl-01.oopen.de
 
 # o38 dc-opp cl-opp
 cl-opp.oopen.de
@@ -871,6 +895,7 @@ web-02.oopen.de
 web-01.oopen.de
 web-03.oopen.de
 web-04.oopen.de
+cl-01.oopen.de
 
 # o39 - web-05
 web-05.oopen.de
@@ -1059,11 +1084,13 @@ o14.oopen.de
 test.mx.oopen.de
 test.mariadb.oopen.de
 
+# o18.oopen.de - Exil e.V.
+cl-exil.oopen.de
+
 # o19.oopen.de
 munin.oopen.de
 backup.oopen.de
 
-
 # o20.oopen.de (srv-cityslang.cityslang.com)
 o20.oopen.de
 
@@ -1104,6 +1131,9 @@ cloud.akweb.de
 web.cadus.org
 mail.cadus.org
 
+# o32.oopen.de / cl-lubax.oopen.de
+cl-lubax.oopen.de
+
 # Nextcloud / DokuWiki VBER
 o34.oopen.de
 
@@ -1183,11 +1213,14 @@ ga-al-ws1.ga.netz
 # O.OPEN
 # ---
 
+# o18.oopen.de
+cl-exil.oopen.de
+
 # o19.oopen.de
 backup.oopen.de
 
 # o23.oopen.de
-cl-01.oopen.de
+cl-test.oopen.de
 
 # o24.oopen.de
 cl-irights.oopen.de
@@ -1208,6 +1241,9 @@ cl-dissens.oopen.de
 # o30.oopen.de - AK server Jitsi Meet/Nextcloud
 cloud.akweb.de
 
+# o32.oopen.de / cl-lubax.oopen.de
+cl-lubax.oopen.de
+
 # Nextcloud / DokuWiki VBER
 o34.oopen.de
 
@@ -1215,7 +1251,7 @@ o34.oopen.de
 cl-02.oopen.de
 
 # o36.oopen.de
-cl-test.oopen.de
+cl-01.oopen.de
 
 # o38.oopen.de
 cl-opp.oopen.de
@@ -1435,11 +1471,15 @@ test-nd.oopen.de
 
 o12.oopen.de
 o13.oopen.de
-o17.oopen.de
 
 # Freiheit für daniela
 o14.oopen.de
 
+o17.oopen.de
+
+# Exil e.V.
+o18.oopen.de
+
 # Backup Server O.OPEN
 o19.oopen.de
 
@@ -1529,6 +1569,9 @@ o13-git.oopen.de
 test.mx.oopen.de
 test.mariadb.oopen.de
 
+# - o18.oopen.de
+cl-exil.oopen.de
+
 # o19.oopen.de
 backup.oopen.de
 git.oopen.de
@@ -1730,6 +1773,10 @@ o17.oopen.de
 test.mx.oopen.de
 test.mariadb.oopen.de
 
+# Exil e.V.
+o18.oopen.de
+cl-exil.oopen.de
+
 # Backup Server O.OPEN
 o19.oopen.de
 backup.oopen.de
@@ -1793,6 +1840,9 @@ o31.oopen.de
 mail.cadus.org
 web.cadus.org
 
+# o32.oopen.de / cl-lubax.oopen.de
+cl-lubax.oopen.de
+
 # BigBlueButton - O.OPEN
 o33.oopen.de
 
@@ -1911,6 +1961,7 @@ gw-kb.oopen.de
 
 k1371.dyndns.org
 
+
 ga-st-gw-ersatz.ga.netz
 ga-st-gw.ga.netz
 ga-st-gw-neu.ga.netz
@@ -1919,6 +1970,8 @@ ga-nh-gw.oopen.de
 ga-gh-gw.oopen.de
 gw-campus.oopen.de
 
+nd-gate.ndhosting.de
+
 
 # Gateway/Firewall Server office network
 #

roles/common/tasks/apt.yml

@@ -286,11 +286,25 @@
   tags:
     - apt-postgresql-server-pkgs
 
-- name: (apt.yml) Install webserver related packages
+- name: (apt.yml) Install webserver related packages (Debian <= 12)
   apt:
     name: "{{ apt_webserver_pkgs }}"
     state: "{{ apt_install_state }}"
-  when: install_webserver_pkgs|bool
+  when: 
+   - install_webserver_pkgs|bool
+   - ansible_facts['os_family'] == 'Debian'
+   - ansible_facts['distribution_major_version'] | int <= 12
+  tags:
+    - apt-webserver-pkgs
+
+- name: (apt.yml) Install webserver related packages (Debian >= 13)
+  apt:
+    name: "{{ apt_webserver_pkgs_trixie }}"
+    state: "{{ apt_install_state }}"
+  when: 
+   - install_webserver_pkgs|bool
+   - ansible_facts['os_family'] == 'Debian'
+   - ansible_facts['distribution_major_version'] | int >= 13
   tags:
     - apt-webserver-pkgs
 

roles/common/tasks/basic.yml

@@ -1,5 +1,14 @@
 ---
 
+- name: Ensure util-linux-extra is installed on Debian
+  ansible.builtin.apt:
+    name: util-linux-extra
+    state: present
+    update_cache: yes
+  when: 
+    - ansible_facts['os_family'] == 'Debian'
+    - ansible_facts['distribution_major_version'] | int >= 11
+
 - name: (basic.yml) Ensure timezone is is correct
   timezone: name={{ time_zone }}
   tags:

roles/network_interfaces/tasks/interfaces.yml

@@ -21,15 +21,43 @@
   tags:
     - network-interfaces
 
+- name: (interfaces.yml) Build interface map by device
+  ansible.builtin.set_fact:
+    iface_map: "{{ iface_map | default({}) | combine({ item.device: (iface_map[item.device] | default([])) + [item] }) }}"
+  loop: "{{ network_interfaces | default([]) }}"
+  loop_control:
+    label: "{{ item.device }}"
+  tags: [network-interfaces]
+
 - name: (interfaces.yml) Ensure imported device files at interfaces.d are latest
-  template:
+  ansible.builtin.template:
-    src: "etc/network/interfaces.d/device.j2"
+    src: etc/network/interfaces.d/device.j2
-    dest: "{{ network_interface_path }}/device-{{ item.0 }}"
+    dest: "{{ network_interface_path }}/device-{{ grp.key }}"
-  with_items: 
+  loop: "{{ iface_map | dict2items }}"
-    - "{{network_interfaces | default([]) | groupby('device') }}"
+  loop_control:
+    loop_var: grp
   register: network_configuration_result
-  tags:
+  tags: [network-interfaces]
-    - network-interfaces
+
+#- name: Ensure imported device files at interfaces.d are latest
+#  ansible.builtin.template:
+#    src: etc/network/interfaces.d/device.j2
+#    dest: "{{ network_interface_path }}/device-{{ grp.0 }}"
+#  loop: "{{ (network_interfaces | default([]) | groupby('device')) | list }}"
+#  loop_control:
+#    loop_var: grp
+#  register: network_configuration_result
+#  tags: [network-interfaces]
+
+#- name: (interfaces.yml) Ensure imported device files at interfaces.d are latest
+#  template:
+#    src: "etc/network/interfaces.d/device.j2"
+#    dest: "{{ network_interface_path }}/device-{{ item.0 }}"
+#  with_items: 
+#    - "{{network_interfaces | default([]) | groupby('device') }}"
+#  register: network_configuration_result
+#  tags:
+#    - network-interfaces
 
 # ---
 # Remove device files not configured here

roles/network_interfaces/templates/etc/network/interfaces.d/device.j2

@@ -1,7 +1,7 @@
 {{ ansible_managed | comment }}
 
 {# {% for config in  network_interfaces %} #}
-{% for config in item.1 %}
+{% for config in grp.value %}
 
 {%   if config.headline is defined and config.headline %}
 #-----------------------------

scripts/install-ulogd.yml

@@ -10,14 +10,21 @@
       cache_valid_time: "{{ 0 if apt_config_updated is defined and apt_config_updated.changed else apt_update_cache_valid_time }}"
     when: apt_update|bool
 
-  - name: (apt.yml) dpkg --configure
+#  - name: (apt.yml) dpkg --configure
-    command: >
+ #   command: >
-      dpkg --configure -a
+ #     dpkg --configure -a
-    args:
+ #   args:
-      warn: false
+ #     warn: false
-    changed_when: _dpkg_configure.stdout_lines | length
+ #   changed_when: _dpkg_configure.stdout_lines | length
-    register: _dpkg_configure
+ #   register: _dpkg_configure
-    when: apt_dpkg_configure|bool
+ #   when: apt_dpkg_configure|bool
+
+  - name: Fix half-configured packages (dpkg --configure -a)
+    ansible.builtin.command: dpkg --configure -a
+    register: dpkg_config
+    changed_when: (dpkg_config.stdout | default('')) | length > 0
+    when: (apt_dpkg_configure | default(true)) | bool
+    tags: [ansible-dependencies]
 
   - name: Install ulogd2
     apt: