update mautrix-whatsapp to 0.11.1

Reviewed-on: #72

bundles/apt/files/sources.list-raspbian-buster

@@ -1 +0,0 @@
-deb http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpi

bundles/apt/items.py

@@ -7,9 +7,6 @@ supported_os = {
         12: 'bookworm',
         99: 'unstable',
     },
-    'raspbian': {
-        10: 'buster',
-    },
 }
 
 try:
@@ -27,6 +24,10 @@ actions = {
         'triggered': True,
         'cascade_skip': False,
     },
+    'apt_execute_update_commands': {
+        'command': ' && '.join(sorted(node.metadata.get('apt/additional_update_commands', {'true'}))),
+        'triggered': True,
+    },
 }
 
 files = {

bundles/apt/metadata.py

@@ -21,6 +21,9 @@ defaults = {
     'cron/jobs/upgrade-and-reboot'
 )
 def patchday(metadata):
+    if not node.metadata.get('apt/unattended-upgrades/enabled', True):
+        return {}
+
     day = metadata.get('apt/unattended-upgrades/day')
     hour = metadata.get('apt/unattended-upgrades/hour')
 

bundles/arch-with-gui/metadata.py

@@ -33,7 +33,7 @@ defaults = {
             # networking
             'avahi': {},
             'netctl': {},
-            'rfkill': {},
+            'util-linux': {}, # provides rfkill
             'wpa_supplicant': {},
             'wpa_actiond': {},
 

bundles/backup-client/files/generate-backup

@@ -62,10 +62,13 @@ trap "on_exit" EXIT
 
 # redirect stdout and stderr to logfile
 prepare_and_cleanup_logdir
-logfile="$logdir/backup--$(date '+%F--%H-%M-%S')--$$.log.gz"
+if [[ -z "$DEBUG" ]]
-echo "All log output will go to $logfile" | logger -it backup-client
+then
-exec > >(gzip >"$logfile")
+    logfile="$logdir/backup--$(date '+%F--%H-%M-%S')--$$.log.gz"
-exec 2>&1
+    echo "All log output will go to $logfile" | logger -it backup-client
+    exec > >(gzip >"$logfile")
+    exec 2>&1
+fi
 
 # this is where the real work starts
 ts_begin=$(date +%s)

bundles/backup-server/metadata.py

@@ -160,7 +160,7 @@ def monitoring(metadata):
                 client,
                 config['one_backup_every_hours'],
             ),
-            'vars.sshmon_timeout': 20,
+            'vars.sshmon_timeout': 40,
         }
 
     return {

bundles/c3voc-addons/items.py

@@ -7,9 +7,6 @@ supported_os = {
         12: 'bookworm',
         99: 'unstable',
     },
-    'raspbian': {
-        10: 'buster',
-    },
 }
 
 try:
@@ -82,6 +79,10 @@ actions = {
         'triggered': True,
         'cascade_skip': False,
     },
+    'apt_execute_update_commands': {
+        'command': ' && '.join(sorted(node.metadata.get('apt/additional_update_commands', {'true'}))),
+        'triggered': True,
+    },
 }
 
 directories = {

bundles/docker-engine/files/check_docker_container

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+
+from json import loads
+from subprocess import check_output
+from sys import argv
+
+try:
+    container_name = argv[1]
+
+    docker_ps = check_output([
+        'docker',
+        'container',
+        'ls',
+        '--all',
+        '--format',
+        'json',
+        '--filter',
+        f'name={container_name}'
+    ])
+
+    containers = loads(f"[{','.join([l for l in docker_ps.decode().splitlines() if l])}]")
+
+    if not containers:
+        print(f'CRITICAL: container {container_name} not found!')
+        exit(2)
+
+    if len(containers) > 1:
+        print(f'Found more than one container matching {container_name}!')
+        print(docker_ps)
+        exit(3)
+
+    if containers[0]['State'] != 'running':
+        print(f'WARNING: container {container_name} not "running"')
+        exit(2)
+
+    print(f"OK: {containers[0]['Status']}")
+except Exception as e:
+    print(repr(e))
+    exit(2)

bundles/docker-engine/files/docker-wrapper

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+[[ -n "$DEBUG" ]] && set -x
+
+ACTION="$1"
+
+set -euo pipefail
+
+if [[ -z "$ACTION" ]]
+then
+    echo "Usage: $0 start|stop"
+    exit 1
+fi
+
+PUID="$(id -u "docker-${name}")"
+PGID="$(id -g "docker-${name}")"
+
+if [ "$ACTION" == "start" ]
+then
+    docker run -d \
+        --name "${name}" \
+        --env "PUID=$PUID" \
+        --env "PGID=$PGID" \
+        --env "TZ=${timezone}" \
+% for k, v in sorted(environment.items()):
+        --env "${k}=${v}" \
+% endfor
+        --network host \
+% for host_port, container_port in sorted(ports.items()):
+        --expose "127.0.0.1:${host_port}:${container_port}" \
+% endfor
+% for host_path, container_path in sorted(volumes.items()):
+        --volume "/var/opt/docker-engine/${name}/${host_path}:${container_path}" \
+% endfor
+        --restart unless-stopped \
+        "${image}"
+
+elif [ "$ACTION" == "stop" ]
+then
+    docker stop "${name}"
+    docker rm "${name}"
+
+else
+    echo "Unknown action $ACTION"
+    exit 1
+fi
+
+% if node.has_bundle('nftables'):
+systemctl reload nftables
+% endif

bundles/docker-engine/files/docker-wrapper.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=docker-engine app ${name}
+After=network.target
+Requires=${' '.join(sorted(requires))}
+
+[Service]
+WorkingDirectory=/var/opt/docker-engine/${name}/
+ExecStart=/opt/docker-engine/${name} start
+ExecStop=/opt/docker-engine/${name} stop
+Type=simple
+RemainAfterExit=true
+
+[Install]
+WantedBy=multi-user.target

bundles/docker-engine/items.py

@@ -0,0 +1,99 @@
+from bundlewrap.metadata import metadata_to_json
+
+deps = {
+    'pkg_apt:docker-ce',
+    'pkg_apt:docker-ce-cli',
+}
+
+directories['/opt/docker-engine'] = {
+    'purge': True,
+}
+directories['/var/opt/docker-engine'] = {}
+
+files['/etc/docker/daemon.json'] = {
+    'content': metadata_to_json(node.metadata.get('docker-engine/config')),
+    'triggers': {
+        'svc_systemd:docker:restart',
+    },
+    # install config before installing packages to ensure the config is
+    # applied to the first start as well
+    'before': deps,
+}
+
+svc_systemd['docker'] = {
+    'needs': deps,
+}
+
+files['/usr/local/share/icinga/plugins/check_docker_container'] = {
+    'mode': '0755',
+}
+
+for app, config in node.metadata.get('docker-engine/containers', {}).items():
+    volumes = config.get('volumes', {})
+
+    files[f'/opt/docker-engine/{app}'] = {
+        'source': 'docker-wrapper',
+        'content_type': 'mako',
+        'context': {
+            'environment': config.get('environment', {}),
+            'image': config['image'],
+            'name': app,
+            'ports': config.get('ports', {}),
+            'timezone': node.metadata.get('timezone'),
+            'volumes': volumes,
+        },
+        'mode': '0755',
+        'triggers': {
+            f'svc_systemd:docker-{app}:restart',
+        },
+    }
+
+    users[f'docker-{app}'] = {
+        'home': f'/var/opt/docker-engine/{app}',
+        'groups': {
+            'docker',
+        },
+        'after': {
+            # provides docker group
+            'pkg_apt:docker-ce',
+        },
+    }
+
+    files[f'/usr/local/lib/systemd/system/docker-{app}.service'] = {
+        'source': 'docker-wrapper.service',
+        'content_type': 'mako',
+        'context': {
+            'name': app,
+            'requires': {
+                *set(config.get('requires', set())),
+                'docker.service',
+            }
+        },
+        'triggers': {
+            'action:systemd-reload',
+            f'svc_systemd:docker-{app}:restart',
+        },
+    }
+
+    svc_systemd[f'docker-{app}'] = {
+        'needs': {
+            *deps,
+            f'file:/opt/docker-engine/{app}',
+            f'file:/usr/local/lib/systemd/system/docker-{app}.service',
+            f'user:docker-{app}',
+            'svc_systemd:docker',
+            *set(config.get('needs', set())),
+        },
+    }
+
+    for volume in volumes:
+        directories[f'/var/opt/docker-engine/{app}/{volume}'] = {
+            'owner': f'docker-{app}',
+            'group': f'docker-{app}',
+            'needed_by': {
+                f'svc_systemd:docker-{app}',
+            },
+            # don't do anything if the directory exists, docker images
+            # mangle owners
+            'unless': f'test -d /var/opt/docker-engine/{app}/{volume}',
+        }

bundles/docker-engine/metadata.py

@@ -0,0 +1,83 @@
+defaults = {
+    'apt': {
+        'packages': {
+            'docker-ce': {},
+            'docker-ce-cli': {},
+            'docker-compose-plugin': {},
+        },
+        'repos': {
+            'docker': {
+                'items': {
+                    'deb https://download.docker.com/linux/debian {os_release} stable',
+                },
+            },
+        },
+    },
+    'backups': {
+        'paths': {
+            '/var/opt/docker-engine',
+        },
+    },
+    'hosts': {
+        'entries': {
+            '172.17.0.1': {
+                'host.docker.internal',
+            },
+        },
+    },
+    'docker-engine': {
+        'config': {
+            'iptables': False,
+            'no-new-privileges': True,
+        },
+    },
+    'zfs': {
+        'datasets': {
+            'tank/docker-data': {
+                'mountpoint': '/var/opt/docker-engine',
+            },
+        },
+    },
+}
+
+
+@metadata_reactor.provides(
+    'icinga2_api/docker-engine/services',
+)
+def monitoring(metadata):
+    services = {
+        'DOCKER PROCESS': {
+            'command_on_monitored_host': '/usr/lib/nagios/plugins/check_procs -C dockerd -c 1:',
+        },
+    }
+
+    for app in metadata.get('docker-engine/containers', {}):
+        services[f'DOCKER CONTAINER {app}'] = {
+            'command_on_monitored_host': f'sudo /usr/local/share/icinga/plugins/check_docker_container {app}'
+        }
+
+    return {
+        'icinga2_api': {
+            'docker-engine': {
+                'services': services,
+            },
+        },
+    }
+
+
+@metadata_reactor.provides(
+    'zfs/datasets',
+)
+def zfs(metadata):
+    datasets = {}
+
+    for app in metadata.get('docker-engine/containers', {}):
+        datasets[f'tank/docker-data/{app}'] = {
+            'mountpoint': f'/var/opt/docker-engine/{app}'
+        }
+
+    return {
+        'zfs': {
+            'datasets': datasets,
+        },
+    }

bundles/docker-immich/metadata.py

@@ -0,0 +1,64 @@
+assert node.has_bundle('docker-engine')
+assert node.has_bundle('redis')
+assert not node.has_bundle('postgresql') # docker container uses that port
+
+defaults = {
+    'docker-engine': {
+        'containers': {
+            'immich': {
+                'image': 'ghcr.io/imagegenius/immich:latest',
+                'environment': {
+                    'DB_DATABASE_NAME': 'immich',
+                    'DB_HOSTNAME': 'host.docker.internal',
+                    'DB_PASSWORD': repo.vault.password_for(f'{node.name} postgresql immich'),
+                    'DB_USERNAME': 'immich',
+                    'REDIS_HOSTNAME': 'host.docker.internal',
+                },
+                'volumes': {
+                    'config': '/config',
+                    'libraries': '/libraries',
+                    'photos': '/photos',
+                },
+                'needs': {
+                    'svc_systemd:docker-postgresql14',
+                },
+                'requires': {
+                    'docker-postgresql14.service',
+                },
+            },
+            'postgresql14': {
+                'image': 'tensorchord/pgvecto-rs:pg14-v0.2.0',
+                'environment': {
+                    'POSTGRES_PASSWORD': repo.vault.password_for(f'{node.name} postgresql immich'),
+                    'POSTGRES_USER': 'immich',
+                    'POSTGRES_DB': 'immich',
+                },
+                'volumes': {
+                    'database': '/var/lib/postgresql/data',
+                },
+            },
+        },
+    },
+    'nginx': {
+        'vhosts': {
+            'immich': {
+                'locations': {
+                    '/': {
+                        'target': 'http://127.0.0.1:8080/',
+                        'websockets': True,
+                        'max_body_size': '500m',
+                    },
+                    #'/api/socket.io/': {
+                    #    'target': 'http://127.0.0.1:8081/',
+                    #    'websockets': True,
+                    #},
+                },
+            },
+        },
+    },
+    'redis': {
+        'bind': '0.0.0.0',
+    },
+}
+
+

bundles/dovecot/files/dovecot.conf

@@ -29,8 +29,8 @@ mail_location = maildir:/var/mail/vmail/%d/%n
 protocols = imap lmtp sieve
 
 ssl = required
-ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/fullchain.pem
+ssl_cert = </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/fullchain.pem
-ssl_key =  </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/privkey.pem
+ssl_key =  </var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/privkey.pem
 ssl_dh = </etc/ssl/certs/dhparam.pem
 ssl_min_protocol = TLSv1.2
 ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305

bundles/element-web/items.py

@@ -33,7 +33,7 @@ actions = {
             'yarn build',
         ]),
         'needs': {
-            'action:nodejs_install_yarn',
+            'action:apt_execute_update_commands',
             'pkg_apt:nodejs',
         },
         'triggered': True,

bundles/element-web/metadata.py

@@ -11,6 +11,26 @@ defaults = {
     },
 }
 
+@metadata_reactor.provides(
+    'nodejs/version',
+)
+def nodejs(metadata):
+    version = tuple([int(i) for i in metadata.get('element-web/version')[1:].split('.')])
+
+    if version >= (1, 11, 71):
+        return {
+            'nodejs': {
+                'version': 20,
+            },
+        }
+    else:
+        return {
+            'nodejs': {
+                'version': 18,
+            },
+        }
+
+
 @metadata_reactor.provides(
     'nginx/vhosts/element-web',
 )

bundles/forgejo/metadata.py

@@ -100,7 +100,7 @@ def nginx(metadata):
                         },
                     },
                     'website_check_path': '/user/login',
-                    'website_check_string': 'Sign In',
+                    'website_check_string': 'Sign in',
                 },
             },
         },

bundles/grafana/metadata.py

@@ -43,6 +43,7 @@ def nginx(metadata):
                     'locations': {
                         '/': {
                             'target': 'http://127.0.0.1:21010',
+                            'websockets': True,
                         },
                         '/api/ds/query': {
                             'target': 'http://127.0.0.1:21010',

bundles/hedgedoc/items.py

@@ -72,7 +72,6 @@ actions = {
             'yarn build',
         ]),
         'needs': {
-            'action:nodejs_install_yarn',
             'file:/opt/hedgedoc/config.json',
             'git_deploy:/opt/hedgedoc',
             'pkg_apt:nodejs',

bundles/homeassistant/files/check_homeassistant_update

@@ -2,48 +2,42 @@
 
 from sys import exit
 
-import requests
+from packaging.version import parse
-from packaging import version
+from requests import get
 
-bearer = "${bearer}"
+API_TOKEN = "${token}"
-domain = "${domain}"
+DOMAIN = "${domain}"
-OK = 0
-WARN = 1
-CRITICAL = 2
-UNKNOWN = 3
-
-status = 3
-message = "Unknown Update Status"
-
-
-domain = "hass.home.kunbox.net"
-
-s = requests.Session()
-s.headers.update({"Content-Type": "application/json"})
 
 try:
-    stable_version = version.parse(
+    r = get("https://version.home-assistant.io/stable.json")
-        s.get("https://version.home-assistant.io/stable.json").json()["homeassistant"][
+    r.raise_for_status()
-            "generic-x86-64"
+    stable_version = parse(r.json()["homeassistant"]["generic-x86-64"])
-        ]
-    )
-    s.headers.update(
-        {"Authorization": f"Bearer {bearer}", "Content-Type": "application/json"}
-    )
-    running_version = version.parse(
-        s.get(f"https://{domain}/api/config").json()["version"]
-    )
-    if running_version == stable_version:
-        status = 0
-        message = f"OK - running version {running_version} equals stable version {stable_version}"
-    elif running_version > stable_version:
-        status = 1
-        message = f"WARNING - stable version {stable_version} is lower than running version {running_version}, check if downgrade is necessary."
-    else:
-        status = 2
-        message = f"CRITICAL - update necessary, running version {running_version} is lower than stable version {stable_version}"
 except Exception as e:
-    message = f"{message}: {repr(e)}"
+    print(f"Could not get stable version information from home-assistant.io: {e!r}")
+    exit(3)
 
-print(message)
+try:
-exit(status)
+    r = get(
+        f"https://{DOMAIN}/api/config",
+        headers={"Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json"},
+    )
+    r.raise_for_status()
+    running_version = parse(r.json()["version"])
+except Exception as e:
+    print(f"Could not get running version information from homeassistant: {e!r}")
+    exit(3)
+
+try:
+    if stable_version > running_version:
+        print(
+            f"There is a newer version available: {stable_version} (currently installed: {running_version})"
+        )
+        exit(2)
+    else:
+        print(
+            f"Currently running version {running_version} matches newest release on home-assistant.io"
+        )
+        exit(0)
+except Exception as e:
+    print(repr(e))
+    exit(3)

bundles/homeassistant/files/homeassistant.service

@@ -5,6 +5,8 @@ After=network-online.target
 [Service]
 Type=simple
 User=homeassistant
+Environment="VIRTUAL_ENV=/opt/homeassistant/venv"
+Environment="PATH=/opt/homeassistant/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 WorkingDirectory=/var/opt/homeassistant
 ExecStart=/opt/homeassistant/venv/bin/hass -c "/var/opt/homeassistant"
 RestartForceExitStatus=100

bundles/homeassistant/items.py

@@ -30,7 +30,7 @@ files = {
     '/usr/local/share/icinga/plugins/check_homeassistant_update': {
         'content_type': 'mako',
         'context': {
-            'bearer': repo.vault.decrypt(node.metadata.get('homeassistant/api_secret')),
+            'token': node.metadata.get('homeassistant/api_secret'),
             'domain': node.metadata.get('homeassistant/domain'),
         },
         'mode': '0755',

bundles/icinga2/files/check_spam_blocklist

@@ -50,17 +50,13 @@ def check_list(ip_list, blocklist, warn_ips):
         ]).decode().splitlines()
         for item in result:
             if item.startswith(';;'):
-                msgs.append('{} - {}'.format(
+                continue
-                    blocklist,
+            msgs.append('{} listed in {} as {}'.format(
-                    item,
+                ip,
-                ))
+                blocklist,
-            else:
+                item,
-                msgs.append('{} listed in {} as {}'.format(
+            ))
-                    ip,
+            if item in warn_ips and returncode < 2:
-                    blocklist,
-                    item,
-                ))
-            if (item in warn_ips or item.startswith(';;')) and returncode < 2:
                 returncode = 1
             else:
                 returncode = 2

bundles/icinga2/files/scripts/icinga_notification_wrapper

@@ -199,7 +199,7 @@ if __name__ == '__main__':
         notify_per_mail()
 
     if args.sms:
-        if args.service_name:
+        if not args.service_name:
             notify_per_sms()
         if CONFIG['ntfy']['user']:
             notify_per_ntfy()

bundles/icinga2/metadata.py

@@ -17,7 +17,6 @@ defaults = {
             'icinga2': {},
             'icinga2-ido-pgsql': {},
             'icingaweb2': {},
-            'icingaweb2-module-monitoring': {},
             'python3-easysnmp': {},
             'python3-flask': {},
             'snmp': {},

bundles/infobeamer-cms/items.py

@@ -23,7 +23,7 @@ actions = {
 git_deploy = {
     '/opt/infobeamer-cms/src': {
         'rev': 'master',
-        'repo': 'https://github.com/sophieschi/36c3-cms.git',
+        'repo': 'https://github.com/voc/infobeamer-cms.git',
         'needs': {
             'directory:/opt/infobeamer-cms/src',
         },
@@ -96,14 +96,6 @@ files = {
     },
 }
 
-pkg_pip = {
-    'github-flask': {
-        'needed_by': {
-            'svc_systemd:infobeamer-cms',
-        },
-    },
-}
-
 svc_systemd = {
     'infobeamer-cms': {
         'needs': {

bundles/infobeamer-monitor/files/monitor.py

@@ -1,9 +1,10 @@
 #!/usr/bin/env python3
 
 import logging
-from datetime import datetime, timezone
+from datetime import datetime
 from json import dumps
 from time import sleep
+from zoneinfo import ZoneInfo
 
 import paho.mqtt.client as mqtt
 from requests import RequestException, get
@@ -61,8 +62,6 @@ def mqtt_dump_state(device):
         out.append("Location: {}".format(device["location"]))
     out.append("Setup: {} ({})".format(device["setup"]["name"], device["setup"]["id"]))
     out.append("Resolution: {}".format(device["run"].get("resolution", "unknown")))
-    if not device["is_synced"]:
-        out.append("syncing ...")
 
     mqtt_out(
         " - ".join(out),
@@ -73,6 +72,9 @@ def mqtt_dump_state(device):
 mqtt_out("Monitor starting up")
 while True:
     try:
+        online_devices = set()
+        available_credits = None
+
         try:
             r = get(
                 "https://info-beamer.com/api/v1/device/list",
@@ -88,7 +90,6 @@ while True:
             )
         else:
             new_state = {}
-            online_devices = set()
             for device in ib_state:
                 did = str(device["id"])
 
@@ -140,17 +141,15 @@ while True:
                         if device["is_online"]:
                             if device["maintenance"]:
                                 mqtt_out(
-                                    "maintenance required: {}".join(
+                                    "maintenance required: {}".format(
-                                        sorted(device["maintenance"])
+                                        " ".join(sorted(device["maintenance"]))
                                     ),
                                     level="WARN",
                                     device=device,
                                 )
-                                must_dump_state = True
 
                         if (
-                            device["is_synced"] != state[did]["is_synced"]
+                            device["location"] != state[did]["location"]
-                            or device["location"] != state[did]["location"]
                             or device["setup"]["id"] != state[did]["setup"]["id"]
                             or device["run"].get("resolution")
                             != state[did]["run"].get("resolution")
@@ -172,13 +171,56 @@ while True:
 
             state = new_state
 
-            if (
+        try:
-                datetime.now(timezone.utc).strftime("%H%M") == "1312"
+            r = get(
-                and online_devices
+                "https://info-beamer.com/api/v1/account",
-                and int(datetime.now(timezone.utc).strftime("%S")) < 30
+                auth=("", CONFIG["api_key"]),
-            ):
+            )
-                mqtt_out("Online Devices: {}".format(", ".join(sorted(online_devices))))
+            r.raise_for_status()
-        sleep(30)
+            ib_account = r.json()
+        except RequestException as e:
+            LOG.exception("Could not get data from info-beamer")
+            mqtt_out(
+                f"Could not get data from info-beamer: {e!r}",
+                level="WARN",
+            )
+        else:
+            available_credits = ib_account["balance"]
+            if available_credits < 50:
+                mqtt_out(
+                    f"balance has dropped below 50 credits! (available: {available_credits})",
+                    level="ERROR",
+                )
+            elif available_credits < 100:
+                mqtt_out(
+                    f"balance has dropped below 100 credits! (available: {available_credits})",
+                    level="WARN",
+                )
+
+            for quota_name, quota_config in sorted(ib_account["quotas"].items()):
+                value = quota_config["count"]["value"]
+                limit = quota_config["count"]["limit"]
+                if value > limit * 0.9:
+                    mqtt_out(
+                        f"quota {quota_name} is over 90% (limit {limit}, value {value})",
+                        level="ERROR",
+                    )
+                elif value > limit * 0.8:
+                    mqtt_out(
+                        f"quota {quota_name} is over 80% (limit {limit}, value {value})",
+                        level="WARN",
+                    )
+
+        if datetime.now(ZoneInfo("Europe/Berlin")).strftime("%H%M") == "0900":
+            if available_credits is not None:
+                mqtt_out(f"Available Credits: {available_credits}")
+
+            if online_devices:
+                mqtt_out(
+                    "Online Devices: {}".format(", ".join(sorted(online_devices)))
+                )
+
+        sleep(60)
     except KeyboardInterrupt:
         break
 

bundles/matrix-media-repo/files/config.yaml

@@ -3,6 +3,9 @@ repo:
   bindAddress: '${node.metadata.get('matrix-media-repo/listen-addr', '127.0.0.1')}'
   port: ${node.metadata.get('matrix-media-repo/port', 20090)}
   logDirectory: '-'
+  logColors: false
+  jsonLogs: false
+  logLevel: 'info'
   trustAnyForwardedAddress: false
   useForwardedHost: true
 
@@ -22,10 +25,13 @@ homeservers:
     csApi: "${config['domain']}"
     backoffAt: ${config.get('backoff_at', 10)}
     adminApiKind: "${config.get('api', 'matrix')}"
+%  if config.get('signing_key_path'):
+    signingKeyPath: "${config['signing_key_path']}"
+%  endif
 % endfor
 
 accessTokens:
-  maxCacheTimeSeconds: 0
+  maxCacheTimeSeconds: 10
   useLocalAppserviceConfig: false
 
 admins:
@@ -53,7 +59,9 @@ archiving:
 uploads:
   maxBytes: ${node.metadata.get('matrix-media-repo/upload_max_mb')*1024*1024}
   minBytes: 100
-  reportedMaxBytes: 0
+  #reportedMaxBytes: 0
+  maxPending: 5
+  maxAgeSeconds: 1800
   quotas:
     enabled: false
 
@@ -61,14 +69,6 @@ downloads:
   maxBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*1024*1024}
   numWorkers: ${node.metadata.get('matrix-media-repo/workers')}
   failureCacheMinutes: 5
-  cache:
-    enabled: true
-    maxSizeBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*10*1024*1024}
-    maxFileSizeBytes: ${node.metadata.get('matrix-media-repo/download_max_mb')*1024*1024}
-    trackedMinutes: 30
-    minDownloads: 5
-    minCacheTimeSeconds: 300
-    minEvictedTimeSeconds: 60
   expireAfterDays: 0
 
 urlPreviews:
@@ -137,8 +137,8 @@ thumbnails:
 
 rateLimit:
   enabled: true
-  requestsPerSecond: 10
+  requestsPerSecond: 100
-  burst: 50
+  burst: 5000
 
 identicons:
   enabled: true

bundles/matrix-media-repo/items.py

@@ -19,9 +19,6 @@ files = {
     '/opt/matrix-media-repo/config.yaml': {
         'owner': 'matrix-media-repo',
         'content_type': 'mako',
-        'triggers': {
-            'svc_systemd:matrix-media-repo:restart',
-        },
     },
     '/etc/systemd/system/matrix-media-repo.service': {
         'triggers': {

bundles/matrix-synapse/metadata.py

@@ -144,13 +144,14 @@ def nginx(metadata):
     }
 
     if node.has_bundle('matrix-media-repo'):
-        locations['/_matrix/media'] = {
+        for path in ('/_matrix/media', '/_matrix/client/v1/media', '/_matrix/federation/v1/media'):
-            'target': 'http://localhost:20090',
+            locations[path] = {
-            'max_body_size': '{}M'.format(metadata.get('matrix-media-repo/upload_max_mb')),
+                'target': 'http://localhost:20090',
-            # matrix-media-repo needs this to be the
+                'max_body_size': '{}M'.format(metadata.get('matrix-media-repo/upload_max_mb')),
-            # homeserver address.
+                # matrix-media-repo needs this to be the
-            'x_forwarded_host': metadata.get('matrix-synapse/server_name'),
+                # homeserver address.
-        }
+                'x_forwarded_host': metadata.get('matrix-synapse/server_name'),
+            }
 
     vhosts = {
         'matrix-synapse': {

bundles/mixcloud-downloader/files/download.sh

@@ -1,11 +1,15 @@
 #!/bin/bash
 
-OPTS=""
+OPTS="--netrc"
+OPTS="$OPTS --netrc-location /opt/mixcloud-downloader/netrc"
+OPTS="$OPTS --retry-sleep linear=1::2"
+OPTS="$OPTS --retry-sleep fragment:exp=1:60"
+OPTS="$OPTS --extractor-retries 5"
 if [[ -n "$DEBUG" ]]
 then
     set -x
 else
-    OPTS="-q"
+    OPTS="$OPTS -q"
 fi
 
 set -euo pipefail

bundles/mixcloud-downloader/files/netrc

@@ -0,0 +1,3 @@
+% for domain, data in sorted(node.metadata.get('mixcloud-downloader/netrc', {}).items()):
+machine ${domain} login ${data['username']} password ${data['password']}
+% endfor

bundles/mixcloud-downloader/items.py

@@ -6,3 +6,9 @@ files['/opt/mixcloud-downloader/download.sh'] = {
 directories['/opt/mixcloud-downloader'] = {
     'owner': 'kunsi',
 }
+
+files['/opt/mixcloud-downloader/netrc'] = {
+    'content_type': 'mako',
+    'mode': '0400',
+    'owner': 'kunsi',
+}

bundles/mosquitto/items.py

@@ -5,12 +5,6 @@ files = {
             'svc_systemd:mosquitto:restart',
         },
     },
-    '/usr/local/bin/tasmota-telegraf-plugin': {
-        'mode': '0755',
-        'needs': {
-            'pkg_apt:python3-paho-mqtt',
-        },
-    },
 }
 
 svc_systemd = {
@@ -23,6 +17,12 @@ svc_systemd = {
 }
 
 if node.has_bundle('telegraf'):
-    files['/usr/local/bin/tasmota-telegraf-plugin']['triggers'] = {
+    files['/usr/local/bin/tasmota-telegraf-plugin'] = {
-        'svc_systemd:telegraf:restart',
+        'mode': '0755',
+        'needs': {
+            'pkg_apt:python3-paho-mqtt',
+        },
+        'triggers': {
+            'svc_systemd:telegraf:restart',
+        },
     }

bundles/mosquitto/metadata.py

@@ -5,7 +5,6 @@ defaults = {
         'packages': {
             'mosquitto': {},
             'mosquitto-clients': {},
-            'python3-paho-mqtt': {}, # for telegraf plugin
         },
     },
     'icinga2_api': {
@@ -24,6 +23,9 @@ defaults = {
     },
 }
 
+if node.has_bundle('telegraf'):
+    defaults['apt']['packages']['python3-paho-mqtt'] = {}
+
 
 @metadata_reactor.provides(
     'firewall/port_rules',

bundles/nftables/files/nftables.conf

@@ -23,9 +23,8 @@ table inet filter {
 
         icmp type timestamp-request drop
         icmp type timestamp-reply drop
-        ip protocol icmp accept
+        meta l4proto {icmp, ipv6-icmp} accept
 
-        ip6 nexthdr ipv6-icmp accept
 % for ruleset, rules in sorted(input.items()):
 
         # ${ruleset}

bundles/nftables/metadata.py

@@ -29,7 +29,7 @@ defaults = {
     },
 }
 
-if not node.has_bundle('vmhost'):
+if not node.has_bundle('vmhost') and not node.has_bundle('docker-engine'):
     # see comment in bundles/vmhost/items.py
     defaults['apt']['packages']['iptables'] = {
         'installed': False,

bundles/nginx/files/nginx.conf

@@ -11,7 +11,7 @@ events {
 http {
     include       /etc/nginx/mime.types;
     types {
-        application/javascript js mjs;
+        application/javascript mjs;
     }
     default_type  application/octet-stream;
     charset UTF-8;

bundles/nginx/files/site_template

@@ -149,18 +149,18 @@ server {
 %   if 'target' in options:
         proxy_pass           ${options['target']};
         proxy_http_version   ${options.get('http_version', '1.1')};
-        proxy_set_header     Host ${domain};
+        proxy_set_header     Host ${options.get('proxy_pass_host', domain)};
 %    if options.get('websockets', False):
         proxy_set_header     Connection "upgrade";
         proxy_set_header     Upgrade $http_upgrade;
 %    endif
         proxy_set_header     X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header     X-Forwarded-Proto $scheme;
-        proxy_set_header     X-Forwarded-Host ${options.get('x_forwarded_host', domain)};
+        proxy_set_header     X-Forwarded-Host ${options.get('x_forwarded_host', options.get('proxy_pass_host', domain))};
 %    for option, value in options.get('proxy_set_header', {}).items():
         proxy_set_header     ${option} ${value};
 %    endfor
-%    if location != '/':
+%    if location != '/' and location != '= /':
         proxy_set_header     X-Script-Name ${location};
 %    endif
         proxy_buffering      off;
@@ -201,6 +201,8 @@ server {
         fastcgi_hide_header X-XSS-Protection;
 % endif
         fastcgi_hide_header Permissions-Policy;
+        fastcgi_request_buffering off;
+        proxy_buffering off;
     }
 %  if not max_body_size:
     client_max_body_size 5M;

bundles/nodejs/items.py

@@ -1,9 +0,0 @@
-actions = {
-    'nodejs_install_yarn': {
-        'command': 'npm install -g yarn@latest',
-        'unless': 'test -e /usr/lib/node_modules/yarn',
-        'after': {
-            'pkg_apt:',
-        },
-    },
-}

bundles/nodejs/metadata.py

@@ -1,54 +1,40 @@
 defaults = {
     'apt': {
         'additional_update_commands': {
-            # update npm to latest version
+            # update npm and yarn to latest version
+            'npm install -g npm@latest',
             'npm install -g yarn@latest',
         },
         'packages': {
-            'nodejs': {},
+            'nodejs': {
+                'triggers': {
+                    'action:apt_execute_update_commands',
+                },
+            },
+            'npm': {
+                'installed': False,
+                'triggers': {
+                    'action:apt_execute_update_commands',
+                },
+            },
         },
     },
-    'nodejs': {
-        'version': 18,
-    },
-}
-
-VERSIONS_SHIPPED_BY_DEBIAN = {
-    10: 10,
-    11: 12,
-    12: 18,
-    13: 18,
 }
 
 @metadata_reactor.provides(
     'apt/repos/nodejs/items',
-    'apt/additional_update_commands',
 )
 def nodejs_from_version(metadata):
     version = metadata.get('nodejs/version')
 
-    if version != VERSIONS_SHIPPED_BY_DEBIAN[node.os_version[0]]:
+    return {
-        return {
+        'apt': {
-            'apt': {
+            'repos': {
-                'additional_update_commands': {
+                'nodejs': {
-                    # update npm to latest version
+                    'items': {
-                    'npm install -g npm@latest',
+                        f'deb https://deb.nodesource.com/node_{version}.x nodistro main',
-                },
-                'repos': {
-                    'nodejs': {
-                        'items': {
-                            f'deb https://deb.nodesource.com/node_{version}.x {{os_release}} main',
-                            f'deb-src https://deb.nodesource.com/node_{version}.x {{os_release}} main',
-                        },
                     },
                 },
             },
-        }
+        },
-    else:
+    }
-        return {
-            'apt': {
-                'packages': {
-                    'npm': {},
-                },
-            },
-        }

bundles/paperless-ng/metadata.py

@@ -33,6 +33,9 @@ defaults = {
             '/mnt/paperless',
         },
     },
+    'nodejs': {
+        'version': 18,
+    },
     'postgresql': {
         'roles': {
             'paperless': {

bundles/postfix/files/blocked_recipients

@@ -1,3 +1,5 @@
+devnull@${node.metadata.get('postfix/myhostname')} DISCARD DEV-NULL
+
 % for address in sorted(blocked):
 ${address} REJECT
 % endfor

bundles/postfix/files/main.cf

@@ -3,7 +3,7 @@ biff = no
 append_dot_mydomain = no
 readme_directory = no
 compatibility_level = 2
-myhostname = ${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}
+myhostname = ${node.metadata.get('postfix/myhostname')}
 myorigin = /etc/mailname
 mydestination = $myhostname, localhost
 mynetworks = ${' '.join(sorted(mynetworks))}
@@ -38,8 +38,8 @@ smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
 </%text>
 
 % if node.has_bundle('postfixadmin'):
-smtpd_tls_cert_file = /var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/fullchain.pem
+smtpd_tls_cert_file = /var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/fullchain.pem
-smtpd_tls_key_file = /var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname', node.metadata['hostname'])}/privkey.pem
+smtpd_tls_key_file = /var/lib/dehydrated/certs/${node.metadata.get('postfix/myhostname')}/privkey.pem
 <%text>
 smtpd_use_tls=yes
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
@@ -48,7 +48,7 @@ smtpd_client_restrictions = permit_mynetworks permit_sasl_authenticated
 smtpd_helo_required = yes
 smtpd_helo_restrictions = permit_mynetworks reject_invalid_helo_hostname
 smtpd_data_restrictions = reject_unauth_pipelining
-smtpd_recipient_restrictions = permit_mynetworks, check_recipient_access hash:/etc/postfix/blocked_recipients
+smtpd_recipient_restrictions = check_recipient_access hash:/etc/postfix/blocked_recipients, permit_mynetworks
 smtpd_relay_before_recipient_restrictions = yes
 
 # https://ssl-config.mozilla.org/#server=postfix&version=3.7.10&config=intermediate&openssl=3.0.11&guideline=5.7

bundles/postfix/items.py

@@ -25,7 +25,7 @@ my_package = 'pkg_pacman:postfix' if node.os == 'arch' else 'pkg_apt:postfix'
 
 files = {
     '/etc/mailname': {
-        'content': node.metadata.get('postfix/myhostname', node.metadata['hostname']),
+        'content': node.metadata.get('postfix/myhostname'),
         'before': {
             my_package,
         },

bundles/postfix/metadata.py

@@ -87,7 +87,7 @@ def letsencrypt(metadata):
     }
 
     result['domains'] = {
-        metadata.get('postfix/myhostname', metadata.get('hostname')): set(),
+        metadata.get('postfix/myhostname'): set(),
     }
 
     return {
@@ -148,3 +148,14 @@ def icinga2(metadata):
             },
         },
     }
+
+
+@metadata_reactor.provides(
+    'postfix/myhostname',
+)
+def myhostname(metadata):
+    return {
+        'postfix': {
+            'myhostname': metadata.get('hostname'),
+        },
+    }

bundles/postgresql/items.py

@@ -57,7 +57,7 @@ files = {
     },
 }
 
-if node.has_bundle('backup-client') and not node.has_bundle('zfs'):
+if node.has_bundle('backup-client'):
     files['/etc/backup-pre-hooks.d/90-postgresql-dump-all'] = {
         'source': 'backup-pre-hook',
         'content_type': 'mako',
@@ -67,10 +67,6 @@ if node.has_bundle('backup-client') and not node.has_bundle('zfs'):
         'mode': '0700',
     }
     directories['/var/tmp/postgresdumps'] = {}
-else:
-    files['/var/tmp/postgresdumps'] = {
-        'delete': True,
-    }
 
 postgres_roles = {
     'root': {

bundles/postgresql/metadata.py

@@ -11,6 +11,7 @@ defaults = {
     'backups': {
         'paths': {
             '/var/lib/postgresql',
+            '/var/tmp/postgresdumps',
         },
     },
     'bash_functions': {
@@ -74,8 +75,6 @@ if node.has_bundle('zfs'):
             },
         },
     }
-else:
-    defaults['backups']['paths'].add('/var/tmp/postgresdumps')
 
 
 @metadata_reactor.provides(

bundles/powerdns/items.py

@@ -3,6 +3,8 @@ from os import listdir
 from os.path import isfile, join
 from subprocess import check_output
 
+from bundlewrap.utils.ui import io
+
 zone_path = join(repo.path, 'data', 'powerdns', 'files', 'bind-zones')
 
 nameservers = set()
@@ -65,7 +67,7 @@ svc_systemd = {
 actions = {
     'powerdns_reload_zones': {
         'triggered': True,
-        'command': 'pdns_control rediscover; pdns_control reload; pdns_control notify \*',
+        'command': r'pdns_control rediscover; pdns_control reload; pdns_control notify \*',
         'after': {
             'svc_systemd:pdns',
         },
@@ -79,9 +81,10 @@ if node.metadata.get('powerdns/features/bind', False):
             continue
 
         try:
-            output = check_output(['git', 'log', '-1', '--pretty=%ci', join(zone_path, zone)]).decode('utf-8').strip()
+            output = check_output(['git', 'log', '-1', '--pretty=%ci']).decode('utf-8').strip()
             serial = datetime.strptime(output, '%Y-%m-%d %H:%M:%S %z').strftime('%y%m%d%H%M')
-        except:
+        except Exception as e:
+            io.stderr(f"Error while parsing commit time for {zone} serial: {e!r}")
             serial = datetime.now().strftime('%y%m%d0000')
 
         primary_zones.add(zone)
@@ -160,7 +163,7 @@ if node.metadata.get('powerdns/features/pgsql', node.has_bundle('postgresql')):
 
     actions['powerdns_load_pgsql_schema'] = {
         'command': node.metadata.get('postgresql/roles/powerdns/password').format_into('PGPASSWORD={} psql -h 127.0.0.1 -d powerdns -U powerdns -w < /usr/share/pdns-backend-pgsql/schema/schema.pgsql.sql'),
-        'unless': 'sudo -u postgres psql -d powerdns -c "\dt" | grep domains 2>&1 >/dev/null',
+        'unless': r'sudo -u postgres psql -d powerdns -c "\dt" | grep domains 2>&1 >/dev/null',
         'needs': {
             'bundle:postgresql',
             'pkg_apt:pdns-backend-pgsql',

bundles/powerdnsadmin/items.py

@@ -71,8 +71,8 @@ actions = {
             'chown -R powerdnsadmin:powerdnsadmin /opt/powerdnsadmin/src/powerdnsadmin/static/',
         ]),
         'needs': {
-            'action:nodejs_install_yarn',
             'action:powerdnsadmin_install_deps',
+            'bundle:nodejs',
             'pkg_apt:',
         },
     },

bundles/powerdnsadmin/metadata.py

@@ -13,6 +13,9 @@ defaults = {
             'python3-wheel': {},
         },
     },
+    'nodejs': {
+        'version': 18,
+    },
     'users': {
         'powerdnsadmin': {
             'home': '/opt/powerdnsadmin',

bundles/pppd/files/dyndns

@@ -7,7 +7,6 @@ from subprocess import check_output
 
 from requests import get
 
-
 UPDATE_URL = '${url}'
 USERNAME = '${username}'
 PASSWORD = '${password}'

bundles/pppd/files/dyndns_periodic

@@ -5,7 +5,6 @@ from ipaddress import ip_address
 from json import loads
 from subprocess import check_output, run
 
-
 DOMAIN = '${domain}'
 
 # <%text>

bundles/pretalx/items.py

@@ -1,5 +1,5 @@
 assert node.has_bundle('redis'), f'{node.name}: pretalx needs redis'
-assert node.has_bundle('nodejs'), f'{node.name}: pretalx needs nodejs for rebuild and regenerate_css step'
+assert node.has_bundle('nodejs'), f'{node.name}: pretalx needs nodejs for rebuild step'
 
 actions = {
     'pretalx_create_virtualenv': {
@@ -53,17 +53,6 @@ actions = {
         },
         'triggered': True,
     },
-    'pretalx_regenerate-css': {
-        'command': 'sudo -u pretalx PRETALX_CONFIG_FILE=/opt/pretalx/pretalx.cfg /opt/pretalx/venv/bin/python -m pretalx regenerate_css',
-        'needs': {
-            'action:pretalx_migrate',
-            'directory:/opt/pretalx/data',
-            'directory:/opt/pretalx/static',
-            'file:/opt/pretalx/pretalx.cfg',
-            'bundle:nodejs',
-        },
-        'triggered': True,
-    },
 }
 
 users = {
@@ -90,7 +79,6 @@ git_deploy = {
             'action:pretalx_install',
             'action:pretalx_migrate',
             'action:pretalx_rebuild',
-            'action:pretalx_regenerate-css',
             'svc_systemd:pretalx-web:restart',
             'svc_systemd:pretalx-worker:restart',
         },
@@ -121,7 +109,6 @@ svc_systemd = {
             'action:pretalx_install',
             'action:pretalx_migrate',
             'action:pretalx_rebuild',
-            'action:pretalx_regenerate-css',
             'file:/etc/systemd/system/pretalx-web.service',
             'file:/opt/pretalx/pretalx.cfg',
         },
@@ -129,7 +116,8 @@ svc_systemd = {
     'pretalx-worker': {
         'needs': {
             'action:pretalx_install',
-            'action:pretalx_migrate',
+            'action:pretalx_migrate',,
+            'action:pretalx_rebuild',
             'file:/etc/systemd/system/pretalx-worker.service',
             'file:/opt/pretalx/pretalx.cfg',
         },
@@ -204,7 +192,6 @@ for plugin_name, plugin_config in node.metadata.get('pretalx/plugins', {}).items
         'triggers': {
             'action:pretalx_migrate',
             'action:pretalx_rebuild',
-            'action:pretalx_regenerate-css',
             'svc_systemd:pretalx-web:restart',
             'svc_systemd:pretalx-worker:restart',
         },

bundles/pretalx/metadata.py

@@ -26,6 +26,9 @@ defaults = {
             },
         },
     },
+    'nodejs': {
+        'version': 18,
+    },
     'pretalx': {
         'database': {
             'user': 'pretalx',

bundles/proftpd/items.py

@@ -0,0 +1,13 @@
+files['/etc/proftpd/proftpd.conf'] = {
+    'source': f'{node.name}.conf',
+    'triggers': {
+        'svc_systemd:proftpd:restart',
+    },
+}
+
+svc_systemd['proftpd'] = {
+    'needs': {
+        'file:/etc/proftpd/proftpd.conf',
+        'pkg_apt:proftpd-core',
+    },
+}

bundles/proftpd/metadata.py

@@ -0,0 +1,26 @@
+from bundlewrap.metadata import atomic
+
+defaults = {
+    'apt': {
+        'packages': {
+            'proftpd-core': {},
+        },
+    },
+}
+
+
+@metadata_reactor.provides(
+    'firewall/port_rules',
+)
+def firewall(metadata):
+    sources = atomic(metadata.get('mosquitto/restrict-to', set()))
+
+    return {
+        'firewall': {
+            'port_rules': {
+                '20/tcp': sources,
+                '21/tcp': sources,
+                '49152-50192/tcp': sources,
+            },
+        },
+    }

bundles/raspberrypi/files/config.txt

@@ -1,22 +1,30 @@
 disable_overscan=1
-hdmi_force_hotplug=1
-dtparam=spi=on
 dtparam=audio=on
-dtoverlay=vc4-fkms-v3d
+dtoverlay=vc4-kms-v3d
 max_framebuffers=2
-hdmi_drive=2
 force_turbo=1
 
-gpu_mem=${node.metadata['raspberrypi'].get('gpu_mem', 128)}
+gpu_mem=${node.metadata.get('raspberrypi/gpu_mem', 128)}
+
+% if node.metadata.get('raspberrypi/enable_display'):
+display_auto_detect=1
+% else:
+dtparam=i2c_arm=on
+dtparam=i2s=on
+dtparam=spi=on
+hdmi_drive=2
+hdmi_force_hotplug=1
+% endif
 
 % if node.os == 'debian':
 arm_64bit=1
 % endif
+arm_boost=1
 
-% for item in sorted(node.metadata['raspberrypi'].get('config.txt', set())):
+% for item in sorted(node.metadata.get('raspberrypi/config.txt', set())):
 ${item}
 % endfor
 
-% if node.metadata['raspberrypi'].get('camera', False):
+% if node.metadata.get('raspberrypi/enable_camera', False):
-start_x=1
+camera_auto_detect=1
 % endif

bundles/raspberrypi/items.py

@@ -15,11 +15,11 @@ actions = {
 }
 
 files = {
-    '/boot/cmdline.txt': {
+    '/boot/firmware/cmdline.txt': {
         'content': ' '.join(sorted(node.metadata['raspberrypi']['cmdline'])),
         **file_perms,
     },
-    '/boot/config.txt': {
+    '/boot/firmware/config.txt': {
         'content_type': 'mako',
         'context': node.metadata['raspberrypi'],
         **file_perms,

bundles/raspberrypi/metadata.py

@@ -1,5 +1,6 @@
 defaults = {
     'apt': {
+        'clean_old_kernels': False,
         'packages': {
             'dhcpcd5': {
                 'installed': False,
@@ -14,9 +15,16 @@ defaults = {
                 'installed': False,
             },
         },
+        'repos': {
+            'raspi': {
+                'install_gpg_key': False,
+                'items': {
+                    'deb http://archive.raspberrypi.org/debian/ {os_release} main',
+                },
+            },
+        },
     },
     'raspberrypi': {
-        'default-target': 'multi-user.target',
         'cmdline': {
             'console=tty1',
             'root=/dev/mmcblk0p2',
@@ -28,6 +36,8 @@ defaults = {
             'plymouth.ignore-serial-consoles',
             'net.ifnames=0',
         },
+        'default-target': 'multi-user.target',
+        'enable_display': False,
     },
     'systemd': {
         'journal': {
@@ -37,3 +47,19 @@ defaults = {
         },
     },
 }
+
+
+@metadata_reactor.provides(
+    'raspberrypi/cmdline',
+)
+def display(metadata):
+    if not metadata.get('raspberrypi/enable_display'):
+        return {}
+
+    return {
+        'raspberrypi': {
+            'cmdline': {
+                'video=DSI-1:800x480@60,rotate=180',
+            },
+        },
+    }

bundles/redis/files/redis.conf

@@ -48,3 +48,4 @@ tcp-keepalive 0
 timeout 0
 zset-max-ziplist-entries 128
 zset-max-ziplist-value 64
+protected-mode no

bundles/routeros/metadata.py

@@ -2,6 +2,84 @@ import re
 from json import load
 from os.path import join
 
+with open(join(repo.path, 'configs', 'netbox', f'{node.name}.json')) as f:
+    netbox = load(f)
+
+ips = {}
+ports = {}
+vlans = {
+    v['name']: {
+        'id': v['vid'],
+        'delete': False,
+        'tagged': set(),
+        'untagged': set(),
+    }
+    for v in netbox['vlans']
+}
+
+for port, conf in netbox['interfaces'].items():
+    for ip in conf['ips']:
+        ips[ip] = {'interface': port}
+
+    if conf['type'].lower() == 'virtual':
+        # these are VLAN interfaces (for management IPs)
+        if conf['ips']:
+            # this makes management services available in the VLAN
+            try:
+                vlans[port]['tagged'].add('bridge')
+            except KeyError:
+                raise ValueError(
+                    f'name of virtual interface "{port}" on {node.name} '
+                    f'matches none of the known VLANs: {list(vlans.keys())} '
+                    '(you probably need to rename the interface in Netbox '
+                    'and/or run netbox-dump)'
+                )
+        # We do not create the actual VLAN interface here, that
+        # happens automatically in items.py.
+        continue
+    elif not conf['enabled'] or not conf['mode']:
+        # disable unconfigured ports
+        ports[port] = {
+            'disabled': True,
+            'description': conf.get('description', ''),
+        }
+        # dont add vlans for this port
+        continue
+    else:
+        ports[port] = {
+            'disabled': False,
+            'description': conf.get('description', ''),
+        }
+        if conf.get('ips', []):
+            ports[port]['ips'] = set(conf['ips'])
+        if conf['type'] in (
+            '1000base-t',
+            '10gbase-x-sfpp',
+            'A_1000BASE_T',
+            'A_10GBASE_X_SFPP',
+        ):
+            ports[port]['hw'] = True
+
+    if conf['untagged_vlan']:
+        vlans[conf['untagged_vlan']]['untagged'].add(port)
+        if conf['ips']:
+            # this makes management services available in the VLAN
+            vlans[conf['untagged_vlan']]['tagged'].add('bridge')
+
+    # tagged
+
+    if conf['mode'] in ('TAGGED_ALL', 'tagged-all'):
+        tagged = set(vlans.keys()) - {conf['untagged_vlan']}
+    else:
+        tagged = conf['tagged_vlans']
+
+    for vlan in tagged:
+        vlans[vlan]['tagged'].add(port)
+
+        # this makes management services available in the VLAN
+        if conf['ips']:
+            vlans[vlan]['tagged'].add('bridge')
+
 defaults = {
     'icinga2_api': {
         'routeros': {
@@ -17,100 +95,14 @@ defaults = {
             },
         },
     },
+    'routeros': {
+        'ips': ips,
+        'ports': ports,
+        'vlans': vlans,
+    },
 }
 
 
-@metadata_reactor.provides(
-    'routeros/ips',
-    'routeros/ports',
-    'routeros/vlans',
-)
-def get_ports_from_netbox_dump(metadata):
-    with open(join(repo.path, 'configs', f'netbox_device_{node.name}.json')) as f:
-        netbox = load(f)
-
-    ips = {}
-    ports = {}
-    vlans = {
-        v['name']: {
-            'id': v['vid'],
-            'delete': False,
-            'tagged': set(),
-            'untagged': set(),
-        }
-        for v in netbox['vlans']
-    }
-
-    for port, conf in netbox['interfaces'].items():
-        for ip in conf['ips']:
-            ips[ip] = {'interface': port}
-
-        if conf['type'] == 'VIRTUAL':
-            # these are VLAN interfaces (for management IPs)
-            if conf['ips']:
-                # this makes management services available in the VLAN
-                try:
-                    vlans[port]['tagged'].add('bridge')
-                except KeyError:
-                    raise ValueError(
-                        f'name of virtual interface "{port}" on {node.name} '
-                        f'matches none of the known VLANs: {list(vlans.keys())} '
-                        '(you probably need to rename the interface in Netbox '
-                        'and/or run netbox-dump)'
-                    )
-            # We do not create the actual VLAN interface here, that
-            # happens automatically in items.py.
-            continue
-        elif not conf['enabled'] or not conf['mode']:
-            # disable unconfigured ports
-            ports[port] = {
-                'disabled': True,
-                'description': conf.get('description', ''),
-            }
-            # dont add vlans for this port
-            continue
-        else:
-            ports[port] = {
-                'disabled': False,
-                'description': conf.get('description', ''),
-            }
-            if conf.get('ips', []):
-                ports[port]['ips'] = set(conf['ips'])
-            if conf['type'] in (
-                'A_1000BASE_T',
-                'A_10GBASE_X_SFPP',
-            ):
-                ports[port]['hw'] = True
-
-        if conf['untagged_vlan']:
-            vlans[conf['untagged_vlan']]['untagged'].add(port)
-            if conf['ips']:
-                # this makes management services available in the VLAN
-                vlans[conf['untagged_vlan']]['tagged'].add('bridge')
-
-        # tagged
-
-        if conf['mode'] == 'TAGGED_ALL':
-            tagged = set(vlans.keys()) - {conf['untagged_vlan']}
-        else:
-            tagged = conf['tagged_vlans']
-
-        for vlan in tagged:
-            vlans[vlan]['tagged'].add(port)
-
-            # this makes management services available in the VLAN
-            if conf['ips']:
-                vlans[vlan]['tagged'].add('bridge')
-
-    return {
-        'routeros': {
-            'ips': ips,
-            'ports': ports,
-            'vlans': vlans,
-        }
-    }
-
-
 @metadata_reactor.provides('routeros/gateway')
 def gateway(metadata):
     ip_pattern = re.compile(r'(\d{1,3}\.\d{1,3}\.\d{1,3}\.)\d{1,3}')

bundles/rspamd/files/local.d/dmarc.conf

@@ -1,7 +1,7 @@
 reporting {
     enabled = true;
-    email = 'dmarc+${node.name.replace('.', '-')}@kunbox.net';
+    email = 'devnull@${node.metadata.get('postfix/myhostname')}';
-    domain = '${node.metadata.get('hostname')}';
+    domain = '${node.metadata.get('postfix/myhostname')}';
     org_name = 'kunbox.net';
     smtp = '127.0.0.1';
     smtp_port = 25;

bundles/rsyslogd/metadata.py

@@ -6,6 +6,11 @@ defaults = {
             'rsyslog': {},
         },
     },
+    'backups': {
+        'paths': {
+            '/var/log/rsyslog',
+        },
+    },
     'icinga2_api': {
         'rsyslog': {
             'services': {

bundles/samba/files/override.conf

@@ -0,0 +1,3 @@
+[Service]
+RestartSec=10
+Restart=on-failure

bundles/samba/files/smb.conf

@@ -0,0 +1,39 @@
+[global]
+workgroup = KUNBOX
+server string = ${node.name} samba
+dns proxy = no
+max log size = 1000
+syslog = 1
+syslog only = 1
+panic action = /usr/share/samba/panic-action %d
+encrypt passwords = true
+passdb backend = tdbsam
+obey pam restrictions = yes
+map to guest = bad user
+load printers = no
+usershare allow guests = yes
+allow insecure wide links = yes
+% for name, opts in sorted(node.metadata.get('samba/shares', {}).items()):
+
+[${name}]
+browseable = yes
+comment = ${opts.get('comment', f'share of {opts["path"]}')}
+fake oplocks = yes
+force group = ${opts.get('force_group', 'nogroup')}
+force user = ${opts.get('force_user', 'nobody')}
+%  if opts.get('guest_ok', True):
+guest ok = yes
+%  else:
+guest ok = no
+%  endif
+locking = no
+path = ${opts['path']}
+printable = no
+read only = no
+vfs objects = catia fruit
+writable = ${'yes' if opts.get('writable', False) else 'no'}
+%  if opts.get('follow_symlinks', True):
+follow symlinks = yes
+wide links = yes
+%  endif
+% endfor

bundles/samba/items.py

@@ -0,0 +1,59 @@
+svc_systemd = {
+    'nmbd': {
+        'needs': {
+            'pkg_apt:samba',
+        },
+    },
+    'smbd': {
+        'needs': {
+            'pkg_apt:samba',
+        },
+    },
+}
+
+files = {
+    '/etc/samba/smb.conf': {
+        'content_type': 'mako',
+        'triggers': {
+            'svc_systemd:nmbd:restart',
+            'svc_systemd:smbd:restart',
+        },
+    },
+    '/etc/systemd/system/nmbd.service.d/bundlewrap.conf': {
+        'source': 'override.conf',
+        'triggers': {
+            'action:systemd-reload',
+            'svc_systemd:nmbd:restart',
+        },
+    },
+    '/etc/systemd/system/smbd.service.d/bundlewrap.conf': {
+        'source': 'override.conf',
+        'triggers': {
+            'action:systemd-reload',
+            'svc_systemd:smbd:restart',
+        },
+    },
+}
+
+last_action = set()
+for user, uconfig in node.metadata.get('users', {}).items():
+    if (
+        'password' not in uconfig
+        or uconfig.get('delete')
+        or user in ('root',)
+    ):
+        continue
+
+    actions[f'smbpasswd_for_user_{user}'] = {
+        'command': f'smbpasswd -a -s {user}',
+        'unless': f'pdbedit -L | grep -E "^{user}:"',
+        'data_stdin': uconfig['password'] + '\n' + uconfig['password'],
+        'needs': {
+            'pkg_apt:samba',
+            f'user:{user}',
+        },
+        'after': last_action,
+    }
+    last_action = {
+        f'action:smbpasswd_for_user_{user}',
+    }

bundles/samba/metadata.py

@@ -0,0 +1,26 @@
+from bundlewrap.metadata import atomic
+
+defaults = {
+    'apt': {
+        'packages': {
+            'samba': {},
+            'samba-vfs-modules': {},
+        }
+    }
+}
+
+
+@metadata_reactor.provides(
+    'firewall/port_rules',
+)
+def firewall(metadata):
+    return {
+        'firewall': {
+            'port_rules': {
+                '137/udp': atomic(metadata.get('samba/restrict-to', set())),
+                '138/udp': atomic(metadata.get('samba/restrict-to', set())),
+                '139/tcp': atomic(metadata.get('samba/restrict-to', set())),
+                '445/tcp': atomic(metadata.get('samba/restrict-to', set())),
+            },
+        },
+    }

bundles/scansnap/files/ocr.sh

@@ -1,21 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-DATE=$(date +%F_%H-%M-%S)
-
-cd "$1"
-
-convert *.tiff no_ocr.pdf
-ocrmypdf -l deu no_ocr.pdf has_ocr.pdf
-
-rm -f *.tiff
-rm -f no_ocr.pdf
-
-chown nobody:nogroup has_ocr.pdf
-
-mv has_ocr.pdf "/srv/scansnap/${DATE}.pdf"
-
-cd /
-
-rm -r "$1"

bundles/scansnap/files/scan.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-OUTFILE=$(mktemp -d)
-
-scanimage --source 'ADF Duplex' --format tiff --mode Color --brightness 23 --resolution 300 --page-width 210 --page-height 297.3 -x 210 -y 297.3 --batch=${OUTFILE}/p%04d.tiff
-
-/etc/scanbd/scripts/ocr.sh "$OUTFILE" &

bundles/scansnap/files/scanbd.conf

@@ -1,52 +0,0 @@
-global {
-        debug   = true
-        debug-level = 2
-
-        user    = saned
-        group   = scanner
-
-        saned   = "/usr/sbin/saned"
-        saned_opt  = {}
-        saned_env  = { "SANE_CONFIG_DIR=/etc/scanbd" }
-
-        scriptdir = /etc/scanbd/scripts
-
-        timeout = 500
-
-        pidfile = "/var/run/scanbd.pid"
-
-        environment {
-                device = "SCANBD_DEVICE"
-                action = "SCANBD_ACTION"
-        }
-
-        function function_knob {
-                filter = "^message.*"
-                desc   = "The value of the function knob / wheel / selector"
-                env    = "SCANBD_FUNCTION"
-        }
-        function function_mode {
-                filter = "^mode.*"
-                desc   = "Color mode"
-                env    = "SCANBD_FUNCTION_MODE"
-        }
-
-        multiple_actions = false
-        action scan {
-                filter = "^scan.*"
-                numerical-trigger {
-                        from-value = 0
-                        to-value   = 1
-                }
-                desc   = "Scan to file"
-                script = "scan.sh"
-        }
-}
-
-include(scanner.d/avision.conf)
-include(scanner.d/fujitsu.conf)
-include(scanner.d/hp.conf)
-include(scanner.d/pixma.conf)
-include(scanner.d/snapscan.conf)
-include(scanner.d/canon.conf)
-include(scanner.d/plustek.conf)

bundles/scansnap/items.py

@@ -1,39 +0,0 @@
-directories = {
-    '/etc/scanbd/scripts': {
-        'purge': True,
-    },
-    '/srv/scansnap': {
-        'owner': 'nobody',
-        'group': 'nogroup',
-    },
-}
-
-files = {
-    '/etc/scanbd/scanbd.conf': {
-        'triggers': {
-            'svc_systemd:scanbd:restart',
-        },
-    },
-    '/etc/scanbd/scripts/ocr.sh': {
-        'mode': '0755',
-        'needs': {
-            'directory:/srv/scansnap',
-        },
-    },
-    '/etc/scanbd/scripts/scan.sh': {
-        'mode': '0755',
-        'needs': {
-            'directory:/srv/scansnap',
-            'file:/etc/scanbd/scripts/ocr.sh',
-        },
-    },
-}
-
-svc_systemd = {
-    'scanbd': {
-        'needs': {
-            'file:/etc/scanbd/scanbd.conf',
-            'pkg_apt:scanbd',
-        },
-    },
-}

bundles/scansnap/metadata.py

@@ -1,22 +0,0 @@
-defaults = {
-    'apt': {
-        'packages': {
-            'sane-utils': {},
-            'scanbd': {},
-            'imagemagick': {},
-            'ocrmypdf': {},
-            'tesseract-ocr-deu': {},
-        },
-    },
-    'backups': {
-        'paths': {
-            '/srv/scansnap',
-        },
-    },
-    'cron': {
-        'jobs': {
-            # Automatically remove files which are older than 14 days
-            'scansnap_cleanup': '00 00 * * *    root    /usr/bin/find /srv/scansnap/ -mindepth 1 -mtime +14 -delete',
-        },
-    },
-}

bundles/sdm630_mqtt/files/sdm630_printout.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=SDM630 stats printout
+Conflicts=getty@tty1.service
+After=systemd-user-sessions.service getty@tty1.service plymouth-quit.service
+
+[Service]
+User=sdm630_mqtt
+Group=sdm630_mqtt
+ExecStart=/opt/sdm630_mqtt/venv/bin/python printout.py /opt/sdm630_mqtt/config.toml
+WorkingDirectory=/opt/sdm630_mqtt/src
+Restart=always
+RestartSec=10
+StandardInput=tty
+StandardOutput=tty
+StandardError=journal
+TTYPath=/dev/tty1
+TTYReset=yes
+TTYVHangup=yes
+
+[Install]
+WantedBy=multi-user.target

bundles/sdm630_mqtt/files/sdm630_to_mqtt.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=SDM630-to-MQTT bridge
+After=network.target
+
+[Service]
+User=sdm630_mqtt
+Group=sdm630_mqtt
+ExecStart=/opt/sdm630_mqtt/venv/bin/python sdm630_mqtt.py /opt/sdm630_mqtt/config.toml
+WorkingDirectory=/opt/sdm630_mqtt/src
+Restart=always
+RestartSec=1
+
+[Install]
+WantedBy=multi-user.target

bundles/sdm630_mqtt/items.py

@@ -0,0 +1,76 @@
+directories['/opt/sdm630_mqtt/src'] = {}
+
+git_deploy['/opt/sdm630_mqtt/src'] = {
+    'repo': 'https://git.franzi.business/kunsi/sdm630_mqtt.git',
+    'rev': 'main',
+    'triggers': {
+        'action:sdm630_mqtt_install_deps',
+    },
+}
+
+actions['sdm630_mqtt_create_virtualenv'] = {
+    'command': 'python3 -m virtualenv /opt/sdm630_mqtt/venv',
+    'unless': 'test -x /opt/sdm630_mqtt/venv/bin/python3',
+    'needs': {
+        'directory:/opt/sdm630_mqtt/src',
+    },
+}
+
+actions['sdm630_mqtt_install_deps'] = {
+    'command': 'cd /opt/sdm630_mqtt/src && /opt/sdm630_mqtt/venv/bin/pip install -r requirements.txt',
+    'triggered': True,
+    'needs': {
+        'action:sdm630_mqtt_create_virtualenv',
+    },
+}
+
+users['sdm630_mqtt'] = {
+    'home': '/opt/sdm630_mqtt',
+}
+
+files['/opt/sdm630_mqtt/config.toml'] = {
+    'content': repo.libs.faults.dict_as_toml(node.metadata.get('sdm630_mqtt/config')),
+    'triggers': set(),
+}
+
+if node.has_bundle('telegraf'):
+    files['/opt/sdm630_mqtt/config.toml']['triggers'].add('svc_systemd:telegraf:restart')
+    git_deploy['/opt/sdm630_mqtt/src']['triggers'].add('svc_systemd:telegraf:restart')
+
+if node.metadata.get('sdm630_mqtt/enable_stats_collection', True):
+    files['/usr/local/lib/systemd/system/sdm630_to_mqtt.service'] = {
+        'triggers': {
+            'action:systemd-reload',
+            'svc_systemd:sdm630_to_mqtt:restart',
+        },
+    }
+
+    svc_systemd['sdm630_to_mqtt'] = {
+        'needs': {
+            'git_deploy:/opt/sdm630_mqtt/src',
+            'action:sdm630_mqtt_install_deps',
+            'file:/usr/local/lib/systemd/system/sdm630_to_mqtt.service',
+        },
+    }
+
+    files['/opt/sdm630_mqtt/config.toml']['triggers'].add('svc_systemd:sdm630_to_mqtt:restart')
+    git_deploy['/opt/sdm630_mqtt/src']['triggers'].add('svc_systemd:sdm630_to_mqtt:restart')
+
+if node.metadata.get('sdm630_mqtt/enable_local_printout', False):
+    files['/usr/local/lib/systemd/system/sdm630_printout.service'] = {
+        'triggers': {
+            'action:systemd-reload',
+            'svc_systemd:sdm630_printout:restart',
+        },
+    }
+
+    svc_systemd['sdm630_printout'] = {
+        'needs': {
+            'git_deploy:/opt/sdm630_mqtt/src',
+            'action:sdm630_mqtt_install_deps',
+            'file:/usr/local/lib/systemd/system/sdm630_printout.service',
+        },
+    }
+
+    files['/opt/sdm630_mqtt/config.toml']['triggers'].add('svc_systemd:sdm630_printout:restart')
+    git_deploy['/opt/sdm630_mqtt/src']['triggers'].add('svc_systemd:sdm630_printout:restart')

bundles/sdm630_mqtt/metadata.py

@@ -0,0 +1,38 @@
+defaults = {
+    'sdm630_mqtt': {
+        'config': {
+            'modbus': {
+                'host': '127.0.0.1',
+                'port': 501,
+                'unit_id': 1,
+            },
+            'mqtt': {
+                'prefix': 'sdm630',
+                'host': '127.0.0.1',
+                'port': 1883,
+            },
+            'printout': {
+                'title': 'SDM630',
+            },
+            'telegraf': {
+                'identifier': 'unknown',
+            },
+        },
+    },
+    'telegraf': {
+        'input_plugins': {
+            'execd': {
+                'sdm630_mqtt': {
+                    'command': [
+                        '/opt/sdm630_mqtt/venv/bin/python',
+                        '/opt/sdm630_mqtt/src/telegraf.py',
+                        '/opt/sdm630_mqtt/config.toml',
+                    ],
+                    'signal': 'none',
+                    'restart_delay': '1s',
+                    'data_format': 'influx',
+                },
+            },
+        },
+    },
+}

bundles/smartd/metadata.py

@@ -43,30 +43,6 @@ if node.has_bundle('telegraf'):
     }
 
 
-@metadata_reactor.provides(
-    'smartd/disks',
-)
-def zfs_disks_to_metadata(metadata):
-    disks = set()
-
-    for config in metadata.get('zfs/pools', {}).values():
-        for option in config['when_creating']['config']:
-            if option.get('type', '') in {'log', 'cache'}:
-                continue
-
-            for disk in option['devices']:
-                if search(r'p([0-9]+)$', disk) or disk.startswith('/dev/mapper/'):
-                    continue
-
-                disks.add(disk)
-
-    return {
-        'smartd': {
-            'disks': disks,
-        },
-    }
-
-
 @metadata_reactor.provides(
     'icinga2_api/smartd/services',
 )

bundles/sshmon/files/check_cpu_stats

@@ -4,27 +4,30 @@ from re import findall
 from subprocess import check_output
 from sys import exit
 
+ITERATIONS = 10
+
 try:
     top_output = None
 
-    for line in check_output(['top', '-b', '-n1', '-d1']).decode('UTF-8').splitlines():
+    top_output = check_output(rf"top -b -n{ITERATIONS} -d1 | grep -i '^%cpu'", shell=True).decode('UTF-8')
-        if line.lower().strip().startswith('%cpu'):
-            top_output = line.lower().split(':', 2)[1]
-            break
-
-    if not top_output:
-        print('%cpu not found in top output')
-        exit(3)
 
     cpu_usage = {}
-    for value, identifier in findall('([0-9\.\,]{3,5}) ([a-z]{2})', top_output):
+    for value, identifier in findall(r'([0-9\.\,]{3,5}) ([a-z]{2})', top_output):
-        cpu_usage[identifier] = float(value.replace(',', '.'))
+        if identifier not in cpu_usage:
+            cpu_usage[identifier] = 0.0
+        cpu_usage[identifier] += float(value.replace(',', '.'))
+
+    output = []
+    for identifier, value_added in cpu_usage.items():
+        value = value_added / ITERATIONS
+        output.append(f"{value:.2f} {identifier}")
+        cpu_usage[identifier] = value
+
+    print(f"Average over {ITERATIONS} seconds: " + ", ".join(output))
 
     warn = set()
     crit = set()
 
-    print(top_output)
-
     # steal
     if cpu_usage['st'] > 10:
         crit.add('CPU steal is {}% (>10%)'.format(cpu_usage['st']))

bundles/sshmon/files/check_https_certificate_at_url

@@ -19,7 +19,11 @@ crit_days=30
 case "$issuer_hash" in
     # 4f06f81d: issuer=C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
     # 8d33f237: issuer=C = US, O = Let's Encrypt, CN = R3
-    4f06f81d|8d33f237)
+    # 462422cf: issuer=C = US, O = Let's Encrypt, CN = E5
+    # 9aad238c: issuer=C = US, O = Let's Encrypt, CN = E6
+    # 31dfb39d: issuer=C = US, O = Let's Encrypt, CN = R11
+    # aa578057: issuer=C = US, O = Let's Encrypt, CN = R10
+    4f06f81d|8d33f237|462422cf|9aad238c|31dfb39d|aa578057)
         warn_days=10
         crit_days=3
         ;;

bundles/sshmon/metadata.py

@@ -19,6 +19,8 @@ defaults = {
             'services': {
                 'CPU': {
                     'command_on_monitored_host': '/usr/local/share/icinga/plugins/check_cpu_stats',
+                    # takes samples over 10 seconds
+                    'vars.sshmon_timeout': 20
                 },
                 'LOAD': {
                     'command_on_monitored_host': '/usr/lib/nagios/plugins/check_load -r -w 4,2,1 -c 8,4,2',

bundles/systemd-networkd/files/template-bridge.network

@@ -3,3 +3,6 @@ Name=${' '.join(sorted(match))}
 
 [Network]
 Bridge=${bridge}
+
+[Link]
+ActivationPolicy=always-up

bundles/systemd-networkd/metadata.py

@@ -4,6 +4,9 @@ defaults = {
             'isc-dhcp-client': {
                 'installed': False,
             },
+            'network-manager': {
+                'installed': False,
+            },
             'resolvconf': {
                 'installed': False,
             },

bundles/telegraf/items.py

@@ -11,7 +11,19 @@ telegraf_config = {
         'quiet': False,
         'round_interval': False,
     },
-    'inputs': {
+    'outputs': {
+        'influxdb_v2': [{
+            'urls': [node.metadata.get('telegraf/influxdb_url', repo.libs.defaults.influxdb_url)],
+            'token': node.metadata.get('telegraf/influxdb_token', repo.vault.decrypt(repo.libs.defaults.influxdb_token)),
+            'organization': node.metadata.get('telegraf/influxdb_org', repo.vault.decrypt(repo.libs.defaults.influxdb_org)),
+            'bucket': node.metadata.get('telegraf/influxdb_bucket', repo.vault.decrypt(repo.libs.defaults.influxdb_bucket)),
+        }],
+    },
+    'inputs': {},
+}
+
+if node.metadata.get('telegraf/collect_default_metrics', True):
+    telegraf_config['inputs'] = {
         'cpu': [{
             'percpu': False,
             'totalcpu': True,
@@ -43,17 +55,9 @@ telegraf_config = {
         'nstat': [{}],
         'processes': [{}],
         'system': [{}],
-        **node.metadata.get('telegraf/input_plugins/builtin', {}),
+    }
-    },
+
-    'outputs': {
+telegraf_config['inputs'].update(node.metadata.get('telegraf/input_plugins/builtin', {}))
-        'influxdb_v2': [{
-            'urls': [node.metadata.get('telegraf/influxdb_url', repo.libs.defaults.influxdb_url)],
-            'token': node.metadata.get('telegraf/influxdb_token', repo.vault.decrypt(repo.libs.defaults.influxdb_token)),
-            'organization': node.metadata.get('telegraf/influxdb_org', repo.vault.decrypt(repo.libs.defaults.influxdb_org)),
-            'bucket': node.metadata.get('telegraf/influxdb_bucket', repo.vault.decrypt(repo.libs.defaults.influxdb_bucket)),
-        }],
-    },
-}
 
 # Bundlewrap can't merge lists. To work around this, telegraf/input_plugins/exec(d)
 # is a dict, of which we only use the value of it. This also allows us

bundles/zfs/metadata.py

@@ -170,7 +170,7 @@ def scrub_timer(metadata):
         'systemd-timers': {
             'timers': {
                 'zfs-scrub': {
-                    'when': 'Sun 02:00:00 UTC',
+                    'when': metadata.get('zfs/scrub_when', 'Sun 02:00:00 UTC'),
                     'command': scrubs,
                 },
             },

configs/as3320.txt

@@ -1,5 +1,7 @@
 109.237.176.0/20
+109.72.116.0/24
 116.50.16.0/21
+128.65.164.0/22
 129.181.208.0/21
 129.181.216.0/22
 137.170.112.0/24
@@ -15,13 +17,12 @@
 139.12.4.0/24
 141.169.240.0/20
 141.77.0.0/16
-141.98.44.0/24
 143.99.213.0/24
 145.225.16.0/23
 146.247.58.0/24
-147.136.84.0/22
 147.161.22.0/24
 147.78.17.0/24
+147.79.8.0/21
 149.208.250.0/23
 149.208.252.0/24
 149.208.253.0/24
@@ -34,6 +35,7 @@
 149.249.244.0/22
 149.249.244.0/23
 149.249.246.0/23
+153.17.244.8/29
 153.17.249.0/24
 153.17.250.0/24
 153.17.251.0/24
@@ -46,7 +48,11 @@
 153.97.32.0/24
 158.116.231.0/24
 160.211.126.0/24
-163.5.168.0/24
+163.5.156.0/24
+163.5.170.0/24
+163.5.186.0/24
+163.5.220.0/24
+163.5.66.0/24
 164.133.10.0/24
 164.133.11.0/24
 164.133.150.0/24
@@ -60,11 +66,9 @@
 168.199.192.0/22
 168.199.212.0/22
 170.237.92.0/23
-171.25.178.0/24
-176.221.24.0/24
-176.221.25.0/24
 176.53.136.0/24
 176.53.137.0/24
+176.57.59.0/24
 185.100.160.0/22
 185.101.244.0/23
 185.101.246.0/23
@@ -76,45 +80,38 @@
 185.131.239.0/24
 185.133.12.0/22
 185.136.115.0/24
-185.149.25.0/24
-185.149.26.0/24
-185.149.27.0/24
 185.149.52.0/24
 185.157.101.0/24
 185.161.176.0/22
-185.162.72.0/23
 185.163.76.0/24
 185.163.77.0/24
 185.163.78.0/24
 185.163.79.0/24
-185.172.38.0/24
-185.172.39.0/24
 185.180.224.0/24
 185.183.212.0/23
 185.183.214.0/23
 185.188.64.0/24
+185.195.239.0/24
 185.198.13.0/24
 185.202.32.0/21
-185.203.148.0/22
 185.207.46.0/24
-185.235.71.0/24
+185.21.247.0/24
 185.237.0.0/24
 185.237.1.0/24
 185.237.2.0/24
-185.240.85.0/24
 185.242.224.0/24
 185.243.44.0/22
 185.243.44.0/24
 185.243.45.0/24
 185.243.46.0/24
 185.243.47.0/24
-185.250.42.0/23
 185.28.208.0/22
 185.39.12.0/22
 185.48.0.0/22
+185.57.231.0/24
 185.57.24.0/24
 185.82.160.0/23
-185.91.204.0/22
+188.214.139.0/24
 192.109.121.0/24
 192.109.122.0/24
 192.109.124.0/24
@@ -176,7 +173,6 @@
 193.110.102.0/23
 193.110.102.0/24
 193.110.103.0/24
-193.124.35.0/24
 193.138.91.0/24
 193.141.143.0/24
 193.141.180.0/23
@@ -243,7 +239,6 @@
 193.41.10.0/23
 193.47.164.0/24
 193.53.93.0/24
-193.56.21.0/24
 193.58.253.0/24
 193.84.136.0/22
 193.96.230.0/24
@@ -253,6 +248,7 @@
 193.98.224.0/24
 193.99.96.0/20
 194.0.151.0/24
+194.0.232.0/24
 194.110.133.0/24
 194.113.160.0/22
 194.113.20.0/23
@@ -295,6 +291,13 @@
 194.15.64.0/21
 194.15.72.0/22
 194.150.228.0/23
+194.152.128.0/24
+194.152.129.0/24
+194.152.132.0/24
+194.152.141.0/24
+194.152.142.0/24
+194.152.154.0/24
+194.152.155.0/24
 194.153.86.0/24
 194.156.128.0/22
 194.156.148.0/24
@@ -337,26 +340,20 @@
 194.39.63.0/24
 194.39.88.0/21
 194.39.97.0/24
-194.45.144.0/21
-194.49.110.0/24
 194.49.117.0/24
 194.49.118.0/23
 194.49.125.0/24
 194.49.48.0/24
 194.49.54.0/24
-194.49.72.0/24
 194.49.73.0/24
 194.49.74.0/23
 194.49.85.0/24
-194.55.158.0/24
 194.55.180.0/24
 194.55.183.0/24
 194.55.192.0/19
 194.55.63.0/24
 194.55.64.0/20
 194.55.87.0/24
-194.58.40.0/24
-194.58.56.0/23
 194.59.143.0/24
 194.59.150.0/24
 194.59.151.0/24
@@ -382,34 +379,22 @@
 194.76.52.0/24
 194.77.41.0/24
 194.77.42.0/24
-194.85.248.0/24
-194.85.251.0/24
-194.87.10.0/24
-194.87.17.0/24
-194.87.255.0/24
-194.87.77.0/24
-194.88.112.0/20
 194.88.16.0/21
 194.88.24.0/23
 194.88.26.0/24
 194.88.28.0/23
-194.88.96.0/21
 194.99.118.0/24
 194.99.34.0/24
 194.99.76.0/23
 194.99.83.0/24
 194.99.92.0/22
-195.133.20.0/24
-195.133.64.0/22
 195.133.7.0/24
-195.133.76.0/24
 195.137.216.0/23
 195.138.223.0/24
 195.144.15.0/24
 195.145.0.0/16
 195.149.79.0/24
 195.160.248.0/22
-195.178.132.0/22
 195.190.2.0/24
 195.192.254.0/24
 195.200.207.0/24
@@ -436,12 +421,14 @@
 198.40.90.0/24
 198.57.10.0/24
 2.160.0.0/12
+2.58.100.0/24
 2.58.102.0/24
+204.52.120.0/24
+204.52.121.0/24
 204.69.32.0/24
 205.142.63.0/24
 212.184.0.0/15
 212.185.0.0/16
-212.87.217.0/24
 213.145.90.0/23
 213.145.92.0/23
 213.173.0.0/19
@@ -450,6 +437,7 @@
 213.209.156.0/24
 217.0.0.0/13
 217.117.96.0/24
+217.198.189.0/24
 217.224.0.0/11
 217.24.32.0/20
 217.24.33.0/24
@@ -459,35 +447,21 @@
 31.224.0.0/11
 31.6.56.0/23
 37.143.0.0/22
-37.230.56.0/24
-37.230.57.0/24
-37.230.58.0/23
-37.230.60.0/24
-37.230.63.0/24
 37.46.11.0/24
 37.50.0.0/15
 37.80.0.0/12
-45.128.14.0/23
-45.132.217.0/24
 45.132.80.0/22
-45.140.208.0/24
+45.141.54.0/24
-45.141.130.0/24
+45.145.16.0/24
-45.142.236.0/24
-45.145.241.0/24
-45.145.243.0/24
 45.147.227.0/24
+45.155.77.0/24
 45.81.255.0/24
 45.83.136.0/22
-45.84.214.0/24
 45.93.186.0/23
-46.20.216.0/21
 46.250.224.0/21
 46.250.232.0/21
 46.78.0.0/15
 46.80.0.0/12
-5.10.208.0/24
-5.10.209.0/24
-5.10.220.0/24
 5.133.112.0/24
 5.249.188.0/22
 5.35.192.0/21
@@ -503,14 +477,11 @@
 64.137.119.0/24
 64.137.125.0/24
 64.137.127.0/24
-77.242.149.0/24
 77.47.152.0/22
 77.83.136.0/23
 77.83.138.0/23
-77.83.32.0/22
 77.90.156.0/24
 77.90.184.0/24
-79.139.52.0/22
 79.192.0.0/10
 80.128.0.0/11
 80.128.0.0/12
@@ -522,38 +493,47 @@
 80.157.8.0/21
 80.187.0.0/16
 80.187.160.0/20
+80.244.13.0/24
 80.64.240.0/22
 80.71.231.0/24
 80.71.233.0/24
 80.71.235.0/24
 80.71.236.0/24
 80.71.238.0/24
+80.83.80.0/21
 81.201.32.0/20
-81.30.96.0/20
+81.31.210.0/23
-82.152.178.0/24
+82.163.104.0/21
 82.163.60.0/22
 82.206.32.0/21
 82.206.40.0/21
+82.206.48.0/21
 82.215.70.0/24
-83.136.208.0/22
-83.147.36.0/22
 83.243.48.0/21
 84.128.0.0/10
-84.234.16.0/20
 84.246.108.0/24
 84.32.108.0/22
 84.32.48.0/22
+84.55.0.0/24
+84.55.1.0/24
+84.55.2.0/24
+84.55.3.0/24
+84.55.4.0/24
+84.55.5.0/24
+84.55.6.0/24
+84.55.7.0/24
 85.116.28.0/24
 85.116.29.0/24
 85.116.30.0/24
 85.116.31.0/24
 85.119.160.0/23
-85.204.160.0/22
+85.204.181.0/24
 85.208.248.0/24
 85.208.249.0/24
 85.208.250.0/24
 85.208.251.0/24
-85.237.76.0/22
+86.105.211.0/24
+86.107.164.0/24
 86.38.248.0/21
 86.38.37.0/24
 87.128.0.0/10
@@ -564,10 +544,40 @@
 88.216.60.0/22
 89.116.64.0/22
 89.213.186.0/23
-89.35.127.0/24
+89.39.97.0/24
 89.43.34.0/24
 91.0.0.0/10
 91.103.240.0/21
+91.124.135.0/24
+91.124.19.0/24
+91.124.20.0/24
+91.124.21.0/24
+91.124.22.0/24
+91.124.23.0/24
+91.124.24.0/24
+91.124.26.0/24
+91.124.27.0/24
+91.124.28.0/24
+91.124.31.0/24
+91.124.32.0/24
+91.124.33.0/24
+91.124.34.0/24
+91.124.36.0/24
+91.124.37.0/24
+91.124.38.0/24
+91.124.39.0/24
+91.124.40.0/24
+91.124.41.0/24
+91.124.42.0/24
+91.124.43.0/24
+91.124.44.0/24
+91.124.45.0/24
+91.124.46.0/24
+91.124.47.0/24
+91.124.50.0/24
+91.124.51.0/24
+91.124.6.0/24
+91.124.7.0/24
 91.189.192.0/21
 91.194.232.0/23
 91.198.113.0/24
@@ -592,19 +602,40 @@
 91.216.242.0/24
 91.216.45.0/24
 91.217.214.0/24
+91.221.12.0/23
 91.222.232.0/22
 91.227.98.0/23
-91.232.136.0/22
 91.232.54.0/24
+92.112.128.0/24
+92.112.155.0/24
+92.112.157.0/24
+92.112.16.0/22
+92.112.160.0/24
+92.112.162.0/24
+92.112.165.0/24
+92.112.167.0/24
+92.112.20.0/22
+92.112.48.0/24
+92.112.49.0/24
+92.112.52.0/24
+92.112.54.0/24
+92.112.59.0/24
+92.112.63.0/24
+92.112.64.0/24
+92.112.67.0/24
+92.112.79.0/24
+92.112.81.0/24
+92.112.83.0/24
+92.112.94.0/24
 92.114.44.0/22
 92.119.164.0/22
 92.119.208.0/24
 92.119.209.0/24
 92.119.210.0/24
 92.119.211.0/24
-93.119.184.0/21
+93.113.70.0/24
+93.119.201.0/24
 93.192.0.0/10
-93.95.119.0/24
 94.126.98.0/24
 94.26.110.0/23
 94.26.64.0/23
@@ -620,7 +651,6 @@
 2001:678:b38::/48
 2001:678:bdc::/48
 2001:678:d4c::/48
-2001:678:e9c::/48
 2001:678:ff0::/48
 2001:67c:11a4::/48
 2001:67c:14c4::/48
@@ -641,6 +671,7 @@
 2001:67c:b80::/48
 2001:67c:c84::/48
 2001:67c:c9c::/48
+2001:67c:ec0::/48
 2003:3c0::/28
 2003:3e0::/28
 2003:8:1800::/48
@@ -663,6 +694,8 @@
 2003::/19
 2003::/20
 2003::/23
+2a00:5c60:3::/48
+2a00:5c60:a::/48
 2a00:6680::/46
 2a01:598::/29
 2a01:8fa0::/32
@@ -694,8 +727,11 @@
 2a0d:480::/29
 2a0d:480::/30
 2a0d:484::/30
+2a0e:cbc4::/32
+2a0e:cbc5::/32
+2a0e:cbc6::/32
+2a0e:cbc7::/32
 2a0e:eb40::/32
-2a0f:15c0::/32
 2a10:cd80::/29
 2a11:7400:d1::/48
 2a12:6900:1000::/40

configs/as8881.txt

@@ -1,19 +1,13 @@
 104.151.0.0/17
 109.250.0.0/16
-109.250.0.0/20
+109.250.0.0/18
 109.250.128.0/19
-109.250.16.0/20
 109.250.160.0/19
 109.250.192.0/19
 109.250.224.0/19
-109.250.32.0/19
+109.250.64.0/18
-109.250.64.0/19
-109.250.80.0/22
-109.250.84.0/22
-109.250.88.0/22
-109.250.92.0/22
-109.250.96.0/19
 134.101.0.0/21
+14.102.90.0/24
 143.58.64.0/18
 149.233.32.0/19
 153.94.0.0/20
@@ -35,6 +29,7 @@
 185.151.201.0/24
 185.151.203.0/24
 185.158.48.0/22
+185.187.122.0/24
 185.199.205.0/24
 185.235.232.0/22
 185.8.230.0/23
@@ -45,13 +40,13 @@
 192.166.84.0/22
 192.166.87.0/24
 192.166.88.0/21
+192.189.14.0/24
 193.101.4.0/23
-193.101.5.0/24
+193.102.10.0/24
 193.111.212.0/22
 193.111.212.0/24
 193.163.13.0/24
-193.163.13.0/25
+193.17.225.0/24
-193.163.13.128/25
 193.219.15.0/24
 193.22.120.0/21
 193.22.120.0/24
@@ -92,7 +87,7 @@
 194.127.144.0/21
 194.127.203.0/24
 194.139.55.0/24
-194.145.230.0/24
+194.145.218.0/23
 194.156.216.0/21
 194.156.232.0/23
 194.156.233.0/24
@@ -115,24 +110,23 @@
 194.99.0.0/21
 195.149.80.0/23
 195.167.208.0/20
-195.191.20.0/23
 195.202.32.0/19
 195.226.160.0/19
 195.226.96.0/19
 195.234.139.0/24
 195.238.233.0/24
-195.244.10.0/23
+195.238.238.0/24
 195.64.176.0/23
 195.93.158.0/23
 202.71.128.0/20
+202.71.141.0/24
 212.204.0.0/19
 212.7.128.0/19
 212.8.0.0/19
 212.80.224.0/19
-212.80.224.0/20
-212.80.240.0/20
 212.93.0.0/19
 213.138.32.0/19
+213.138.35.0/24
 213.139.128.0/19
 213.182.128.0/19
 213.30.192.0/18
@@ -149,307 +143,155 @@
 45.13.15.0/24
 46.142.0.0/16
 46.142.0.0/19
-46.142.112.0/20
 46.142.128.0/19
 46.142.160.0/19
-46.142.194.0/24
 46.142.214.0/24
 46.142.224.0/19
-46.142.32.0/20
+46.142.32.0/19
-46.142.48.0/20
 46.142.64.0/19
+46.142.96.0/19
 46.142.96.0/20
 46.189.0.0/17
-46.189.116.0/24
 61.8.128.0/19
+61.8.128.0/22
+61.8.132.0/22
+61.8.136.0/22
+61.8.144.0/22
+61.8.152.0/22
+61.8.156.0/24
+61.8.157.0/24
 62.214.0.0/16
-62.214.213.0/24
 62.214.224.0/19
 62.217.32.0/19
 62.220.0.0/19
 62.68.82.0/24
 62.72.64.0/19
-62.72.88.0/22
+62.72.70.0/24
-62.72.92.0/23
-62.72.94.0/24
 77.74.136.0/21
 77.87.190.0/24
+80.241.192.0/20
 80.242.160.0/19
 82.119.160.0/19
 82.140.0.0/18
-82.140.2.0/23
+82.140.48.0/20
-82.140.2.0/24
-82.140.3.0/24
-82.140.48.0/21
 82.144.32.0/19
-82.144.34.0/24
-82.144.35.0/24
-82.144.36.0/24
-82.144.37.0/24
 82.145.0.0/19
 82.194.96.0/19
 82.207.128.0/17
 82.207.192.0/19
-82.207.224.0/21
-82.207.232.0/22
-82.207.236.0/24
-82.207.240.0/20
-82.207.244.0/24
-82.207.245.0/24
-82.207.246.0/24
-82.207.247.0/24
-82.207.248.0/24
-82.207.249.0/24
-82.207.250.0/24
-82.207.251.0/24
-82.207.252.0/24
-82.207.253.0/24
-82.207.254.0/24
-82.207.255.0/24
 83.135.0.0/16
-83.135.0.0/22
+83.135.0.0/20
 83.135.112.0/20
 83.135.128.0/19
-83.135.16.0/22
 83.135.160.0/21
-83.135.164.0/22
 83.135.168.0/21
 83.135.176.0/22
-83.135.180.0/22
 83.135.184.0/21
 83.135.192.0/20
-83.135.20.0/24
 83.135.208.0/20
-83.135.21.0/24
-83.135.22.0/24
 83.135.224.0/22
-83.135.23.0/24
-83.135.230.0/23
 83.135.232.0/21
-83.135.24.0/24
 83.135.240.0/22
-83.135.244.0/24
-83.135.245.0/24
-83.135.248.0/24
-83.135.249.0/24
-83.135.25.0/24
-83.135.250.0/24
-83.135.251.0/24
-83.135.252.0/24
-83.135.253.0/24
-83.135.254.0/24
-83.135.255.0/24
-83.135.26.0/24
-83.135.27.0/24
-83.135.28.0/24
-83.135.29.0/24
-83.135.30.0/24
-83.135.31.0/24
-83.135.32.0/19
-83.135.4.0/22
 83.135.64.0/19
-83.135.8.0/21
 83.135.96.0/20
 84.19.192.0/19
-84.19.192.0/20
-84.19.208.0/20
 87.122.0.0/15
-87.122.0.0/16
 87.122.0.0/20
 87.122.128.0/21
-87.122.136.0/22
 87.122.144.0/20
 87.122.16.0/20
 87.122.160.0/20
 87.122.176.0/21
-87.122.184.0/24
-87.122.185.0/24
-87.122.186.0/24
-87.122.187.0/24
-87.122.188.0/24
-87.122.189.0/24
-87.122.190.0/24
-87.122.191.0/24
 87.122.192.0/19
 87.122.224.0/19
 87.122.32.0/19
 87.122.64.0/19
 87.122.96.0/19
-87.123.0.0/16
 87.123.0.0/19
-87.123.112.0/20
 87.123.128.0/19
 87.123.160.0/20
 87.123.176.0/20
-87.123.192.0/20
+87.123.194.0/24
-87.123.208.0/22
+87.123.196.0/24
+87.123.203.0/24
 87.123.216.0/21
 87.123.224.0/20
-87.123.240.0/22
+87.123.240.0/21
-87.123.244.0/22
-87.123.248.0/22
-87.123.252.0/24
-87.123.253.0/24
-87.123.254.0/24
-87.123.255.0/24
 87.123.32.0/19
 87.123.64.0/20
 87.123.80.0/20
 87.123.96.0/19
-87.123.96.0/20
 88.130.0.0/16
-88.130.0.0/19
-88.130.130.0/23
-88.130.132.0/22
 88.130.136.0/21
-88.130.144.0/21
+88.130.144.0/20
-88.130.152.0/24
-88.130.153.0/24
-88.130.154.0/24
-88.130.155.0/24
-88.130.156.0/22
-88.130.156.0/24
-88.130.157.0/24
-88.130.158.0/24
-88.130.159.0/24
-88.130.160.0/21
-88.130.172.0/22
 88.130.176.0/21
-88.130.180.0/24
+88.130.192.0/23
-88.130.181.0/24
+88.130.194.0/23
-88.130.182.0/24
-88.130.183.0/24
-88.130.184.0/24
-88.130.185.0/24
-88.130.186.0/24
-88.130.187.0/24
-88.130.188.0/24
-88.130.189.0/24
-88.130.190.0/24
-88.130.191.0/24
-88.130.192.0/21
-88.130.200.0/21
-88.130.208.0/21
 88.130.216.0/21
-88.130.216.0/22
-88.130.220.0/24
-88.130.221.0/24
-88.130.222.0/24
-88.130.223.0/24
-88.130.32.0/20
 88.130.48.0/24
 88.130.49.0/24
 88.130.50.0/24
-88.130.51.0/24
 88.130.52.0/24
 88.130.53.0/24
-88.130.54.0/24
+88.130.54.0/23
-88.130.55.0/24
 88.130.56.0/24
 88.130.57.0/24
 88.130.58.0/24
 88.130.59.0/24
-88.130.60.0/24
 88.130.61.0/24
-88.130.62.0/24
 88.130.63.0/24
 88.130.64.0/19
 88.130.96.0/19
+89.207.200.0/21
 89.244.0.0/14
-89.244.0.0/16
-89.244.112.0/21
 89.244.120.0/21
-89.244.120.0/22
-89.244.124.0/24
-89.244.126.0/24
-89.244.127.0/24
 89.244.160.0/21
-89.244.164.0/22
-89.244.168.0/21
 89.244.176.0/20
 89.244.192.0/19
 89.244.224.0/20
-89.244.240.0/20
+89.244.76.0/24
-89.244.64.0/21
+89.244.78.0/23
-89.244.72.0/22
 89.244.80.0/20
-89.244.96.0/20
+89.244.96.0/22
-89.245.0.0/16
 89.245.0.0/20
+89.245.112.0/20
+89.245.158.0/24
+89.245.159.0/24
 89.245.16.0/20
 89.245.160.0/20
 89.245.176.0/21
-89.245.184.0/24
-89.245.185.0/24
-89.245.186.0/24
-89.245.187.0/24
-89.245.188.0/24
-89.245.189.0/24
-89.245.190.0/24
-89.245.191.0/24
 89.245.192.0/19
 89.245.224.0/19
 89.245.32.0/19
-89.245.32.0/20
+89.245.64.0/19
-89.245.64.0/20
-89.245.80.0/20
 89.245.96.0/20
-89.246.0.0/16
 89.246.0.0/19
-89.246.104.0/23
-89.246.106.0/24
-89.246.107.0/24
-89.246.108.0/24
-89.246.109.0/24
-89.246.110.0/24
-89.246.111.0/24
 89.246.112.0/22
-89.246.116.0/22
-89.246.120.0/24
-89.246.121.0/24
 89.246.122.0/24
-89.246.123.0/24
 89.246.124.0/22
-89.246.160.0/20
 89.246.160.0/21
-89.246.176.0/22
-89.246.180.0/22
 89.246.184.0/21
 89.246.192.0/19
-89.246.32.0/20
+89.246.32.0/19
-89.246.48.0/21
-89.246.56.0/21
 89.246.96.0/21
-89.247.0.0/16
 89.247.0.0/19
 89.247.112.0/21
+89.247.112.0/22
 89.247.120.0/22
-89.247.124.0/24
-89.247.125.0/24
-89.247.126.0/24
-89.247.127.0/24
 89.247.144.0/20
 89.247.160.0/20
+89.247.179.0/24
 89.247.192.0/20
-89.247.208.0/21
 89.247.216.0/22
-89.247.224.0/21
+89.247.228.0/22
 89.247.232.0/21
-89.247.232.0/22
 89.247.236.0/22
-89.247.240.0/21
+89.247.252.0/22
-89.247.240.0/22
-89.247.252.0/24
-89.247.253.0/24
-89.247.254.0/24
-89.247.255.0/24
 89.247.32.0/19
 89.247.32.0/20
 89.247.64.0/20
 89.247.80.0/20
-89.247.96.0/20
 89.27.128.0/17
-89.27.153.0/24
 91.194.180.0/23
 91.198.67.0/24
 91.199.158.0/24
@@ -468,8 +310,7 @@
 92.116.120.0/21
 92.116.128.0/18
 92.116.16.0/20
-92.116.192.0/19
+92.116.192.0/18
-92.116.224.0/19
 92.116.32.0/19
 92.116.64.0/18
 92.116.96.0/19
@@ -483,67 +324,34 @@
 92.117.240.0/21
 92.117.248.0/21
 92.117.64.0/19
+92.117.96.0/19
 94.134.0.0/15
 94.134.0.0/18
-94.134.100.0/22
+94.134.112.0/22
-94.134.112.0/21
-94.134.120.0/24
-94.134.121.0/24
-94.134.122.0/24
-94.134.123.0/24
-94.134.124.0/24
-94.134.125.0/24
-94.134.126.0/24
-94.134.127.0/24
-94.134.128.0/20
 94.134.144.0/20
 94.134.160.0/21
 94.134.168.0/22
 94.134.172.0/22
-94.134.176.0/20
 94.134.176.0/21
-94.134.192.0/20
+94.134.192.0/22
-94.134.208.0/21
 94.134.216.0/21
-94.134.224.0/19
+94.134.64.0/22
-94.134.64.0/20
+94.134.68.0/22
 94.134.80.0/22
-94.134.84.0/24
+94.134.88.0/22
-94.134.85.0/24
+94.134.94.0/23
-94.134.86.0/24
-94.134.87.0/24
-94.134.88.0/24
-94.134.89.0/24
-94.134.90.0/24
-94.134.91.0/24
-94.134.92.0/24
-94.134.93.0/24
-94.134.94.0/24
-94.134.95.0/24
 94.134.96.0/20
-94.134.96.0/22
 2001:1438:1000::/36
+2001:1438:1:100::/56
+2001:1438:1:200::/56
+2001:1438:1:300::/56
+2001:1438:1:400::/56
+2001:1438:1:900::/56
+2001:1438:1:a00::/56
 2001:1438:2000::/36
 2001:1438:3000::/36
 2001:1438:4000::/36
 2001:1438::/32
-2001:1438:f000::/36
-2001:1438:fff:10::/64
-2001:1438:fff:11::/64
-2001:1438:fff:12::/64
-2001:1438:fff:3::/64
-2001:1438:fff:4::/64
-2001:1438:fff:5::/64
-2001:1438:fff:6::/64
-2001:1438:fff:7::/64
-2001:1438:fff:8::/64
-2001:1438:fff:9::/64
-2001:1438:fff:a::/64
-2001:1438:fff:b::/64
-2001:1438:fff:c::/64
-2001:1438:fff:d::/64
-2001:1438:fff:e::/64
-2001:1438:fff:f::/64
 2001:16b8:1000::/40
 2001:16b8:100::/40
 2001:16b8:1100::/40
@@ -593,12 +401,14 @@
 2001:16b8:a000::/35
 2001:16b8:a00::/40
 2001:16b8:b00::/40
+2001:16b8:c000::/35
 2001:678:c74::/48
 2001:67c:27ac::/48
 2001:67c:2878::/48
 2001:67c:2e8c::/48
 2001:67c:660::/48
 2001:67c:888::/48
+2001:67c:ed8::/48
 2001:7b0::/32
 2001:9e8:2000::/35
 2001:9e8:4000::/35
@@ -615,10 +425,11 @@
 2a00:fb8:4000::/35
 2a00:fb8:6000::/35
 2a00:fb8::/29
-2a00:fb8::/32
 2a00:fb8::/35
 2a03:3fc0:2000::/48
 2a07:9400::/29
 2a0a:ed40::/29
+2a0b:9e80:1000::/36
 2a0d:240::/29
 2a0d:ad00::/29
+2a11:d00::/32

configs/netbox/home.switch-rack.json

@@ -4,225 +4,225 @@
             "description": "home.router (enp1s0)",
             "enabled": true,
             "ips": [],
-            "mode": "TAGGED_ALL",
+            "mode": "tagged-all",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": null
         },
         "ether10": {
             "description": "home.mitel-rfp35 (LAN)",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether11": {
             "description": "home.usv01 (LAN)",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether12": {
-            "description": "home.rechenmonster (IPMI)",
+            "description": "",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether13": {
             "description": "",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether14": {
-            "description": "home.rechenmonster (LAN)",
+            "description": "",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether15": {
             "description": "",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether16": {
             "description": "",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether17": {
             "description": "",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether18": {
             "description": "",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether19": {
             "description": "home.lgtv-wohnzimmer",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether2": {
             "description": "Fritz!Box (LAN1)",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.wan"
         },
         "ether20": {
             "description": "Franzi Laptop",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether21": {
-            "description": "Sophie Laptop",
+            "description": "",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether22": {
-            "description": "Sophie Desktop",
+            "description": "Arbeitsplatz Regal",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether23": {
             "description": "Wohnzimmer Kabel",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether24": {
             "description": "home.snom-wohnzimmer",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether3": {
             "description": "home.aruba325-schlafzimmer",
             "enabled": true,
             "ips": [],
-            "mode": "TAGGED",
+            "mode": "tagged",
             "tagged_vlans": [
                 "ffwi.client",
                 "home.v6only"
             ],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether4": {
             "description": "home.aruba325-wohnzimmer",
             "enabled": true,
             "ips": [],
-            "mode": "TAGGED",
+            "mode": "tagged",
             "tagged_vlans": [
                 "ffwi.client",
                 "home.v6only"
             ],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether5": {
             "description": "home.nas (eno1)",
             "enabled": true,
             "ips": [],
-            "mode": "TAGGED_ALL",
+            "mode": "tagged-all",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": null
         },
         "ether6": {
             "description": "home.aruba325-office",
             "enabled": true,
             "ips": [],
-            "mode": "TAGGED",
+            "mode": "tagged",
             "tagged_vlans": [
                 "ffwi.client",
                 "home.v6only"
             ],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether7": {
             "description": "RIPE-Probe #28280 (LAN)",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.dmz"
         },
         "ether8": {
-            "description": "home.drucker-sophie",
+            "description": "home.drucker-franzi",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "ether9": {
             "description": "info-beamer 12199 (LAN)",
             "enabled": true,
             "ips": [],
-            "mode": "ACCESS",
+            "mode": "access",
             "tagged_vlans": [],
-            "type": "A_1000BASE_T",
+            "type": "1000base-t",
             "untagged_vlan": "home.clients"
         },
         "home.clients": {
@@ -231,27 +231,27 @@
             "ips": [
                 "172.19.138.4/24"
             ],
-            "mode": null,
+            "mode": "",
             "tagged_vlans": [],
-            "type": "VIRTUAL",
+            "type": "virtual",
             "untagged_vlan": null
         },
         "sfp-sfpplus1": {
             "description": "",
             "enabled": true,
             "ips": [],
-            "mode": null,
+            "mode": "",
             "tagged_vlans": [],
-            "type": "A_10GBASE_X_SFPP",
+            "type": "10gbase-x-sfpp",
             "untagged_vlan": null
         },
         "sfp-sfpplus2": {
             "description": "",
             "enabled": true,
             "ips": [],
-            "mode": null,
+            "mode": "",
             "tagged_vlans": [],
-            "type": "A_10GBASE_X_SFPP",
+            "type": "10gbase-x-sfpp",
             "untagged_vlan": null
         }
     },

data/apt/files/gpg-keys/docker.asc

@@ -0,0 +1,62 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFit2ioBEADhWpZ8/wvZ6hUTiXOwQHXMAlaFHcPH9hAtr4F1y2+OYdbtMuth
+lqqwp028AqyY+PRfVMtSYMbjuQuu5byyKR01BbqYhuS3jtqQmljZ/bJvXqnmiVXh
+38UuLa+z077PxyxQhu5BbqntTPQMfiyqEiU+BKbq2WmANUKQf+1AmZY/IruOXbnq
+L4C1+gJ8vfmXQt99npCaxEjaNRVYfOS8QcixNzHUYnb6emjlANyEVlZzeqo7XKl7
+UrwV5inawTSzWNvtjEjj4nJL8NsLwscpLPQUhTQ+7BbQXAwAmeHCUTQIvvWXqw0N
+cmhh4HgeQscQHYgOJjjDVfoY5MucvglbIgCqfzAHW9jxmRL4qbMZj+b1XoePEtht
+ku4bIQN1X5P07fNWzlgaRL5Z4POXDDZTlIQ/El58j9kp4bnWRCJW0lya+f8ocodo
+vZZ+Doi+fy4D5ZGrL4XEcIQP/Lv5uFyf+kQtl/94VFYVJOleAv8W92KdgDkhTcTD
+G7c0tIkVEKNUq48b3aQ64NOZQW7fVjfoKwEZdOqPE72Pa45jrZzvUFxSpdiNk2tZ
+XYukHjlxxEgBdC/J3cMMNRE1F4NCA3ApfV1Y7/hTeOnmDuDYwr9/obA8t016Yljj
+q5rdkywPf4JF8mXUW5eCN1vAFHxeg9ZWemhBtQmGxXnw9M+z6hWwc6ahmwARAQAB
+tCtEb2NrZXIgUmVsZWFzZSAoQ0UgZGViKSA8ZG9ja2VyQGRvY2tlci5jb20+iQI3
+BBMBCgAhBQJYrefAAhsvBQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEI2BgDwO
+v82IsskP/iQZo68flDQmNvn8X5XTd6RRaUH33kXYXquT6NkHJciS7E2gTJmqvMqd
+tI4mNYHCSEYxI5qrcYV5YqX9P6+Ko+vozo4nseUQLPH/ATQ4qL0Zok+1jkag3Lgk
+jonyUf9bwtWxFp05HC3GMHPhhcUSexCxQLQvnFWXD2sWLKivHp2fT8QbRGeZ+d3m
+6fqcd5Fu7pxsqm0EUDK5NL+nPIgYhN+auTrhgzhK1CShfGccM/wfRlei9Utz6p9P
+XRKIlWnXtT4qNGZNTN0tR+NLG/6Bqd8OYBaFAUcue/w1VW6JQ2VGYZHnZu9S8LMc
+FYBa5Ig9PxwGQOgq6RDKDbV+PqTQT5EFMeR1mrjckk4DQJjbxeMZbiNMG5kGECA8
+g383P3elhn03WGbEEa4MNc3Z4+7c236QI3xWJfNPdUbXRaAwhy/6rTSFbzwKB0Jm
+ebwzQfwjQY6f55MiI/RqDCyuPj3r3jyVRkK86pQKBAJwFHyqj9KaKXMZjfVnowLh
+9svIGfNbGHpucATqREvUHuQbNnqkCx8VVhtYkhDb9fEP2xBu5VvHbR+3nfVhMut5
+G34Ct5RS7Jt6LIfFdtcn8CaSas/l1HbiGeRgc70X/9aYx/V/CEJv0lIe8gP6uDoW
+FPIZ7d6vH+Vro6xuWEGiuMaiznap2KhZmpkgfupyFmplh0s6knymuQINBFit2ioB
+EADneL9S9m4vhU3blaRjVUUyJ7b/qTjcSylvCH5XUE6R2k+ckEZjfAMZPLpO+/tF
+M2JIJMD4SifKuS3xck9KtZGCufGmcwiLQRzeHF7vJUKrLD5RTkNi23ydvWZgPjtx
+Q+DTT1Zcn7BrQFY6FgnRoUVIxwtdw1bMY/89rsFgS5wwuMESd3Q2RYgb7EOFOpnu
+w6da7WakWf4IhnF5nsNYGDVaIHzpiqCl+uTbf1epCjrOlIzkZ3Z3Yk5CM/TiFzPk
+z2lLz89cpD8U+NtCsfagWWfjd2U3jDapgH+7nQnCEWpROtzaKHG6lA3pXdix5zG8
+eRc6/0IbUSWvfjKxLLPfNeCS2pCL3IeEI5nothEEYdQH6szpLog79xB9dVnJyKJb
+VfxXnseoYqVrRz2VVbUI5Blwm6B40E3eGVfUQWiux54DspyVMMk41Mx7QJ3iynIa
+1N4ZAqVMAEruyXTRTxc9XW0tYhDMA/1GYvz0EmFpm8LzTHA6sFVtPm/ZlNCX6P1X
+zJwrv7DSQKD6GGlBQUX+OeEJ8tTkkf8QTJSPUdh8P8YxDFS5EOGAvhhpMBYD42kQ
+pqXjEC+XcycTvGI7impgv9PDY1RCC1zkBjKPa120rNhv/hkVk/YhuGoajoHyy4h7
+ZQopdcMtpN2dgmhEegny9JCSwxfQmQ0zK0g7m6SHiKMwjwARAQABiQQ+BBgBCAAJ
+BQJYrdoqAhsCAikJEI2BgDwOv82IwV0gBBkBCAAGBQJYrdoqAAoJEH6gqcPyc/zY
+1WAP/2wJ+R0gE6qsce3rjaIz58PJmc8goKrir5hnElWhPgbq7cYIsW5qiFyLhkdp
+YcMmhD9mRiPpQn6Ya2w3e3B8zfIVKipbMBnke/ytZ9M7qHmDCcjoiSmwEXN3wKYI
+mD9VHONsl/CG1rU9Isw1jtB5g1YxuBA7M/m36XN6x2u+NtNMDB9P56yc4gfsZVES
+KA9v+yY2/l45L8d/WUkUi0YXomn6hyBGI7JrBLq0CX37GEYP6O9rrKipfz73XfO7
+JIGzOKZlljb/D9RX/g7nRbCn+3EtH7xnk+TK/50euEKw8SMUg147sJTcpQmv6UzZ
+cM4JgL0HbHVCojV4C/plELwMddALOFeYQzTif6sMRPf+3DSj8frbInjChC3yOLy0
+6br92KFom17EIj2CAcoeq7UPhi2oouYBwPxh5ytdehJkoo+sN7RIWua6P2WSmon5
+U888cSylXC0+ADFdgLX9K2zrDVYUG1vo8CX0vzxFBaHwN6Px26fhIT1/hYUHQR1z
+VfNDcyQmXqkOnZvvoMfz/Q0s9BhFJ/zU6AgQbIZE/hm1spsfgvtsD1frZfygXJ9f
+irP+MSAI80xHSf91qSRZOj4Pl3ZJNbq4yYxv0b1pkMqeGdjdCYhLU+LZ4wbQmpCk
+SVe2prlLureigXtmZfkqevRz7FrIZiu9ky8wnCAPwC7/zmS18rgP/17bOtL4/iIz
+QhxAAoAMWVrGyJivSkjhSGx1uCojsWfsTAm11P7jsruIL61ZzMUVE2aM3Pmj5G+W
+9AcZ58Em+1WsVnAXdUR//bMmhyr8wL/G1YO1V3JEJTRdxsSxdYa4deGBBY/Adpsw
+24jxhOJR+lsJpqIUeb999+R8euDhRHG9eFO7DRu6weatUJ6suupoDTRWtr/4yGqe
+dKxV3qQhNLSnaAzqW/1nA3iUB4k7kCaKZxhdhDbClf9P37qaRW467BLCVO/coL3y
+Vm50dwdrNtKpMBh3ZpbB1uJvgi9mXtyBOMJ3v8RZeDzFiG8HdCtg9RvIt/AIFoHR
+H3S+U79NT6i0KPzLImDfs8T7RlpyuMc4Ufs8ggyg9v3Ae6cN3eQyxcK3w0cbBwsh
+/nQNfsA6uu+9H7NhbehBMhYnpNZyrHzCmzyXkauwRAqoCbGCNykTRwsur9gS41TQ
+M8ssD1jFheOJf3hODnkKU+HKjvMROl1DK7zdmLdNzA1cvtZH/nCC9KPj1z8QC47S
+xx+dTZSx4ONAhwbS/LN3PoKtn8LPjY9NP9uDWI+TWYquS2U+KHDrBDlsgozDbs/O
+jCxcpDzNmXpWQHEtHU7649OXHP7UeNST1mCUCH5qdank0V1iejF6/CfTFU4MfcrG
+YT90qFF93M3v01BbxP+EIY2/9tiIPbrd
+=0YYh
+-----END PGP PUBLIC KEY BLOCK-----

data/apt/files/gpg-keys/grafana.asc

@@ -1,4 +1,46 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: GnuPG v1
+
+mQENBFiHXVIBCADr3VDEAGpq9Sg/xrPVu1GGqWGXdbnTbbNKeveCtFHZz7/GSATW
+iwiY1skvlAOBiIKCqJEji0rZZgd8WxuhdfugiCBk1hDTMWCpjI0P+YymV77jHjYB
+jHrKNlhb+aLjEd9Gf2EtbKUT1fvGUkzlVrcRGSX/XR9MBZlgja7NIyuVbn3uwZQ4
+jflWSNSlvMpohNxTFkrBFTRrCJXhbDLfCS46+so22CP3+1VQyqJ7/6RWK9v9KYdS
+AVNgILXMggSrMqha4WA1a/ktczVQXNtP8IuPxTdp9pNYsklOTmrFVeq3mXsvWh9Q
+lIhpYHIZlTZ5wVBq4wTRchsXC5MubIhz+ASDABEBAAG0GkdyYWZhbmEgPGluZm9A
+Z3JhZmFuYS5jb20+iQE4BBMBAgAiBQJYh11SAhsDBgsJCAcDAgYVCAIJCgsEFgID
+AQIeAQIXgAAKCRCMjDTFJAmMthxJB/9Id6JrwqRkJW+eSBb71FGQmRsJvNFR8J+3
+NPVhJNkTFFOM7TnjAMUIv+LYEURqGcceTNAN1aHq/7n/8ybXucCS0CnDYyNYpyVs
+tWJ3FOQK3jPrmziDCWPQATqMM/Z2auXVFWrDFqfh2xKZNjuix0w2nyuWB8U0CG2U
+89w+ksPJblGGU5xLPPzDQoAqyZXY3gpGGTkCuohMq2RWYbp/QJSQagYhQkKZoJhr
+XJlnw4At6R1A5UUPzDw6WJqMRkGrkieE6ApIgf1vZSmnLRpXkqquRTAEyGT8Pugg
+ee6YkD19/LK6ED6gn32StY770U9ti560U7oRjrOPK/Kjp4+qBtkQuQENBFiHXVIB
+CACz4hO1g/4fKO9QWLcbSWpB75lbNgt1kHXP0UcW8TE0DIgqrifod09lC85adIz0
+zdhs+00lLqckM5wNbp2r+pd5rRaxOsMw2V+c/y1Pt3qZxupmPc5l5lL6jzbEVR9g
+ygPaE+iabTk9Np2OZQ7Qv5gIDzivqK2mRHXaHTzoQn2dA/3xpFcxnen9dvu7LCpA
+CdScSj9/UIRKk9PHIgr2RJhcjzLx0u1PxN9MEqfIsIJUUgZOoDsr8oCs44PGGIMm
+cK1CKALLLiC4ZM58B56jRyXo18MqB6VYsC1X9wkcIs72thL3tThXO70oDGcoXzoo
+ywAHBH63EzEyduInOhecDIKlABEBAAGJAR8EGAECAAkFAliHXVICGwwACgkQjIw0
+xSQJjLbWSwf/VIM5wEFBY4QLGUAfqfjDyfGXpcha58Y24Vv3n6MwJqnCIbTAaeWf
+30CZ/wHg3NNIMB7I31vgmMOEbHQdv0LPTi9TG205VQeehcpNtZRZQ0D8TIetbxyi
+Emmn9osig9U3/7jaAWBabE/9bGx4TF3eLlEH9wmFrNYeXvgRqmyqVoqhIMCNAAOY
+REYyHyy9mzr9ywkwl0aroBqhzKIPyFlatZy9oRKllY/CCKO9RJy4DZidLphuwzqU
+ymdQ1sqe5nKvwG5GvcncPc3O7LMevDBWnpNNkgERnVxCqpm90TuE3ONbirnU4+/S
+tUsVU1DERc1fjOCnAm4pKIlNYphISIE7OQ==
+=0pMC
+-----END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: This is a revocation certificate
+
+iQE2BCABCgAgFiEETkDd9tduKEpKZ4DkjIw0xSQJjLYFAmO9q0cCHQIACgkQjIw0
+xSQJjLarJAf+JJU0CHTMSSs5WH6ohVy54HN+ev7p7vfcgvvFBAWZLTLrG5+eFUH0
+w0m9KegxAs+H/H/68ld1jY/P62fvkOR7WCWQ7HH+8ClKLwuWS4DpOHK9IOkHDK0w
+0pVJ6NBiwhv8/B7EmiBf9zndjMtYa/wf8JZYVOXb0XE0L+Ec0WZSRZH+/WGA1E1s
+MSgPwqDF7RKXDCJ65elYxi9CPZvXhj6RVldn/aRuHf5/SCDE/HmnDB9+v6ReEsWV
+r/Xis2J0pWphpF/xtYxGf+Iy5fAHwDd4z9uKs9mBHSR0aDisuAW/eHF6KvBzQ7y0
+Yf3KxEyDvLwuAA5NBi7Xsd2wSKdfBGUGcQ==
+=KTb+
+-----END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
 
 mQGNBGO4aiUBDAC82zo3vUyQH3yTCabQ7ZpospBg/xXBbJWbQNksIbEP/+I12CjB
 zac1QcMFd27MJlyXpsTqqSo1ZHOisNy0Tmyl/WlqMyoMeChg+LmIHLNbvAK0jPOX
@@ -39,3 +81,59 @@ Fj8eP2CocfRC+Lqv0azQwyEVMkYSMKoFbhXmjiBZn9JxblndKnVbByA1/nMAa0Q7
 HTJC50jDJfpM9d1xQW/W5LBSQjd3czM6zlRXsliX
 =lSMJ
 -----END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: This is a revocation certificate
+
+iQG2BCABCAAgFiEEDiLriOOeEid6d2CunkObECzzwMYFAmO4amECHQAACgkQnkOb
+ECzzwMYiDQv/bbRnEhrFhr5XyA2vnu6nTZezbMwArC/ZwtFxtnj2iAwGZYY/pbPx
+L8cHTpvK99I6J02SBHpmzthwHSindddPjuuQENdqH/TDlGvPH/mECJVTN9/kpjlg
+HtO0MVKAKyXGbij7fR8prfPMRqOFbo4Rn9nQZZ/eY9KwkKVKxKHymppNbUbvv1qQ
+NGfOi2QWkF+T8dbihbJHJgYpPb7uEmJ2EOX0KHu9nlYGX4jxtql+M3yeOi3juaXH
+hLFWqVn3FkQW7N4IV+bVTkYcxQg01rWqY/h7BvL88AiMoiUXhOvE5iAS4sJe+EVB
+bDfRaLr1Ju1CXYm5B+Q9b2pU0SWAbBNlVxYGs+NOeBh9YzwdGTFW2l/S/VLLv0bE
+hBYuLwOIs0BqrL4TWwlB1ucEikg+r3O7OZL8Dnw0mnBVBmQxKhl1p8dLcYtylG3B
+aEIbN6wHQe03xYvAmaHDdG0kjPiwhOlpZ+YU3ux8F2YnENXm9J+25GMyTXqybKQl
+ltTE4hHgRH2v
+=n71X
+-----END PGP PUBLIC KEY BLOCK-----
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBGTnhmkBDADUE+SzjRRyitIm1siGxiHlIlnn6KO4C4GfEuV+PNzqxvwYO+1r
+mcKlGDU0ugo8ohXruAOC77Kwc4keVGNU89BeHvrYbIftz/yxEneuPsCbGnbDMIyC
+k44UOetRtV9/59Gj5YjNqnsZCr+e5D/JfrHUJTTwKLv88A9eHKxskrlZr7Un7j3i
+Ef3NChlOh2Zk9Wfk8IhAqMMTferU4iTIhQk+5fanShtXIuzBaxU3lkzFSG7VuAH4
+CBLPWitKRMn5oqXUE0FZbRYL/6Qz0Gt6YCJsZbaQ3Am7FCwWCp9+ZHbR9yU+bkK0
+Dts4PNx4Wr9CktHIvbypT4Lk2oJEPWjcCJQHqpPQZXbnclXRlK5Ea0NVpaQdGK+v
+JS4HGxFFjSkvTKAZYgwOk93qlpFeDML3TuSgWxuw4NIDitvewudnaWzfl9tDIoVS
+Bb16nwJ8bMDzovC/RBE14rRKYtMLmBsRzGYHWd0NnX+FitAS9uURHuFxghv9GFPh
+eTaXvc4glM94HBUAEQEAAbQmR3JhZmFuYSBMYWJzIDxlbmdpbmVlcmluZ0BncmFm
+YW5hLmNvbT6JAdQEEwEKAD4WIQS1Oud7rbYwpoMEYAWWP6J3EEWFRQUCZOeGaQIb
+AwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCWP6J3EEWFRUiADACa
+i+xytv2keEFJWjXNnFAx6/obnHRcXOI3w6nH/zL8gNI7YN5jcdQT2NYvKVYTb3fW
+GuMsjHWgat5Gq3AtJrOKABpZ6qeYNPk0Axn/dKtOTwXjZ4pKX3bbUYvVfs0fCEZv
+B0HHIj2wI9kgMpoTrkj22LE8layZTPOoQ+3/FbLzS8hN3CYZj25mHN7bpZq8EbV3
+8FW9EU0HM0tg6CvoxkRiVqAuAC0KnVIZAdhD4dlYKuncq64nMvT1A5wxSYbnE+uf
+mnWQQhhS6BOwRqN054yw1FrWNDFsvnOSHmr8dIiriv+aZYvx5JQFJ7oZP3LwdYyg
+ocQcAJA8HFTIk3P6uJiIF/zdDzocgdKs+IYDoId0hxX7sGCvqdrsveq8n3m7uQiN
+7FvSiV0eXIdV4F7340kc8EKiYwpuYSaZX0UWKLenzlUvD+W4pZCWtoXzPsW7PKUt
+q1xdW0+NY+AGLCvSJCc5F4S5kFCObfBAYBbldjwwJFocdq/YOvvWYTPyV7kJeJS5
+AY0EZOeGaQEMALNIFUricEIwtZiX7vSDjwxobbqPKqzdek8x3ud0CyYlrbGHy0k+
+FDEXstjJQQ1s9rjJSu3sv5wyg9GDAUH3nzO976n/ZZvKPti3p2XU2UFx5gYkaaFV
+D56yYxqGY0YU5ft6BG+RUz3iEPg3UBUzt0sCIYnG9+CsDqGOnRYIIa46fu2/H9Vu
+8JvvSq9xbsK9CfoQDkIcoQOixPuI4P7eHtswCeYR/1LUTWEnYQWsBCf57cEpzR6t
+7mlQnzQo9z4i/kp4S0ybDB77wnn+isMADOS+/VpXO+M7Zj5tpfJ6PkKch3SGXdUy
+3zht8luFOYpJr2lVzp7n3NwB4zW08RptTzTgFAaW/NH2JjYI+rDvQm4jNs08Dtsp
+nm4OQvBA9Df/6qwMEOZ9i10ixqk+55UpQFJ3nf4uKlSUM7bKXXVcD/odq804Y/K4
+y3csE059YVIyaPexEvYSYlHE2odJWRg2Q1VehmrOSC8Qps3xpU7dTHXD74ZpaYbr
+haViRS5v/lCsiwARAQABiQG8BBgBCgAmFiEEtTrne622MKaDBGAFlj+idxBFhUUF
+AmTnhmkCGwwFCQPCZwAACgkQlj+idxBFhUUNbQv8DCcfi3GbWfvp9pfY0EJuoFJX
+LNgci7z7smXq7aqDp2huYQ+MulnPAydjRCVW2fkHItF2Ks6l+2/8t5Xz0eesGxST
+xTyR31ARENMXaq78Lq+itZ+usOSDNuwJcEmJM6CceNMLs4uFkX2GRYhchkry7P0C
+lkLxUTiB43ooi+CqILtlNxH7kM1O4Ncs6UGZMXf2IiG9s3JDCsYVPkC5QDMOPkTy
+2ZriF56uPerlJveF0dC61RZ6RlM3iSJ9Fwvea0Oy4rwkCcs5SHuwoDTFyxiyz0QC
+9iqi3fG3iSbLvY9UtJ6X+BtDqdXLAT9Pq527mukPP3LwpEqFVyNQKnGLdLOu2YXc
+TWWWseSQkHRzBmjD18KTD74mg4aXxEabyT4snrXpi5+UGLT4KXGV5syQO6Lc0OGw
+9O/0qAIU+YW7ojbKv8fr+NB31TGhGYWASjYlN1NvPotRAK6339O0/Rqr9xGgy3AY
+SR+ic2Y610IM7xccKuTVAW9UofKQwJZChqae9VVZ
+=J9CI
+-----END PGP PUBLIC KEY BLOCK-----

data/apt/files/gpg-keys/icinga2.asc

@@ -1,30 +1,29 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v2.0.19 (GNU/Linux)
 
-mQGiBFKHzk4RBACSHMIFTtfw4ZsNKAA03Gf5t7ovsKWnS7kcMYleAidypqhOmkGg
+mQINBGZMb30BEAC6c5P5lo5cLN2wX9+jA7TEEJ/NiiOM9VxBwB/c2PFd6AjdGBbe
-0petiYsMPYT+MOepCJFGNzwQwJhZrdLUxxMSWay4Xj0ArgpD9vbvU+gj8Tb02l+x
+28VcXWmFdETg1N3Woq08yNVXdxS1tMslyl9apmmyCiSC2OPMmTOveLzZ196IljYR
-SqNGP8jXMV5UnK4gZsrYGLUPvx47uNNYRIRJAGOPYTvohhnFJiG402dzlwCg4u5I
+DeZMF8C+rdzNKXZzn7+nEp9xRy34QUZRfx6pEnugMd0VK0d/ZKgMbcq2IvcRQwap
-1RdFplkp9JM6vNM9VBIAmcED/2jr7UQGsPs8YOiPkskGHLh/zXgO8SvcNAxCLgbp
+60+9t8ppesXhgaRBsAzvrj1twngqXP90JwzKGaR+iaGzrvvJn6cgXkw3MyXhskKY
-BjGcF4Iso/A2TAI/2KGJW6kBW/Paf722ltU6s/6mutdXJppgNAz5nfpEt4uZKZyu
+4J0c7TV6DmTOIfL6RmBp8+SSco8xXD/O/YIpG8LWe+sbMqSaq7jFvKCINWgK4RAt
-oSWf77179B2B/Wl1BsX/Oc3chscAgQb2pD/qPF/VYRJU+hvdQkq1zfi6cVsxyREV
+7mBRHvx81Y8IwV6B2wch/lSyYxKXTbE7uMefy3vyP9A9IFhMbFpc0EJA/4tHYEL4
-k+IwA/46nXh51CQxE29ayuy1BoIOxezvuXFUXZ8rP6aCh4KaiN9AJoy7pBieCzsq
+qPZyR44mizsxa+1h6AXO258ERtzL+FoksXnWTcQqBKjd6SHhLwN4BLsjrlWsJ6lD
-d7rPEeGIzBjI+yhEu8p92W6KWzL0xduWfYg9I7a2GTk8CaLX2OCLuwnKd7RVDyyZ
+VaSKsekEwMFTLvZiLxYXBLPU04dvGNgX7nbkFMEK6RxHqfMu+m6+0jPXzQ+ejuae
-yzRjWs0T5U7SRAWspLStYxMdKert9lLyQiRHtLwmlgBPqa0gh7Q+SWNpbmdhIE9w
+xoBBT61O7v5PPTqbZFBKnVzQPf7fBIHW5/AGAc+qAI459viwcCSlJ21RCzirFYc0
-ZW4gU291cmNlIE1vbml0b3JpbmcgKEJ1aWxkIHNlcnZlcikgPGluZm9AaWNpbmdh
+/KDuSoo61yyNcq4G271lbT5SNeMZNlDxKkiHjbCpIU6iEF7uK828F1ZGKOMRztok
-Lm9yZz6IYAQTEQIAIAUCUofOTgIbAwYLCQgHAwIEFQIIAwQWAgMBAh4BAheAAAoJ
+bzE7j1IDIfDQ3P/zfq73Rr2S9FfHlXvEmLIuj5G4PO7p0IwUlCD1a9oY+QARAQAB
-EMbjGcM0QQaCgSQAnRjXdbsyqziqhmxfAKffNJYuMPwdAKCS/IRCVyQzApFBtIBQ
+tCxJY2luZ2EgR21iSCAoQnVpbGQgc2VydmVyKSA8aW5mb0BpY2luZ2EuY29tPokC
-1xuoym/4C7kCDQRSh85OEAgAvPwjlURCi8z6+7i60no4n16dNcSzd6AT8Kizpv2r
+TgQTAQoAOBYhBN069hmO0AC0wLc5VswRb1WqfyOCBQJmTG99AhsDBQsJCAcCBhUK
-9BmNBff/GNYGnHyob/DMtmO2esEuVG8w62rO9m1wzzXzjbtmtU7NZ1Tg+C+reU2I
+CQgLAgQWAgMBAh4BAheAAAoJEMwRb1WqfyOCGrIP/i/4fYEkdCi4nhQGMzSP0Eyh
-GNVu3SYtEVK/UTJHAhLcgry9yD99610tYPN2Fx33Efse94mXOreBfCvDsmFGSc7j
+UhJjsUP9mEqSQRqOAplvjYa1yBbrSPLfkRE0oAL/o+4eUKcAQFeDQtDXJ/D4xl3Q
-GVNCWXpMR3jTYyGj1igYd5ztOzG63D8gPyOucTTl+RWN/G9EoGBv6sWqk5eCd1Fs
+J5MehRJYzklrSs5XkEscb73HoDBUfFSgCVM2zK+JkCX0CPJ4ZLWtZGJ+8pCLpnkH
-JlWyQX4BJn3YsCZx3uj1DWL0dAl2zqcn6m1M4oj1ozW47MqM/efKOcV6VvCs9SL8
+nCPonbGc6sS+m2JsPRwxyxAhdXxWSAesXd8dUSW3MOQz9JlC4/idQcCFs03fdhuZ
-F/NFvZcH4LKzeupCQ5jEONqcTlVlnLlIqId95Z4DI4AV9wADBQf/S6sKA4oH49tD
+4jGMry08OihWVudTDK8nkwRZLzNoOivAQ3mIeaTcRMmgPJfYN4k0o90lXJWAbG+2
-Yb5xAfUyEp5ben05TzUJbXs0Z7hfRQzy9+vQbWGamWLgg3QRUVPx1e4IT+W5vEm5
+j8p7Pyjv71OctI8KUbS4+f2H8i6r5Pc4M4hlUQh6QAN9o1oPJrXxurdp0EXgQXSy
-dggNTMEwlLMI7izCPDcD32B5oxNVxlfj428KGllYWCFj+edY+xKTvw/PHnn+drKs
+rVH2MeguqprFJxGjdlTCSTYgQEmEXMixRAGzteEgCf/Qk9mPXoxFTNyNg4/Lkglb
-LE65Gwx4BPHm9EqWHIBX6aPzbgbJZZ06f6jWVBi/N7e/5n8lkxXqS23DBKemapyu
+Nj6dY6or6w+IsbdrcePqDAs+j9t5B97vU7Ldquloj85myQjkWPP8kjlsOlsXBkQ/
-S1i56sH7mQSMaRZP/iiOroAJemPNxv1IQkykxw2woWMmTLKLMCD/i+4DxejE50tK
+C+mD+5iW2AiWh+yCasf6mOZwUfINZF+VDpmfIsZZbWpcMgp1f32fpRFZ3ietnsnR
-dxaOLTc4HDCsattw/RVJO6fwE414IXHMv330z4HKWJevMQ+CmQGfswvCwgeBP9n8
++luNb19hUHKyyDDHMe/YM7H9P5vtX9BGz6O9kNpo1LAnigkSQSFBZlK3Po3Yk9eg
-PItLjBQAXIhJBBgRAgAJBQJSh85OAhsMAAoJEMbjGcM0QQaCzpAAmwUNoRyySf9p
+XPbDT5HsU3TMyS5ZnSDRRPPJwsyGPXz+0pCADae9H9hCc2C2LZIrrtwlOFPWuViA
-5G3/2UD1PMueIwOtAKDVVDXEq5LJPVg4iafNu0SRMwgP0Q==
+ifY/dQmUP37n5XgMADRc
-=icbY
+=O0zm
 -----END PGP PUBLIC KEY BLOCK-----

data/apt/files/gpg-keys/nodejs.asc

@@ -1,52 +1,29 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
-Comment: GPGTools - https://gpgtools.org
 
-mQINBFObJLYBEADkFW8HMjsoYRJQ4nCYC/6Eh0yLWHWfCh+/9ZSIj4w/pOe2V6V+
+mQENBFdDN1ABCADaNd/I3j3tn40deQNgz7hB2NvT+syXe6k4ZmdiEcOfBvFrkS8B
-W6DHY3kK3a+2bxrax9EqKe7uxkSKf95gfns+I9+R+RJfRpb1qvljURr54y35IZgs
+hNS67t93etHsxEy7E0qwsZH32bKazMqe9zDwoa3aVImryjh6SHC9lMtW27JPHFeM
-fMG22Np+TmM2RLgdFCZa18h0+RbH9i0b+ZrB9XPZmLb/h9ou7SowGqQ3wwOtT3Vy
+Srkt9YmH1WMwWcRO6eSY9B3PpazquhnvbammLuUojXRIxkDroy6Fw4UKmUNSRr32
-qmif0A2GCcjFTqWW6TXaY8eZJ9BCEqW3k/0Cjw7K/mSy/utxYiUIvZNKgaG/P8U7
+9Ej87jRoR1B2/57Kfp2Y4+vFGGzSvh3AFQpBHq51qsNHALU6+8PjLfIt+5TPvaWR
-89QyvxeRxAf93YFAVzMXhoKxu12IuH4VnSwAfb8gQyxKRyiGOUwk0YoBPpqRnMmD
+TB+kAZnQZkaIQM2nr1n3oj6ak2RATY/+kjLizgFWzgEfbCrbsyq68UoY5FPBnu4Z
-Dl7SdmY3oQHEJzBelTMjTM8AjbB9mWoPBX5G8t4u47/FZ6PgdfmRg9hsKXhkLJc7
+E3iDZpaIqwKr0seUC7iA1xM5eHi5kty1oB7HABEBAAG0Ik5Tb2xpZCA8bnNvbGlk
-C1btblOHNgDx19fzASWX+xOjZiKpP6MkEEzq1bilUFul6RDtxkTWsTa5TGixgCB/
+LWdwZ0Bub2Rlc291cmNlLmNvbT6JATgEEwECACIFAldDN1ACGwMGCwkIBwMCBhUI
-G2fK8I9JL/yQhDc6OGY9mjPOxMb5PgUlT8ox3v8wt25erWj9z30QoEBwfSg4tzLc
+AgkKCwQWAgMBAh4BAheAAAoJEC9ZtfmbG+C0y7wH/i4xnab36dtrYW7RZwL8i6Sc
-Jq6N/iepQemNfo6Is+TG+JzI6vhXjlsBm/Xmz0ZiFPPObAH/vGCY5I6886vXQ7ft
+NjMx4j9+U1kr/F6YtqWd+JwCbBdar5zRghxPcYEq/qf7MbgAYcs1eSOuTOb7n7+o
-qWHYHT8jz/R4tigMGC+tvZ/kcmYBsLCCI5uSEP6JJRQQhHrCvOX0UaytItfsQfLm
+xUwdH2iCtHhKh3Jr2mRw1ks7BbFZPB5KmkxHaEBfLT4d+I91ZuUdPXJ+0SXs9gzk
-EYRd2F72o1yGh3yvWWfDIBXRmaBuIGXGpajC0JyBGSOWb9UxMNZY/2LJEwARAQAB
+Dbz65Uhoz3W03aiF8HeL5JNARZFMbHHNVL05U1sTGTCOtu+1c/33f3TulQ/XZ3Y4
-tB9Ob2RlU291cmNlIDxncGdAbm9kZXNvdXJjZS5jb20+iQI4BBMBAgAiBQJTmyS2
+hwGCpLe0Tv7g7Lp3iLMZMWYPEa0a7S4u8he5IEJQLd8bE8jltcQvrdr3Fm8kI2Jg
-AhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRAWVaCraFdigHTmD/9OKhUy
+BJmUmX4PSfhuTCFaR/yeCt3UoW883bs9LfbTzIx9DJGpRIu8Y0IL3b4sj/GoZVq5
-jJ+h8gMRg6ri5EQxOExccSRU0i7UHktecSs0DVC4lZG9AOzBe+Q36cym5Z1di6JQ
+AQ0EV0M3UAEIAKrTaC62ayzqOIPa7nS90BHHck4Z33a2tZF/uof38xNOiyWGhT8u
-kHl69q3zBdV3KTW+H1pdmnZlebYGz8paG9iQ/wS9gpnSeEyx0Enyi167Bzm0O4A1
+JeFoTTHn5SQq5Ftyu4K3K2fbbpuu/APQF05AaljzVkDGNMW4pSkgOasdysj831cu
-GK0prkLnz/yROHHEfHjsTgMvFwAnf9uaxwWgE1d1RitIWgJpAnp1DZ5O0uVlsPPm
+ssrHX2RYS22wg80k6C/Hwmh5F45faEuNxsV+bPx7oPUrt5n6GMx84vEP3i1+FDBi
-XAhuBJ32mU8S5BezPTuJJICwBlLYECGb1Y65Cil4OALU7T7sbUqfLCuaRKxuPtcU
+0pt/B/QnDFBXki1BGvJ35f5NwDefK8VaInxXP3ZN/WIbtn5dqxppkV/YkO7GiJlp
-VnJ6/qiyPygvKZWhV6Od0Yxlyed1kftMJyYoL8kPHfeHJ+vIyt0s7cropfiwXoka
+Jlju9rf3kKUIQzKQWxFsbCAPIHoWv7rH9RSxgDithXtG6Yg5R1aeBbJaPNXL9wpJ
-1iJB5nKyt/eqMnPQ9aRpqkm9ABS/r7AauMA/9RALudQRHBdWIzfIg0Mlqb52yyTI
+YBJbiMjkAFaz4B95FOqZm3r7oHugiCGsHX0AEQEAAYkBHwQYAQIACQUCV0M3UAIb
-IgQJHNGNX1T3z1XgZhI+Vi8SLFFSh8x9FeUZC6YJu0VXXj5iz+eZmk/nYjUt4Mtc
+DAAKCRAvWbX5mxvgtE/OB/0VN88DR3Y3fuqy7lq/dthkn7Dqm9YXdorZl3L152eE
-pVsVYIB7oIDIbImODm8ggsgrIzqxOzQVP1zsCGek5U6QFc9GYrQ+Wv3/fG8hfkDn
+IF882aG8FE3qZdaLGjQO4oShAyNWmRfSGuoH0XERXAI9n0r8m4mDMxE6rtP7tHet
-xXLww0OGaEQxfodm8cLFZ5b8JaG3+Yxfe7JkNclwvRimvlAjqIiW5OK0vvfHco+Y
+y/5M8x3CTyuMgx5GLDaEUvBusnTD+/v/fBMwRK/cZ9du5PSG4R50rtst+oYyC2ao
-gANhQrlMnTx//IdZssaxvYytSHpPZTYw+qPEjbBJOLpoLrz8ZafN1uekpAqQjffI
+x4I2SgjtF/cY7bECsZDplzatN3gv34PkcdIg8SLHAVlL4N5tzumDeizRspcSyoy2
-AOqW9SdIzq/kSHgl0bzWbPJPw86XzzftewjKNbkCDQRTmyS2ARAAxSSdQi+WpPQZ
+K2+hwKU4C4+dekLLTg8rjnRROvplV2KtaEk6rxKtIRFDCoQng8wfJuIMrDNKvqZw
-fOflkx9sYJa0cWzLl2w++FQnZ1Pn5F09D/kPMNh4qOsyvXWlekaV/SseDZtVziHJ
+FRGt7cbvW5MCnuH8MhItOl9Uxp1wHp6gtav/h8Gp6MBa
-Km6V8TBG3flmFlC3DWQfNNFwn5+pWSB8WHG4bTA5RyYEEYfpbekMtdoWW/Ro8Kmh
+=MARt
-41nuxZDSuBJhDeFIp0ccnN2Lp1o6XfIeDYPegyEPSSZqrudfqLrSZhStDlJgXjea
-JjW6UP6txPtYaaila9/Hn6vF87AQ5bR2dEWB/xRJzgNwRiax7KSU0xca6xAuf+TD
-xCjZ5pp2JwdCjquXLTmUnbIZ9LGV54UZ/MeiG8yVu6pxbiGnXo4Ekbk6xgi1ewLi
-vGmz4QRfVklV0dba3Zj0fRozfZ22qUHxCfDM7ad0eBXMFmHiN8hg3IUHTO+UdlX/
-aH3gADFAvSVDv0v8t6dGc6XE9Dr7mGEFnQMHO4zhM1HaS2Nh0TiL2tFLttLbfG5o
-QlxCfXX9/nasj3K9qnlEg9G3+4T7lpdPmZRRe1O8cHCI5imVg6cLIiBLPO16e0fK
-yHIgYswLdrJFfaHNYM/SWJxHpX795zn+iCwyvZSlLfH9mlegOeVmj9cyhN/VOmS3
-QRhlYXoA2z7WZTNoC6iAIlyIpMTcZr+ntaGVtFOLS6fwdBqDXjmSQu66mDKwU5Ek
-fNlbyrpzZMyFCDWEYo4AIR/18aGZBYUAEQEAAYkCHwQYAQIACQUCU5sktgIbDAAK
-CRAWVaCraFdigIPQEACcYh8rR19wMZZ/hgYv5so6Y1HcJNARuzmffQKozS/rxqec
-0xM3wceL1AIMuGhlXFeGd0wRv/RVzeZjnTGwhN1DnCDy1I66hUTgehONsfVanuP1
-PZKoL38EAxsMzdYgkYH6T9a4wJH/IPt+uuFTFFy3o8TKMvKaJk98+Jsp2X/QuNxh
-qpcIGaVbtQ1bn7m+k5Qe/fz+bFuUeXPivafLLlGc6KbdgMvSW9EVMO7yBy/2JE15
-ZJgl7lXKLQ31VQPAHT3an5IV2C/ie12eEqZWlnCiHV/wT+zhOkSpWdrheWfBT+ac
-hR4jDH80AS3F8jo3byQATJb3RoCYUCVc3u1ouhNZa5yLgYZ/iZkpk5gKjxHPudFb
-DdWjbGflN9k17VCf4Z9yAb9QMqHzHwIGXrb7ryFcuROMCLLVUp07PrTrRxnO9A/4
-xxECi0l/BzNxeU1gK88hEaNjIfviPR/h6Gq6KOcNKZ8rVFdwFpjbvwHMQBWhrqfu
-G3KaePvbnObKHXpfIKoAM7X2qfO+IFnLGTPyhFTcrl6vZBTMZTfZiC1XDQLuGUnd
-sckuXINIU3DFWzZGr0QrqkuE/jyr7FXeUJj9B7cLo+s/TXo+RaVfi3kOc9BoxIvy
-/qiNGs/TKy2/Ujqp/affmIMoMXSozKmga81JSwkADO1JMgUy6dApXz9kP4EE3g==
-=CLGF
 -----END PGP PUBLIC KEY BLOCK-----

data/proftpd/files/home.paperless.conf

@@ -0,0 +1,74 @@
+Include /etc/proftpd/modules.conf
+
+UseIPv6 on
+<IfModule mod_ident.c>
+    IdentLookups off
+</IfModule>
+
+ServerName "home.paperless"
+ServerType standalone
+DeferWelcome off
+
+DefaultServer on
+ShowSymlinks on
+
+TimeoutNoTransfer 600
+TimeoutStalled 600
+TimeoutIdle 1200
+
+DisplayLogin welcome.msg
+DisplayChdir .message true
+ListOptions "-l"
+
+DenyFilter \*.*/
+
+RequireValidShell off
+
+Port 21
+
+PassivePorts 49152 50192
+
+MaxInstances 30
+
+User proftpd
+Group nogroup
+
+Umask 022 022
+AllowOverwrite on
+
+TransferLog /var/log/proftpd/xferlog
+SystemLog /var/log/proftpd/proftpd.log
+
+<IfModule mod_quotatab.c>
+    QuotaEngine off
+</IfModule>
+
+<IfModule mod_ratio.c>
+    Ratios off
+</IfModule>
+
+<IfModule mod_delay.c>
+    DelayEngine on
+</IfModule>
+
+<IfModule mod_ctrls.c>
+    ControlsEngine off
+    ControlsMaxClients 2
+    ControlsLog /var/log/proftpd/controls.log
+    ControlsInterval 5
+    ControlsSocket /var/run/proftpd/proftpd.sock
+</IfModule>
+
+<IfModule mod_ctrls_admin.c>
+    AdminControlsEngine off
+</IfModule>
+
+<Anonymous /mnt/paperless/consume/>
+    User nobody
+    Group nogroup
+    UserAlias anonymous ftp
+
+    <Directory *>
+        AllowAll
+    </Directory>
+</Anonymous>

data/ssl/_.home.kunbox.net.crt.pem

@@ -1,22 +1,22 @@
 -----BEGIN CERTIFICATE-----
-MIIDsDCCAzWgAwIBAgISBMRgrLMPa1cucom1daU3fmCaMAoGCCqGSM49BAMDMDIx
+MIIDsDCCAzWgAwIBAgISBIi3muU9O51f4fWWUXJHNgRHMAoGCCqGSM49BAMDMDIx
 CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
-NTAeFw0yNDA2MTExNDQyMzdaFw0yNDA5MDkxNDQyMzZaMBoxGDAWBgNVBAMTD2hv
+NjAeFw0yNDA5MDQxNjA1MThaFw0yNDEyMDMxNjA1MTdaMBoxGDAWBgNVBAMTD2hv
-bWUua3VuYm94Lm5ldDB2MBAGByqGSM49AgEGBSuBBAAiA2IABGlCPITmq729xoLb
+bWUua3VuYm94Lm5ldDB2MBAGByqGSM49AgEGBSuBBAAiA2IABA5vskMN8tWHCOsv
-DkSn6SYxnP7Mns9dBSqUv1WktnYjwbavlbXKN3Bz0yCGcXSCZA+Nq576DBK9L9X6
+aUojW+t8otSpRgcU0tLsONhzQ7GhG5tC5DQ5pN7HiG14eejONQE4hRWC4rkP/e47
-tTeIvqG1akyNxY+1eDK3vhH4FKmZE6oOyh1jqfG2LY7dvLYCQKOCAiQwggIgMA4G
+EVQd/rFK5m0lQesR68zogtW9KfQZUoINhlOuR4CxpBY1LrG5laOCAiQwggIgMA4G
 A1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYD
-VR0TAQH/BAIwADAdBgNVHQ4EFgQUt6i+27R0AAj+AUgSNg3Gmm5GzLYwHwYDVR0j
+VR0TAQH/BAIwADAdBgNVHQ4EFgQU3iCazGKeVwzCa84zl+qckbspEmEwHwYDVR0j
-BBgwFoAUnytfzzwhT50Et+0rLMTGcIvS1w0wVQYIKwYBBQUHAQEESTBHMCEGCCsG
+BBgwFoAUkydGmAOpUWiOmNbEQkjbI79YlNIwVQYIKwYBBQUHAQEESTBHMCEGCCsG
-AQUFBzABhhVodHRwOi8vZTUuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6
+AQUFBzABhhVodHRwOi8vZTYuby5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6
-Ly9lNS5pLmxlbmNyLm9yZy8wLQYDVR0RBCYwJIIRKi5ob21lLmt1bmJveC5uZXSC
+Ly9lNi5pLmxlbmNyLm9yZy8wLQYDVR0RBCYwJIIRKi5ob21lLmt1bmJveC5uZXSC
 D2hvbWUua3VuYm94Lm5ldDATBgNVHSAEDDAKMAgGBmeBDAECATCCAQQGCisGAQQB
-1nkCBAIEgfUEgfIA8AB2AO7N0GTV2xrOxVy3nbTNE6Iyh0Z8vOzew1FIWUZxH7Wb
+1nkCBAIEgfUEgfIA8AB2AD8XS0/XIkdYlB1lHIS+DRLtkDd/H4Vq68G/KIXs+GRu
-AAABkAf3K9YAAAQDAEcwRQIhAPFpuj8ZoOmqhDNJDSuJ3BWyUuOUyY2QXjIVRHop
+AAABkb3+C2AAAAQDAEcwRQIhAMwv6NjH3Ggd1WfeSVvyToVaM15glwfSJcAW8+40
-dKyPAiAa2cwsyBFOjWOEYRCZ/7UgBA5axt8ZCrRYseefFwpvSQB2AN/hVuuqBa+1
+XbCKAiABUoDmQjhKi5VfwZ7e0WX5XjEmgBN2qTafK5RqlaCDJgB2AO7N0GTV2xrO
-nA+GcY2owDJOrlbZbqf1pWoB0cE7vlJcAAABkAf3LJ8AAAQDAEcwRQIhAL9+dxTj
+xVy3nbTNE6Iyh0Z8vOzew1FIWUZxH7WbAAABkb3+C3IAAAQDAEcwRQIgU9sxMGOG
-34moGhk32PnQZg2+nVNiVxLxYjDL9fk1R+bXAiAA7EjWqcZgktinTpt1pVQMmuUn
+aP3npu7vw3G9TiFRxuZRCI96My34WVSCOcsCIQDhDjS9QhJGtNT68Z0sx6DJCcco
-FQ1IRh5AdycNn0lL2jAKBggqhkjOPQQDAwNpADBmAjEAubnofDBEyrcSJAiGxlqc
+L1AXGWwojxizcx48bTAKBggqhkjOPQQDAwNpADBmAjEA/SOZeiZrClB5EJlZFdQy
-EpUndlnkT/irfl/As8EUt0KMSPhnV3i7oEq89bi0KDghAjEA+XHccaWUi7BJEoV7
+hrt2qh4HC5zvHdSLTWI4GAxDy8xRg/ANO6fp0Sb7Q7jdAjEAhiQgQfgUln08i/tv
-nCUOCct64mb2LmXkvYiFVicsV9ubp4kVbziWjLgng6TC3HoM
+3TGjVRIT/Y4A4QadodTROpfmFDH3QIsNwRPRhQUUSscBavK9
 -----END CERTIFICATE-----

data/ssl/_.home.kunbox.net.crt_intermediate.pem

@@ -1,27 +1,27 @@
 
 -----BEGIN CERTIFICATE-----
-MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
+MIIEVzCCAj+gAwIBAgIRALBXPpFzlydw27SHyzpFKzgwDQYJKoZIhvcNAQELBQAw
 TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
 cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
 WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
-RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
+RW5jcnlwdDELMAkGA1UEAxMCRTYwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATZ8Z5G
-a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
+h/ghcWCoJuuj+rnq2h25EqfUJtlRFLFhfHWWvyILOR/VvtEKRqotPEoJhC6+QJVV
-VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
+6RlAN2Z17TJOdwRJ+HB7wxjnzvdxEP6sdNgA1O1tHHMWMxCcOrLqbGL0vbijgfgw
 gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
-ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
+ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSTJ0aYA6lRaI6Y1sRCSNsj
-i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
+v1iU0jAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
 AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
 BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
-Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
+Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAfYt7SiA1sgWGCIpunk46r4AExIRc
-2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
+MxkKgUhNlrrv1B21hOaXN/5miE+LOTbrcmU/M9yvC6MVY730GNFoL8IhJ8j8vrOL
-bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
+pMY22OP6baS1k9YMrtDTlwJHoGby04ThTUeBDksS9RiuHvicZqBedQdIF65pZuhp
-6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
+eDcGBcLiYasQr/EO5gxxtLyTmgsHSOVSBcFOn9lgv7LECPq9i7mfH3mpxgrRKSxH
-XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
+pOoZ0KXMcB+hHuvlklHntvcI0mMMQ0mhYj6qtMFStkF1RpCG3IPdIwpVCQqu8GV7
-koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
+s8ubknRzs+3C/Bm19RFOoiPpDkwvyNfvmQ14XkyqqKK5oZ8zhD32kFRQkxa8uZSu
-cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
+h4aTImFxknu39waBxIRXE4jKxlAmQc4QjFZoq1KmQqQg0J/1JF8RlFvJas1VcjLv
-E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
+YlvUB2t6npO6oQjB3l+PNf0DpQH7iUx3Wz5AjQCi6L25FjyE06q6BZ/QlmtYdl/8
-K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
+ZYao4SRqPEs/6cAiF+Qf5zg2UkaWtDphl1LKMuTNLotvsX99HP69V2faNyegodQ0
-GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
+LyTApr/vT01YPE46vNsDLgK+4cL6TrzC/a4WcmF5SRJ938zrv/duJHLXQIku5v0+
-sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
+EwOy59Hdm0PT/Er/84dDV0CSjdR/2XuZM3kpysSKLgD1cKiDA+IRguODCxfO9cyY
-VQD9F6Na/+zmXCc=
+Ig46v9mFmBvyH04=
 -----END CERTIFICATE-----

data/ssl/_.home.kunbox.net.key.pem.vault

@@ -1 +1 @@
-encrypt$gAAAAABmaHBwHXKZDN_8bEa47lNIX25-wvvW1RcC689Hod4HAsY2tT6fd9k7zdnbK8KWedRNopdRIlhQUkU0xBVh5J5maiYfn5R8Kp_VpkXiWY0LVY3XMWjB4oHmU29VEbl490oesAhUUH6hb7lwfvsbV4WTM_7aL0_sPfF1udxO89gg-9z2nbl-7zmTdSBY651fZQngd4SlwK17N1fedkHgYamGLdgE10oPZiRsOJKrUGv-Pxi4ICQ7J_AF6bO05PyZkeNqqUP19g2f5EsKNnT0bxQHCP5sbofvYzli-fU2bW-leuvm-VU8lV27t39lQZyF-WcWnB7626w0semrg7cCJ4qoHJVekEFWzJBLhagSNdCDWHAwdV2_MHzSgbXvyXz0maga8-1wBoa8Ueinp2oPQMPaUsVzy6NVX7mAsB6Rw9CXDSEf8WPSKWaz7324qhxKmhMHt0r68z0qM28mHb98F_vbS6geCw==
+encrypt$gAAAAABm2JL0vVqh3Zut-a1Gfn8iOtDZS8aBpGobV3-d3u8My0MPunYmbQ6kXUAw7U0Bu87AAPXNsmi1pxrxcu8vXvhw4uM445WwKj-UqaV5fmk-ZasHGq-O6K52YqEgK6wo-9u_sOBubbwJSwFVaHxT3gczLW_GVRHhFIFGgdnRlz4YoAz4NXcos_uNO9GMEOGhfGx9e2c2GOIg64vXkj_1LjXEDoV9HYMzy-2wLt4A6q-ZiZwCoKl8-lt8sY_rLk_yfmy3sMvzqg8JaE7T4sunmXDdf4HQlnvl_cu1uW33Rrsq4-080HKx6rKNsZQGhWD2yls016xBAYZvQbDjHd6-7bld1bs5RUF5tfEC3Kx567TBdMaf5C7-PnNB7O_MC4I6SkmUElGRdYyCHuP5HXf9dKtiGCtjHyfEzqTBrcI0xPt631_IGPWMNId7zyLqfLHpMFTPS9jgGVKoT1TXwKe4NSHaGxXO-A==

data/ssl/_.home.sophies-kitchen.eu.crt.pem

@@ -1,23 +1,23 @@
 -----BEGIN CERTIFICATE-----
-MIIDxzCCA02gAwIBAgISBDW3AazQEdYbYaSrLIoUKbvsMAoGCCqGSM49BAMDMDIx
+MIIDxjCCA0ygAwIBAgISBIbwgyWchKDri2pD+Lk46M3eMAoGCCqGSM49BAMDMDIx
 CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
-NjAeFw0yNDA2MjExNjUzNDBaFw0yNDA5MTkxNjUzMzlaMCIxIDAeBgNVBAMTF2hv
+NTAeFw0yNDA5MTkxOTQ5NDFaFw0yNDEyMTgxOTQ5NDBaMCIxIDAeBgNVBAMTF2hv
-bWUuc29waGllcy1raXRjaGVuLmV1MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEQDuO
+bWUuc29waGllcy1raXRjaGVuLmV1MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4rKd
-QacqKUrKWbwBWgSqPkaBIb4t6f4kiRMvCyY8KiZmIvJadVD6iKnbcGzFQ0LRI+vt
+PfAtfQts90WjdnsscizZzlUF/HZBx97kT4/eWgyU/MNOFGF4WqGA92OX0ymZVJ7l
-+O6ZVpwsUOXvgF3PB7o7OfODlVsKRc4pYJPvoRRaz1VlK6eZW20GGivBVgl0o4IC
+D4CnHq96odx0LqHBQ+W+MXNlsWnwBTUOPKp8XyUeDhZbkgNJDR8nGtHje9a8o4IC
-NDCCAjAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
+MzCCAi8wDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
-BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRScRdoEyCVXr1PC0yvKusaOO5i
+BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSONIAWFPI0mqJYBqnWk1J0Ea27
-dTAfBgNVHSMEGDAWgBSTJ0aYA6lRaI6Y1sRCSNsjv1iU0jBVBggrBgEFBQcBAQRJ
+sDAfBgNVHSMEGDAWgBSfK1/PPCFPnQS37SssxMZwi9LXDTBVBggrBgEFBQcBAQRJ
-MEcwIQYIKwYBBQUHMAGGFWh0dHA6Ly9lNi5vLmxlbmNyLm9yZzAiBggrBgEFBQcw
+MEcwIQYIKwYBBQUHMAGGFWh0dHA6Ly9lNS5vLmxlbmNyLm9yZzAiBggrBgEFBQcw
-AoYWaHR0cDovL2U2LmkubGVuY3Iub3JnLzA9BgNVHREENjA0ghkqLmhvbWUuc29w
+AoYWaHR0cDovL2U1LmkubGVuY3Iub3JnLzA9BgNVHREENjA0ghkqLmhvbWUuc29w
 aGllcy1raXRjaGVuLmV1ghdob21lLnNvcGhpZXMta2l0Y2hlbi5ldTATBgNVHSAE
-DDAKMAgGBmeBDAECATCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB1AEiw42vapkc0
+DDAKMAgGBmeBDAECATCCAQMGCisGAQQB1nkCBAIEgfQEgfEA7wB1AEiw42vapkc0
-D+VqAvqdMOscUgHLVt0sgdm7v6s52IRzAAABkDvuwaIAAAQDAEYwRAIgP3lyMqvr
+D+VqAvqdMOscUgHLVt0sgdm7v6s52IRzAAABkgwK350AAAQDAEYwRAIga5zPs7YZ
-+a7XWoRLxzQzhv6umJ/hiQPTWen3qqTao34CIGLq9y9ZPZUuo2smf49h9v9I9B4t
+mJqbxhinEJKKQ9XCe1w/MhBzFMzwHFGbaPgCIHeprkwET14Y3h5dmUF7szwTg1Ey
-o6ihFaHoOB68q37DAHcA3+FW66oFr7WcD4ZxjajAMk6uVtlup/WlagHRwTu+UlwA
+zqLM+GQL3t7EAX2cAHYAPxdLT9ciR1iUHWUchL4NEu2QN38fhWrrwb8ohez4ZG4A
-AAGQO+7CZAAABAMASDBGAiEAjl1f87koOUNfTNL4IRO+BBEVeHCxPvYRaztVJoC0
+AAGSDArfogAABAMARzBFAiEA0faR1cyqpmCyHo/0KCv04fkpwgzWdMY+WopJXDLD
-x6ECIQDblc+Snmea3OSqydLcyi8xgdtMySyQgPElXLtM7H+RUjAKBggqhkjOPQQD
+zz8CIEBKANatmiRstc5D69jKhq2beHldLZB3jRfm1WlWqmxJMAoGCCqGSM49BAMD
-AwNoADBlAjA0FOSmTiYrA9Hd2T5DkI2TMOH2akk8SxXprkei6H37bI8O3br7ke8t
+A2gAMGUCMCrpe2jxoTH410jNJPOnbN4ae0Ng54JtRNcFWHlcwpk07NrByJSTPWDd
-jwHWVtvN4d8CMQDohhdWUQ3G8Fl4ektN34oX6U3NcywBm96U3RVt5JYcfnn8ea68
+zr7AYsbbVQIxAOGboJcIxsuf+rN30iWoe5KwCY3sd5XW8bEKFQnugIVHxAQKnHNc
-Qboj263s/g0Ciqs=
+0InWz2sVWYKNBA==
 -----END CERTIFICATE-----

data/ssl/_.home.sophies-kitchen.eu.crt_intermediate.pem

@@ -1,27 +1,27 @@
 
 -----BEGIN CERTIFICATE-----
-MIIEVzCCAj+gAwIBAgIRALBXPpFzlydw27SHyzpFKzgwDQYJKoZIhvcNAQELBQAw
+MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
 TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
 cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
 WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
-RW5jcnlwdDELMAkGA1UEAxMCRTYwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATZ8Z5G
+RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
-h/ghcWCoJuuj+rnq2h25EqfUJtlRFLFhfHWWvyILOR/VvtEKRqotPEoJhC6+QJVV
+a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
-6RlAN2Z17TJOdwRJ+HB7wxjnzvdxEP6sdNgA1O1tHHMWMxCcOrLqbGL0vbijgfgw
+VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
 gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
-ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSTJ0aYA6lRaI6Y1sRCSNsj
+ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
-v1iU0jAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
+i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
 AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
 BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
-Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAfYt7SiA1sgWGCIpunk46r4AExIRc
+Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
-MxkKgUhNlrrv1B21hOaXN/5miE+LOTbrcmU/M9yvC6MVY730GNFoL8IhJ8j8vrOL
+2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
-pMY22OP6baS1k9YMrtDTlwJHoGby04ThTUeBDksS9RiuHvicZqBedQdIF65pZuhp
+bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
-eDcGBcLiYasQr/EO5gxxtLyTmgsHSOVSBcFOn9lgv7LECPq9i7mfH3mpxgrRKSxH
+6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
-pOoZ0KXMcB+hHuvlklHntvcI0mMMQ0mhYj6qtMFStkF1RpCG3IPdIwpVCQqu8GV7
+XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
-s8ubknRzs+3C/Bm19RFOoiPpDkwvyNfvmQ14XkyqqKK5oZ8zhD32kFRQkxa8uZSu
+koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
-h4aTImFxknu39waBxIRXE4jKxlAmQc4QjFZoq1KmQqQg0J/1JF8RlFvJas1VcjLv
+cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
-YlvUB2t6npO6oQjB3l+PNf0DpQH7iUx3Wz5AjQCi6L25FjyE06q6BZ/QlmtYdl/8
+E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
-ZYao4SRqPEs/6cAiF+Qf5zg2UkaWtDphl1LKMuTNLotvsX99HP69V2faNyegodQ0
+K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
-LyTApr/vT01YPE46vNsDLgK+4cL6TrzC/a4WcmF5SRJ938zrv/duJHLXQIku5v0+
+GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
-EwOy59Hdm0PT/Er/84dDV0CSjdR/2XuZM3kpysSKLgD1cKiDA+IRguODCxfO9cyY
+sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
-Ig46v9mFmBvyH04=
+VQD9F6Na/+zmXCc=
 -----END CERTIFICATE-----

data/ssl/_.home.sophies-kitchen.eu.key.pem.vault

@@ -1 +1 @@
-encrypt$gAAAAABmdb4pdFakOuqHPRpEu_RjEPVVS9Ef0kuvWKKT3Gr3056e0nhinh_THX1w7CqiZ4CQlvSIH7vlDNUORFWlqDuZJOh8FYPSzjr78aK1MqVGZHxQBK8VVNd0K5m1U3z9_4W_pB7Zr_5fLXDqtIW-t68GQPEfxCwy2h2eBepQ2zJiLupWa7JwuqiXH6QyB4gD5Y-9F30RjH52WtJLrx6XtgClPG0p-6FrHcNHqmMYqgpt11zvLa88lOBUoDGFrrqqFRbY039ay2b1jrQOAhTQLDxnAMsbr5jTSbST1modE-1u_Wis-Km-jcMwkiViZpK-HC6Ce_TNdt1NDarBat6nRhTrpqHXENlroVixHmGl1_-Y6mc75tJ-KHQKRRzwK8V_X62iA3vfSz1Xps8B1FZqxJWA2EdM0JkQecCuC-bnpedEoumYnif3vLhe91NV8SQ5FBlkd3NFT8vBAWCgnqT_jDf5YQW70w==
+encrypt$gAAAAABm7I7N50TwtCs2LUt_MArRJnLQ-xLFVhr-zDtdWUVMejViIN2O9h5d_RP45jWt5BpxIkTORarcULXprEXp7zbb-CR5CTwbsNK6HnvSHPwuwXuxJQKRJtT4wWfYEFOxY9aUR9gxvXc3arsYHwVsGyLOeWA_6YzjO5IpL1LfQrsJuUE_1p9sKRyPpslmOJtD5OihMtIfAJNzBDwOSE_gdtLa8iae3DHtSvmKbGKSvwQEZ0pkJxVTVXJY4wddQmdsuV0ky04ls_tUINH8t6IMTJCt_5_ELzpTSdcHgV6W4yh8r_LTEH38n2boYnz3fKgieHnDHDWxFW1EYA2JWjkamH7hQ8iOMl8bqQieFAENnYjF41iz6tSCjfxVyKt_OfJUAwMScVMhPsuaI_i_ZB0Ge6BLsMwkw0d3yw06CwRQ3N7PcPPJLhL_eQS3EuV7Y-7Vv64secplJJIkcFfm1t5zcGkkm4-pDw==

groups/locations.py

@@ -61,6 +61,9 @@ groups['home'] = {
 }
 
 groups['sophie'] = {
+    'supergroups': {
+        'linux',
+    },
     'member_patterns': {
         r"sophie\..*",
     },
@@ -68,6 +71,9 @@ groups['sophie'] = {
         'icinga_options': {
             'exclude_from_monitoring': True,
         },
+        'backup-client': {
+            'target': 'htz-hel.backup-sophie',
+        },
         'users': {
             'sophie': {},
         },