fix: specify ansible.builtin.template for service file and configuration deployments

add host ki-fm.oopen.de
fix(file-ah-common.yml): correct indentation for samba user group assignments
2026-07-30 23:48:29 +02:00 · 2026-07-30 12:54:19 +02:00 · 2026-07-30 01:53:06 +02:00 · 2026-07-30 01:38:49 +02:00 · 2026-07-29 23:40:23 +02:00 · 2026-07-29 23:34:58 +02:00
440 changed files with 18428 additions and 9144 deletions
@@ -1 +1,15 @@
+# Editor
 *.swp
+*.swo
+*~
+
+# Python
+__pycache__/
+*.py[cod]
+
+# Ansible
+*.retry
+.vault_pass
+
+# OS
+.DS_Store
@@ -14,5 +14,8 @@
  "ansible.ansible.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible",
  "ansible.python.interpreterPath": "${workspaceFolder}/.venv/bin/python3",
  "ansible.validation.lint.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-lint",
-  "ansible.ansibleNavigator.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-navigator"
+  "ansible.ansibleNavigator.path": "/home/chris/devel/git/git.oopen.de/ansible/oopen-server/.venv/bin/ansible-navigator",
+  "yaml.customTags": [
+    "!vault scalar"
+  ]
 }
@@ -1,5 +1,4 @@
 ---
-
 # ---
 # deb822 ist das neue Konfigurationsformats für APT-Quellen (Repositories).
 # Es basiert auf der Debian Control Syntax nach RFC 822 – daher der Name
@@ -15,33 +14,32 @@
    debian_mirror: "http://deb.debian.org/debian"
    security_mirror: "http://security.debian.org/debian-security"
    components: "main contrib non-free non-free-firmware"
-    enable_backports: true         # auf false setzen, wenn du keine Backports willst
-    pin_backports_low: true        # Backports nur auf Anfrage
+    enable_backports: true # auf false setzen, wenn du keine Backports willst
+    pin_backports_low: true # Backports nur auf Anfrage
    # Nur manuelle Installation/Upgrade aus Backports:
    #    backports_pin_priority: 100
    #
    # Automatische Updates für bereits installierte Backports-Pakete.
    #    backports_pin_priority: 500 (>= 500)
    #
-    backports_pin_priority: 100    # 100 = nie automatisch bevorzugen
+    backports_pin_priority: 100 # 100 = nie automatisch bevorzugen
    apt_cache_valid_time: 3600
-    # Für offizielle Debian-Repos brauchst es kein Signed-By, weil debian-archive-keyring 
+    # Für offizielle Debian-Repos brauchst es kein Signed-By, weil debian-archive-keyring
    # ohnehin systemweit vertrauenswürdig ist.
    #
-    use_signed_by: true  # oder false, wenn du Option A willst
-    # Wenn Signed-By explizit gesetzt werden soll, dann nutze den Keyring-Pfad und stelle sicher, 
+    use_signed_by: true # oder false, wenn du Option A willst
+    # Wenn Signed-By explizit gesetzt werden soll, dann nutze den Keyring-Pfad und stelle sicher,
    # dass das Paket installiert ist.
    signed_by_keyring: "/usr/share/keyrings/debian-archive-keyring.gpg"

  pre_tasks:
    - name: Sicherstellen, dass wir Debian sind
-      assert:
+      ansible.builtin.assert:
        that:
          - ansible_facts['os_family'] == "Debian"
        fail_msg: "Dieses Playbook ist nur für Debian geeignet."

  tasks:
-
    - name: Keyring für Debian-Archive sicherstellen (falls Signed-By genutzt)
      ansible.builtin.apt:
        name: debian-archive-keyring
@@ -54,7 +52,13 @@
        dest: /etc/apt/sources.list.before-trixie
        remote_src: true
        force: false
-      ignore_errors: true
+        owner: root
+        group: root
+        mode: "0644"
+      failed_when:
+        - backup_result.failed
+        - "'No such file or directory' not in backup_result.msg"
+      register: backup_result

    - name: Alte /etc/apt/sources.list deaktivieren (leere Kommentar-Datei)
      ansible.builtin.copy:
@@ -90,6 +94,7 @@
        group: root
        mode: "0644"
      when: enable_backports
+
    - name: Backports-Repo entfernen wenn deaktiviert
      ansible.builtin.file:
        path: /etc/apt/sources.list.d/backports.sources
@@ -107,7 +112,7 @@

    - name: APT-Cache aktualisieren
      ansible.builtin.apt:
-        update_cache: yes
+        update_cache: true
        cache_valid_time: "{{ apt_cache_valid_time }}"

    - name: Verifikation - zeigen, ob Suites auf trixie stehen
@@ -118,4 +123,3 @@
    - name: Ausgabe anzeigen (nur Info)
      ansible.builtin.debug:
        msg: "{{ apt_policy.stdout.split('\n') | select('search', 'trixie') | list | join('\n') }}"
-
@@ -0,0 +1,732 @@
+#!/usr/bin/env python3
+"""
+Extract ipt-firewall configuration from a host and generate host_vars YAML.
+
+Reads /etc/ipt-firewall/{interfaces,main}_ipv{4,6}.conf via SSH,
+maps all variables to Ansible fw_* names, and writes a host_vars file.
+
+Usage:
+    ./extract-fw-host-vars.py <hostname> [--user USER] [--port PORT] [--dry-run]
+
+Example:
+    ./extract-fw-host-vars.py cl-01.oopen.de
+    ./extract-fw-host-vars.py cl-01.oopen.de --user root --dry-run
+"""
+
+import argparse
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+
+# ---------------------------------------------------------------------------
+# Defaults matching roles/ipt-firewall/defaults/main.yml
+# Only values that differ from these will be emitted.
+# ---------------------------------------------------------------------------
+DEFAULTS = {
+    "fw_do_not_firewall_bridged_traffic": False,
+    "fw_do_not_firewall_lx_guest_systems": False,
+    "fw_drop_icmp": False,
+    "fw_drop_mndp": True,
+    "fw_drop_mdns": True,
+    "fw_allow_all_outgoing_traffic": False,
+    "fw_blocked_ifs": "",
+    "fw_unprotected_ifs": "",
+    "fw_forward_private_ips_v4": "",
+    "fw_forward_private_ips_v6": "",
+    "fw_restrict_local_service_to_net_v4": "",
+    "fw_restrict_local_service_to_net_v6": "",
+    "fw_restrict_local_net_to_net_v4": "",
+    "fw_restrict_local_net_to_net_v6": "",
+    "fw_allow_ext_service_v4": "",
+    "fw_allow_ext_service_v6": "",
+    "fw_allow_ext_net_v4": "",
+    "fw_allow_ext_net_v6": "",
+    "fw_allow_local_service_v4": "",
+    "fw_allow_local_service_v6": "",
+    "fw_allow_local_service_from_networks_v4": "",
+    "fw_allow_local_service_from_networks_v6": "",
+    "fw_vpn_server_ips": "",
+    "fw_forward_vpn_server_ips": "",
+    "fw_vpn_ports": "$standard_vpn_port",
+    "fw_wireguard_server_ips": "",
+    "fw_forward_wireguard_server_ips": "",
+    "fw_wireguard_server_ports": "$standard_wireguard_port",
+    "fw_wireguard_out_ports": "$standard_wireguard_port",
+    "fw_local_ntp_service": False,
+    "fw_ntp_port": "$standard_ntp_port",
+    "fw_ntp_allowed_net": "",
+    "fw_dhcp_server_ifs": "",
+    "fw_dhcp_client_ifs": "",
+    "fw_dns_server_ips": "",
+    "fw_forward_dns_server_ips": "",
+    "fw_local_resolver_service": False,
+    "fw_resolver_port": "$standard_dns_port",
+    "fw_resolver_allowed_networks_v4": "",
+    "fw_resolver_allowed_networks_v6": "",
+    "fw_ssh_server_ips": "$ext_ips",
+    "fw_forward_ssh_server_ips": "",
+    "fw_ssh_ports": "$standard_ssh_port",
+    "fw_http_server_ips": "",
+    "fw_forward_http_server_ips": "",
+    "fw_http_ports": "$standard_http_ports",
+    "fw_log_cgi_traffic_out": False,
+    "fw_cgi_script_users": "",
+    "fw_mm_server_ips": "",
+    "fw_forward_mm_server_ips": "",
+    "fw_smtpd_ips": "",
+    "fw_forward_smtpd_ips": "",
+    "fw_smtpd_additional_listen_ports": "",
+    "fw_smtpd_additional_outgoing_ports": "",
+    "fw_mail_server_ips": "",
+    "fw_forward_mail_server_ips": "",
+    "fw_mail_user_ports": "$standard_mailuser_ports",
+    "fw_mail_client_ips": "",
+    "fw_forward_mail_client_ips": "",
+    "fw_dovecot_auth_service": False,
+    "fw_dovecot_auth_port": "$dovecot_external_auth_port",
+    "fw_dovecot_auth_allowed_networks_v4": "",
+    "fw_dovecot_auth_allowed_networks_v6": "",
+    "fw_ftp_server_ips": "",
+    "fw_forward_ftp_server_ips": "",
+    "fw_ftp_passive_port_range": "50000:50400",
+    "fw_xmpp_server_ips": "",
+    "fw_forward_xmpp_server_ips": "",
+    "fw_xmmp_tcp_in_ports": "5222 5223 5269",
+    "fw_xmmp_tcp_out_ports": "5269",
+    "fw_xmmp_remote_out_services_v4": "",
+    "fw_xmmp_remote_out_services_v6": "",
+    "fw_mumble_server_ips": "",
+    "fw_forward_mumble_server_ips": "",
+    "fw_mumble_ports": "$standard_mumble_port",
+    "fw_jitsi_server_ips": "",
+    "fw_forward_jitsi_server_ips": "",
+    "fw_jitsi_tcp_ports": "$standard_jitsi_tcp_ports",
+    "fw_jitsi_udp_port_range": "$standard_jitsi_udp_port_range",
+    "fw_jitsi_tcp_ports_out": "$standard_turn_service_ports,4443,4444,4445,4446",
+    "fw_jitsi_udp_ports_out": "$standard_http_ports,$standard_turn_service_ports,4443,4444,4445,4446",
+    "fw_jitsi_dovecot_auth": False,
+    "fw_jitsi_dovecot_host": "",
+    "fw_jitsi_jibri_remote_auth": False,
+    "fw_jitsi_jibri_remote_ips": "",
+    "fw_jibri_server_ips": "",
+    "fw_forward_jibri_server_ips": "",
+    "fw_jibri_remote_jitsi_server": "",
+    "fw_nc_turn_server_ips": "",
+    "fw_forward_nc_turn_server_ips": "",
+    "fw_nc_turn_ports": "$standard_turn_service_ports",
+    "fw_nc_turn_udp_ports": "$standard_turn_service_udp_ports",
+    "fw_tftp_server_ips": "",
+    "fw_prometheus_local_server_ips": "",
+    "fw_prometheus_local_client_ips": "",
+    "fw_prometheus_remote_server_ips": "",
+    "fw_munin_server_ips": "",
+    "fw_forward_munin_server_ips": "",
+    "fw_munin_remote_port": "$standard_munin_port",
+    "fw_munin_local_port": "4949",
+    "munin_remote_ipv4": "",
+    "munin_remote_ipv6": "",
+    "fw_xymon_server_ips": "",
+    "fw_local_xymon_client": False,
+    "fw_xymon_port": "$standard_xymon_port",
+    "fw_rsync_out_ips": "",
+    "fw_forward_rsync_out_ips": "",
+    "fw_rsync_ports": "873",
+    "fw_tcp_out_ports": "",
+    "fw_forward_tcp_out_ports": "",
+    "fw_udp_out_ports": "",
+    "fw_forward_udp_out_ports": "",
+    "fw_portforward_tcp_v4": "",
+    "fw_portforward_udp_v4": "",
+    "fw_portforward_tcp_v6": "",
+    "fw_portforward_udp_v6": "",
+    "fw_blocked_ips": "",
+    "fw_block_tcp_ports": "111 113 135 137:139 445",
+    "fw_block_udp_ports": "111 137:139",
+    "fw_create_traffic_counter": True,
+    "fw_create_iperf_rules": True,
+    "fw_protection_against_syn_flooding": True,
+    "fw_protection_against_port_scanning": True,
+    "fw_protection_against_ssh_brute_force_attacks": True,
+    "fw_limit_connections_per_source_IP": True,
+    "fw_per_IP_connection_limit": "$default_per_IP_connection_limit",
+    "fw_limit_new_tcp_connections_per_seconds_per_source_IP": True,
+    "fw_limit_new_tcp_connections_per_seconds_ports": "",
+    "fw_kernel_activate_forwarding": False,
+    "fw_kernel_support_dynaddr": False,
+    "fw_dynaddr_flag": "5",
+    "fw_kernel_reduce_timeouts": True,
+    "fw_kernel_tcp_syncookies": True,
+    "fw_kernel_protect_against_icmp_bogus_messages": True,
+    "fw_kernel_ignore_broadcast_ping": True,
+    "fw_kernel_deactivate_source_route": True,
+    "fw_kernel_dont_accept_redirects": True,
+    "fw_kernel_activate_rp_filter": True,
+    "fw_kernel_log_martians": False,
+    "fw_kernel_forward_between_interfaces": False,
+    "fw_vpn_ifs": "tun+",
+    "fw_wg_ifs": "wg+",
+    "fw_nat_devices": "",
+}
+
+# ---------------------------------------------------------------------------
+# Variable mapping: (bash_varname, source) → ansible_varname
+# source: 'iface_v4', 'iface_v6', 'main_v4', 'main_v6', 'main_shared'
+# ---------------------------------------------------------------------------
+
+# Shared service variables (read from main_ipv4.conf, same in both)
+MAIN_SHARED = {
+    "do_not_firewall_bridged_traffic": "fw_do_not_firewall_bridged_traffic",
+    "do_not_firewall_lx_guest_systems": "fw_do_not_firewall_lx_guest_systems",
+    "drop_icmp": "fw_drop_icmp",
+    "drop_mndp": "fw_drop_mndp",
+    "drop_mdns": "fw_drop_mdns",
+    "allow_all_outgoing_traffic": "fw_allow_all_outgoing_traffic",
+    "blocked_ifs": "fw_blocked_ifs",
+    "unprotected_ifs": "fw_unprotected_ifs",
+    "vpn_server_ips": "fw_vpn_server_ips",
+    "forward_vpn_server_ips": "fw_forward_vpn_server_ips",
+    "vpn_ports": "fw_vpn_ports",
+    "wireguard_server_ips": "fw_wireguard_server_ips",
+    "forward_wireguard_server_ips": "fw_forward_wireguard_server_ips",
+    "wireguard_server_ports": "fw_wireguard_server_ports",
+    "wireguard_out_ports": "fw_wireguard_out_ports",
+    "local_ntp_service": "fw_local_ntp_service",
+    "ntp_port": "fw_ntp_port",
+    "ntp_allowed_net": "fw_ntp_allowed_net",
+    "dns_server_ips": "fw_dns_server_ips",
+    "forward_dns_server_ips": "fw_forward_dns_server_ips",
+    "local_resolver_service": "fw_local_resolver_service",
+    "resolver_port": "fw_resolver_port",
+    "ssh_server_ips": "fw_ssh_server_ips",
+    "forward_ssh_server_ips": "fw_forward_ssh_server_ips",
+    "ssh_ports": "fw_ssh_ports",
+    "http_server_ips": "fw_http_server_ips",
+    "forward_http_server_ips": "fw_forward_http_server_ips",
+    "http_ports": "fw_http_ports",
+    "log_cgi_traffic_out": "fw_log_cgi_traffic_out",
+    "cgi_script_users": "fw_cgi_script_users",
+    "mm_server_ips": "fw_mm_server_ips",
+    "forward_mm_server_ips": "fw_forward_mm_server_ips",
+    "smtpd_ips": "fw_smtpd_ips",
+    "forward_smtpd_ips": "fw_forward_smtpd_ips",
+    "smtpd_additional_listen_ports": "fw_smtpd_additional_listen_ports",
+    "smtpd_additional_outgoung_ports": "fw_smtpd_additional_outgoing_ports",
+    "mail_server_ips": "fw_mail_server_ips",
+    "forward_mail_server_ips": "fw_forward_mail_server_ips",
+    "mail_user_ports": "fw_mail_user_ports",
+    "mail_client_ips": "fw_mail_client_ips",
+    "forward_mail_client_ips": "fw_forward_mail_client_ips",
+    "dovecot_auth_service": "fw_dovecot_auth_service",
+    "dovecot_auth_port": "fw_dovecot_auth_port",
+    "ftp_server_ips": "fw_ftp_server_ips",
+    "forward_ftp_server_ips": "fw_forward_ftp_server_ips",
+    "ftp_passive_port_range": "fw_ftp_passive_port_range",
+    "xmpp_server_ips": "fw_xmpp_server_ips",
+    "forward_xmpp_server_ips": "fw_forward_xmpp_server_ips",
+    "xmmp_tcp_in_ports": "fw_xmmp_tcp_in_ports",
+    "xmmp_tcp_out_ports": "fw_xmmp_tcp_out_ports",
+    "mumble_server_ips": "fw_mumble_server_ips",
+    "forward_mumble_server_ips": "fw_forward_mumble_server_ips",
+    "mumble_ports": "fw_mumble_ports",
+    "jitsi_server_ips": "fw_jitsi_server_ips",
+    "forward_jitsi_server_ips": "fw_forward_jitsi_server_ips",
+    "jitsi_tcp_ports": "fw_jitsi_tcp_ports",
+    "jitsi_udp_port_range": "fw_jitsi_udp_port_range",
+    "jitsi_tcp_ports_out": "fw_jitsi_tcp_ports_out",
+    "jitsi_udp_ports_out": "fw_jitsi_udp_ports_out",
+    "jitsi_dovecot_auth": "fw_jitsi_dovecot_auth",
+    "jitsi_dovecot_host": "fw_jitsi_dovecot_host",
+    "jitsi_jibri_remote_auth": "fw_jitsi_jibri_remote_auth",
+    "jitsi_jibri_remote_ips": "fw_jitsi_jibri_remote_ips",
+    "jibri_server_ips": "fw_jibri_server_ips",
+    "forward_jibri_server_ips": "fw_forward_jibri_server_ips",
+    "jibri_remote_jitsi_server": "fw_jibri_remote_jitsi_server",
+    "nc_turn_server_ips": "fw_nc_turn_server_ips",
+    "forward_nc_turn_server_ips": "fw_forward_nc_turn_server_ips",
+    "nc_turn_ports": "fw_nc_turn_ports",
+    "nc_turn_udp_ports": "fw_nc_turn_udp_ports",
+    "tftp_server_ips": "fw_tftp_server_ips",
+    "prometheus_local_server_ips": "fw_prometheus_local_server_ips",
+    "prometheus_local_client_ips": "fw_prometheus_local_client_ips",
+    "prometheus_remote_server_ips": "fw_prometheus_remote_server_ips",
+    "munin_server_ips": "fw_munin_server_ips",
+    "forward_munin_server_ips": "fw_forward_munin_server_ips",
+    "munin_remote_port": "fw_munin_remote_port",
+    "munin_local_port": "fw_munin_local_port",
+    "xymon_server_ips": "fw_xymon_server_ips",
+    "local_xymon_client": "fw_local_xymon_client",
+    "xymon_port": "fw_xymon_port",
+    "rsync_out_ips": "fw_rsync_out_ips",
+    "forward_rsync_out_ips": "fw_forward_rsync_out_ips",
+    "rsync_ports": "fw_rsync_ports",
+    "tcp_out_ports": "fw_tcp_out_ports",
+    "forward_tcp_out_ports": "fw_forward_tcp_out_ports",
+    "udp_out_ports": "fw_udp_out_ports",
+    "forward_udp_out_ports": "fw_forward_udp_out_ports",
+    "blocked_ips": "fw_blocked_ips",
+    "block_tcp_ports": "fw_block_tcp_ports",
+    "block_udp_ports": "fw_block_udp_ports",
+    "create_traffic_counter": "fw_create_traffic_counter",
+    "create_iperf_rules": "fw_create_iperf_rules",
+    "protection_against_syn_flooding": "fw_protection_against_syn_flooding",
+    "protection_against_port_scanning": "fw_protection_against_port_scanning",
+    "protection_against_ssh_brute_force_attacks": "fw_protection_against_ssh_brute_force_attacks",
+    "limit_connections_per_source_IP": "fw_limit_connections_per_source_IP",
+    "per_IP_connection_limit": "fw_per_IP_connection_limit",
+    "limit_new_tcp_connections_per_seconds_per_source_IP": "fw_limit_new_tcp_connections_per_seconds_per_source_IP",
+    "limit_new_tcp_connections_per_seconds_ports": "fw_limit_new_tcp_connections_per_seconds_ports",
+}
+
+# IPv4-only variables (from main_ipv4.conf)
+MAIN_V4_ONLY = {
+    "forward_private_ips": "fw_forward_private_ips_v4",
+    "restrict_local_service_to_net": "fw_restrict_local_service_to_net_v4",
+    "restrict_local_net_to_net": "fw_restrict_local_net_to_net_v4",
+    "allow_ext_service": "fw_allow_ext_service_v4",
+    "allow_ext_net": "fw_allow_ext_net_v4",
+    "allow_local_service": "fw_allow_local_service_v4",
+    "allow_local_service_from_networks": "fw_allow_local_service_from_networks_v4",
+    "portforward_tcp": "fw_portforward_tcp_v4",
+    "portforward_udp": "fw_portforward_udp_v4",
+    "munin_remote_ip": "munin_remote_ipv4",
+    "dovecot_auth_allowed_networks": "fw_dovecot_auth_allowed_networks_v4",
+    "xmmp_remote_out_services": "fw_xmmp_remote_out_services_v4",
+    "resolver_allowed_networks": "fw_resolver_allowed_networks_v4",
+    "dhcp_server_ifs": "fw_dhcp_server_ifs",
+    "dhcp_client_ifs": "fw_dhcp_client_ifs",
+    "kernel_activate_forwarding": "fw_kernel_activate_forwarding",
+    "kernel_support_dynaddr": "fw_kernel_support_dynaddr",
+    "dynaddr_flag": "fw_dynaddr_flag",
+    "kernel_reduce_timeouts": "fw_kernel_reduce_timeouts",
+    "kernel_tcp_syncookies": "fw_kernel_tcp_syncookies",
+    "kernel_protect_against_icmp_bogus_messages": "fw_kernel_protect_against_icmp_bogus_messages",
+    "kernel_ignore_broadcast_ping": "fw_kernel_ignore_broadcast_ping",
+    "kernel_activate_rp_filter": "fw_kernel_activate_rp_filter",
+    "kernel_log_martians": "fw_kernel_log_martians",
+    "kernel_deactivate_source_route": "fw_kernel_deactivate_source_route",
+    "kernel_dont_accept_redirects": "fw_kernel_dont_accept_redirects",
+}
+
+# IPv6-only variables (from main_ipv6.conf)
+MAIN_V6_ONLY = {
+    "forward_private_ips": "fw_forward_private_ips_v6",
+    "restrict_local_service_to_net": "fw_restrict_local_service_to_net_v6",
+    "restrict_local_net_to_net": "fw_restrict_local_net_to_net_v6",
+    "allow_ext_service": "fw_allow_ext_service_v6",
+    "allow_ext_net": "fw_allow_ext_net_v6",
+    "allow_local_service": "fw_allow_local_service_v6",
+    "allow_local_service_from_networks": "fw_allow_local_service_from_networks_v6",
+    "portforward_tcp": "fw_portforward_tcp_v6",
+    "portforward_udp": "fw_portforward_udp_v6",
+    "munin_remote_ip": "munin_remote_ipv6",
+    "dovecot_auth_allowed_networks": "fw_dovecot_auth_allowed_networks_v6",
+    "xmmp_remote_out_services": "fw_xmmp_remote_out_services_v6",
+    "resolver_allowed_networks": "fw_resolver_allowed_networks_v6",
+    "kernel_forward_between_interfaces": "fw_kernel_forward_between_interfaces",
+}
+
+
+# ---------------------------------------------------------------------------
+# Parsing
+# ---------------------------------------------------------------------------
+
+def parse_bash_config(text):
+    """
+    Parse key=value pairs from a bash config file.
+    Handles: var="value", var=value, var=true/false
+    Multiline values (var="line1\n  line2\n") are joined as a single string.
+    Returns dict of {varname: value_string}
+    """
+    result = {}
+    warnings = []
+
+    # Collapse multiline quoted strings: "...\n  ..." → "... ..."
+    # Strategy: scan char by char for opening " after =, collect until closing "
+    lines = text.splitlines()
+    i = 0
+    while i < len(lines):
+        line = lines[i].strip()
+
+        # Skip comments and blank lines
+        if not line or line.startswith('#'):
+            i += 1
+            continue
+
+        # Match assignment
+        m = re.match(r'^([A-Za-z_][A-Za-z0-9_]*)=(.*)', line)
+        if not m:
+            i += 1
+            continue
+
+        varname = m.group(1)
+        rest = m.group(2).strip()
+
+        # Quoted value (single or double quotes, may span multiple lines)
+        if rest and rest[0] in ('"', "'"):
+            quote_char = rest[0]
+            collected = rest[1:]  # strip opening quote
+            parts = []
+            closed = False
+
+            while True:
+                close_pos = collected.find(quote_char)
+                if close_pos != -1:
+                    parts.append(collected[:close_pos])
+                    # join all parts; split() collapses whitespace and drops empty lines
+                    value = ' '.join(' '.join(parts).split())
+                    result[varname] = value
+                    closed = True
+                    break
+                else:
+                    parts.append(collected)
+                    i += 1
+                    if i >= len(lines):
+                        break
+                    collected = lines[i].strip()
+
+            if not closed:
+                warnings.append(f"  # {varname}: unterminated quoted string — skipped")
+
+        else:
+            # Unquoted value (true, false, $var_ref, number, etc.)
+            # Strip trailing comment
+            value = re.sub(r'\s+#.*$', '', rest).strip()
+            result[varname] = value
+
+        i += 1
+
+    return result, warnings
+
+
+def ssh_cat(host, user, port, path, sudo_password=None):
+    """Read a file from a remote host via SSH. Returns file content or None."""
+    ssh_cmd = ["ssh"]
+    if user:
+        ssh_cmd += ["-l", user]
+    if port:
+        ssh_cmd += ["-p", str(port)]
+    ssh_cmd += ["-o", "BatchMode=yes", "-o", "ConnectTimeout=10", host]
+
+    if sudo_password is not None:
+        # Use sudo -S to read password from stdin; -p '' suppresses the prompt
+        ssh_cmd += [f"sudo -S -p '' cat {path}"]
+        stdin_data = sudo_password + "\n"
+    else:
+        ssh_cmd += [f"cat {path}"]
+        stdin_data = None
+
+    try:
+        result = subprocess.run(
+            ssh_cmd, input=stdin_data, capture_output=True, text=True, timeout=30
+        )
+        if result.returncode != 0:
+            print(f"  WARNING: could not read {path}: {result.stderr.strip()}", file=sys.stderr)
+            return None
+        return result.stdout
+    except subprocess.TimeoutExpired:
+        print(f"  ERROR: SSH timeout reading {path}", file=sys.stderr)
+        return None
+
+
+def coerce_bool(value):
+    """Convert bash true/false string to Python bool, or return string."""
+    if value.lower() in ("true", "yes", "1"):
+        return True
+    if value.lower() in ("false", "no", "0"):
+        return False
+    return value  # keep as string (e.g. $standard_ssh_port)
+
+
+def yaml_value(v):
+    """Format a Python value as a YAML-safe string."""
+    if isinstance(v, bool):
+        return "true" if v else "false"
+    if v == "":
+        return '""'
+    # Quote if contains special YAML characters
+    if any(c in str(v) for c in [':', '#', '{', '}', '[', ']', ',', '&', '*', '?', '|', '-', '<', '>', '=', '!', '%', '@', '`', '"', "'"]):
+        # Use double-quote with escaping
+        escaped = str(v).replace('\\', '\\\\').replace('"', '\\"')
+        return f'"{escaped}"'
+    return str(v)
+
+
+def build_host_vars(parsed_iface_v4, parsed_iface_v6, parsed_main_v4, parsed_main_v6):
+    """
+    Map parsed bash variables to Ansible fw_* variables.
+    Returns dict of {ansible_var: value} containing only non-default values.
+    """
+    result = {}
+
+    # --- Interfaces: extract lists from numbered vars ---
+    def extract_list(parsed, prefix, suffix="", count=3):
+        items = []
+        for i in range(1, count + 1):
+            v = parsed.get(f"{prefix}{i}{suffix}", "").strip()
+            if v:
+                items.append(v)
+        return items
+
+    fw_ext_interfaces = extract_list(parsed_iface_v4, "ext_if_")
+    fw_ext_ips_v4 = extract_list(parsed_iface_v4, "ext_", suffix="_ip")   # ext_1_ip, ext_2_ip, ext_3_ip
+    fw_ext_ips_v6 = extract_list(parsed_iface_v6, "ext_", suffix="_ip")
+    fw_local_interfaces = extract_list(parsed_iface_v4, "local_if_")
+    fw_local_ips_v4 = extract_list(parsed_iface_v4, "local_", suffix="_ip")
+    fw_local_ips_v6 = extract_list(parsed_iface_v6, "local_", suffix="_ip")
+    fw_lxc_guest_ips_v4 = extract_list(parsed_iface_v4, "lxc_guest_", suffix="_ip", count=7)
+    fw_lxc_guest_ips_v6 = extract_list(parsed_iface_v6, "lxc_guest_", suffix="_ip", count=7)
+
+    if fw_ext_interfaces:
+        result["fw_ext_interfaces"] = fw_ext_interfaces
+    if fw_ext_ips_v4:
+        result["fw_ext_ips_v4"] = fw_ext_ips_v4
+    if fw_ext_ips_v6:
+        result["fw_ext_ips_v6"] = fw_ext_ips_v6
+    if fw_local_interfaces:
+        result["fw_local_interfaces"] = fw_local_interfaces
+    if fw_local_ips_v4:
+        result["fw_local_ips_v4"] = fw_local_ips_v4
+    if fw_local_ips_v6:
+        result["fw_local_ips_v6"] = fw_local_ips_v6
+    if fw_lxc_guest_ips_v4:
+        result["fw_lxc_guest_ips_v4"] = fw_lxc_guest_ips_v4
+    if fw_lxc_guest_ips_v6:
+        result["fw_lxc_guest_ips_v6"] = fw_lxc_guest_ips_v6
+
+    # vpn_ifs / wg_ifs / nat_devices (same in both interface files)
+    for bash_var, ansible_var in [("vpn_ifs", "fw_vpn_ifs"), ("wg_ifs", "fw_wg_ifs"), ("nat_devices", "fw_nat_devices")]:
+        v = parsed_iface_v4.get(bash_var, "")
+        if v and v != DEFAULTS.get(ansible_var, ""):
+            result[ansible_var] = v
+
+    # --- Shared main variables (read from ipv4) ---
+    for bash_var, ansible_var in MAIN_SHARED.items():
+        raw = parsed_main_v4.get(bash_var)
+        if raw is None:
+            continue
+        v = coerce_bool(raw) if raw.lower() in ("true", "false") else raw
+        default = DEFAULTS.get(ansible_var)
+        if v != default:
+            result[ansible_var] = v
+
+    # --- IPv4-only main variables ---
+    for bash_var, ansible_var in MAIN_V4_ONLY.items():
+        raw = parsed_main_v4.get(bash_var)
+        if raw is None:
+            continue
+        v = coerce_bool(raw) if raw.lower() in ("true", "false") else raw
+        default = DEFAULTS.get(ansible_var)
+        if v != default:
+            result[ansible_var] = v
+
+    # --- IPv6-only main variables ---
+    for bash_var, ansible_var in MAIN_V6_ONLY.items():
+        raw = parsed_main_v6.get(bash_var)
+        if raw is None:
+            continue
+        v = coerce_bool(raw) if raw.lower() in ("true", "false") else raw
+        default = DEFAULTS.get(ansible_var)
+        if v != default:
+            result[ansible_var] = v
+
+    return result
+
+
+def render_yaml(hostname, host_vars, all_warnings):
+    """Render the host_vars as YAML text."""
+    lines = [
+        "---",
+        f"# ipt-firewall configuration for {hostname}",
+        "# Generated by extract-fw-host-vars.py - review before committing!",
+        "# Place in: host_vars/<hostname>/ipt_firewall.yml",
+        "",
+    ]
+
+    lines.append("fw_manage_config: false")
+    lines.append("")
+
+    if all_warnings:
+        lines.append("# WARNINGS — manual review needed:")
+        for w in all_warnings:
+            lines.append(w)
+        lines.append("")
+
+    # Group output by section
+    sections = [
+        ("Network", ["fw_ext_interfaces", "fw_ext_ips_v4", "fw_ext_ips_v6",
+                     "fw_local_interfaces", "fw_local_ips_v4", "fw_local_ips_v6",
+                     "fw_lxc_guest_ips_v4", "fw_lxc_guest_ips_v6",
+                     "fw_vpn_ifs", "fw_wg_ifs", "fw_nat_devices"]),
+        ("Munin", ["munin_remote_ipv4", "munin_remote_ipv6", "fw_munin_local_port",
+                   "fw_munin_server_ips", "fw_forward_munin_server_ips", "fw_munin_remote_port"]),
+        ("Bridged / LXC", ["fw_do_not_firewall_bridged_traffic", "fw_do_not_firewall_lx_guest_systems"]),
+        ("Drop policies", ["fw_drop_icmp", "fw_drop_mndp", "fw_drop_mdns"]),
+        ("Outgoing / interfaces", ["fw_allow_all_outgoing_traffic", "fw_blocked_ifs", "fw_unprotected_ifs"]),
+        ("Forwarding", ["fw_forward_private_ips_v4", "fw_forward_private_ips_v6",
+                        "fw_kernel_activate_forwarding", "fw_kernel_forward_between_interfaces"]),
+        ("Access control IPv4", ["fw_restrict_local_service_to_net_v4", "fw_restrict_local_net_to_net_v4",
+                                  "fw_allow_ext_service_v4", "fw_allow_ext_net_v4",
+                                  "fw_allow_local_service_v4", "fw_allow_local_service_from_networks_v4"]),
+        ("Access control IPv6", ["fw_restrict_local_service_to_net_v6", "fw_restrict_local_net_to_net_v6",
+                                  "fw_allow_ext_service_v6", "fw_allow_ext_net_v6",
+                                  "fw_allow_local_service_v6", "fw_allow_local_service_from_networks_v6"]),
+        ("SSH", ["fw_ssh_server_ips", "fw_forward_ssh_server_ips", "fw_ssh_ports"]),
+        ("HTTP", ["fw_http_server_ips", "fw_forward_http_server_ips", "fw_http_ports",
+                  "fw_log_cgi_traffic_out", "fw_cgi_script_users"]),
+        ("Mail", ["fw_smtpd_ips", "fw_forward_smtpd_ips", "fw_smtpd_additional_listen_ports",
+                  "fw_smtpd_additional_outgoing_ports", "fw_mail_server_ips", "fw_forward_mail_server_ips",
+                  "fw_mail_user_ports", "fw_mail_client_ips", "fw_forward_mail_client_ips",
+                  "fw_dovecot_auth_service", "fw_dovecot_auth_port",
+                  "fw_dovecot_auth_allowed_networks_v4", "fw_dovecot_auth_allowed_networks_v6"]),
+        ("DNS", ["fw_dns_server_ips", "fw_forward_dns_server_ips",
+                 "fw_local_resolver_service", "fw_resolver_port",
+                 "fw_resolver_allowed_networks_v4", "fw_resolver_allowed_networks_v6"]),
+        ("NTP", ["fw_local_ntp_service", "fw_ntp_port", "fw_ntp_allowed_net"]),
+        ("DHCP", ["fw_dhcp_server_ifs", "fw_dhcp_client_ifs"]),
+        ("VPN / WireGuard", ["fw_vpn_server_ips", "fw_forward_vpn_server_ips", "fw_vpn_ports",
+                              "fw_wireguard_server_ips", "fw_forward_wireguard_server_ips",
+                              "fw_wireguard_server_ports", "fw_wireguard_out_ports"]),
+        ("FTP", ["fw_ftp_server_ips", "fw_forward_ftp_server_ips", "fw_ftp_passive_port_range"]),
+        ("XMPP", ["fw_xmpp_server_ips", "fw_forward_xmpp_server_ips",
+                  "fw_xmmp_tcp_in_ports", "fw_xmmp_tcp_out_ports",
+                  "fw_xmmp_remote_out_services_v4", "fw_xmmp_remote_out_services_v6"]),
+        ("Mumble", ["fw_mumble_server_ips", "fw_forward_mumble_server_ips", "fw_mumble_ports"]),
+        ("Jitsi", ["fw_jitsi_server_ips", "fw_forward_jitsi_server_ips",
+                   "fw_jitsi_tcp_ports", "fw_jitsi_udp_port_range",
+                   "fw_jitsi_tcp_ports_out", "fw_jitsi_udp_ports_out",
+                   "fw_jitsi_dovecot_auth", "fw_jitsi_dovecot_host",
+                   "fw_jitsi_jibri_remote_auth", "fw_jitsi_jibri_remote_ips",
+                   "fw_jibri_server_ips", "fw_forward_jibri_server_ips", "fw_jibri_remote_jitsi_server"]),
+        ("TURN / STUN", ["fw_nc_turn_server_ips", "fw_forward_nc_turn_server_ips",
+                          "fw_nc_turn_ports", "fw_nc_turn_udp_ports"]),
+        ("Mattermost", ["fw_mm_server_ips", "fw_forward_mm_server_ips"]),
+        ("Prometheus", ["fw_prometheus_local_server_ips", "fw_prometheus_local_client_ips",
+                        "fw_prometheus_remote_server_ips"]),
+        ("Xymon", ["fw_xymon_server_ips", "fw_local_xymon_client", "fw_xymon_port"]),
+        ("Rsync", ["fw_rsync_out_ips", "fw_forward_rsync_out_ips", "fw_rsync_ports"]),
+        ("Out ports", ["fw_tcp_out_ports", "fw_forward_tcp_out_ports",
+                       "fw_udp_out_ports", "fw_forward_udp_out_ports"]),
+        ("Portforwarding", ["fw_portforward_tcp_v4", "fw_portforward_udp_v4",
+                             "fw_portforward_tcp_v6", "fw_portforward_udp_v6"]),
+        ("Block", ["fw_blocked_ips", "fw_block_tcp_ports", "fw_block_udp_ports"]),
+        ("Protection / limits", ["fw_protection_against_syn_flooding",
+                                  "fw_protection_against_port_scanning",
+                                  "fw_protection_against_ssh_brute_force_attacks",
+                                  "fw_limit_connections_per_source_IP", "fw_per_IP_connection_limit",
+                                  "fw_limit_new_tcp_connections_per_seconds_per_source_IP",
+                                  "fw_limit_new_tcp_connections_per_seconds_ports"]),
+        ("Kernel IPv4", ["fw_kernel_support_dynaddr", "fw_dynaddr_flag",
+                          "fw_kernel_reduce_timeouts", "fw_kernel_tcp_syncookies",
+                          "fw_kernel_protect_against_icmp_bogus_messages",
+                          "fw_kernel_ignore_broadcast_ping",
+                          "fw_kernel_deactivate_source_route", "fw_kernel_dont_accept_redirects",
+                          "fw_kernel_activate_rp_filter", "fw_kernel_log_martians"]),
+        ("Special", ["fw_create_traffic_counter", "fw_create_iperf_rules"]),
+    ]
+
+    emitted = set()
+    for section_name, keys in sections:
+        section_lines = []
+        for k in keys:
+            if k in host_vars:
+                v = host_vars[k]
+                if isinstance(v, list):
+                    section_lines.append(f"{k}:")
+                    for item in v:
+                        section_lines.append(f"  - \"{item}\"")
+                elif isinstance(v, bool):
+                    section_lines.append(f"{k}: {'true' if v else 'false'}")
+                else:
+                    section_lines.append(f"{k}: {yaml_value(str(v))}")
+                emitted.add(k)
+
+        if section_lines:
+            lines.append(f"# --- {section_name}")
+            lines.extend(section_lines)
+            lines.append("")
+
+    # Anything not covered by sections
+    remaining = {k: v for k, v in host_vars.items() if k not in emitted}
+    if remaining:
+        lines.append("# --- Other")
+        for k, v in remaining.items():
+            if isinstance(v, list):
+                lines.append(f"{k}:")
+                for item in v:
+                    lines.append(f"  - \"{item}\"")
+            elif isinstance(v, bool):
+                lines.append(f"{k}: {'true' if v else 'false'}")
+            else:
+                lines.append(f"{k}: {yaml_value(str(v))}")
+        lines.append("")
+
+    return "\n".join(lines)
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Extract ipt-firewall host_vars from a remote host")
+    parser.add_argument("hostname", help="Target hostname (must be in SSH config or known_hosts)")
+    parser.add_argument("--user", "-u", default="chris", help="SSH user (default: chris)")
+    parser.add_argument("--port", "-p", type=int, default=None, help="SSH port (default: 22)")
+    parser.add_argument("--output", "-o", default=None, help="Output file (default: stdout)")
+    parser.add_argument("--sudo", "-s", action="store_true",
+                        help="Read files via sudo (prompts for sudo password once)")
+    parser.add_argument("--dry-run", action="store_true", help="Print SSH commands without executing")
+    args = parser.parse_args()
+
+    hostname = args.hostname
+    conf_dir = "/etc/ipt-firewall"
+    files = {
+        "iface_v4": f"{conf_dir}/interfaces_ipv4.conf",
+        "iface_v6": f"{conf_dir}/interfaces_ipv6.conf",
+        "main_v4":  f"{conf_dir}/main_ipv4.conf",
+        "main_v6":  f"{conf_dir}/main_ipv6.conf",
+    }
+
+    if args.dry_run:
+        cmd = "sudo -S -p '' cat" if args.sudo else "cat"
+        for key, path in files.items():
+            print(f"ssh {args.user}@{hostname} {cmd} {path}")
+        return
+
+    sudo_password = None
+    if args.sudo:
+        import getpass
+        sudo_password = getpass.getpass(f"sudo password for {args.user}@{hostname}: ")
+
+    print(f"Connecting to {hostname} as {args.user} ...", file=sys.stderr)
+
+    contents = {}
+    for key, path in files.items():
+        print(f"  Reading {path} ...", file=sys.stderr)
+        content = ssh_cat(hostname, args.user, args.port, path, sudo_password=sudo_password)
+        contents[key] = content or ""
+
+    all_warnings = []
+    parsed = {}
+    for key, text in contents.items():
+        p, warnings = parse_bash_config(text)
+        parsed[key] = p
+        if warnings:
+            all_warnings.extend([f"  # [{key}] {w}" for w in warnings])
+
+    host_vars = build_host_vars(
+        parsed["iface_v4"], parsed["iface_v6"],
+        parsed["main_v4"],  parsed["main_v6"],
+    )
+
+    yaml_text = render_yaml(hostname, host_vars, all_warnings)
+
+    if args.output:
+        out_path = Path(args.output)
+        out_path.parent.mkdir(parents=True, exist_ok=True)
+        out_path.write_text(yaml_text)
+        print(f"Written to {out_path}", file=sys.stderr)
+    else:
+        print(yaml_text)
+
+
+if __name__ == "__main__":
+    main()
@@ -28,10 +28,10 @@ network_interfaces:
    address: 172.16.80.1
    netmask: 24
    gateway: 172.16.80.254
-    #nameservers:
+    # nameservers:
    #  - 192.168.81.1
    #  - 172.16.81.254
-    #search: ga.netz ga.intra
+    # search: ga.netz ga.intra


  - device: eno2
@@ -136,7 +136,7 @@ cron_user_entries:
    job: /root/bin/manage-gw-config/copy_gateway-config.sh GA-NH


-#cron_user_special_time_entries: []
+# cron_user_special_time_entries: []
 cron_user_special_time_entries:

  - name: "Check if Postfix Service is running at boot time"
@@ -222,7 +222,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -376,23 +376,23 @@ bind9_gateway_listen_on_v6:
 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
   - none

 bind9_transfer_source:  !!str "192.168.81.1"
 bind9_notify_source: !!str "192.168.81.1"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

 bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -416,4 +416,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -1,7 +1,7 @@
 ---


-#ansible_managed: !!str " *** [ Ansible managed file: DO NOT EDIT DIRECTLY ] ***"
+# ansible_managed: !!str " *** [ Ansible managed file: DO NOT EDIT DIRECTLY ] ***"

 ansible_managed: >
  *** ANSIBLE MANAGED FILE - DO NOT EDIT ***
@@ -56,8 +56,8 @@ ansible_remote_user:
    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
    shell: /bin/bash
    ssh_keys:
-     - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-     - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'

 # ---
 # vars used by roles/common/tasks/basic.yml
@@ -69,7 +69,7 @@ locales:
  - en_US.UTF-8
  - de_DE.UTF-8

-#copy_plain_files_security_limits: []
+# copy_plain_files_security_limits: []
 copy_plain_files_security_limits:

  # /etc/security/limits.d/*.conf
@@ -79,7 +79,7 @@ copy_plain_files_security_limits:
    dest_path: /etc/security/limits.d/90-user-NOFILE.conf


-#copy_plain_files_systemd: []
+# copy_plain_files_systemd: []
 copy_plain_files_systemd:

  # /etc/systemd/system.conf.d/*.conf
@@ -109,24 +109,23 @@ copy_plain_files_systemd:
    dest_path: /etc/systemd/system.conf.d/20-DefaultLimitRTTIME.conf


-#copy_plain_files_journald: []
+# copy_plain_files_journald: []
 copy_plain_files_journald:

-   - name: SystemMaxUse
-     src_path: etc/systemd/journald.conf.d/50-SystemMaxUse.conf
-     dest_path: /etc/systemd/journald.conf.d/50-SystemMaxUse.conf
+  - name: SystemMaxUse
+    src_path: etc/systemd/journald.conf.d/50-SystemMaxUse.conf
+    dest_path: /etc/systemd/journald.conf.d/50-SystemMaxUse.conf

-   - name: SystemMaxFileSize
-     src_path: etc/systemd/journald.conf.d/50-SystemMaxFileSize.conf
-     dest_path: /etc/systemd/journald.conf.d/50-SystemMaxFileSize.conf
+  - name: SystemMaxFileSize
+    src_path: etc/systemd/journald.conf.d/50-SystemMaxFileSize.conf
+    dest_path: /etc/systemd/journald.conf.d/50-SystemMaxFileSize.conf

-   - name: MaxFileSec
-     src_path: etc/systemd/journald.conf.d/50-MaxFileSec.conf
-     dest_path: /etc/systemd/journald.conf.d/50-MaxFileSec.conf
+  - name: MaxFileSec
+    src_path: etc/systemd/journald.conf.d/50-MaxFileSec.conf
+    dest_path: /etc/systemd/journald.conf.d/50-MaxFileSec.conf


-
-#copy_plain_files_sysctl: []
+# copy_plain_files_sysctl: []
 copy_plain_files_sysctl:

  # /etc/sysctl.d/*.conf
@@ -673,6 +672,7 @@ apt_initial_install_trixie:
  - bash
  - bash-completion
  - bc
+  - bind9-dnsutils
  - bridge-utils
  - btrfs-progs
  - bzip2
@@ -682,7 +682,6 @@ apt_initial_install_trixie:
  - curl
  - dbus
  - debian-keyring
-  - dnsutils
  - dselect
  - ethtool
  - fdisk
@@ -697,7 +696,6 @@ apt_initial_install_trixie:
  - gettext-doc
  - git
  - groff
-  - groff
  - haveged
  - hdparm
  - htop
@@ -731,7 +729,7 @@ apt_initial_install_trixie:
  - lsof
  - lua5.4
  - lynx
-  - man
+  - man-db
  - mawk
  - mc
  - moreutils
@@ -746,6 +744,11 @@ apt_initial_install_trixie:
  - perl
  - perl-doc
  - psmisc
+  - python3
+  - python3-apt
+  - python3-systemd
+  - python-apt-common
+  - python-is-python3
  - quota
  - quotatool
  - rblcheck
@@ -779,7 +782,6 @@ apt_initial_install_trixie:
  - wget
  - whois
  - wipe
-  - wipe
  - zip
  - zsh

@@ -1260,7 +1262,7 @@ apt_compiler_pkgs:
  - libncurses-dev
  - libsystemd-dev
  - libnss3-dev
-  #- python-dev
+  # - python-dev

 yum_compiler_pkgs_centos:
  - gcc-c++
@@ -1473,10 +1475,10 @@ yum_webserver_pkgs_centos:
  - poppler-utils

  # - libqdbm-dev
-  #- libatm-dev
-  #- libc-client2007e-dev
-  #- libc-client-dev
-  #- ffmpeg
+  # - libatm-dev
+  # - libc-client2007e-dev
+  # - libc-client-dev
+  # - ffmpeg

 yum_webserver_pkgs_fedora:
  - libdb-devel
@@ -1816,26 +1818,26 @@ apt_postgresql_pkgs:
  - postgresql

 yum_postgresql_pkgs_centos:
-   - postgresql
-   - postgresql-server
-   - postgresql-libs
-   - postgresql-devel
-   - postgresql-static
-   - postgresql-plperl
-   - perl-DBD-Pg
-   - perl-DateTime-Format-Pg
-   - check_postgres
+  - postgresql
+  - postgresql-server
+  - postgresql-libs
+  - postgresql-devel
+  - postgresql-static
+  - postgresql-plperl
+  - perl-DBD-Pg
+  - perl-DateTime-Format-Pg
+  - check_postgres

 yum_postgresql_pkgs_fedora:
-   - postgresql
-   - postgresql-server
-   - postgresql-libs
-   - postgresql-private-devel
-   - postgresql-static
-   - postgresql-plperl
-   - perl-DBD-Pg
-   - perl-DateTime-Format-Pg
-   - check_postgres
+  - postgresql
+  - postgresql-server
+  - postgresql-libs
+  - postgresql-private-devel
+  - postgresql-static
+  - postgresql-plperl
+  - perl-DBD-Pg
+  - perl-DateTime-Format-Pg
+  - check_postgres

 install_bind_packages: false
 apt_bind_pkgs:
@@ -1915,12 +1917,12 @@ apt_extra_pkgs: []
 apt_install: {}
 apt_install_state: latest

-apt_remove:
-  - rpcbind
-  - apt-transport-tor
-  - tor
-  - tor-geoipdb
-  - torsocks
+apt_remove: []
+# apt_remove:
+#   - apt-transport-tor
+#   - tor
+#   - tor-geoipdb
+#   - torsocks

 apt_remove_purge: false

@@ -2172,7 +2174,7 @@ yum_initial_install_fedora_38:
  - btrfs-progs


-  #- ntpdate
+  # - ntpdate


 # ---
@@ -2234,7 +2236,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - oopen.de

@@ -2243,7 +2245,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -2281,7 +2283,7 @@ munin_remote_ipv6_old: 2a01:4f9:3a:1051::84
 # ---

 cron_env_entries: []
-#cron_env_entries:
+# cron_env_entries:
 #  - name: PATH
 #    job: /root/bin/admin-stuff:/root/bin:usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 #
@@ -2289,7 +2291,7 @@ cron_env_entries: []
 #    job: /bin/bash

 cron_user_entries: []
-#cron_user_entries:
+# cron_user_entries:
 #
 #  - name: "Check if Postfix Mailservice is up and running?"
 #    minute: "*/15"
@@ -2301,7 +2303,7 @@ cron_user_entries: []


 cron_user_special_time_entries: []
-#cron_user_special_time_entries:
+# cron_user_special_time_entries:
 #
 #  - name: "Check if Postfix Service is running at boot time"
 #    special_time: reboot
@@ -2378,9 +2380,6 @@ extra_system_user: []


 entries_authorized_key: []
-#entries_authorized_key:
-#  - user: root
-#  - key: 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDcc4brtgGW0xP2KiZGq5xsyUKcNiYF72zQ49Z0lqx3iu0zj9oz79oGZY1N9jCeKG30AsbwL+4H6/l2hAekFZu6fIwuiRgCVRAwYrnnlOGDAnYOGHfks23pk2BU0/fb2VnxiK967FvpJ/xDP49t1UC5voX/O2MTkz6NROJPwIClHgnwN1bg+C09UpJNmmdROi8myhiu1/aYbAWDfQzVUnHio0q3vBM16ZUQkoIHxQT4fF8elS408n0jd9WJHyRtLB/mCMI6O3G2yHdPVciqKwgRwRtJ8hDjmFfyeLtxb4ADpa2Q/f6MuJI0elxbxjp8l2XKjVSwPJ8GKomC16HfgFMrnUNQcx9YMrXB26f+lperf9NlwbQtXZffj9M+BxTAFvh+1Q/iIHqRat2Bb/8OUY9JI2zuWUliffqb5Kbzjik4vMqZvI2ED2zphsPcpLST7u+4z40vZliBf1F4P2vDBfIRK87ldfJQQw6saMZznjZPNV7CA+K7IFCpOz0wuoVE3wOka8hdYmMIMno34Zf6P+xuTaAPXJOCubKuhicUlhtX7q72Pln5kuvbO3ZRgEK3XnyIWeAd2rkaU6XVo7W19043e9HkkbG8nZETYu7TGFhufXyloinde5XLyW295BS8fKa1AteJPDLY4ClF2PZiWbxWRjAhlRAlgXgup09rN2HHjw== root@b.ns'

 create_sftp_group: false

@@ -2409,8 +2408,8 @@ sshd_ports:
  - 22

 sshd_listen_address:
-   - '::'
-   - '0.0.0.0'
+  - '::'
+  - '0.0.0.0'

 sshd_host_keys:
  - /etc/ssh/ssh_host_rsa_key
@@ -2441,9 +2440,9 @@ sshd_kbd_interactive_authentication:

 sshd_use_pam: !!str "yes"

-#sshd_allowed_users:
-#  - chris
-#  - sysadm
+# sshd_allowed_users:
+#   - chris
+#   - sysadm
 sshd_allowed_users: {}

 sshd_print_motd: !!str "no"
@@ -2452,7 +2451,7 @@ sshd_use_dns: !!str "no"

 sshd_gateway_ports: !!str "no"

-#sshd_required_rsa_size: 4096
+# sshd_required_rsa_size: 4096

 # This users are allowed to use password authentification
 #
@@ -2580,31 +2579,31 @@ bind9_gateway_acl:
      - ::1/128

 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - none
+  - none

-#bind9_transfer_source:  !!str "192.168.182.1"
+# bind9_transfer_source:  !!str "192.168.182.1"
 bind9_transfer_source: {}

-#bind9_notify_source: !!str "192.168.182.1"
+# bind9_notify_source: !!str "192.168.182.1"
 bind9_notify_source: {}

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# ind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -2626,6 +2625,8 @@ ntp_server: {}
 # Firewall repository
 # ---

+git_default_branch: main
+
 git_firewall_repository: {}

 # ---
@@ -2894,7 +2895,7 @@ git_jitsi_meet_repositories:
 # ---
 # group [so36_server_dehydrated]
 # ---
-#git_so36_dehydrated_repositories:
+# git_so36_dehydrated_repositories:
 #
 #  # install repositories (destination: /usr/local/src/)
 #  - name: dehydrated-cron
@@ -2924,7 +2925,7 @@ nfs_start_servers: 16
 # NOTE !!
 #    Take car to increase 'fsid' in case of more than one export
 #
-#nfs_exports:
+# nfs_exports:
 #   - src: 192.168.112.10:/data/home
 #     path: /data/home
 #     mount_opts: users,rsize=8192,wsize=8192,hard,intr
@@ -2988,9 +2989,25 @@ copy_plain_files_postfwd:
    src_path: mailserver/etc/postfix/postfwd.bl-user
    dest_path: /etc/postfix/postfwd.bl-user

+  - name: postfwd.high_rate_ip
+    src_path: mailserver/etc/postfix/postfwd.high_rate_ip
+    dest_path: /etc/postfix/postfwd.high_rate_ip
+
+  - name: postfwd.high_rate_hostname
+    src_path: mailserver/etc/postfix/postfwd.high_rate_hostname
+    dest_path: /etc/postfix/postfwd.high_rate_hostname
+
  - name: postfwd.bl-recipient-exeeds-msg-size-20mb
    src_path: mailserver/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
-    dest_path:  /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
+    dest_path: /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
+
+  - name: postfwd.high-rate-number-messages
+    src_path: mailserver/etc/postfix/postfwd.high-rate-number-messages
+    dest_path: /etc/postfix/postfwd.high-rate-number-messages
+
+  - name: postfwd.high-rate-number-recipients
+    src_path: mailserver/etc/postfix/postfwd.high-rate-number-recipients
+    dest_path: /etc/postfix/postfwd.high-rate-number-recipients

  - name: postfwd.wl-hosts
    src_path: mailserver/etc/postfix/postfwd.wl-hosts
@@ -3085,18 +3102,18 @@ si_authorisation_signature:

 website_name_postfixadmin:

-#email_welcome_message: "\n
-#Hallo,\n
+# email_welcome_message: "\n
+# Hallo,\n
 #
-#Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+# Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
 #
-#O.OPEN\n
+# O.OPEN\n
 #
-#--\n
-#O.OPEN            |   Phone:  +49 30 / 290 484 91\n
-#Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99\n
-#D-10999 Berlin    |   E-MAIL: oo@oopen.de\n
-#"
+# --\n
+# O.OPEN            |   Phone:  +49 30 / 290 484 91\n
+# Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99\n
+# -10999 Berlin    |   E-MAIL: oo@oopen.de\n
+# "
 email_welcome_message:

 # -
@@ -3107,12 +3124,12 @@ dovecot_from_address:
 dovecot_reply_to:
 webmailer_address:

-#salutation: "O.OPEN\n
+# salutation: "O.OPEN\n
 #
-#--\n
-#O.OPEN           |   Phone:  +49 30 / 290 484 91\n
-#Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99\n
-#D-10999 Berlin   |   http://oopen.de"
+# --\n
+# O.OPEN           |   Phone:  +49 30 / 290 484 91\n
+# Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99\n
+# D-10999 Berlin   |   http://oopen.de"
 salutation:

 # -
@@ -3260,24 +3277,22 @@ samba_cronjob_permissions:
 # start automatically after boot.
 #
 debian_services_active_and_started:
-   - bind
-   - cron
-   - haveged
-   - ntp
-   - redis-server
-   - ssh
-   - tor
+  - bind
+  - cron
+  - haveged
+  - ntp
+  - redis-server
+  - ssh
+  - tor

 redhat_services_active_and_started:
-   - crond
-   - haveged
-   - named
-   - ntpd
-   - redis
-   - sshd
-   - tor
-
-
+  - crond
+  - haveged
+  - named
+  - ntpd
+  - redis
+  - sshd
+  - tor


 # ==============================
@@ -1,175 +0,0 @@
---
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-copy_additional_plain_files_sysctl:
-
-  - name: enable-ipv6
-    src_path: etc/sysctl.d/30-enable-ipv6.conf
-    dest_path: /etc/sysctl.d/30-enable-ipv6.conf
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-#sshd_hostkeyalgorithms:
-#  - ssh-ed25519
-#  - ssh-ed25519-cert-v01@openssh.com
-#  - rsa-sha2-256
-#  - rsa-sha2-512
-#  - ecdsa-sha2-nistp256
-#  - rsa-sha2-256-cert-v01@openssh.com
-#  - rsa-sha2-512-cert-v01@openssh.com
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 127.0.0.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - akb.netz
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 194.150.168.168
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-bind9_gateway_listen_on_v6:
-  - none
-
-bind9_gateway_listen_on:
-  - any
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $y$j9T$IVBTpn.OrI6YiQ9q3fA8b1$Y1bmID5yXJbKfoLFt1VmQs6LezeTj5/1M9ppZBD2Pn4
-
@@ -45,8 +45,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -57,20 +57,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 185.12.64.2
+  - 185.12.64.2


 # ---
@@ -107,14 +107,14 @@ insert_root_ssh_keypair: true

 root_ssh_keypair:
  - name: id-rsa-dehydrated
-    priv_key_src: a.mx/root/.ssh/a.mx-id_rsa-dehydrated
+    priv_key_src: a.mx.oopen.de/root/.ssh/a.mx-id_rsa-dehydrated
    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: a.mx/root/.ssh/a.mx-id_rsa-dehydrated.pub
+    pub_key_src: a.mx.oopen.de/root/.ssh/a.mx-id_rsa-dehydrated.pub
    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
  - name: id-rsa-opendkim
-    priv_key_src: a.mx/root/.ssh/a.mx-id_rsa-opendkim
+    priv_key_src: a.mx.oopen.de/root/.ssh/a.mx-id_rsa-opendkim
    priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: a.mx/root/.ssh/a.mx-id_rsa-opendkim.pub
+    pub_key_src: a.mx.oopen.de/root/.ssh/a.mx-id_rsa-opendkim.pub
    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub


@@ -151,53 +151,6 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---

-copy_plain_files:
-
-  # /root/bin/monitoring
-  #
-  - name: monitoring_check_cert_for_dovecot.conf
-    src_path: a.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf
-    dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: a.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_postfix_add_mailboxes.conf
-    src_path: a.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf
-    dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
-
-  - name: postfix_sent_userinfo_postfix.conf
-    src_path: a.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf
-    dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: a.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfwd_host_specific:
-
-  # Postfix Firewall postfwd
-  #
-  - name: postfwd.wl-user
-    src_path: a.mx/etc/postfix/postfwd.wl-user
-    dest_path: /etc/postfix/postfwd.wl-user
-
-  - name: postfwd.bl-recipient-exeeds-msg-size-20mb
-    src_path: a.mx/etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
-    dest_path:  /etc/postfix/postfwd.bl-recipient-exeeds-msg-size-20mb
-
-
-#copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-

 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -219,7 +172,7 @@ db_in_use: !!str "true"
 postfix_db_type: PostgreSQL
 postfix_db_name: postfix
 postfix_db_user: postfix
-#postfix_db_host: /run/postgresql
+# postfix_db_host: /run/postgresql
 postfix_db_pass: FKt4z55FxMZp

 # install_amavis.conf
@@ -228,33 +181,34 @@ mp_receipt_number: 106015125438
 si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e

 # install_postfixadmin.conf
-# 
+#
 website_name_postfixadmin: adm.oopen.de

-email_welcome_message: "\n
-Hallo,\n
+email_welcome_message: |

-Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+  Hallo,

-O.OPEN\n
+  Ihre/Deine neue E-Mail Adresse ist eingerichtet.

--\n
-O.OPEN            |   Phone:  +49 30 / 290 484 91\n
-Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99\n
-D-10999 Berlin    |   E-MAIL: oo@oopen.de\n
-"
+  O.OPEN
+
+  --
+  O.OPEN            |   Phone:  +49 30 / 290 484 91
+  Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99
+  D-10999 Berlin    |   E-MAIL: oo@oopen.de

 # install_update_dovecot.conf
 #
 dovecot_from_address: "o.open <oo@oopen.de>"
 dovecot_reply_to: "oo@oopen.de"
 webmailer_address: "https://webmail.oopen.de"
-salutation: "O.OPEN\n
+salutation: |
+  O.OPEN

--\n
-O.OPEN           |   Phone:  +49 30 / 290 484 91\n
-Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99\n
-D-10999 Berlin   |   http://oopen.de\n"
+  --
+  O.OPEN           |   Phone:  +49 30 / 290 484 91
+  Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99
+  D-10999 Berlin   |   http://oopen.de

 # install_upgrade_roundcube-webmail.conf
 #
@@ -265,7 +219,7 @@ autoreply_hostname: autoreply.oopen.de
 roundcube_db_type: pgsql
 roundcube_db_name: roundcubemail
 roundcube_db_user: roundcube
-#roundcube_db_host: localhost
+# roundcube_db_host: localhost
 roundcube_db_pass: '3Dsz3j5R'

 roundcube_acl_plugin: true
@@ -281,7 +235,7 @@ autoreply_2_hostname: autoreply.oopen.de
 roundcube_2_db_type: pgsql
 roundcube_2_db_name: roundcubemail2
 roundcube_2_db_user: roundcube
-#roundcube_2_db_host: localhost
+# roundcube_2_db_host: localhost
 roundcube_2_db_pass: '3Dsz3j5R'

 roundcube2_acl_plugin: true
@@ -0,0 +1,45 @@
+---
+# ipt-firewall configuration for a.mx.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "95.217.204.247"
+fw_ext_ips_v6:
+  - "2a01:4f9:4a:47e5::247"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_smtpd_ips: $ext_1_ip
+fw_mail_server_ips: $ext_1_ip
+fw_mail_client_ips: $ext_1_ip
+fw_dovecot_auth_service: true
+
+# - meet.oopen.de       -> 159.69.74.155
+# - meet.akweb.de       -> 148.251.14.136
+# - jo.oopen.de         -> 94.16.115.62
+# -
+# - meet.akweb.de                   -> 2a01:4f8:201:7389::136
+# - meet.oopen.de                   -> 2a01:4f8:231:19a7::155
+fw_dovecot_auth_allowed_networks_v4: 159.69.74.155 148.251.14.136 94.16.115.62
+fw_dovecot_auth_allowed_networks_v6: "2a01:4f8:231:19a7::155 2a01:4f8:201:7389::136"
+
+# --- Jitsi
+fw_jitsi_dovecot_auth: true
+
+# --- Rsync
+fw_rsync_out_ips: $ext_1_ip
+
+# --- Protection / limits
+fw_per_IP_connection_limit: 250 # noqa: var-naming[pattern]
@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length

 # ---
 # vars used by roles/ansible_dependencies
@@ -86,8 +87,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -98,20 +99,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -129,10 +130,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -142,7 +143,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -198,45 +199,45 @@ copy_plain_files:
 # ---

 symlink_files:
-   - name: bind_get_domain_by_hostname
-     src_path: /root/bin/bind/bind_get_domain_by_hostname.sh
-     dest_path: /usr/local/bin/bind_get_domain_by_hostname.sh
+  - name: bind_get_domain_by_hostname
+    src_path: /root/bin/bind/bind_get_domain_by_hostname.sh
+    dest_path: /usr/local/bin/bind_get_domain_by_hostname.sh

-   - name: bind_get_zonefile_by_hostname
-     src_path: /root/bin/bind/bind_get_zonefile_by_hostname.sh
-     dest_path: /usr/local/bin/bind_get_zonefile_by_hostname.sh
+  - name: bind_get_zonefile_by_hostname
+    src_path: /root/bin/bind/bind_get_zonefile_by_hostname.sh
+    dest_path: /usr/local/bin/bind_get_zonefile_by_hostname.sh

-   - name: bind_rndc_sync_clean
-     src_path: /root/bin/bind/bind_rndc_sync_clean.sh
-     dest_path: /usr/local/bin/bind_rndc_sync_clean.sh
+  - name: bind_rndc_sync_clean
+    src_path: /root/bin/bind/bind_rndc_sync_clean.sh
+    dest_path: /usr/local/bin/bind_rndc_sync_clean.sh

-   - name: /bind_set_new_serial
-     src_path: /root/bin/bind/bind_set_new_serial.sh
-     dest_path: /usr/local/bin/bind_set_new_serial.sh
+  - name: /bind_set_new_serial
+    src_path: /root/bin/bind/bind_set_new_serial.sh
+    dest_path: /usr/local/bin/bind_set_new_serial.sh

-   - name: bind_set_renew_tlsa
-     src_path: /root/bin/bind/bind_set_renew_tlsa.sh
-     dest_path: /usr/local/bin/bind_set_renew_tlsa.sh
+  - name: bind_set_renew_tlsa
+    src_path: /root/bin/bind/bind_set_renew_tlsa.sh
+    dest_path: /usr/local/bin/bind_set_renew_tlsa.sh

-   - name: bind_add_dkim_zone_master
-     src_path: /root/bin/bind/bind_add_dkim_zone_master.sh
-     dest_path: /usr/local/bin/bind_add_dkim_zone_master.sh
+  - name: bind_add_dkim_zone_master
+    src_path: /root/bin/bind/bind_add_dkim_zone_master.sh
+    dest_path: /usr/local/bin/bind_add_dkim_zone_master.sh

-   - name: bind_add_dkim_zone_slave
-     src_path: /root/bin/bind/bind_add_dkim_zone_slave.sh
-     dest_path: /usr/local/bin/bind_add_dkim_zone_slave.sh
+  - name: bind_add_dkim_zone_slave
+    src_path: /root/bin/bind/bind_add_dkim_zone_slave.sh
+    dest_path: /usr/local/bin/bind_add_dkim_zone_slave.sh

-   - name: bind_reload_all_zones
-     src_path: /root/bin/bind/bind_reload_all_zones.sh
-     dest_path: /usr/local/bin/bind_reload_all_zones.sh
+  - name: bind_reload_all_zones
+    src_path: /root/bin/bind/bind_reload_all_zones.sh
+    dest_path: /usr/local/bin/bind_reload_all_zones.sh

-   - name: bind_remove_domain_on_master
-     src_path: /root/bin/bind/bind_remove_domain_on_master.sh
-     dest_path: /usr/local/bin/bind_remove_domain_on_master.sh
+  - name: bind_remove_domain_on_master
+    src_path: /root/bin/bind/bind_remove_domain_on_master.sh
+    dest_path: /usr/local/bin/bind_remove_domain_on_master.sh

-   - name: bind_remove_domain_on_slave
-     src_path: /root/bin/bind/bind_remove_domain_on_slave.sh
-     dest_path: /usr/local/bin/bind_remove_domain_on_slave.sh
+  - name: bind_remove_domain_on_slave
+    src_path: /root/bin/bind/bind_remove_domain_on_slave.sh
+    dest_path: /usr/local/bin/bind_remove_domain_on_slave.sh


 # ---
@@ -244,13 +245,9 @@ symlink_files:
 # ---


-
-
-
 # ==============================


 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,27 @@
+---
+# ipt-firewall configuration for a.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "195.201.179.131"
+fw_ext_ips_v6:
+  - "2a01:4f8:231:19a7::131"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- DNS
+fw_dns_server_ips: $ext_ips
+
+# --- VPN / WireGuard
+fw_wireguard_server_ips: $ext_ips
+
+# --- Block
+fw_blocked_ips: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -139,4 +139,3 @@ resolved_fallback_nameserver:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length

 # ---
 # vars used by roles/ansible_dependencies
@@ -29,7 +30,7 @@
 # vars used by roles/common/tasks/users.yml
 # ---

-extra_user: 
+extra_user:

  - name: kaya
    user_id: 1002
@@ -121,7 +122,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - wf.netz
@@ -131,7 +132,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -163,10 +164,130 @@ resolved_fallback_nameserver:
 # see: roles/common/tasks/vars


+# ---
+# vars used by roles/common/tasks/nfs.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/samba-config-server.yml
+# vars used by roles/common/tasks/samba-user.yml
+# ---
+
+samba_server_ip: 192.168.52.10
+samba_server_cidr_prefix: 24
+
+samba_workgroup: WF
+
+samba_netbios_name: ANITA
+
+samba_groups:
+  - name: users
+    group_id: 100
+  - name: archive
+    group_id: 1020
+  - name: intern
+    group_id: 1030
+
+samba_user:
+
+  - name: annette
+    groups:
+      - users
+      - intern
+    password: '20.18-annette%'
+
+  - name: axel
+    groups:
+      - archive
+      - users
+      - intern
+    password: 'axel123'
+
+  - name: chris
+    groups:
+      - users
+      - archive
+      - intern
+    password: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          63643330373231636537366333326630333265303265653933613835656262323863363038653234
+          3462653135633266373439626263356636646637643035340a653466356235346663626163306363
+          61313164643061306433643738643563303036646334376536626531383965303036386162393832
+          6631333038306462610a356535633265633563633962333137326533633834636331343562633765
+          3631
+
+  - name: kaya
+    groups:
+      - users
+      - intern
+    password: 'kaya123'
+
+  - name: lalix
+    groups:
+      - users
+      - intern
+    password: 'lalix123'
+
+  - name: mariette
+    groups:
+      - users
+      - intern
+    password: 'mariette123'
+
+  - name: sysadm
+    groups:
+      - users
+      - archive
+      - intern
+    password: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          31306162383164643133623335323736323837613435333430363336353032323565633130353733
+          3363646437363062313763636333356436666331396131370a393762363931626166326530373261
+          62616332643232663432613662646134613539323861383436636364633562646138646538343863
+          6530336565363934330a363063653533396666373730663062363633363634363337323039363231
+          3130
+
+base_home: /home
+
+samba_homes_virusfilter: true
+
+samba_shares:
+
+  - name: archiv
+    path: /data/samba/archiv
+    group_valid_users: users
+    group_write_list: archive
+    file_create_mask: !!str 664
+    dir_create_mask: !!str 2775
+    vfs_object_virusfilter: true
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+  - name: daten2
+    path: /data/samba/daten2
+    group_valid_users: users
+    group_write_list: users
+    file_create_mask: !!str 664
+    dir_create_mask: !!str 2775
+    vfs_object_virusfilter: true
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+  - name: verwaltung
+    path: /data/samba/archiv
+    group_valid_users: intern
+    group_write_list: intern
+    file_create_mask: !!str 664
+    dir_create_mask: !!str 2775
+    vfs_object_virusfilter: true
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+
+
 # ==============================


 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -120,7 +120,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ak.local
@@ -130,7 +130,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.0.254
+  - 172.16.0.254


 # ---
@@ -145,7 +145,6 @@ cron_user_special_time_entries:
    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -270,16 +269,16 @@ samba_user:
      - technik
    password: 'aS2ifv2.d-FI'

-
-
 base_home: /data/home

+samba_homes_virusfilter: true
+
 # remove_samba_users:
 #   - name: name1
 #   - name: name2
 #
 remove_samba_users: []
-#remove_samba_users:
+# remove_samba_users:
 #  - name: evren

 samba_shares:
@@ -291,6 +290,7 @@ samba_shares:
    group_write_list: alle
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -305,12 +305,13 @@ samba_shares:
    recycle_path: '@Recycle'

  - name: redakteure
-    comment: Verzeichnis für Redakteure 
+    comment: Verzeichnis für Redakteure
    path: /data/samba/shares/redakteure
    group_valid_users: redakteure
    group_write_list: redakteure
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -321,6 +322,7 @@ samba_shares:
    group_write_list: technik
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -331,6 +333,7 @@ samba_shares:
    group_write_list: alle
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -26,8 +26,6 @@

 install_compiler_pkgs: true

-install_postgresql_pkgs: true
-

 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
@@ -45,8 +43,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -57,20 +55,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +81,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +94,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -107,14 +105,14 @@ insert_root_ssh_keypair: true

 root_ssh_keypair:
  - name: id-rsa-dehydrated
-    priv_key_src: d.mx/root/.ssh/d.mx-id_rsa-dehydrated
+    priv_key_src: b.mx.oopen.de/root/.ssh/b.mx-id_rsa-dehydrated
    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: d.mx/root/.ssh/d.mx-id_rsa-dehydrated.pub
+    pub_key_src: b.mx.oopen.de/root/.ssh/b.mx-id_rsa-dehydrated.pub
    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
  - name: id-rsa-opendkim
-    priv_key_src: d.mx/root/.ssh/d.mx-id_rsa-opendkim
+    priv_key_src: b.mx.oopen.de/root/.ssh/b.mx-id_rsa-opendkim
    priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: d.mx/root/.ssh/d.mx-id_rsa-opendkim.pub
+    pub_key_src: b.mx.oopen.de/root/.ssh/b.mx-id_rsa-opendkim.pub
    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub


@@ -151,20 +149,6 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---

-copy_plain_files:
-
-  - name: postfix_create_opendkim_key.conf
-    src_path: d.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: d.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-  - name: install_sympa.conf
-    src_path: lists.mx.warenform/usr/local/src/sympa/conf/install_sympa.conf
-    dest_path: /usr/local/src/sympa/conf/install_sympa.conf
-

 copy_template_files: []
 #
@@ -173,18 +157,17 @@ copy_template_files: []
 #    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf


-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---

-hostname: d.mx.oopen.de
-ipv4_address: 95.217.204.227
-ipv6_address: 2a01:4f9:4a:47e5::227
+hostname: b.mx.oopen.de
+ipv4_address: 162.55.82.73
+ipv6_address: 2a01:4f8:271:1266::73

 admin_email: argus@oopen.de
-is_relay_host: false
-is_sympa_list_server: true
+is_relay_host: !!str "true"
+sasl_auth_enable: !!str "yes"

 # install_amavis.conf
 #
@@ -194,10 +177,10 @@ si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07e

 template_files_mailsystem_script:

-  - name: mailsystem_install_postfix_advanced.conf
-    src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
-    dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf
-
  - name: mailsystem_install_amavis.conf
    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
+
+  - name: mailsystem_install_postfix_advanced.conf
+    src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
+    dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf
@@ -0,0 +1,28 @@
+---
+# ipt-firewall configuration for b.mx.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "162.55.82.73"
+fw_ext_ips_v6:
+  - "2a01:4f8:271:1266::73"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_smtpd_ips: $ext_1_ip
+fw_smtpd_additional_listen_ports: 2525
+
+# --- Rsync
+fw_rsync_out_ips: $ext_1_ip
@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length

 # ---
 # vars used by roles/ansible_dependencies
@@ -34,7 +35,7 @@ extra_user:
      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCv2rDahAeQBR9NcQkHG5VHbMNGlOzHJPbh5V34ogloAtW0VVO7xnes3Ak3Q/eM0tFbFMG4MRti1M3Un0GJzTV9H2bqN02TmUp5MnDVDcHNfG4L7hqLH2KtwniKeB41IKIeJUdhpKxdFFqM8Z78Xn5EASO5Fu33lQcH+RTbmoYikEr1WrSbQB3wcqtXS+lNveyFUlJD9XJ0MLzanBePQh9boc93CfOa3yFTb90grfB5QjnpL7167MpSH6Oq/DVh5NcnMzvoYjZf9gsMTHuOAUyUKGeUdg2K89gFjkBq2r3S3ouKpDQxPSRXHuNDBSeHJEHy8DP6rOd+0qZVOaPEv3Qi/BRPO9LWcc2aUg8ydI7w1oMd/STaK54PaUJJ7uXV3ZTQsxGyziwZlx+Gq0PNAMjKFdYXAcuGPnlYxDGhVcJJElEuu7DJQqpWfzofov2VEniQQ8Ekknpxd5MFYka0NP038lpIZyMzy13DFJ6KUchbTGfzkHcwKmFX+3vZFEBqq5rZWOuY303qe5gP7eKhsBV/iu47Ne1OtTS2N0QFPTElshk3CLbZKerQo+XLxo3Z15cRDxDsgkdAHtY1PiMjXeX8ZahwXC2vs1ZfBoN4kK2iIH1Gtor4QG+g7chjKa+kZDKqFd4y0EZzeR0IjYCyWt2mNd3hMbEjBtZp75drYmRlqQ== root@ga-st-mail-opendkim'
      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDF7Sx0YJlLjjg3Sm8uiXJyBeKKmZFum3D8Mw2VQZrXJgYOrVB/SVDXO4N5I6NOT5bvxs8c5DLV/4J4ewGP5dGSYiepRnkrRSBUUS6ICwkYfyXremHJ31uREfODRBA4Vnsmpw0SlbQ2I9IpYwsaD3/IDZehDgaCKu4D0/LIprZh0/u+WX7kOGb8Tkm/PBu2SSbAzURaMXn/UtGsUyrickAmEK9qXZDsNYgcwOqZaPtkMZP3mAdix/gKaWV07oU49zxBrouD8gRWAs/yOLvxOe1JDcH2ZExXl81jJYlUffKarBHsWNNE79hUInnH9YTfxP1AEC+MyFXxqKwz3Lk1dQyUo1TFtJTYY+/IHsXT/6KhbOi6twhj7U7uZEqaIWyo6N+WVL9fFhgmbSoVIE6KrBM5VtOdr33A3a+XeNAQGjW6mqOcv3iNUDipTnDTKkEAWQWWnK5YRuaJw1eUCoii/FDp0hRTWIqn+RVCgkOGgEjMIRC8tiQouCXxwfukfcq9zD8S8UCyyQY0uWRHm3uM5GHTmvIJHBXfXBSX/B+PgesSZVwICCiS/6ZSWT+6D5ObBdKGkz12A797YyaMsN7RtJn6OBhPRrGfqQLCIM7lpxJHAoQmTSMiuQp/TjHLedjAm3FvxET2ZvqPWg9QtvSzIoz2JOdKysZHGgbBdC7q6Cssvw== root@ga-st-mail-dehydrated'
      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQClupkurU+acJRtp2s9GgiC+rANqlup8SfhtulV0a/8z6nobjcpQWrfVq+MNjM7VghnlMAwMjz7tccFGyCmJoSS11RcnFtPmqnSNj0/TI8zyYOZUvZCczPBSeqs/IxawyYz91e3RlPWbpv71Nj+/EHUZApZkkdTkpYHduSJYWtKYA2l2Glzmjd2d2u/IFIkqXhvl1bT3RUMLZJqYdEwYAvlW2JB84EIWNf4ytcGcu6rakXCRP9o62BbRza3AfMgSfa45PLodPi5VpqDiTHSCIBll+VOuLqTgQCBYeANRPClMLbueVXXcMrmEwrDXeC0dpqTdgaF2Tz3xYsrAzTe6bcNJsGgGCQyTtDKpsAgoKb31agsyy68CoZto13Ea4WYsNVx0T3KaRlaDm98KqnUJXHJvXnLegqfXiURL5BpxXmAnFvZ0duHrtRkVpzeu5n5vz41RLnFHyLln2VE6a+IYdiLlPl2hC+7pswb+nBP9yNn6T4WQZNtHp4YssANuYKO+/gJaHpMJ1TqgL/Ip66erK+372M1T/6ibiU3+qHbwW7FbXVfn3Dz2abJGyNkoaZGpQIXtx0UxWYZHF8E35Z0ll9NQo1CnDvV3jA1aMnYVTv9DuSYxqLY34oHWXEFzMyStCRWup4Tfrp3pT61GRhb2h8kZi5dqQur9KrqWmA6HF9D+Q== root@lists.mx'
-      -  'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC82aW3qFetvOZSBJFCBnSONurzqAtkZT7cNA+0OuXgYmKXjsOaBlA2pm2a+rKS1Rs2VOzQFAHJMGaR/JGRYTU060jZaZmJhNgNbtqBicDeiEE0p1HfQCm/HSN5vf4Q8CRMDHxkaRxkWOIxvouxn2dkbZklZ+SZCNh42ZMMVC/q0UJmgTV2A5RCbd6eARs9u6lnix+PAhTYYLjsnyNSorr0g6FLb4367dg1klyyHuCNb0rjTZxnYTNDHGHTrYQUXIaZt16iWaxzmnSQi4fivmunGc2Xafhkea+lfxbSwtG68zeJC4D3QBGKZu8xtjyipj9v2LyBrXONgBXfBKs8b9dmhL/Qr4cIhaUdl0IDYaQ/UEBmy3z6CeUxrUsWoQP6st8299ndj1ul7sW2Q5QPH2hLX2PSLOoMygV0cho6oh1XEAkTsAgTXnqhp5G0vZF/2VFYyu2QP+0/yJawOSUE2TMJmA5yU7TMx5koDZL51Rj9XVFqouzRG+6gOOAnhHICfvQUYpS+WW/nqNYl1MI+9Gk29Em2YoBwb1zlep6gC5EyjTzx4h13ldSFSmHcEn9vptZeZv78Es/bT9ib8IdUS9oRatw9IEmA9xnWgHxcrTn1+QYJkbjc1cS2lFVR9wmm3/4It/RyWuxAf3k4qlzHzIS/F4St7MLjviPAWRxqyvroQQ== root@test.mx'
+      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC82aW3qFetvOZSBJFCBnSONurzqAtkZT7cNA+0OuXgYmKXjsOaBlA2pm2a+rKS1Rs2VOzQFAHJMGaR/JGRYTU060jZaZmJhNgNbtqBicDeiEE0p1HfQCm/HSN5vf4Q8CRMDHxkaRxkWOIxvouxn2dkbZklZ+SZCNh42ZMMVC/q0UJmgTV2A5RCbd6eARs9u6lnix+PAhTYYLjsnyNSorr0g6FLb4367dg1klyyHuCNb0rjTZxnYTNDHGHTrYQUXIaZt16iWaxzmnSQi4fivmunGc2Xafhkea+lfxbSwtG68zeJC4D3QBGKZu8xtjyipj9v2LyBrXONgBXfBKs8b9dmhL/Qr4cIhaUdl0IDYaQ/UEBmy3z6CeUxrUsWoQP6st8299ndj1ul7sW2Q5QPH2hLX2PSLOoMygV0cho6oh1XEAkTsAgTXnqhp5G0vZF/2VFYyu2QP+0/yJawOSUE2TMJmA5yU7TMx5koDZL51Rj9XVFqouzRG+6gOOAnhHICfvQUYpS+WW/nqNYl1MI+9Gk29Em2YoBwb1zlep6gC5EyjTzx4h13ldSFSmHcEn9vptZeZv78Es/bT9ib8IdUS9oRatw9IEmA9xnWgHxcrTn1+QYJkbjc1cS2lFVR9wmm3/4It/RyWuxAf3k4qlzHzIS/F4St7MLjviPAWRxqyvroQQ== root@test.mx'
      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDIf2ahqowiUbP4f3/qtdC1JmbjIdlF+i+TiWpxWam0yjiGuTPDjI1ud5vj0of2+P4DJy2dkDvF3yK7/Np7qpxIJgsj9HNiwIlGtfrwNCzqGlyPovjNpAr8cCR1P34K9CgHz4BInc//vjxlUXZpK17omOJ4KaVY1f/Eit0G5Y2TJ38BY6MztuUfou8PdJqITM3GM/YOk4iz2OnObDjHAbd6VTSn4yrYTkGT30axiCHdSy0XhvfUgB1yO08PIcOOogGkxRLYkvUAxwhDsFSpGzQBhUb1O5RqGnBs/aR4sxwjTaeO8mP6lpQMp2pz//I6448N3k5P1CwcJAqrkUuOk4o+jHWr5rSO+eKm4SQ74RBnAAM9bA0tpvCmO8kV2tsdbS4Yw94H4GfTgOPZ5Fe6Y8ciTR+bkGdp7sqm5DNtjZNZuwiFmoe2vj7RJlCNDIXhwVEGAWf+lFYCQKp05A13QoRYGg2aebaLSjw9XYBghNtwnmYkSb84xIoELmPKYrvdodO2uHgGxHBls1mFTz8m01kn+A49L3yY+cFZtSua/+YYoZLh1tNLAL4rBRCRVpZs+VHrmz0GCxwYMHkm9ti0SRPrb7jtH9DYwLUdci4pL8z/G4D2M92A66OZqIybgAJkkdl4H4mv9n05FPJ8RxPniD58x3AMTZNtkxGxn8UkTCSSGQ== root@web-01-opendkim'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICCvag/r50Dxfsh3fcG3fZSZ+vbsCwbV+WDoJ++zNSHl root@web-01-dns'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFpQyckVQMI2YMbIQ9Gqf2JyGyM2JufIPf0lv7jvMxLI root@web-02-dns'
@@ -80,8 +81,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -92,20 +93,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -123,10 +124,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -136,7 +137,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -188,45 +189,45 @@ copy_plain_files:
 # ---

 symlink_files:
-   - name: bind_get_domain_by_hostname
-     src_path: /root/bin/bind/bind_get_domain_by_hostname.sh
-     dest_path: /usr/local/bin/bind_get_domain_by_hostname.sh
+  - name: bind_get_domain_by_hostname
+    src_path: /root/bin/bind/bind_get_domain_by_hostname.sh
+    dest_path: /usr/local/bin/bind_get_domain_by_hostname.sh

-   - name: bind_get_zonefile_by_hostname
-     src_path: /root/bin/bind/bind_get_zonefile_by_hostname.sh
-     dest_path: /usr/local/bin/bind_get_zonefile_by_hostname.sh
+  - name: bind_get_zonefile_by_hostname
+    src_path: /root/bin/bind/bind_get_zonefile_by_hostname.sh
+    dest_path: /usr/local/bin/bind_get_zonefile_by_hostname.sh

-   - name: bind_rndc_sync_clean
-     src_path: /root/bin/bind/bind_rndc_sync_clean.sh
-     dest_path: /usr/local/bin/bind_rndc_sync_clean.sh
+  - name: bind_rndc_sync_clean
+    src_path: /root/bin/bind/bind_rndc_sync_clean.sh
+    dest_path: /usr/local/bin/bind_rndc_sync_clean.sh

-   - name: /bind_set_new_serial
-     src_path: /root/bin/bind/bind_set_new_serial.sh
-     dest_path: /usr/local/bin/bind_set_new_serial.sh
+  - name: /bind_set_new_serial
+    src_path: /root/bin/bind/bind_set_new_serial.sh
+    dest_path: /usr/local/bin/bind_set_new_serial.sh

-   - name: bind_set_renew_tlsa
-     src_path: /root/bin/bind/bind_set_renew_tlsa.sh
-     dest_path: /usr/local/bin/bind_set_renew_tlsa.sh
+  - name: bind_set_renew_tlsa
+    src_path: /root/bin/bind/bind_set_renew_tlsa.sh
+    dest_path: /usr/local/bin/bind_set_renew_tlsa.sh

-   - name: bind_add_dkim_zone_master
-     src_path: /root/bin/bind/bind_add_dkim_zone_master.sh
-     dest_path: /usr/local/bin/bind_add_dkim_zone_master.sh
+  - name: bind_add_dkim_zone_master
+    src_path: /root/bin/bind/bind_add_dkim_zone_master.sh
+    dest_path: /usr/local/bin/bind_add_dkim_zone_master.sh

-   - name: bind_add_dkim_zone_slave
-     src_path: /root/bin/bind/bind_add_dkim_zone_slave.sh
-     dest_path: /usr/local/bin/bind_add_dkim_zone_slave.sh
+  - name: bind_add_dkim_zone_slave
+    src_path: /root/bin/bind/bind_add_dkim_zone_slave.sh
+    dest_path: /usr/local/bin/bind_add_dkim_zone_slave.sh

-   - name: bind_reload_all_zones
-     src_path: /root/bin/bind/bind_reload_all_zones.sh
-     dest_path: /usr/local/bin/bind_reload_all_zones.sh
+  - name: bind_reload_all_zones
+    src_path: /root/bin/bind/bind_reload_all_zones.sh
+    dest_path: /usr/local/bin/bind_reload_all_zones.sh

-   - name: bind_remove_domain_on_master
-     src_path: /root/bin/bind/bind_remove_domain_on_master.sh
-     dest_path: /usr/local/bin/bind_remove_domain_on_master.sh
+  - name: bind_remove_domain_on_master
+    src_path: /root/bin/bind/bind_remove_domain_on_master.sh
+    dest_path: /usr/local/bin/bind_remove_domain_on_master.sh

-   - name: bind_remove_domain_on_slave
-     src_path: /root/bin/bind/bind_remove_domain_on_slave.sh
-     dest_path: /usr/local/bin/bind_remove_domain_on_slave.sh
+  - name: bind_remove_domain_on_slave
+    src_path: /root/bin/bind/bind_remove_domain_on_slave.sh
+    dest_path: /usr/local/bin/bind_remove_domain_on_slave.sh


 # ---
@@ -240,4 +241,3 @@ symlink_files:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,27 @@
+---
+# ipt-firewall configuration for b.ns.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "95.217.204.204"
+fw_ext_ips_v6:
+  - "2a01:4f9:4a:47e5::204"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- DNS
+fw_dns_server_ips: $ext_ips
+
+# --- VPN / WireGuard
+fw_wireguard_server_ips: $ext_ips
+
+# --- Block
+fw_blocked_ips: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
@@ -70,8 +70,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -82,20 +82,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -109,10 +109,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -122,7 +122,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -257,6 +257,7 @@ default_user:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmfp+4waTzHxdT5TaxAMsIPDDwNe8Dwuif1jL+9v9GP root@a.mx'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFBIyXel+KOTLB6VB2xJwyWaZc0KuCJzocwlziFdovCl root@a.ns'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGi22vcCilahX9KwbqcF8/D0RnzQXvgzTUFTmRHNJsBZ root@anabaena'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5xyeZBGQn4Iz5iV2DMBVll/6n/X0JuoPMDpc8D32ra root@ak-plan'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINU1InXFKZX9emaT5QsY4Nr0tr8CzbyV8Js8RzZC9vGk root@b.mx'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPo7hI8oIS+/xufCUNTTgNoz592udJaU+79L0uADzKJY root@b.ns'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMtIXFS9OrKBvBl+fKtYN/lOOKpPuuc02H8HV+++LeBU root@backup'
@@ -272,6 +273,7 @@ default_user:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvmOpsiL+eiJ3qZVDJiUCFVZge0OQJ1hpZgw7pJ8sq5 root@cl-irights'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIjr0aBl2KQTJnlVK03DOs0u+IXSon4VewwAzzSBsmVW root@cl-lubax'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMhwPCxVHqABXzyXwVuqbH703RCU0N+SC/cx4TuoHhGU root@cl-nd'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEp6BXQ/v/Hf/IJnI0JIS96RC4NGDMFUbwyW8nH3Xq66 root@cl-ndm'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL7h6rR+q5bRh/qgzA7ZyiZcRr9vMbo7cxhQsoukWmUn root@cl-vbrg'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcHQfSVG8DM1qHp2ce73ZBWXknZGZFur5s27V58T7ON root@cl-opp'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIClnyNS5RQsbXmgOX7NU7i154DElOlha3y0ybF6FwScT root@cl-test'
@@ -319,7 +321,8 @@ default_user:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGcgS05xGLPuECQ7E5zjzfSDxdFBO1mAjkSV2bktxld+ root@o23'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEM1SI7Lwk0G8UycysL7ZPdXm1DRGgPnr01B0ewRGEKi root@o24'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJKfPInE9VjXVe+6DQ+4/H1nQJwXljYEK6gwfmTDgGy root@o26'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIES9ftVcNMv6pW2HDM12fIbOOEvq1fcd74kbO4LHfhGH root@o28'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIES9ftVcNMv6pW2HDM12fIbOOEvq1fcd74kbO4LHfhGH root@o28-FM-BAK'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPyLS+kyfMX0hlv0rMmGyG6huvuqZlEOOf007xuI6io0 root@o28'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDtACieGFf34NDepB9GqJjVqji6bf6xrO1LevXgm3aN+ root@o29'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE70FVVu2bsdH2qJITFVSDEPraiI4uSCuzEkYlbl6pRW root@o30'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF0+aRoMxzmiQCAIMajNhbTZEumtZ9yCG2Nb4ucqK8lo root@o31'
@@ -339,6 +342,7 @@ default_user:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUZ0WNd3rTqHH1tiXAELwssGw6xUP1ROdhgxKbMinYY root@oolm-web'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJJCzTmrRp0s0qpkf9HYyx4lL+zs1jTAYcCsvqpJ72p root@super-opferhilfefonds'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID82UUUkYKYFbJdmTcMYu+vl3M0FVQznXFbngqPoumP+ root@prometheus-nd'
+      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIObY/MOgF4QVWROrQCaKCfBOfAwKVcja3q7Ngwo1MEDt root@psono-ndm'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJU5HzfGYZwWeaoAGGFF7/3VQP19ce6Rgn5wcOR98Q3o root@server26'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBRfCFz6mPdn3TKVCgffHQAKt3LN/0srS/gBsMoOyZpi root@shop-agr'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHbeMf/CvAYIU/4UW8Ql59FgPo/3vcZ3vI3QzK2kOadE root@srv-cityslang'
@@ -406,4 +410,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -0,0 +1,39 @@
+---
+# ipt-firewall configuration for backup.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "37.27.121.218"
+fw_ext_ips_v6:
+  - "2a01:4f9:3070:2bda::218"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- Access control IPv4
+fw_allow_ext_service_v4: "138.201.17.150:1036:tcp o32.oopen.de:2222:tcp"
+
+# --- Access control IPv6
+fw_allow_ext_service_v6: "2a01:4f8:171:2895::2,1036,tcp o32.oopen.de,2222,tcp"
+
+# --- HTTP
+fw_http_server_ips: $ext_ips
+
+# --- Out ports
+# -
+# - TCP Ports
+# -
+# - ssh port k1371.dyndns.org:    51372
+# - ssh port k1371.homelinux.org: 51374
+# -
+fw_tcp_out_ports: 51372 51374
+
+# --- Block
+fw_blocked_ips: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
@@ -188,8 +188,6 @@ cron_user_entries:
 insert_ssh_keypair_backup_server: false


-
-
 default_user:

  - name: chris
@@ -308,4 +306,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for backup.warenform.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "78.46.47.84"
+fw_ext_ips_v6:
+  - "2a01:4f8:110:401b::84"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Block
+fw_blocked_ips: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -44,9 +44,9 @@ network_interfaces:
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
-    #nameservers:
+    # nameservers:
    #  - 192.168.42.1
-    #search: b3-bornim.netz
+    # search: b3-bornim.netz


 # ---
@@ -131,7 +131,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - b3-bornim.netz
@@ -141,7 +141,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.42.254
+  - 172.16.42.254


 # ---
@@ -156,7 +156,6 @@ cron_user_special_time_entries:
    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -236,7 +235,7 @@ samba_user:
    groups:
      - praktikant
    password: '20-b3_praktikant-22%'
-  
+
  - name: caroline
    groups:
      - praktikant
@@ -394,7 +393,7 @@ samba_shares:
    recycle_path: '@Recycle'

  - name: gs
-    comment: Gesellschafter 
+    comment: Gesellschafter
    path: /data/samba/share/gesellschafter
    group_valid_users: gs
    group_write_list: gs
@@ -45,8 +45,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -57,20 +57,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -107,19 +107,19 @@ insert_root_ssh_keypair: true

 root_ssh_keypair:
  - name: id-rsa-dehydrated
-    priv_key_src: c.mx/root/.ssh/c.mx-id_rsa-dehydrated
+    priv_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa-dehydrated
    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: c.mx/root/.ssh/c.mx-id_rsa-dehydrated.pub
+    pub_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa-dehydrated.pub
    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
  - name: id-rsa-opendkim
-    priv_key_src: c.mx/root/.ssh/c.mx-id_rsa-opendkim
+    priv_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa-opendkim
    priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: c.mx/root/.ssh/c.mx-id_rsa-opendkim.pub
+    pub_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa-opendkim.pub
    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
  - name: id-rsa
-    priv_key_src: c.mx/root/.ssh/c.mx-id_rsa
+    priv_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa
    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: c.mx/root/.ssh/c.mx-id_rsa.pub
+    pub_key_src: c.mx.oopen.de/root/.ssh/c.mx-id_rsa.pub
    pub_key_dest: /root/.ssh/id_rsa.pub


@@ -156,49 +156,6 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---

-copy_plain_files:
-
-  # /root/bin/monitoring
-  #
-  - name: monitoring_check_cert_for_dovecot.conf
-    src_path: c.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf
-    dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: c.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_postfix_add_mailboxes.conf
-    src_path: c.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf
-    dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
-
-  - name: postfix_sent_userinfo_postfix.conf
-    src_path: c.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf
-    dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: c.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfwd_host_specific: []
-
-  # Postfix Firewall postfwd
-  #
-  #- name: postfwd.wl-user
-  #  src_path: c.mx/etc/postfix/postfwd.wl-user
-  #  dest_path: /etc/postfix/postfwd.wl-user
-
-
-#copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-

 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -218,7 +175,7 @@ db_in_use: !!str "true"
 postfix_db_type: MySQL
 postfix_db_name: postfix
 postfix_db_user: postfix
-#postfix_db_host:
+# postfix_db_host:
 postfix_db_pass: AeB4kohyie5rahJ7

 # install_amavis.conf
@@ -227,33 +184,33 @@ mp_receipt_number: 106015125438
 si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e

 # install_postfixadmin.conf
-# 
+#
 website_name_postfixadmin: adm.initiativenserver.de

-email_welcome_message: "\n
-Hallo,\n
+email_welcome_message: |
+  Hallo,

-Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+  Ihre/Deine neue E-Mail Adresse ist eingerichtet.

-Aktionsbündnis gegen Gewalt, Rechtsextremismus und Fremdenfeindlichkeit
+  Aktionsbündnis gegen Gewalt, Rechtsextremismus und Fremdenfeindlichkeit

--\n
-Initiativenserver  |   phone:  0331 505824-28\n
-Mittelstraße 38/39 |   fax:    0331 505824-29\n
-14467 Potsdam      |   email:  kontakt@initiativenserver.de\n
-"
+  --
+  Initiativenserver  |   phone:  0331 505824-28
+  Mittelstraße 38/39 |   fax:    0331 505824-29
+  14467 Potsdam      |   email:  kontakt@initiativenserver.de

 # install_update_dovecot.conf
 #
 dovecot_from_address: "Admin Initiativenserver <admin@initiativenserver.de>"
 dovecot_reply_to: "admin@initiativenserver.de"
 webmailer_address: "https://webmail.initiativenserver.de"
-salutation: "Aktionsbündnis gegen Gewalt, Rechtsextremismus und FremdenfeindlichkeitN\n
+salutation: |
+  Aktionsbündnis gegen Gewalt, Rechtsextremismus und Fremdenfeindlichkeit

--\n
-Initiativenserver  |   phone:  0331 505824-28\n
-Mittelstraße 38/39 |   fax:    0331 505824-29\n
-14467 Potsdam      |   email:  kontakt@initiativenserver.de\n"
+  --
+  Initiativenserver  |   phone:  0331 505824-28
+  Mittelstraße 38/39 |   fax:    0331 505824-29
+  14467 Potsdam      |   email:  kontakt@initiativenserver.de

 # install_upgrade_roundcube-webmail.conf
 #
@@ -264,7 +221,7 @@ autoreply_hostname: autoreply.initiativenserver.de
 roundcube_db_type: mysql
 roundcube_db_name: roundcubemail
 roundcube_db_user: roundcube
-#roundcube_db_host: 
+# roundcube_db_host:
 roundcube_db_pass: 're6Xe8Fereejai3D'

 roundcube_acl_plugin: false
@@ -295,4 +252,3 @@ template_files_mailsystem_script:
  - name: mailsystem_install_upgrade_roundcube-webmail.conf
    src_path: usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf.j2
    dest_path: /usr/local/src/mailsystem/conf/install_upgrade_roundcube-webmail.conf
-
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -85,10 +85,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -98,7 +98,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -163,4 +163,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,27 @@
+---
+# ipt-firewall configuration for cl-01.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "162.55.82.74"
+fw_ext_ips_v6:
+  - "2a01:4f8:271:1266::74"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- Block
+fw_blocked_ips: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
@@ -88,7 +88,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -98,7 +98,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -150,4 +150,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,27 @@
+---
+# ipt-firewall configuration for cl-02.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "95.217.204.203"
+fw_ext_ips_v6:
+  - "2a01:4f9:4a:47e5::203"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- Block
+fw_blocked_ips: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -148,4 +148,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for cl-dissens.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "65.21.220.152"
+fw_ext_ips_v6:
+  - "2a01:4f9:3080:318c::152"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
@@ -1,151 +0,0 @@
---
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-sshd_permit_root_login: !!str "prohibit-password"
-
-# ---
-# vars used by apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 185.12.64.2
-  - 2a01:4ff:ff00::add:1
-  - 185.12.64.1
-  - 2a01:4ff:ff00::add:2
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which 
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - oopen.de
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 194.150.168.168
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-sudo_users:
-  - chris
-  - sysadm
-  - localadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-sudoers_file_user_privileges:
-  - name: back
-    entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -148,4 +148,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for cl-flr.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "176.9.125.5"
+fw_ext_ips_v6:
+  - "2a01:4f8:151:8415::5"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -232,4 +232,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,27 @@
+---
+# ipt-firewall configuration for cl-fm.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "142.132.147.170"
+fw_ext_ips_v6:
+  - "2a01:4f8:261:1994::170"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- Block
+fw_blocked_ips: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -232,4 +232,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,24 @@
+---
+# ipt-firewall configuration for cl-irights.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "157.90.140.168"
+fw_ext_ips_v6:
+  - "2a01:4f8:2220:37c3::168"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
@@ -19,7 +19,7 @@
 # vars used by roles/common/tasks/sshd.yml
 # ---

-#sshd_permit_root_login: !!str "prohibit-password"
+# sshd_permit_root_login: !!str "prohibit-password"
 sshd_permit_root_login: !!str "no"

 # ---
@@ -43,8 +43,8 @@ systemd_resolved: false
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -55,20 +55,20 @@ systemd_resolved: false
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -84,10 +84,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -149,4 +149,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,27 @@
+---
+# ipt-firewall configuration for cl-fm.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "46.224.120.108"
+fw_ext_ips_v6:
+  - "2a01:4f8:1c1a:4d53::1"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# --- Block
+# fw_blocked_ips: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
@@ -0,0 +1,126 @@
+---
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+sshd_permit_root_login: !!str "prohibit-password"
+
+# ---
+# vars used by apt.yml
+# ---
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+resolved_nameserver:
+  - 185.12.64.2
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 2a01:4ff:ff00::add:1
+
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+cron_user_special_time_entries:
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+cron_user_entries:
+  - name: "Check if webservices sre running. Restart if necessary"
+    minute: "*/5"
+    hour: "*"
+    job: /root/bin/monitoring/check_webservice_load.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: "*/5"
+    hour: "*"
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: "*/15"
+    hour: "*"
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
+    minute: "*/5"
+    hour: "*"
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Optimize mysql tables"
+    minute: "53"
+    hour: "04"
+    job: /root/bin/mysql/optimize_mysql_tables.sh
+
+  - name: "Flush query cache for mysql tables"
+    minute: "27"
+    hour: "04"
+    job: /root/bin/mysql/flush_query_cache.sh
+
+  - name: "Flush Host cache"
+    minute: "17"
+    hour: "05"
+    job: /root/bin/mysql/flush_host_cache.sh
+
+  - name: "Run occ file:scan for each cloud account"
+    minute: "02"
+    hour: "23"
+    job: /root/bin/nextcloud/occ_maintenance.sh -s cloud-test.ndhosting.de
+
+  - name: "Background job for nextcloud instance 'cloud-test.ndhosting.de"
+    minute: "*/15"
+    hour: "*"
+    job: sudo -u "www-data" /usr/local/php/bin/php  -f /var/www/cloud-test.ndhosting.de/htdocs/cron.php
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: "23"
+    hour: "05"
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: "33"
+    hour: "05"
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+sudo_users:
+  - chris
+  - sysadm
+  - localadmin
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+
+sudoers_file_user_privileges:
+  - name: back
+    entry: "ALL=(www-data) NOPASSWD: /usr/local/php/bin/php"
@@ -0,0 +1,28 @@
+---
+# ipt-firewall configuration for a.mx.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "135.181.90.132"
+fw_ext_ips_v6:
+  - "2a01:4f9:c014:1ba8::1"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_mail_client_ips: $ext_1_ip
+
+# - Docker-Netzwerk nicht firewallen
+#
+fw_unprotected_ifs: br-euroffice
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -232,4 +232,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -0,0 +1,234 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+sshd_permit_root_login: !!str "prohibit-password"
+
+# ---
+# vars used by apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 185.12.64.1
+  - 2a01:4ff:ff00::add:2
+  - 2a01:4ff:ff00::add:1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+# resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/cron.yml
+# ---
+
+cron_env_entries:
+  - name: PATH
+    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
+  - name: SHELL
+    job: /bin/bash
+    insertafter: PATH
+
+
+cron_user_special_time_entries:
+
+  - name: "Restart DNS Cache service 'systemd-resolved'"
+    special_time: reboot
+    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
+    insertafter: PATH
+
+
+cron_user_entries:
+
+  - name: "Check if webservices sre running. Restart if necessary"
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_webservice_load.sh
+
+  - name: "Check if SSH service is running. Restart service if needed."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/monitoring/check_ssh.sh
+
+  - name: "Check if Postfix Mailservice is up and running?"
+    minute: '*/15'
+    hour: '*'
+    job: /root/bin/monitoring/check_postfix.sh
+
+  - name: "Check Postfix E-Mail LOG file for 'fatal' errors.."
+    minute: '*/5'
+    hour: '*'
+    job: /root/bin/postfix/check-postfix-fatal-errors.sh
+
+  - name: "Optimize mysql tables"
+    minute: '53'
+    hour: '04'
+    job: /root/bin/mysql/optimize_mysql_tables.sh
+
+  - name: "Flush query cache for mysql tables"
+    minute: '27'
+    hour: '04'
+    job: /root/bin/mysql/flush_query_cache.sh
+
+  - name: "Flush Host cache"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/mysql/flush_host_cache.sh
+
+  - name: "Run occ file:scan for each cloud account"
+    minute: '02'
+    hour: '23'
+    job: /root/bin/nextcloud/occ_maintenance.sh -s cloud.neuemedienmacher.de
+
+  - name: "Background job for nextcloud instance 'cloud.neuemedienmacher.de"
+    minute: '*/15'
+    hour: '*'
+    job: sudo -u "www-data" /usr/local/php/bin/php  -f /var/www/cloud.neuemedienmacher.de/htdocs/cron.php
+
+  - name: "Check if certificates for coolwsd service are up to date"
+    minute: '17'
+    hour: '05'
+    job: /root/bin/nextcloud/check_cert_coolwsd.sh
+
+  - name: "Generate/Renew Let's Encrypt Certificates if needed (using dehydrated script)"
+    minute: '23'
+    hour: '05'
+    job: /var/lib/dehydrated/cron/dehydrated_cron.sh
+
+  - name: "Check whether all certificates are included in the VHOST configurations"
+    minute: '33'
+    hour: '05'
+    job: /var/lib/dehydrated/tools/update_ssl_directives.sh
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+sudo_users:
+  - chris
+  - sysadm
+  - localadmin
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+sudoers_file_user_privileges:
+  - name: back
+    entry: 'ALL=(www-data) NOPASSWD: /usr/local/php/bin/php'
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
@@ -0,0 +1,25 @@
+---
+# ipt-firewall configuration for cl-ndm.oopen.de
+# Generated by extract-fw-host-vars.py - review before committing!
+# Place in: host_vars/<hostname>/ipt_firewall.yml
+
+fw_manage_config: true
+
+# --- Network
+fw_ext_interfaces:
+  - "eth0"
+fw_ext_ips_v4:
+  - "88.198.56.197"
+fw_ext_ips_v6:
+  - "2a01:4f8:222:2c2::197"
+
+# --- Munin
+munin_remote_ipv4: 37.27.121.227
+munin_remote_ipv6: "2a01:4f9:3070:2bda::227"
+
+# --- HTTP
+fw_http_server_ips: $ext_1_ip
+
+# --- Mail
+fw_smtpd_additional_outgoing_ports: 2525
+fw_mail_client_ips: $ext_1_ip
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -143,4 +143,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -81,10 +81,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - oopen.de

@@ -93,7 +93,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -140,4 +140,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -70,4 +70,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -70,4 +70,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -87,7 +87,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -144,4 +144,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -85,10 +85,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -98,7 +98,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -158,4 +158,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -42,8 +42,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -54,20 +54,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -156,4 +156,3 @@ sudoers_file_user_privileges:
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -26,6 +26,8 @@

 install_compiler_pkgs: true

+install_postgresql_pkgs: true
+

 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
@@ -43,8 +45,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -55,20 +57,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -81,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -94,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -105,14 +107,14 @@ insert_root_ssh_keypair: true

 root_ssh_keypair:
  - name: id-rsa-dehydrated
-    priv_key_src: b.mx/root/.ssh/b.mx-id_rsa-dehydrated
+    priv_key_src: d.mx.oopen.de/root/.ssh/d.mx-id_rsa-dehydrated
    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: b.mx/root/.ssh/b.mx-id_rsa-dehydrated.pub
+    pub_key_src: d.mx.oopen.de/root/.ssh/d.mx-id_rsa-dehydrated.pub
    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
  - name: id-rsa-opendkim
-    priv_key_src: b.mx/root/.ssh/b.mx-id_rsa-opendkim
+    priv_key_src: d.mx.oopen.de/root/.ssh/d.mx-id_rsa-opendkim
    priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: b.mx/root/.ssh/b.mx-id_rsa-opendkim.pub
+    pub_key_src: d.mx.oopen.de/root/.ssh/d.mx-id_rsa-opendkim.pub
    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub


@@ -149,58 +151,18 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---

-copy_plain_files:
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: b.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: b.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfix_host_specific:
-
-  - name: relay_domains
-    src_path: b.mx/etc/postfix/relay_domains
-    dest_path: /etc/postfix/relay_domains
-
-
-copy_plain_files_postfwd_host_specific:
-
-  # Postfix Firewall postfwd
-  #
-  - name: postfwd.wl-nets
-    src_path: b.mx/etc/postfix/postfwd.wl-nets
-    dest_path: /etc/postfix/postfwd.wl-nets
-
-  - name: postfwd.wl-sender
-    src_path: b.mx/etc/postfix/postfwd.wl-sender
-    dest_path: /etc/postfix/postfwd.wl-sender
-
-
-copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-

 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---

-hostname: b.mx.oopen.de
-ipv4_address: 162.55.82.73
-ipv6_address: 2a01:4f8:271:1266::73
+hostname: d.mx.oopen.de
+ipv4_address: 95.217.204.227
+ipv6_address: 2a01:4f9:4a:47e5::227

 admin_email: argus@oopen.de
-is_relay_host: !!str "true"
-sasl_auth_enable: !!str "yes"
+is_relay_host: false
+is_sympa_list_server: true

 # install_amavis.conf
 #
@@ -210,10 +172,10 @@ si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07e

 template_files_mailsystem_script:

-  - name: mailsystem_install_amavis.conf
-    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
  - name: mailsystem_install_postfix_advanced.conf
    src_path: usr/local/src/mailsystem/conf/install_postfix_advanced.conf.j2
    dest_path: /usr/local/src/mailsystem/conf/install_postfix_advanced.conf
+
+  - name: mailsystem_install_amavis.conf
+    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
+    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
@@ -0,0 +1,141 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+sshd_permit_root_login: !!str "prohibit-password"
+
+# ---
+# vars used by apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+  - 2a01:4ff:ff00::add:2
+  - 185.12.64.1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+# resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length

 # ---
 # vars used by roles/ansible_dependencies
@@ -81,7 +82,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - wf.netz
@@ -91,14 +92,14 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

-extra_user: 
+extra_user:

  - name: kaya
    password: $6$t9gheUvd$hFTJ5mp0bdu4Hc5zGmS6HuSAfFOc4QRROLX4wnCauLjwTxUtvhgeLDlL5YkjGfiWOCEe84krH4op0DdKjTJWG/
@@ -150,4 +151,3 @@ sudo_users:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -87,7 +87,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - wf.netz
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -142,15 +142,12 @@ resolved_fallback_nameserver:
 # ---


-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---


-
-
 # ==============================


@@ -94,7 +94,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - wf.netz
@@ -104,7 +104,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -149,15 +149,12 @@ resolved_fallback_nameserver:
 # ---


-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---


-
-
 # ==============================


@@ -87,7 +87,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - wf.netz
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -142,15 +142,12 @@ resolved_fallback_nameserver:
 # ---


-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---


-
-
 # ==============================


@@ -87,7 +87,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - wf.netz
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -142,15 +142,12 @@ resolved_fallback_nameserver:
 # ---


-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---


-
-
 # ==============================


@@ -87,7 +87,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - wf.netz
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -142,15 +142,12 @@ resolved_fallback_nameserver:
 # ---


-
 # ---
 # vars used by roles/common/tasks/samba-config-server.yml
 # vars used by roles/common/tasks/samba-user.yml
 # ---


-
-
 # ==============================


@@ -41,8 +41,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -53,20 +53,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -121,4 +121,3 @@ git_firewall_repository: {}
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -41,8 +41,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -53,20 +53,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -81,10 +81,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - warenform.de
@@ -94,7 +94,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -138,4 +138,3 @@ git_firewall_repository: {}
 # ---
 # vars used by scripts/reset_root_passwd.yml
 # ---
-
@@ -45,8 +45,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -57,20 +57,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -83,10 +83,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -96,7 +96,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -105,17 +105,17 @@ resolved_fallback_nameserver:

 insert_root_ssh_keypair: true

-root_ssh_keypair:
-  - name: id-rsa-dehydrated
-    priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated
-    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-dehydrated.pub
-    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
-  - name: id-rsa-opendkim
-    priv_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim
-    priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: e.mx/root/.ssh/e.mx-id_rsa-opendkim.pub
-    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub
+# root_ssh_keypair:
+#  - name: id-rsa-dehydrated
+#    priv_key_src: e.mx.oopen.de/root/.ssh/e.mx-id_rsa-dehydrated
+#    priv_key_dest: /root/.ssh/id_rsa-dehydrated
+#    pub_key_src: e.mx.oopen.de/root/.ssh/e.mx-id_rsa-dehydrated.pub
+#    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
+#  - name: id-rsa-opendkim
+#    priv_key_src: e.mx.oopen.de/root/.ssh/e.mx-id_rsa-opendkim
+#    priv_key_dest: /root/.ssh/id_rsa-opendkim
+#    pub_key_src: e.mx.oopen.de/root/.ssh/e.mx-id_rsa-opendkim.pub
+#    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub


 # ---
@@ -151,36 +151,6 @@ root_ssh_keypair:
 # vars used by roles/common/tasks/copy_files.yml
 # ---

-copy_plain_files:
-
-  - name: monitoring_check_cert_for_dovecot.conf
-    src_path: e.mx/root/bin/monitoring/conf/check_cert_for_dovecot.conf
-    dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
-
-  - name: postfix_create_opendkim_key.conf
-    src_path: e.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_postfix_add_mailboxes.conf
-    src_path: e.mx/root/bin/postfix/conf/postfix_add_mailboxes.conf
-    dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
-
-  - name: postfix_sent_userinfo_postfix.conf
-    src_path: e.mx/root/bin/postfix/conf/sent_userinfo_postfix.conf
-    dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: e.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-

 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -208,33 +178,34 @@ mp_receipt_number: 106015125438
 si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e

 # install_postfixadmin.conf
-# 
+#
 website_name_postfixadmin: adm-e.oopen.de

-email_welcome_message: "\n
-Hallo,\n
+email_welcome_message: |

-Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+  Hallo,

-O.OPEN\n
+  Ihre/Deine neue E-Mail Adresse ist eingerichtet.

--\n
-O.OPEN            |   Phone:  +49 30 / 290 484 91\n
-Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99\n
-D-10999 Berlin    |   E-MAIL: oo@oopen.de\n
-"
+  O.OPEN
+
+  --
+  O.OPEN            |   Phone:  +49 30 / 290 484 91
+  Erkelenzdamm 21   |   Fax:    +49 30 / 290 484 99
+  D-10999 Berlin    |   E-MAIL: oo@oopen.de

 # install_update_dovecot.conf
 #
 dovecot_from_address: "o.open <oo@oopen.de>"
 dovecot_reply_to: "oo@oopen.de"
 webmailer_address: "https://webmail-e.oopen.de"
-salutation: "O.OPEN\n
+salutation: |
+  O.OPEN

--\n
-O.OPEN           |   Phone:  +49 30 / 290 484 91\n
-Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99\n
-D-10999 Berlin   |   http://oopen.de"
+  --
+  O.OPEN           |   Phone:  +49 30 / 290 484 91
+  Erkelenzdamm 21  |   Fax:    +49 30 / 290 484 99
+  D-10999 Berlin   |   http://oopen.de

 # install_upgrade_roundcube-webmail.conf
 #
@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -45,9 +45,9 @@ network_interfaces:
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
-    #nameservers:
+    # nameservers:
    #  - 192.168.100.1
-    #search: kanzlei-kiel.netz
+    # search: kanzlei-kiel.netz

    # optional bridge parameters bridge: {}
    # bridge:
@@ -66,7 +66,7 @@ network_interfaces:
    # inline hook scripts
    pre-up:
      - !!str "ip link set dev eno1np0 up" # pre-up script lines
-    up: [] #up script lines
+    up: [] # up script lines
    post-up: [] # post-up script lines (alias for up)
    pre-down: [] # pre-down script lines (alias for down)
    down: [] # down script lines
@@ -155,7 +155,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - kanzlei-kiel.netz
@@ -165,7 +165,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -233,7 +233,6 @@ default_user:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItQLQ7lhBY2USF4Jcp4teF+1NydI73VeHYbQW8q4Mcw root@gw-ah'


-
 # ---
 # vars used by roles/common/tasks/cron.yml
 # ---
@@ -273,7 +272,7 @@ cron_user_special_time_entries:
    job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
    insertafter: PATH

-#cron_user_special_time_entries:
+# cron_user_special_time_entries:
 #
 #  - name: "Restart DNS Cache service 'systemd-resolved'"
 #    special_time: reboot
@@ -281,7 +280,6 @@ cron_user_special_time_entries:
 #    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -431,9 +429,9 @@ samba_user:

  - name: buchholz
    groups:
-       - buero
-       - intern
-       - verwaltung
+      - buero
+      - intern
+      - verwaltung
    password: '20-buch_holz-20'

  - name: kiel-nb1
@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -44,9 +44,9 @@ network_interfaces:
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
-    #nameservers:
+    # nameservers:
    #  - 192.168.162.1
-    #search: blkr.netz
+    # search: blkr.netz


 # ---
@@ -152,7 +152,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - blkr.netz
@@ -162,7 +162,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -177,7 +177,6 @@ cron_user_special_time_entries:
    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -44,9 +44,9 @@ network_interfaces:
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
-    #nameservers:
+    # nameservers:
    #  - 192.168.162.1
-    #search: blkr.netz
+    # search: blkr.netz


 # ---
@@ -152,7 +152,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - blkr.netz
@@ -162,7 +162,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -177,7 +177,6 @@ cron_user_special_time_entries:
    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -200,14 +199,14 @@ cron_user_special_time_entries:
 # see: roles/common/tasks/vars

 sudoers_file_user_aliases:
-   - name: MAIN_USER
-     entry: 'josephine, julius, julius-e, leonie,  buero1, buero2, buero3, referendariat, refa, ref1, sebastian, buero-05, buero-06, lap-01'
+  - name: MAIN_USER
+    entry: 'josephine, julius, julius-e, leonie,  buero1, buero2, buero3, referendariat, refa, ref1, sebastian, buero-05, buero-06, lap-01'

 sudoers_file_cmnd_aliases:
-   - name: REBOOT 
-     entry: '/sbin/reboot'
-   - name: MANAGE_SERVICE
-     entry: '/usr/bin/systemctl'
+  - name: REBOOT
+    entry: '/sbin/reboot'
+  - name: MANAGE_SERVICE
+    entry: '/usr/bin/systemctl'


 sudoers_file_user_privileges:
@@ -249,16 +248,16 @@ nfs_server: 192.168.162.10
 #    Take car to increase 'fsid' in case of more than one export
 #
 nfs_exports:
-   - src: 192.168.162.10:/data/samba/shares
-     path: /data/samba/shares
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.162.0/24
-       - 10.0.192.0/24
-       - 10.1.192.0/24
-       - 192.168.63.0/24
-     use_fsid_option: true
+  - src: 192.168.162.10:/data/samba/shares
+    path: /data/samba/shares
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.162.0/24
+      - 10.0.192.0/24
+      - 10.1.192.0/24
+      - 192.168.63.0/24
+    use_fsid_option: true


 # ---
@@ -392,6 +391,26 @@ samba_user:
      - verwaltung
    password: 'q.Y-q/3r9j.E'

+  - name: buchhaltung
+    groups:
+      - buero
+    password: '7RcK/j3Sez-y'
+
+  - name: wimi
+    groups:
+      - buero
+    password: 'c2F.v.xd49-I'
+
+  - name: refa1
+    groups:
+      - buero
+    password: '3hp-hf7Pym.J'
+
+  - name: refi-m40
+    groups:
+      - buero
+    password: 'VX.S.3zKr446'
+

 #  - name: lap-02
 #    groups:
@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -44,9 +44,9 @@ network_interfaces:
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
-    #nameservers:
+    # nameservers:
    #  - 192.168.132.1
-    #search: blkr.netz
+    # search: blkr.netz


 # ---
@@ -130,7 +130,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - dissens.netz
@@ -140,7 +140,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -189,7 +189,7 @@ default_user:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'

-#extra_user:
+# extra_user:
 #
 #  - name: borg
 #    user_id: 1065
@@ -272,14 +272,14 @@ cron_user_special_time_entries:
 # see: roles/common/tasks/vars

 sudoers_file_user_aliases:
-   - name: MAIN_USER
-     entry: 'malte.taeubrich, ulla.wittenzellner, sarah.klemm, bernard.koennecke, elenor.faellgren, mario.freidank '
+  - name: MAIN_USER
+    entry: 'malte.taeubrich, ulla.wittenzellner, sarah.klemm, bernard.koennecke, elenor.faellgren, mario.freidank '

 sudoers_file_cmnd_aliases:
-   - name: REBOOT 
-     entry: '/sbin/reboot'
-   - name: MANAGE_SERVICE
-     entry: '/usr/bin/systemctl'
+  - name: REBOOT
+    entry: '/sbin/reboot'
+  - name: MANAGE_SERVICE
+    entry: '/usr/bin/systemctl'


 sudoers_file_user_privileges:
@@ -330,16 +330,16 @@ nfs_server: 192.168.132.10
 #    Take car to increase 'fsid' in case of more than one export
 #
 nfs_exports:
-   - src: 192.168.132.10:/data/samba/shares
-     path: /data/samba/shares
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.132.0/24
-       - 10.0.192.0/24
-       - 10.1.192.0/24
-       - 192.168.63.0/24
-     use_fsid_option: true
+  - src: 192.168.132.10:/data/samba/shares
+    path: /data/samba/shares
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.132.0/24
+      - 10.0.192.0/24
+      - 10.1.192.0/24
+      - 192.168.63.0/24
+    use_fsid_option: true


 # ---
@@ -446,6 +446,12 @@ samba_user:
      - verwaltung
    password: '20-mar1o.fr31dank-24+'

+  - name: nano.nowak
+    groups:
+      - projekte
+      - team
+    password: '20-n4n0.n0w4k.26!'
+
  - name: olaf.stuve
    groups:
      - projekte
@@ -528,7 +534,7 @@ base_home: /data/home
 samba_homes_virusfilter: true

 remove_samba_users: []
-#remove_samba_users:
+# remove_samba_users:
 #  - name: sebastian.scheele
 #  - name: rositsa.mahdi
 #  - name: laura.sasse
@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -44,9 +44,9 @@ network_interfaces:
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
-    #nameservers:
+    # nameservers:
    #  - 192.168.182.1
-    #search: ebs.netz
+    # search: ebs.netz

    # optional bridge parameters bridge: {}
    # bridge:
@@ -65,7 +65,7 @@ network_interfaces:
    # inline hook scripts
    pre-up:
      - !!str "ip link set dev eno1 up" # pre-up script lines
-    up: [] #up script lines
+    up: [] # up script lines
    post-up: [] # post-up script lines (alias for up)
    pre-down: [] # pre-down script lines (alias for down)
    down: [] # down script lines
@@ -161,7 +161,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ebs.netz
@@ -171,7 +171,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.182.254
+  - 172.16.182.254


 # ---
@@ -247,7 +247,6 @@ cron_user_special_time_entries:
    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -293,17 +292,16 @@ nfs_server: 192.168.182.10
 #    Take car to increase 'fsid' in case of more than one export
 #
 nfs_exports:
-   - src: 192.168.182.10:/data/samba/shares
-     path: /data/samba/shares
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.182.0/24
-       - 10.0.192.0/24
-       - 10.1.192.0/24
-       - 192.168.63.0/24
-     use_fsid_option: true
-
+  - src: 192.168.182.10:/data/samba/shares
+    path: /data/samba/shares
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.182.0/24
+      - 10.0.192.0/24
+      - 10.1.192.0/24
+      - 192.168.63.0/24
+    use_fsid_option: true


 # ---
@@ -318,7 +316,7 @@ samba_workgroup: EBS

 samba_netbios_name: FILE-EBS

-#samba_server_min_protocol: !!str NT1
+# samba_server_min_protocol: !!str NT1

 samba_groups:

@@ -557,7 +555,6 @@ samba_shares:
    vfs_object_recycle: false


-
 # ==============================


@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -44,9 +44,9 @@ network_interfaces:
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
-    #nameservers:
+    # nameservers:
    #  - 192.168.192.1
-    #search: fhxb.netz
+    # search: fhxb.netz


 # ---
@@ -131,7 +131,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - fhxb.netz
@@ -141,7 +141,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.192.254
+  - 172.16.192.254


 # ---
@@ -156,7 +156,6 @@ cron_user_special_time_entries:
    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -202,28 +201,27 @@ nfs_server: 192.168.192.10
 #    Take car to increase 'fsid' in case of more than one export
 #
 nfs_exports:
-   - src: 192.168.192.10:/data/home
-     path: /data/home
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.192.0/23
-       - 10.0.192.0/24
-       - 10.1.192.0/24
-       - 192.168.63.0/24
-     use_fsid_option: true
-
-   - src: 192.168.192.10:/data/samba/shares
-     path: /data/samba/shares
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.192.0/23
-       - 10.0.192.0/24
-       - 10.1.192.0/24
-       - 192.168.63.0/24
-     use_fsid_option: true
+  - src: 192.168.192.10:/data/home
+    path: /data/home
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.192.0/23
+      - 10.0.192.0/24
+      - 10.1.192.0/24
+      - 192.168.63.0/24
+    use_fsid_option: true

+  - src: 192.168.192.10:/data/samba/shares
+    path: /data/samba/shares
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.192.0/23
+      - 10.0.192.0/24
+      - 10.1.192.0/24
+      - 192.168.63.0/24
+    use_fsid_option: true


 # ---
@@ -285,7 +283,7 @@ samba_groups:
    group_id: 1480
  - name: vermittlung
    group_id: 1490
-    
+
  - name: altlasten
    group_id: 1510

@@ -358,7 +356,7 @@ samba_user:
    password: '5hE-7n.JRQ9Y'

    # Archiv01
-  - name : a.rchiv01
+  - name: a.rchiv01
    groups:
      - archiv
      - ausstellungen
@@ -371,7 +369,7 @@ samba_user:
    password: '45pS2X-rim.e'

    # Archiv02
-  - name : a.rchiv02
+  - name: a.rchiv02
    groups:
      - archiv
      - ausstellungen
@@ -384,7 +382,7 @@ samba_user:
    password: '7gqKY/7-nh3Q'

    # Astrid Schiemann
-  - name : a.schiemann
+  - name: a.schiemann
    groups:
      - archiv
      - ausstellungen
@@ -408,7 +406,7 @@ samba_user:
    password: 'G.u3r.tJ6Qkh'

    # Babara Schaller
-  - name : b.schaller
+  - name: b.schaller
    groups:
      - archiv
      - ausstellungen
@@ -421,7 +419,7 @@ samba_user:
    password: 'ufPmZ.L/63yJ'

    # Ellen Thieleman
-  - name : e.thieleman
+  - name: e.thieleman
    groups:
      - ausstellungen
      - buero
@@ -430,14 +428,14 @@ samba_user:
    password: 'MFS79-tzWA/c'

    # Erika Hausotter
-  - name : e.hausotter
+  - name: e.hausotter
    groups:
      - archiv
      - team
    password: 'A/pY4-9VvUdo'

    # Fabian Bovens
-  - name : f.bovens
+  - name: f.bovens
    groups:
      - archiv
      - ausstellungen
@@ -449,7 +447,7 @@ samba_user:
    password: 'z/Cw3.IzP2xn'

    # Florian Helm
-  - name : f.helm
+  - name: f.helm
    groups:
      - altlasten
      - archiv
@@ -475,7 +473,7 @@ samba_user:
    password: 'z2FE..fUh4fx'

    # Frauke Erdmann
-  - name : f.erdmann
+  - name: f.erdmann
    groups:
      - archiv
      - ausstellungen
@@ -488,7 +486,7 @@ samba_user:
    password: 'P/yV5N9rxA-Y'

    # Gerhard Grosche
-  - name : g.grosche
+  - name: g.grosche
    groups:
      - archiv
      - ausstellungen
@@ -500,7 +498,7 @@ samba_user:
    password: '6/H-EgRqP9-T'

    # Heike Müller
-  - name : h.mueller
+  - name: h.mueller
    groups:
      - administration
      - buero
@@ -508,7 +506,7 @@ samba_user:
    password: 'VT7/n5hHy-Av'

    # Jana König
-  - name : j.koenig
+  - name: j.koenig
    groups:
      - administration
      - archiv
@@ -532,7 +530,7 @@ samba_user:
    password: 'fE6.2K/HpnuS'

    # Jorinde Splettstößer
-  - name : j.splettstoesser
+  - name: j.splettstoesser
    groups:
      - administration
      - archiv
@@ -557,7 +555,7 @@ samba_user:
    password: '2/octHEm/g5H'

    # Natalie Bayer
-  - name : n.bayer
+  - name: n.bayer
    groups:
      - administration
      - altlasten
@@ -584,7 +582,7 @@ samba_user:
    password: 'AI/.44Jt6rhY'

    # Natalie Maier
-  - name : n.maier
+  - name: n.maier
    groups:
      - administration
      - altlasten
@@ -611,7 +609,7 @@ samba_user:
    password: 'kI25L.pfQI/q'

    # Norbert Schropp
-  - name : n.schropp
+  - name: n.schropp
    groups:
      - archiv
      - ausstellungen
@@ -623,7 +621,7 @@ samba_user:
    password: 'rK/puJ2.7sb4'

    # Praktikum 01
-  - name : p.raktikum01
+  - name: p.raktikum01
    groups:
      - ausstellungen
      - buero
@@ -634,7 +632,7 @@ samba_user:
    password: '2IN.R5HIq-ig'

    # Praktikum 02
-  - name : p.raktikum02
+  - name: p.raktikum02
    groups:
      - ausstellungen
      - buero
@@ -645,7 +643,7 @@ samba_user:
    password: 'NnRYo5-d6i/n'

    # Volo 01
-  - name : v.olo01
+  - name: v.olo01
    groups:
      - archiv
      - ausstellungen
@@ -665,7 +663,7 @@ samba_user:
    password: 'A/pY4-9VvUdo'

    # Volo 02
-  - name : v.olo02
+  - name: v.olo02
    groups:
      - archiv
      - ausstellungen
@@ -686,7 +684,7 @@ samba_user:
    password: 'sp29q-Yn-6PY'

    # Volo 03
-  - name : v.olo03
+  - name: v.olo03
    groups:
      - archiv
      - ausstellungen
@@ -708,14 +706,15 @@ samba_user:
      - fhxb-sammlungen
    password: 'n7I.fSsR-9vv'

-
 base_home: /home

+samba_homes_virusfilter: true
+
 # remove_samba_users:
 #   - name: name1
 #   - name: name2
 #
-#remove_samba_users: []
+# remove_samba_users: []
 remove_samba_users:
  - name: evren

@@ -728,6 +727,7 @@ samba_shares:
    group_write_list: administration
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true

  - name: Altlasten
@@ -737,6 +737,7 @@ samba_shares:
    group_write_list: altlasten
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true

  - name: Archiv
@@ -746,6 +747,7 @@ samba_shares:
    group_write_list: archiv
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -756,6 +758,7 @@ samba_shares:
    group_write_list: ausstellungen
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -766,6 +769,7 @@ samba_shares:
    group_write_list: buero
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -776,6 +780,7 @@ samba_shares:
    group_write_list: forschung
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -786,6 +791,7 @@ samba_shares:
    group_write_list: gedenken-im-stadtraum
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -796,6 +802,7 @@ samba_shares:
    group_write_list: intern
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -806,6 +813,7 @@ samba_shares:
    group_write_list: leitung
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -816,6 +824,7 @@ samba_shares:
    group_write_list: museum-organisation
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -826,6 +835,7 @@ samba_shares:
    group_write_list: presse-orga-oeffentlichkeit
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -836,6 +846,7 @@ samba_shares:
    group_write_list: projekte
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -846,6 +857,7 @@ samba_shares:
    group_write_list: publikationen
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -856,6 +868,7 @@ samba_shares:
    group_write_list: stolpersteine
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -866,6 +879,7 @@ samba_shares:
    group_write_list: team
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -876,6 +890,7 @@ samba_shares:
    group_write_list: technik
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -886,6 +901,7 @@ samba_shares:
    group_write_list: vze
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -896,6 +912,7 @@ samba_shares:
    group_write_list: veranstaltungen
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -906,6 +923,7 @@ samba_shares:
    group_write_list: vermietung
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -916,6 +934,7 @@ samba_shares:
    group_write_list: vermittlung
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -926,6 +945,7 @@ samba_shares:
    group_write_list: fhxb-bildarchiv
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -936,11 +956,11 @@ samba_shares:
    group_write_list: fhxb-sammlungen
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'


-
 # ==============================


@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -44,9 +44,9 @@ network_interfaces:
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
-    #nameservers:
+    # nameservers:
    #  - 192.168.222.1
-    #search: blkr.netz
+    # search: blkr.netz


 # ---
@@ -130,7 +130,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - fm.netz
@@ -140,7 +140,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -203,7 +203,7 @@ default_user:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHUvk8+UduCcBbQO1YxXSU8SaGIl8x+TBmIFmPb9JQu8 root@gw-fm'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0ibOee8TvYlrEzKno5J6h3ZQs79i0wPElqYvQxAymK root@file-fm'

-#extra_user:
+# extra_user:
 #
 #  - name: borg
 #    user_id: 1065
@@ -296,14 +296,14 @@ cron_user_special_time_entries:
 # see: roles/common/tasks/vars

 sudoers_file_user_aliases:
-   - name: MAIN_USER
-     entry: 'sysadm'
+  - name: MAIN_USER
+    entry: 'sysadm'

 sudoers_file_cmnd_aliases:
-   - name: REBOOT 
-     entry: '/sbin/reboot'
-   - name: MANAGE_SERVICE
-     entry: '/usr/bin/systemctl'
+  - name: REBOOT
+    entry: '/sbin/reboot'
+  - name: MANAGE_SERVICE
+    entry: '/usr/bin/systemctl'


 sudoers_file_user_privileges:
@@ -354,16 +354,16 @@ nfs_server: 192.168.222.10
 #    Take car to increase 'fsid' in case of more than one export
 #
 nfs_exports:
-   - src: 192.168.222.10:/data/samba/shares
-     path: /data/samba/shares
-     mount_opts: users,rsize=8192,wsize=8192,hard,intr
-     export_opt: rw,root_squash,sync,subtree_check
-     export_networks:
-       - 192.168.222.0/24
-       - 10.0.222.0/24
-       - 10.1.222.0/24
-       - 192.168.63.0/24
-     use_fsid_option: true
+  - src: 192.168.222.10:/data/samba/shares
+    path: /data/samba/shares
+    mount_opts: users,rsize=8192,wsize=8192,hard,intr
+    export_opt: rw,root_squash,sync,subtree_check
+    export_networks:
+      - 192.168.222.0/24
+      - 10.0.222.0/24
+      - 10.1.222.0/24
+      - 192.168.63.0/24
+    use_fsid_option: true


 # ---
@@ -473,12 +473,14 @@ samba_user:

 base_home: /data/home

+samba_homes_virusfilter: true
+
 # remove_samba_users:
 #   - name: name1
 #   - name: name2
 #
 remove_samba_users: []
-#remove_samba_users: 
+# remove_samba_users:
 #  - name: elenor.faellgrem
 #  - name: maiken.schiele

@@ -491,6 +493,7 @@ samba_shares:
    group_write_list: buero
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -501,6 +504,7 @@ samba_shares:
    group_write_list: projekte
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -511,6 +515,7 @@ samba_shares:
    group_write_list: verwaltung
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: true
    recycle_path: '@Recycle'

@@ -66,14 +66,13 @@ install_compiler_pkgs: true
 # ---


-#copy_template_files: []
+# copy_template_files: []
 #
 #  - name: mailsystem_install_amavis.conf
 #    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
 #    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf


-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---
@@ -87,7 +87,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - anw-km.netz
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.122.254
+  - 172.16.122.254


 # ---
@@ -112,7 +112,6 @@ cron_user_special_time_entries:
    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -24,7 +24,7 @@ network_interfaces:

  - device: br0
    # use only once per device (for the first device entry)
-    headline: br0 - bridge over device eno1np0
+    headline: br0 - bridge over device enp97s0

    # auto & allow are only used for the first device entry
    allow: [] # array of allow-[stanzas] eg. allow-hotplug
@@ -33,7 +33,7 @@ network_interfaces:
    family: inet
    method: static
    description:
-    address: 192.168.122.210
+    address: 192.168.122.215
    netmask: 24
    gateway: 192.168.122.254

@@ -53,7 +53,7 @@ network_interfaces:
    #   maxwait:
    #   waitport:
    bridge:
-      ports: eno1np0 # for mor devices support a blank separated list
+      ports: enp97s0 # for mor devices support a blank separated list
      stp: !!str off
      fd: 5
      hello: 2
@@ -61,8 +61,8 @@ network_interfaces:

    # inline hook scripts
    pre-up:
-      - !!str "ip link set dev eno1np0 up" # pre-up script lines
-    up: [] #up script lines
+      - !!str "ip link set dev enp97s0 up" # pre-up script lines
+    up: [] # up script lines
    post-up: [] # post-up script lines (alias for up)
    pre-down: [] # pre-down script lines (alias for down)
    down: [] # down script lines
@@ -93,13 +93,6 @@ network_interfaces:
 # vars used by roles/common/tasks/apt.yml
 # ---

-apt_install_extra_pkgs:
-  - lvm2
-  - kpartx
-  - ntfs-3g
-  - swtpm
-  - swtpm-tools
-

 # ---
 # vars used by roles/common/tasks/systemd-resolved.yml
@@ -158,7 +151,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - anw-km.netz
@@ -168,7 +161,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 172.16.122.254
+  - 172.16.122.254


 # ---
@@ -221,61 +214,10 @@ cron_user_entries:
    job: /root/bin/monitoring/check_ntpsec_service.sh


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

-extra_user:
-
-  - name: advoware
-    user_id: 1115
-    group_id: 1115
-    group: advoware
-    home: / data/home/advoware
-    password: $y$j9T$wuQkVnvJxMIy/2Hvmqm2w/$AlMLFmglx764uNSekaFJ3inN59jiDc8.4F2vhUybF22
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: a-jur
-    user_id: 1110
-    group_id: 1110
-    group: a-jur
-    home: / data/home/a-jur
-    password: $y$j9T$wuQkVnvJxMIy/2Hvmqm2w/$AlMLFmglx764uNSekaFJ3inN59jiDc8.4F2vhUybF22
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    home: /home/back
-    password: $y$j9T$WmitGB98lhPLJ39Iy4YfH.$irv0LP1bB5ImQKBUr1acEif6Ed6zDu6gLQuGQd/i5s0
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
-
-  - name: borg
-    user_id: 1065
-    group_id: 1065
-    group: borg
-    home: /home/borg
-    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILsqkTV7RiYPljwlP/MZA+MBeTgiwZI7oCAD77Ujpm1V root@file-km'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOan+hwlA8B3mk82tsvL1LGlejrF5pqT2J3POrg/QJLX root@gw-km'
-
-
 # ---
 # vars used by roles/common/tasks/users-systemfiles.yml
 # ---
@@ -312,12 +254,12 @@ sudoers_file_user_back_mount_privileges:
 # vars used by roles/common/tasks/samba-user.yml
 # ---

-samba_server_ip: 192.168.122.210
+samba_server_ip: 192.168.122.215
 samba_server_cidr_prefix: 24

-samba_workgroup: ANW-KM
+samba_workgroup: WORKGROUP

-samba_netbios_name: FILE-KM-01
+samba_netbios_name: FILE-KM-ALT

 samba_server_min_protocol: !!str NT1

@@ -326,16 +268,12 @@ samba_groups:
    group_id: 1100
  - name: a-jur
    group_id: 1110
-  - name: advoware
-    group_id: 1115
  - name: intern
    group_id: 1120
  - name: wildvang
    group_id: 1130
-  #- name: aulmann
-  #  group_id: 1130
-  #- name: howe
-  #  group_id: 1140
+  - name: eibelshaeuser
+    group_id: 1140
  - name: stahmann
    group_id: 1150
  - name: traine
@@ -344,7 +282,8 @@ samba_groups:
    group_id: 1170
  - name: alle
    group_id: 1180
-
+  - name: install
+    group_id: 1190


 samba_user:
@@ -352,108 +291,31 @@ samba_user:
  - name: advoware
    groups:
      - advoware
+    has_rdp: false
    password: '9WNRbc49m3'

  - name: a-jur
    groups:
      - a-jur
      - alle
-      - intern
      - kanzlei
+    has_rdp: false
    password: 'a-jur'

-  - name: andrea
-    groups:
-      - advoware
-      - stahmann
-      - traine
-      - public
-    password: 'fXc3bmK9gj'
-
-  - name: andreas
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - kanzlei
-    password: 'YKQRa.M9-6rL'
-
-  - name: aphex2
-    groups:
-      - alle
-      - stahmann
-      - traine
-      - public
-    password: 'J3KMRprK9H'
-
-  - name: berenice
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'berenice'
-
-  - name: beuster
-    groups:
-      - advoware
-      - stahmann
-      - traine
-      - public
-      - alle
-    password: 'zlm17Kx'
-
-  - name: buero
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero'
-
-  - name: buero2
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero2'
-
-  - name: buero3
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero3'
-
-  - name: buero4
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero4'
-
-  - name: buero7
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero7'
-
  - name: chris
    groups:
      - a-jur
      - advoware
      - alle
      - intern
+      - install
      - kanzlei
+      - eibelshaeuser
      - stahmann
      - traine
      - wildvang
      - public
+    has_rdp: true
    password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          30383265366434633965346530666535363761396165393434643665393137353765653739636364
@@ -462,14 +324,202 @@ samba_user:
          3837613337343533650a663061366230353531316535656433643162353063383534323833323138
          3430

-  - name: christina
+  - name: sysadm
+    groups:
+      - a-jur
+      - advoware
+      - alle
+      - intern
+      - install
+      - kanzlei
+      - eibelshaeuser
+      - stahmann
+      - traine
+      - wildvang
+      - public
+    has_rdp: false
+    password: 'Ax_GSHh5'
+
+  - name: winadm
+    groups:
+      - a-jur
+      - advoware
+      - alle
+      - intern
+      - install
+      - kanzlei
+      - eibelshaeuser
+      - stahmann
+      - traine
+      - wildvang
+      - public
+    has_rdp: false
+    password: 'Ax_GSHh5'
+
+# ---
+# Andreas Eibelhäuser
+# ---
+
+  - name: andreas
+    groups:
+      - advoware
+      - alle
+      - eibelshaeuser
+      - public
+    has_rdp: true
+    password: 'YKQRa.M9-6rL'
+
+  - name: philipp
+    groups:
+      - advoware
+      - alle
+      - eibelshaeuser
+      - public
+    has_rdp: true
+    password: '20-phi.lip.26%'
+
+  - name: ref.eibelshaeuser
+    groups:
+      - advoware
+      - alle
+      - eibelshaeuser
+      - public
+    has_rdp: true
+    password: '20-ref-eibels.haeuser.26+'
+
+# ---
+# Berenice Böhlo
+# ---
+
+  - name: berenice
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: true
+    password: 'berenice'
+
+  - name: annabel
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: true
+    password: '20+an-na.bel/26!'
+
+  - name: jens-uwe
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: false
+    password: '20_jens-uwe.thomas.26!'
+
+  - name: mariami
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: false
+    password: '20.ma-ri-ami/26!'
+
+  - name: nina
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: true
+    password: '20-ni.ha-ger%26%'
+
+  - name: zeina
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+      - wildvang
+    has_rdp: true
+    password: '20/ze.ina-26+'
+
+  - name: rm-buero1
+    groups:
+      - advoware
+      - alle
+      - a-jur
+      - kanzlei
+      - public
+    has_rdp: false
+    password: '20+rm.buero-1/26!'
+
+  - name: rm-buero2
+    groups:
+      - advoware
+      - alle
+      - a-jur
+      - kanzlei
+      - public
+    has_rdp: false
+    password: '20_rmbuero.2-26%'
+
+# ---
+# Rolf Stahmann
+# ---
+
+  - name: irina
    groups:
      - advoware
      - alle
      - stahmann
      - traine
      - public
-    password: 'qvR7zX4Lhs'
+    has_rdp: false
+    password: 'W9NKv39pXW'
+
+  - name: rolf
+    groups:
+      - alle
+      - stahmann
+      - traine
+      - public
+    has_rdp: true
+    password: '4xNVNFXgP4'
+
+  - name: Tresen
+    groups:
+      - a-jur
+      - advoware
+      - alle
+      - kanzlei
+      - stahmann
+      - traine
+      - public
+    has_rdp: false
+    password: 'maltzwo2'
+
+# ---
+# Federico Traine
+# ---
+
+  - name: andrea
+    groups:
+      - advoware
+      - alle
+      - stahmann
+      - traine
+      - public
+    has_rdp: true
+    password: 'fXc3bmK9gj'

  - name: federico
    groups:
@@ -478,8 +528,146 @@ samba_user:
      - stahmann
      - traine
      - public
+    has_rdp: true
    password: 'zHfj9g3NcC'

+  - name: thomas
+    groups:
+      - advoware
+      - alle
+      - traine
+      - public
+    has_rdp: true
+    password: '55-tho-mas-550'
+
+  - name: leonora
+    groups:
+      - advoware
+      - alle
+      - traine
+      - public
+    has_rdp: true
+    password: '20/le-o-nora.26!'
+
+  - name: kristin
+    groups:
+      - advoware
+      - alle
+      - traine
+      - public
+    has_rdp: true
+    password: '20.kris_tin-26/'
+
+  - name: jule
+    groups:
+      - advoware
+      - alle
+      - traine
+      - public
+    has_rdp: true
+    password: '20_ju-le%26!'
+
+  - name: luanda
+    groups:
+      - advoware
+      - alle
+      - traine
+      - public
+    has_rdp: false
+    password: '20-lu.anda+26!'
+
+# ---
+# Wiebke Wildvang
+# ---
+
+  - name: wiebke
+    groups:
+      - alle
+      - wildvang
+      - public
+    has_rdp: true
+    password: 'uJ5gF/m53p.P'
+
+
+  - name: aphex2
+    groups:
+      - alle
+      - stahmann
+      - traine
+      - public
+    has_rdp: false
+    password: 'J3KMRprK9H'
+
+  - name: beuster
+    groups:
+      - advoware
+      - stahmann
+      - traine
+      - public
+      - alle
+    has_rdp: false
+    password: 'zlm17Kx'
+
+  - name: buero
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: false
+    password: 'buero'
+
+  - name: buero2
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: false
+    password: 'buero2'
+
+  - name: buero3
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: false
+    password: 'buero3'
+
+  - name: buero4
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: false
+    password: 'buero4'
+
+  - name: buero7
+    groups:
+      - advoware
+      - kanzlei
+      - a-jur
+      - alle
+      - public
+    has_rdp: false
+    password: 'buero7'
+
+  - name: christina
+    groups:
+      - advoware
+      - alle
+      - stahmann
+      - traine
+      - public
+    has_rdp: false
+    password: 'qvR7zX4Lhs'
+
 #  - name: gerhard
 #    groups:
 #      - advoware
@@ -495,6 +683,8 @@ samba_user:
    groups:
      - alle
      - stahmann
+      - public
+    has_rdp: false
    password: '44-Ro-440'

 #  - name: howe-staff-1
@@ -505,15 +695,6 @@ samba_user:
 #      - howe
 #    password: ''

-  - name: irina
-    groups:
-      - advoware
-      - alle
-      - stahmann
-      - traine
-      - public
-    password: 'W9NKv39pXW'
-
  - name: jessica
    groups:
      - advoware
@@ -521,6 +702,7 @@ samba_user:
      - stahmann
      - traine
      - public
+    has_rdp: false
    password: 'bV3pjPtjkR'

 #  - name: laura
@@ -539,6 +721,7 @@ samba_user:
      - stahmann
      - traine
      - public
+    has_rdp: false
    password: 'fndvLmrt7W'

  - name: lenovo4
@@ -548,6 +731,7 @@ samba_user:
      - stahmann
      - traine
      - public
+    has_rdp: false
    password: 'tpCMmTKj7H'

  - name: lenovo5
@@ -557,6 +741,7 @@ samba_user:
      - stahmann
      - traine
      - public
+    has_rdp: false
    password: 'L5Hannover51'

  - name: lenovo6
@@ -565,81 +750,10 @@ samba_user:
      - alle
      - stahmann
      - traine
+      - public
+    has_rdp: false
    password: '66koeln66'

-  - name: rm-buero1
-    groups:
-      - advoware
-      - alle
-      - a-jur
-      - kanzlei
-    password: ''
-
-  - name: rm-buero2
-    groups:
-      - advoware
-      - alle
-      - a-jur
-      - kanzlei
-    password: ''
-
-  - name: rolf
-    groups:
-      - alle
-      - stahmann
-      - traine
-      - public
-    password: '4xNVNFXgP4'
-
-  - name: sysadm
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - intern
-      - kanzlei
-      - stahmann
-      - traine
-      - wildvang
-      - public
-    password: 'Ax_GSHh5'
-
-  - name: thomas
-    groups:
-      - advoware
-      - alle
-      - traine
-    password: '55-tho-mas-550'
-
-  - name: Tresen
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - kanzlei
-      - stahmann
-      - traine
-      - public
-    password: 'maltzwo2'
-
-  - name: wiebke
-    groups:
-      - alle
-      - wildvang
-      - public
-    password: 'uJ5gF/m53p.P'
-
-  - name: winadm
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - intern
-      - kanzlei
-      - public
-    password: 'Ax_GSHh5'
-
-

 base_home: /data/home

@@ -650,8 +764,8 @@ remove_samba_users:
  - name: gerhard
  - name: laura

-#remove_samba_users: []
-#remove_samba_users:
+# remove_samba_users: []
+# remove_samba_users:
 #  - name: evren

 samba_shares:
@@ -683,12 +797,25 @@ samba_shares:
  - name: install
    comment: Install auf Fileserver
    path: /data/samba/no-backup-shares/install
-    group_valid_users: intern
-    group_write_list: intern
+    group_valid_users: install
+    group_write_list: install
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
    vfs_object_recycle: false

+  - name: eibelshaeuser
+    comment: Eibelshaeuser auf Fileserver
+    path: /data/samba/eibelshaeuser
+    group_valid_users: eibelshaeuser
+    group_write_list: eibelshaeuser
+    file_create_mask: !!str 660
+    dir_create_mask: !!str 2770
+    vfs_object_virusfilter: true
+    vfs_object_recycle: true
+    recycle_path: '@Recycle'
+    vfs_object_recycle_is_visible: true
+
  - name: wildvang
    comment: Wildvang auf Fileserver
    path: /data/samba/Wildvang
@@ -1,774 +0,0 @@
---
-
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-
-network_interfaces:
-
-  - device: br0
-    # use only once per device (for the first device entry)
-    headline: br0 - bridge over device enp97s0
-
-    # auto & allow are only used for the first device entry
-    allow: [] # array of allow-[stanzas] eg. allow-hotplug
-    auto: true
-
-    family: inet
-    method: static
-    description:
-    address: 192.168.122.10
-    netmask: 24
-    gateway: 192.168.122.254
-
-    # optional dns settings nameservers: []
-    #
-    #    nameservers:
-    #      - 194.150.168.168  # dns.as250.net
-    #      - 91.239.100.100   # anycast.censurfridns.dk
-    #    search: warenform.de
-    #
-
-    # optional bridge parameters bridge: {}
-    # bridge:
-    #   ports:
-    #   stp:
-    #   fd:
-    #   maxwait:
-    #   waitport:
-    bridge:
-      ports: enp97s0 # for mor devices support a blank separated list
-      stp: !!str off
-      fd: 5
-      hello: 2
-      maxage: 12
-
-    # inline hook scripts
-    pre-up:
-      - !!str "ip link set dev enp97s0 up" # pre-up script lines
-    up: [] #up script lines
-    post-up: [] # post-up script lines (alias for up)
-    pre-down: [] # pre-down script lines (alias for down)
-    down: [] # down script lines
-    post-down: [] # post-down script lines
-
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 192.168.122.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - anw-km.netz
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 172.16.122.254
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart DNS Cache service 'systemd-resolved'"
-    special_time: reboot
-    job: "sleep 10 ; /bin/systemctl restart systemd-resolved"
-    insertafter: PATH
-
-  - name: "Activate ksm support"
-    special_time: reboot
-    job: "echo 1 > /sys/kernel/mm/ksm/run"
-    insertafter: PATH
-
-
-cron_user_entries:
-
-  - name: "Check if SSH service is running. Restart service if needed."
-    minute: '*/5'
-    hour: '*'
-    job: /root/bin/monitoring/check_ssh.sh
-
-  - name: "Check if postfix mailservice is running. Restart service if needed."
-    minute: "*/5"
-    hour: "*"
-    job: /root/bin/monitoring/check_postfix.sh
-
-  - name: "Check Postfix E-Mail LOG file for 'fatal' errors."
-    minute: "*/30"
-    hour: "*"
-    job: /root/bin/postfix/check-postfix-fatal-errors.sh
-
-  - name: "Clean up Samba Trash Dirs"
-    minute: "02"
-    hour: "23"
-    job: /root/bin/samba/clean_samba_trash.sh
-
-  - name: "Set (group and access) Permissons for Samba shares"
-    minute: "14"
-    hour: "23"
-    job: /root/bin/samba/set_permissions_samba_shares.sh
-
-  - name: "Check if ntpsec is running. Restart service if needed."
-    minute: "*/6"
-    hour: "*"
-    job: /root/bin/monitoring/check_ntpsec_service.sh
-
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-sudoers_file_user_back_mount_privileges:
-  - 'ALL=(root) NOPASSWD: /usr/bin/mount'
-  - 'ALL=(root) NOPASSWD: /usr/bin/umount'
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/samba-config-server.yml
-# vars used by roles/common/tasks/samba-user.yml
-# ---
-
-samba_server_ip: 192.168.122.10
-samba_server_cidr_prefix: 24
-
-samba_workgroup: WORKGROUP
-
-samba_netbios_name: FILE-KM
-
-samba_server_min_protocol: !!str NT1
-
-samba_groups:
-  - name: kanzlei
-    group_id: 1100
-  - name: a-jur
-    group_id: 1110
-  - name: intern
-    group_id: 1120
-  - name: wildvang
-    group_id: 1130
-  #- name: aulmann
-  #  group_id: 1130
-  #- name: howe
-  #  group_id: 1140
-  - name: stahmann
-    group_id: 1150
-  - name: traine
-    group_id: 1160
-  - name: public
-    group_id: 1170
-  - name: alle
-    group_id: 1180
-
-
-
-samba_user:
-
-  - name: advoware
-    groups:
-      - advoware
-    password: '9WNRbc49m3'
-
-  - name: a-jur
-    groups:
-      - a-jur
-      - alle
-      - intern
-      - kanzlei
-    password: 'a-jur'
-
-  - name: andrea
-    groups:
-      - advoware
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'fXc3bmK9gj'
-
-  - name: andreas
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - kanzlei
-    password: 'YKQRa.M9-6rL'
-
-  - name: aphex2
-    groups:
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'J3KMRprK9H'
-
-  - name: berenice
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'berenice'
-
-  - name: beuster
-    groups:
-      - advoware
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-      - alle
-    password: 'zlm17Kx'
-
-  - name: buero
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero'
-
-  - name: buero2
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero2'
-
-  - name: buero3
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero3'
-
-  - name: buero4
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero4'
-
-  - name: buero7
-    groups:
-      - advoware
-      - kanzlei
-      - a-jur
-      - alle
-    password: 'buero7'
-
-  - name: chris
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - aulmann
-      - intern
-      - kanzlei
-      - stahmann
-      - traine
-      - public
-    password: !vault |
-          $ANSIBLE_VAULT;1.1;AES256
-          30383265366434633965346530666535363761396165393434643665393137353765653739636364
-          6330623334353763613065343336306434376335646666380a363030363335656261656236636562
-          63663763616630383264303039336562626537366634303636356237323630666635356130383165
-          3837613337343533650a663061366230353531316535656433643162353063383534323833323138
-          3430
-
-  - name: christina
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'qvR7zX4Lhs'
-
-  - name: federico
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'zHfj9g3NcC'
-
-#  - name: gerhard
-#    groups:
-#      - advoware
-#      - alle
-#      - aulmann
-#      - howe
-#      - stahmann
-#      - traine
-#      - public
-#    password: 'bHdhzWnTj9'
-
-  - name: ho-st1
-    groups:
-      - alle
-      - howe
-      - stahmann
-    password: '44-Ro-440'
-
-#  - name: howe-staff-1
-#    groups:
-#      - advoware
-#      - alle
-#      - aulmann
-#      - howe
-#    password: ''
-
-  - name: irina
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'W9NKv39pXW'
-
-  - name: jessica
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'bV3pjPtjkR'
-
-#  - name: laura
-#    groups:
-#      - alle
-#      - aulmann
-#      - howe
-#      - stahmann
-#      - traine
-#    password: '99-Hamburg-990'
-
-  - name: lenovo3
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'fndvLmrt7W'
-
-  - name: lenovo4
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'tpCMmTKj7H'
-
-  - name: lenovo5
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'L5Hannover51'
-
-  - name: lenovo6
-    groups:
-      - advoware
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-    password: '66koeln66'
-
-  - name: rm-buero1
-    groups:
-      - advoware
-      - alle
-      - a-jur
-      - kanzlei
-    password: ''
-
-  - name: rm-buero2
-    groups:
-      - advoware
-      - alle
-      - a-jur
-      - kanzlei
-    password: ''
-
-  - name: rolf
-    groups:
-      - alle
-      - aulmann
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: '4xNVNFXgP4'
-
-  - name: sysadm
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - aulmann
-      - intern
-      - kanzlei
-      - stahmann
-      - traine
-      - public
-    password: 'Ax_GSHh5'
-
-  - name: thomas
-    groups:
-      - advoware
-      - alle
-      - traine
-    password: '55-tho-mas-550'
-
-  - name: Tresen
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - kanzlei
-      - howe
-      - stahmann
-      - traine
-      - public
-    password: 'maltzwo2'
-
-  - name: wiebke
-    groups:
-      - alle
-      - wildvang
-      - public
-    password: '4xNVNFXgP4'
-
-  - name: winadm
-    groups:
-      - a-jur
-      - advoware
-      - alle
-      - intern
-      - kanzlei
-      - public
-    password: 'Ax_GSHh5'
-
-
-
-base_home: /data/home
-
-remove_samba_users:
-  - name: howe-staff-1
-  - name: gerhard
-  - name: laura
-
-#remove_samba_users: []
-#remove_samba_users:
-#  - name: evren
-
-samba_shares:
-
-  - name: a-jur
-    comment: a-jur Dokumente
-    path: /data/samba/a-jur
-    group_valid_users: a-jur
-    group_write_list: a-jur
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: kanzlei
-    comment: Kanzlei auf Fileserver
-    path: /data/samba/kanzlei
-    group_valid_users: kanzlei
-    group_write_list: kanzlei
-    file_create_mask: !!str 664
-    dir_create_mask: !!str 2775
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: install
-    comment: Install auf Fileserver
-    path: /data/samba/no-backup-shares/install
-    group_valid_users: intern
-    group_write_list: intern
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: false
-
-  - name: wildvang
-    comment: Traine auf Fileserver
-    path: /data/samba/Wildvang
-    group_valid_users: wildvang
-    group_write_list: wildvang
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-#  - name: aulmann
-#    comment: Aulmann auf Fileserver
-#    path: /data/samba/Aulmann
-#    group_valid_users: aulmann
-#    group_write_list: aulmann
-#    file_create_mask: !!str 660
-#    dir_create_mask: !!str 2770
-#    vfs_object_recycle: true
-#    recycle_path: '@Recycle'
-#    vfs_object_recycle_is_visible: true
-
-#  - name: howe
-#    comment: Howe auf Fileserver
-#    path: /data/samba/Howe
-#    group_valid_users: howe
-#    group_write_list: howe
-#    file_create_mask: !!str 660
-#    dir_create_mask: !!str 2770
-#    vfs_object_recycle: true
-#    recycle_path: '@Recycle'
-#    vfs_object_recycle_is_visible: true
-
-  - name: stahmann
-    comment: Stahmann auf Fileserver
-    path: /data/samba/Stahmann
-    group_valid_users: stahmann
-    group_write_list: stahmann
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: traine
-    comment: Traine auf Fileserver
-    path: /data/samba/Traine
-    group_valid_users: traine
-    group_write_list: traine
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: public
-    comment: Public auf Fileserver
-    path: /data/samba/public
-    group_valid_users: public
-    group_write_list: public
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: Advoware-Schriftverkehr
-    comment: Advoware Dokumente
-    path: /data/samba/Advoware-Schriftverkehr
-    group_valid_users: advoware
-    group_write_list: advoware
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-  - name: Advoware-Backup
-    comment: Advoware Dokumente
-    path: /data/samba/Advoware-Backup
-    group_valid_users: intern
-    group_write_list: intern
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: false
-
-  - name: alle
-    comment: Alle auf Fileserver
-    path: /data/samba/Alle
-    group_valid_users: alle
-    group_write_list: alle
-    file_create_mask: !!str 660
-    dir_create_mask: !!str 2770
-    vfs_object_recycle: true
-    recycle_path: '@Recycle'
-    vfs_object_recycle_is_visible: true
-
-#  - name: web
-#    comment: Web auf Fileserver
-#    path: /data/samba/Web
-#    group_valid_users: web
-#    group_write_list: web
-#    file_create_mask: !!str 660
-#    dir_create_mask: !!str 2770
-#    vfs_object_recycle: true
-#    recycle_path: '@Recycle'
-
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
@@ -46,8 +46,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -58,20 +58,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -87,10 +87,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -100,7 +100,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -132,7 +132,6 @@ cron_user_entries:
    job: /root/bin/monitoring/check_ssh.sh


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -197,4 +196,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -43,8 +43,8 @@ systemd_resolved: true
 #      IPv6: 2606:4700:4700::1111
 #   sekundäre DNS-Adresse
 #      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
+#      IPv6: 2606:4700:4700::1001
+#
 # Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
 #   primäre DNS-Adresse
 #      IPv4: 8.8.8.8
@@ -55,20 +55,20 @@ systemd_resolved: true
 #
 # Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
 #   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
 #   sekundäre DNS-Adresse
 #      IPv4: 149.112.112.112
 #      IPv6: 2620:fe::9
 #
 # OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
 #      IPv4: 194.36.144.87  - ns29.de
 #      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
 #    IPv4: 5.1.66.255
 #    IPv6: 2001:678:e68:f000::
 #    Servername für DNS-over-TLS: dot.ffmuc.net
@@ -81,10 +81,10 @@ resolved_nameserver:

 # search domains
 #
-# If there are more than one search domains, then specify them here in the order in which 
+# If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - oopen.de
@@ -94,25 +94,25 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
 # vars used by roles/common/tasks/users.yml
 # ---

-#insert_root_ssh_keypair: true
+# insert_root_ssh_keypair: true
 #
-#root_ssh_keypair:
+# root_ssh_keypair:
 #  - name: id-rsa-dehydrated
-#    priv_key_src: b.mx/root/.ssh/b.mx-id_rsa-dehydrated
+#    priv_key_src: g.mx.oopen.de/root/.ssh/b.mx-id_rsa-dehydrated
 #    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-#    pub_key_src: b.mx/root/.ssh/b.mx-id_rsa-dehydrated.pub
+#    pub_key_src: g.mx.oopen.de/root/.ssh/b.mx-id_rsa-dehydrated.pub
 #    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
 #  - name: id-rsa-opendkim
-#    priv_key_src: b.mx/root/.ssh/b.mx-id_rsa-opendkim
+#    priv_key_src: g.mx.oopen.de/root/.ssh/b.mx-id_rsa-opendkim
 #    priv_key_dest: /root/.ssh/id_rsa-opendkim
-#    pub_key_src: b.mx/root/.ssh/b.mx-id_rsa-opendkim.pub
+#    pub_key_src: g.mx.oopen.de/root/.ssh/b.mx-id_rsa-opendkim.pub
 #    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub


@@ -149,42 +149,6 @@ resolved_fallback_nameserver:
 # vars used by roles/common/tasks/copy_files.yml
 # ---

-copy_plain_files:
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: g.mx/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: g.mx/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfix_host_specific:
-
-  - name: relay_domains
-    src_path: g.mx/etc/postfix/relay_domains
-    dest_path: /etc/postfix/relay_domains
-
-
-copy_plain_files_postfwd_host_specific:
-
-  # Postfix Firewall postfwd
-  #
-  - name: postfwd.wl-nets
-    src_path: g.mx/etc/postfix/postfwd.wl-nets
-    dest_path: /etc/postfix/postfwd.wl-nets
-
-
-copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-

 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -5,10 +5,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -28,10 +28,10 @@ network_interfaces:
    address: 172.16.10.1
    netmask: 24
    gateway: 172.16.10.254
-    #nameservers:
+    # nameservers:
    #  - 192.168.10.1
    #  - 192.168.10.3
-    #search: ga.netz
+    # search: ga.netz


  - device: eth2
@@ -90,7 +90,7 @@ network_interfaces:

    family: inet
    method: static
-    #hwaddress: 0c:c4:7a:7d:51:46
+    # hwaddress: 0c:c4:7a:7d:51:46
    description:
    address: 10.221.15.254
    netmask: 20
@@ -185,8 +185,8 @@ network_interfaces:
      - /sbin/ip route add 192.168.11.0/24 via 172.16.111.254
      - /sbin/ip route add 192.168.78.0/24 via 172.16.111.254
      # User Networks Campus
-      #- /sbin/ip route add 192.168.72.0/24 via 172.16.111.254
-      #- /sbin/ip route add 192.168.73.0/24 via 172.16.111.254
+      # - /sbin/ip route add 192.168.72.0/24 via 172.16.111.254
+      # - /sbin/ip route add 192.168.73.0/24 via 172.16.111.254
      # User Network Novalishaus
      - /sbin/ip route add 192.168.81.0/24 via 172.16.111.254
      # User Network Georgshaus
@@ -202,7 +202,7 @@ network_interfaces:
      # WLAN privat Novalishaus
      - /sbin/ip route add 10.31.0.0/20 via 172.16.111.254
      # Management Netork Campus
-      #- /sbin/ip route add 10.72.1.0/24 via 172.16.111.254
+      # - /sbin/ip route add 10.72.1.0/24 via 172.16.111.254
      # WLan Router Stockhausen
      - /sbin/ip route add 10.112.1.0/24 via 172.16.111.254
      # WLan Netz
@@ -329,7 +329,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -340,7 +340,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 192.168.11.1
+  - 192.168.11.1


 # ---
@@ -482,30 +482,29 @@ bind9_gateway_acl:
      - 192.168.10.2


-
 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - none
+  - none

-bind9_transfer_source:  !!str "192.168.10.1"
+bind9_transfer_source: !!str "192.168.10.1"
 bind9_notify_source: !!str "192.168.10.1"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -529,4 +528,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -82,8 +82,8 @@ default_user:

 sudo_users:
  - chris
-  - maadmin
  - sysadm
+  - maadmin
  - wadmin


@@ -123,7 +123,6 @@ sshd_permit_root_login: !!str "prohibit-password"
 # ---


-
 # ==============================


@@ -82,9 +82,9 @@ default_user:

 sudo_users:
  - chris
+  - maadmin
  - sysadm
  - wadmin
-  - maadmin


 # ---
@@ -123,7 +123,6 @@ sshd_permit_root_login: !!str "prohibit-password"
 # ---


-
 # ==============================


@@ -133,7 +133,7 @@ systemd_resolved: true
 #    Servername für DNS-over-TLS: dot.ffmuc.net
 #    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
 resolved_nameserver:
-   - 192.168.10.1
+  - 192.168.10.1
   - 192.168.10.3

 # search domains
@@ -141,7 +141,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -163,14 +163,14 @@ insert_root_ssh_keypair: true

 root_ssh_keypair:
  - name: id-rsa-dehydrated
-    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated
+    priv_key_src: ga-al-relay.ga.netz/root/.ssh/ga-st-mail-id_rsa-dehydrated
    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
+    pub_key_src: ga-al-relay.ga.netz/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
  - name: id-rsa-opendkim
-    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim
+    priv_key_src: ga-al-relay.ga.netz/root/.ssh/ga-st-mail-id_rsa-opendkim
    priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
+    pub_key_src: ga-al-relay.ga.netz/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub


@@ -233,30 +233,29 @@ bind9_gateway_acl:
      - 192.168.10.2


-
 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - none
+  - none

-bind9_transfer_source:  !!str "192.168.10.2"
+bind9_transfer_source: !!str "192.168.10.2"
 bind9_notify_source: !!str "192.168.10.2"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -273,35 +272,19 @@ bind9_gateway_allow_recursion:
 # ---


-copy_plain_files_postfix_host_specific:
-
-  - name: relay_domains
-    src_path: ga-al-relay/etc/postfix/relay_domains
-    dest_path: /etc/postfix/relay_domains
-
-
-copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-
-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---

 hostname: ga-al-relay.ga.netz
 ipv4_address: 192.168.10.2
-#ipv6_address: 
+# ipv6_address:

 admin_email: it@gemeinschaft-altenschlirf.org
 is_relay_host: !!str "false"
 sasl_auth_enable: !!str "yes"


-
 template_files_mailsystem_script:

  - name: mailsystem_install_postfix_advanced.conf
@@ -5,10 +5,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -28,10 +28,10 @@ network_interfaces:
    address: 172.16.72.1
    netmask: 24
    gateway: 172.16.72.254
-    #nameservers:
+    # nameservers:
    #  - 192.168.81.1
    #  - 172.16.81.254
-    #search: ga.netz ga.intra
+    # search: ga.netz ga.intra

  - device: eno2
    headline: eno2 - Uplink Lehrer-und Schülerdatenbank (LUSD)
@@ -45,7 +45,6 @@ network_interfaces:
      - /sbin/ip route add 10.9.131.0/24 via 192.168.100.253


-
  - device: eno3
    family: inet
    method: manual
@@ -76,7 +75,7 @@ network_interfaces:
    family: inet
    method: manual
    post-up:
-      # VLAN 20 - LAN 2 Campus including UniFi Accesspoints 
+      # VLAN 20 - LAN 2 Campus including UniFi Accesspoints
      - /sbin/ip link add link eno4 name eno4.20 type vlan id 20

  - device: eno4.20
@@ -109,7 +108,6 @@ network_interfaces:
    netmask: 24


-
 # ---
 # vars used by roles/ansible_dependencies
 # ---
@@ -197,7 +195,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - campus.netz
@@ -208,7 +206,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -346,28 +344,28 @@ bind9_gateway_acl:
      - 192.168.10.2

 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - none
+  - none

-bind9_transfer_source:  !!str "192.168.81.1"
+bind9_transfer_source: !!str "192.168.81.1"
 bind9_notify_source: !!str "192.168.81.1"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -391,4 +389,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -5,10 +5,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -31,7 +31,7 @@ network_interfaces:


  - device: eno2
-    headline: eno2 -  LAN 
+    headline: eno2 -  LAN
    auto: true
    family: inet
    method: static
@@ -132,7 +132,7 @@ cron_user_entries:
    job: /root/bin/admin-stuff/speedtest.sh


-#cron_user_special_time_entries: []
+# cron_user_special_time_entries: []
 cron_user_special_time_entries:

  - name: "Restart NTP service 'ntpsec'"
@@ -208,7 +208,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -219,7 +219,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -359,28 +359,28 @@ bind9_gateway_acl:
      - 192.168.10.2

 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - none
+  - none

-bind9_transfer_source:  !!str "192.168.85.1"
+bind9_transfer_source: !!str "192.168.85.1"
 bind9_notify_source: !!str "192.168.85.1"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -404,4 +404,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -5,10 +5,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -28,10 +28,10 @@ network_interfaces:
    address: 172.16.80.1
    netmask: 24
    gateway: 172.16.80.254
-    #nameservers:
+    # nameservers:
    #  - 192.168.81.1
    #  - 172.16.81.254
-    #search: ga.netz ga.intra
+    # search: ga.netz ga.intra


  - device: eno2
@@ -45,7 +45,7 @@ network_interfaces:


  - device: eno5
-    headline: eno5 -  LAN 
+    headline: eno5 -  LAN
    auto: true
    family: inet
    method: static
@@ -136,7 +136,7 @@ cron_user_entries:
    job: /root/bin/manage-gw-config/copy_gateway-config.sh GA-NH


-#cron_user_special_time_entries: []
+# cron_user_special_time_entries: []
 cron_user_special_time_entries:

  - name: "Restart NTP service 'ntpsec'"
@@ -212,7 +212,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -223,7 +223,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -363,28 +363,28 @@ bind9_gateway_acl:
      - 192.168.10.2

 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - none
+  - none

-bind9_transfer_source:  !!str "192.168.81.1"
+bind9_transfer_source: !!str "192.168.81.1"
 bind9_notify_source: !!str "192.168.81.1"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -408,4 +408,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -79,8 +79,8 @@ systemd_resolved: true
 #    Servername für DNS-over-TLS: dot.ffmuc.net
 #    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
 resolved_nameserver:
-  - 192.168.11.1 
-  - 192.168.10.1 
+  - 192.168.11.1
+  - 192.168.10.1
  - 192.168.11.3

 # search domains
@@ -88,7 +88,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -99,8 +99,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 127.0.0.1
-
+  - 127.0.0.1


 # ---
@@ -240,28 +239,28 @@ bind9_gateway_acl:
      - 192.168.10.2

 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - internaldns
+  - internaldns

-#bind9_transfer_source:  !!str "192.168.11.1"
-#bind9_notify_source: !!str "192.168.11.1"
+# bind9_transfer_source:  !!str "192.168.11.1"
+# bind9_notify_source: !!str "192.168.11.1"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -285,4 +284,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -1,591 +0,0 @@
---
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-network_interfaces:
-
-  - device: eno1np0
-    headline: eno1np0 - Temporary LAN network
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.18
-    netmask: 24
-
-  - device: enp129s0f2
-    headline: enp129s0f2 - Uplink static line (radio) to Altenschlirf
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.111.254
-    netmask: 24
-    up:
-      # - For management Antennas
-      - /sbin/ip link add link enp129s0f2 name enp129s0f2.111 type vlan id 111
-    post-up:
-      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
-      # -
-      # - Telefon Altenshlirf
-      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
-      # User Network Altenshlirf
-      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
-      # Management Network Altenschlirf
-      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
-      # WLan Router (Accesspoints) Altenshlirf
-      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
-      # # WLan Networks Altenshlirf
-      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
-      # DSL via Fritzbox Altenschlirf
-      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
-      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
-      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
-      # VPN home Network Altenschlirf
-      #
-      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
-      # VPN 'gw-ckubu' Network Altenschlirf
-      #
-      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
-      # private networks 'ckubu'
-      #
-      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
-      # so we route them back to that gateway..
-      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
-      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
-
-
-  - device: enp129s0f2.111
-    headline: enp129s0f2.111 - network 10.10.111.0 (management antennas)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.111.254
-    netmask: 24
-
-
-  - device: enp1s0f0 
-    headline: enp1s0f0 - holds VLAN 211 device for Network Telefons Stockhausen
-    auto: false
-    family: inet
-    method: manual
-    up:
-      - /sbin/ip link add link enp1s0f0 name enp1s0f0.211 type vlan id 211
-
-
-  - device: enp1s0f0.211
-    headline: enp1s0f0.211 - Network Telefons Stockhausen
-    auto: true
-    family: inet
-    method: static
-    # Note:
-    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
-    #       This LANCom Router IS NOT pngable                                 !!
-    address: 172.16.211.1
-    netmask: 24
-    pre-up:
-      - /sbin/ifconfig enp1s0f0 up
-
-
-  - device: enp1s0f2
-    headline: enp1s0f2 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.11.1
-    netmask: 24
-    gateway: 172.16.11.254
-
-
-  - device: enp1s0f3
-    headline: enp1s0f3 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.13.1
-    netmask: 24
-    gateway: 172.16.13.254
-
-
-  - device: enp1s0f1
-    headline: enp1s0f1 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.12.1
-    netmask: 24
-    gateway: 172.16.12.254
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond0
-    headline: bond0 - LAG (Link Aggregation) on devices enp129s0f0 and enp194s0f0
-    auto: true
-    family: inet
-    method: static
-    address: 10.1.9.254
-    netmask: 24
-    bond:
-      slaves: enp129s0f0 enp194s0f0
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
-      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
-      # VLAN 78 for network Georgshaus 192.168.78.0/24
-      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
-
-
-  - device: bond0.11
-    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.11.254
-    netmask: 24
-
-
-  - device: bond0.78
-    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.78.254
-    netmask: 24
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond1
-    headline: bond1 - LAG (Link Aggregation) on devices enp129s0f1 and enp194s0f1 - Main Network Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.254
-    netmask: 24
-    nameservers:
-      - 192.168.11.1
-      - 192.168.10.3
-    search: ga.netz ga.intra
-    bond:
-      slaves: enp129s0f1 enp194s0f1
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints
-      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
-      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
-      # Route ???
-      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
-      # Route to management network campus
-      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
-      # Route to LAN campus
-      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
-      # Route to WLAN campus
-      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
-
-
-  - device: bond1.121
-    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.121.15.254
-    netmask: 20
-
-
-  - device: bond1.131
-    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.131.15.254
-    netmask: 20
-
-
-  - device: bond1:ns
-    headline: bond1:ns - Alias IP on bond1 device for Nameservice
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.1
-    netmask: 32
-
-
-  - device: bond1:1
-    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.9.254
-    netmask: 24
-
-
-  - device: bond1:ap
-    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
-    auto: true
-    family: inet
-    method: static
-    address: 10.112.1.254
-    netmask: 24
-    post-up:
-      # - Wireless Networks routed through appropriate Accesspoints
-      # -
-      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
-      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
-      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
-      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
-      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
-      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
-      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
-      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
-      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
-      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
-      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
-      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
-      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
-      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
-      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
-
-
-  - device: bond1:ipmi
-    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 10.11.11.254
-    netmask: 24
-
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 127.0.0.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - ga.netz
-  - ga.intra
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 192.168.10.1
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-insert_ssh_keypair_backup_server: false
-ssh_keypair_backup_server:
-  - name: backup
-    backup_user: back
-    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
-    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
-    pub_key_dest: /root/.ssh/id_rsa.pub
-
-insert_keypair_backup_client: true
-ssh_keypair_backup_client:
-  - name: backup
-    priv_key_src: root/.ssh/id_ed25519.oopen-server
-    priv_key_dest: /root/.ssh/id_ed25519
-    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
-    pub_key_dest: /root/.ssh/id_ed25519.pub
-    target: backup.oopen.de
-
-default_user:
-
-  - name: chris
-    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: maadmin
-    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-
-  - name: wadmin
-    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - maadmin
-  - wadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-bind9_gateway_acl:
-  - local-net:
-    name: local-net
-    entries:
-      - 127.0.0.0/8
-      - 172.16.0.0/12
-      - 192.168.0.0/16
-      - 10.0.0.0/8
-      - fc00::/7
-      - fe80::/10
-      - ::1/128
-  - internaldns:
-    name: internaldns
-    entries:
-      - '# Nameserver Gateway Stockhausen'
-      - 192.168.11.1
-      - '# Domain Controller Stockhausen'
-      - 192.168.10.3
-      - '# Nameserver Gateway Altenschlirf'
-      - 192.168.10.1
-      - '# Domain Controller Altenschlirf'
-      - 192.168.10.3
-      - 192.168.10.6
-      - 172.16.0.1
-      - '# Nameserver Gateway Novalishaus'
-      - 192.168.81.1
-      - 10.2.11.2
-      - '# Nameserver wolle'
-      - 10.113.12.3
-      - '# Postfix Mailserver'
-      - 192.168.11.2
-      - '# Mail Relay System'
-      - 192.168.10.2
-
-bind9_gateway_listen_on_v6:
-   - none
-
-bind9_gateway_listen_on:
-  - any
-
-#bind9_gateway_allow_transfer: {}
-bind9_gateway_allow_transfer:
-   - internaldns
-
-bind9_transfer_source:  !!str "192.168.11.1"
-bind9_notify_source: !!str "192.168.11.1"
-
-#bind9_gateway_allow_query: {}
-bind9_gateway_allow_query:
-  - local-net
-
-#bind9_gateway_allow_query_cache: {}
-bind9_gateway_allow_query_cache:
-  - local-net
-
-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
-bind9_gateway_allow_recursion:
-  - local-net
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -1,592 +0,0 @@
---
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-network_interfaces:
-
-  - device: lan0
-    headline: lan0 - Temporary LAN network
-    auto: false
-    family: inet
-    method: static
-    address: 192.168.11.18
-    gateway: 192.168.11.254
-    netmask: 24
-
-  - device: lan4
-    headline: lan4 - Uplink static line (radio) to Altenschlirf
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.111.254
-    netmask: 24
-    up:
-      # - For management Antennas
-      - /sbin/ip link add link lan4 name lan4.111 type vlan id 111
-    post-up:
-      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
-      # -
-      # - Telefon Altenshlirf
-      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
-      # User Network Altenshlirf
-      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
-      # Management Network Altenschlirf
-      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
-      # WLan Router (Accesspoints) Altenshlirf
-      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
-      # # WLan Networks Altenshlirf
-      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
-      # DSL via Fritzbox Altenschlirf
-      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
-      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
-      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
-      # VPN home Network Altenschlirf
-      #
-      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
-      # VPN 'gw-ckubu' Network Altenschlirf
-      #
-      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
-      # private networks 'ckubu'
-      #
-      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
-      # so we route them back to that gateway..
-      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
-      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
-
-
-  - device: lan4.111
-    headline: lan4.111 - network 10.10.111.0 (management antennas)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.111.254
-    netmask: 24
-
-
-  - device: lan6 
-    headline: lan6 - holds VLAN 211 device for Network Telefons Stockhausen
-    auto: false
-    family: inet
-    method: manual
-    up:
-      - /sbin/ip link add link lan6 name lan6.211 type vlan id 211
-
-
-  - device: lan6.211
-    headline: lan6.211 - Network Telefons Stockhausen
-    auto: true
-    family: inet
-    method: static
-    # Note:
-    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
-    #       This LANCom Router IS NOT pngable                                 !!
-    address: 172.16.211.1
-    netmask: 24
-    pre-up:
-      - /sbin/ifconfig lan6 up
-
-
-  - device: lan8
-    headline: lan8 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.11.1
-    netmask: 24
-    gateway: 172.16.11.254
-
-
-  - device: lan9
-    headline: lan9 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.13.1
-    netmask: 24
-    gateway: 172.16.13.254
-
-
-  - device: lan7
-    headline: lan7 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.12.1
-    netmask: 24
-    gateway: 172.16.12.254
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond0
-    headline: bond0 - LAG (Link Aggregation) on devices lan2 and lan10
-    auto: true
-    family: inet
-    method: static
-    address: 10.1.9.254
-    netmask: 24
-    bond:
-      slaves: lan2 lan10
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
-      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
-      # VLAN 78 for network Georgshaus 192.168.78.0/24
-      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
-
-
-  - device: bond0.11
-    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.11.254
-    netmask: 24
-
-
-  - device: bond0.78
-    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.78.254
-    netmask: 24
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond1
-    headline: bond1 - LAG (Link Aggregation) on devices lan3 and lan11 - Main Network Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.254
-    netmask: 24
-    nameservers:
-      - 192.168.11.1
-      - 192.168.10.3
-    search: ga.netz ga.intra
-    bond:
-      slaves: lan3 lan11
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints
-      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
-      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
-      # Route ???
-      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
-      # Route to management network campus
-      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
-      # Route to LAN campus
-      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
-      # Route to WLAN campus
-      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
-
-
-  - device: bond1.121
-    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.121.15.254
-    netmask: 20
-
-
-  - device: bond1.131
-    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.131.15.254
-    netmask: 20
-
-
-  - device: bond1:ns
-    headline: bond1:ns - Alias IP on bond1 device for Nameservice
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.1
-    netmask: 32
-
-
-  - device: bond1:1
-    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.9.254
-    netmask: 24
-
-
-  - device: bond1:ap
-    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
-    auto: true
-    family: inet
-    method: static
-    address: 10.112.1.254
-    netmask: 24
-    post-up:
-      # - Wireless Networks routed through appropriate Accesspoints
-      # -
-      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
-      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
-      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
-      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
-      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
-      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
-      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
-      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
-      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
-      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
-      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
-      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
-      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
-      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
-      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
-
-
-  - device: bond1:ipmi
-    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 10.11.11.254
-    netmask: 24
-
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 127.0.0.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - ga.netz
-  - ga.intra
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 192.168.10.1
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-insert_ssh_keypair_backup_server: false
-ssh_keypair_backup_server:
-  - name: backup
-    backup_user: back
-    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
-    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
-    pub_key_dest: /root/.ssh/id_rsa.pub
-
-insert_keypair_backup_client: true
-ssh_keypair_backup_client:
-  - name: backup
-    priv_key_src: root/.ssh/id_ed25519.oopen-server
-    priv_key_dest: /root/.ssh/id_ed25519
-    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
-    pub_key_dest: /root/.ssh/id_ed25519.pub
-    target: backup.oopen.de
-
-default_user:
-
-  - name: chris
-    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: maadmin
-    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-
-  - name: wadmin
-    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - maadmin
-  - wadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-bind9_gateway_acl:
-  - local-net:
-    name: local-net
-    entries:
-      - 127.0.0.0/8
-      - 172.16.0.0/12
-      - 192.168.0.0/16
-      - 10.0.0.0/8
-      - fc00::/7
-      - fe80::/10
-      - ::1/128
-  - internaldns:
-    name: internaldns
-    entries:
-      - '# Nameserver Gateway Stockhausen'
-      - 192.168.11.1
-      - '# Domain Controller Stockhausen'
-      - 192.168.10.3
-      - '# Nameserver Gateway Altenschlirf'
-      - 192.168.10.1
-      - '# Domain Controller Altenschlirf'
-      - 192.168.10.3
-      - 192.168.10.6
-      - 172.16.0.1
-      - '# Nameserver Gateway Novalishaus'
-      - 192.168.81.1
-      - 10.2.11.2
-      - '# Nameserver wolle'
-      - 10.113.12.3
-      - '# Postfix Mailserver'
-      - 192.168.11.2
-      - '# Mail Relay System'
-      - 192.168.10.2
-
-bind9_gateway_listen_on_v6:
-   - none
-
-bind9_gateway_listen_on:
-  - any
-
-#bind9_gateway_allow_transfer: {}
-bind9_gateway_allow_transfer:
-   - internaldns
-
-bind9_transfer_source:  !!str "192.168.11.1"
-bind9_notify_source: !!str "192.168.11.1"
-
-#bind9_gateway_allow_query: {}
-bind9_gateway_allow_query:
-  - local-net
-
-#bind9_gateway_allow_query_cache: {}
-bind9_gateway_allow_query_cache:
-  - local-net
-
-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
-bind9_gateway_allow_recursion:
-  - local-net
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -1,583 +0,0 @@
---
-# ---
-# vars used by roles/network_interfaces
-# ---
-
-
-# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
-
-# Should the interfaces be reloaded after config change?
-network_interface_reload: False
-
-network_interface_path: /etc/network/interfaces.d
-network_interface_required_packages:
-  - vlan
-  - bridge-utils
-  - ifmetric
-  - ifupdown
-  - ifenslave
-
-network_interfaces:
-
-  - device: eth2
-    headline: eth2 - Uplink static line (radio) to Altenschlirf
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.111.254
-    netmask: 24
-    up:
-      # - For management Antennas
-      - /sbin/ip link add link eth2 name eth2.111 type vlan id 111
-    post-up:
-      # - Static routes to Altenschlirf (Router Ip-Address Altenschlirf: 172.16.111.253)
-      # -
-      # - Telefon Altenshlirf
-      - /sbin/ip route add 172.16.210.0/24 via 172.16.111.253
-      # User Network Altenshlirf
-      - /sbin/ip route add 192.168.10.0/24 via 172.16.111.253
-      # Management Network Altenschlirf
-      - /sbin/ip route add 10.10.10.0/24 via 172.16.111.253
-      # WLan Router (Accesspoints) Altenshlirf
-      - /sbin/ip route add 10.122.1.0/24 via 172.16.111.253
-      # # WLan Networks Altenshlirf
-      - /sbin/ip route add 10.123.0.0/16 via 172.16.111.253
-      # DSL via Fritzbox Altenschlirf
-      - /sbin/ip route add 172.16.10.0/24 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf guest NET (Unifi routet Network)
-      - /sbin/ip route add 10.221.0.0/20 via 172.16.111.253
-      # - WLAN Gemeinschaft Altenschlirf private NET (Unifi routet Network)
-      - /sbin/ip route add 10.231.0.0/20 via 172.16.111.253
-      # VPN home Network Altenschlirf
-      #
-      - /sbin/ip route add 10.0.10.0/24 via 172.16.111.253
-      # VPN 'gw-ckubu' Network Altenschlirf
-      #
-      - /sbin/ip route add 10.1.10.0/24 via 172.16.111.253
-      # private networks 'ckubu'
-      #
-      # connections from private ckubu networks ist routed through VPN Altenschlirf (gw-ckubu),
-      # so we route them back to that gateway..
-      - /sbin/ip route add 192.168.63.0/24 via 172.16.111.253
-      - /sbin/ip route add 192.168.64.0/24 via 172.16.111.253
-
-
-  - device: eth2.111
-    headline: eth2.111 - network 10.10.111.0 (management antennas)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.111.254
-    netmask: 24
-
-
-  - device: eth8 
-    headline: eth8 - holds VLAN 211 device for Network Telefons Stockhausen
-    auto: false
-    family: inet
-    method: manual
-    up:
-      - /sbin/ip link add link eth8 name eth8.211 type vlan id 211
-
-
-  - device: eth8.211
-    headline: eth8.211 - Network Telefons Stockhausen
-    auto: true
-    family: inet
-    method: static
-    # Note:
-    #    !! 172.16.211.254 is reserved for LANCom Router (DSL line teleefon).
-    #       This LANCom Router IS NOT pngable                                 !!
-    address: 172.16.211.1
-    netmask: 24
-    pre-up:
-      - /sbin/ifconfig eth8 up
-
-
-  - device: eth9
-    headline: eth9 - Uplink DSL surf2 via (static) line to Fritz!Box 7490 (formaly Zyxel 6501)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.11.1
-    netmask: 24
-    gateway: 172.16.11.254
-
-
-  - device: eth10
-    headline: eth10 - Uplink DSL surf3 via (static) line to Fritz!Box 7490
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.13.1
-    netmask: 24
-    gateway: 172.16.13.254
-
-
-  - device: eth11
-    headline: eth11 - Uplink DSL surf1 via (static) line to Fritz!Box 7490 (Mailserver)
-    auto: true
-    family: inet
-    method: static
-    address: 172.16.12.1
-    netmask: 24
-    gateway: 172.16.12.254
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond0
-    headline: bond0 - LAG (Link Aggregation) on devices eth0 and eth4
-    auto: true
-    family: inet
-    method: static
-    address: 10.1.9.254
-    netmask: 24
-    bond:
-      slaves: eth0 eth4
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 11 for management network Stockhausen/Schloss 10.10.11.0/24
-      - /sbin/ip link add link bond0 name bond0.11 type vlan id 11
-      # VLAN 78 for network Georgshaus 192.168.78.0/24
-      - /sbin/ip link add link bond0 name bond0.78 type vlan id 78
-
-
-  - device: bond0.11
-    headline: bond0.11 - VLAN 11 on interface bond0 (Management Network Stockhausen)
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.11.254
-    netmask: 24
-
-
-  - device: bond0.78
-    headline: bond0.78 - VLAN 78 on interface bond0 (Georgshaus ?)
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.78.254
-    netmask: 24
-
-
-    # ----------
-    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
-    #    apt-get install ifenslave
-    # ----------
-  - device: bond1
-    headline: bond1 - LAG (Link Aggregation) on devices eth3 and eth5 - Main Network Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.254
-    netmask: 24
-    nameservers:
-      - 192.168.11.1
-      - 192.168.10.3
-    search: ga.netz ga.intra
-    bond:
-      slaves: eth3 eth5
-      # Mode 4 (802.3ad)
-      #
-      #    also possible here:
-      #       - Mode 5: balance-tlb
-      #       - Mode 6: balance-alb
-      mode: 4
-      miimon: 100
-      lacp-rate: 1
-      ad-select: count
-      downdelay: 200
-      updelay: 200
-    post-up:
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints
-      - /sbin/ip link add link bond1 name bond1.121 type vlan id 121
-      # VLAN 121 - for Ubiquiti UniFi Accesspoints Guests
-      - /sbin/ip link add link bond1 name bond1.131 type vlan id 131
-      # Route ???
-      - /sbin/ip route add 10.11.16.0/24 via 192.168.11.6
-      # Route to management network campus
-      - /sbin/ip route add 10.72.1.0/24 via 192.168.11.72
-      # Route to LAN campus
-      - /sbin/ip route add 192.168.72.0/24 via 192.168.11.72
-      # Route to WLAN campus
-      - /sbin/ip route add 192.168.73.0/24 via 192.168.11.72
-
-
-  - device: bond1.121
-    headline: bond1.121 - VLAN 121 on interface bond1 for Ubiquiti UniFi Accesspoints Guest NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.121.15.254
-    netmask: 20
-
-
-  - device: bond1.131
-    headline: bond1.131 - VLAN 131 on interface bond1 for Ubiquiti UniFi Accesspoints private NET
-    auto: true
-    family: inet
-    method: static
-    address: 10.131.15.254
-    netmask: 20
-
-
-  - device: bond1:ns
-    headline: bond1:ns - Alias IP on bond1 device for Nameservice
-    auto: true
-    family: inet
-    method: static
-    address: 192.168.11.1
-    netmask: 32
-
-
-  - device: bond1:1
-    headline: bond1:1 - Alias IP on bond1 device for (depricated) Management Network
-    auto: true
-    family: inet
-    method: static
-    address: 10.10.9.254
-    netmask: 24
-
-
-  - device: bond1:ap
-    headline: bond1:ap - Alias IP on bond1 device for Network Accesspoints
-    auto: true
-    family: inet
-    method: static
-    address: 10.112.1.254
-    netmask: 24
-    post-up:
-      # - Wireless Networks routed through appropriate Accesspoints
-      # -
-      - /sbin/ip route add 10.113.1.0/24 via 10.112.1.1
-      - /sbin/ip route add 10.113.2.0/24 via 10.112.1.2
-      - /sbin/ip route add 10.113.3.0/24 via 10.112.1.3
-      - /sbin/ip route add 10.113.4.0/24 via 10.112.1.4
-      - /sbin/ip route add 10.113.5.0/24 via 10.112.1.5
-      - /sbin/ip route add 10.113.6.0/24 via 10.112.1.6
-      - /sbin/ip route add 10.113.7.0/24 via 10.112.1.7
-      - /sbin/ip route add 10.113.8.0/24 via 10.112.1.8
-      - /sbin/ip route add 10.113.9.0/24 via 10.112.1.9
-      - /sbin/ip route add 10.113.10.0/24 via 10.112.1.10
-      - /sbin/ip route add 10.113.11.0/24 via 10.112.1.11
-      - /sbin/ip route add 10.113.12.0/24 via 10.112.1.12
-      - /sbin/ip route add 10.113.13.0/24 via 10.112.1.13
-      - /sbin/ip route add 10.113.14.0/24 via 10.112.1.14
-      - /sbin/ip route add 10.113.15.0/24 via 10.112.1.15
-
-
-  - device: bond1:ipmi
-    headline: bond1:ipmi - Alias IP on bond1 for IPMI Addresses Servr Stockhausen
-    auto: true
-    family: inet
-    method: static
-    address: 10.11.11.254
-    netmask: 24
-
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001
-#
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9
-#      IPv6: 2620:fe::fe
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de
-#      IPv4: 94.16.114.254  - ns28.de
-#      IPv4: 51.254.162.59  - ns9.de
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-#
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 127.0.0.1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - ga.netz
-  - ga.intra
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 192.168.10.1
-
-
-# ---
-# vars used by roles/common/tasks/cron.yml
-# ---
-
-cron_user_special_time_entries:
-
-  - name: "Restart NTP service 'ntpsec'"
-    special_time: reboot
-    job: "sleep 15 ; /bin/systemctl restart ntpsec"
-    insertafter: PATH
-
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-insert_ssh_keypair_backup_server: false
-ssh_keypair_backup_server:
-  - name: backup
-    backup_user: back
-    priv_key_src: root/.ssh/id_rsa.backup.oopen.de
-    priv_key_dest: /root/.ssh/id_rsa
-    pub_key_src: root/.ssh/id_rsa.backup.oopen.de.pub
-    pub_key_dest: /root/.ssh/id_rsa.pub
-
-insert_keypair_backup_client: true
-ssh_keypair_backup_client:
-  - name: backup
-    priv_key_src: root/.ssh/id_ed25519.oopen-server
-    priv_key_dest: /root/.ssh/id_ed25519
-    pub_key_src: root/.ssh/id_ed25519.oopen-server.pub
-    pub_key_dest: /root/.ssh/id_ed25519.pub
-    target: backup.oopen.de
-
-default_user:
-
-  - name: chris
-    password: $y$j9T$rDrvWa/KInzTe601YYf9./$WjDlaItCrgX7gu4nCs481y8WLxiRaNJCC/MgFgKuzg3
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-
-  - name: maadmin
-    password: $y$j9T$LCkYWvykWzrpFxIlmSUB01$e1ROfZxXAU53UdAwZAECzED4iV4LS02Q4IPQ2fycv51
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-
-  - name: wadmin
-    password: $6$sLWIXKTW$i/STlSS0LijkrnGR/XMbaxJsEbrRdDYgqyCqIr.muLN5towes8yHDCXsyCYDjuaBNKPHXyFpr8lclg5DOm9OF1
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: sysadm
-    user_id: 1050
-    group_id: 1050
-    group: sysadm
-    password: $y$j9T$awYUu9oRvV39ojITZOC7D1$czTh5HHIE32PXb0vl40ayAarm39txR4jaH1QzBscqfC
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHCQRRXy0+9D+mhLniRlUpZZ3kZdZcQKXBsGnlsFYaRi maadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5GDIFA6/i6lzkr+EP/EZM9glrK0eSR0nmrEFgUJ4n8 wadmin@ga-st-lsx1'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID17MN6fUg0D1dMSgVYIBpIy+sDBBmiaHmXRXU63TXJA wadmin@ga-st-li1303'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKtK8/rxHL1MKX5AHrgAzUYu0kV+1iYCmknpTQ7F0ham wadmin@wolf-debtest'
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcaDFxj0pYjOv/ohFVxVY2RKvy6ACZFPX9UkrUPHkbN wadmin@wolf-x1'
-
-  - name: back
-    user_id: 1060
-    group_id: 1060
-    group: back
-    password: $y$j9T$wpg8hlvMpO4PAWSVdLoJq/$dgpQh4cEnbUOQkkZzKUM4S8XzNS/Md5gMmMuNTqec74
-    shell: /bin/bash
-    ssh_keys:
-      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
-
-sudo_users:
-  - chris
-  - sysadm
-  - maadmin
-  - wadmin
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-install_bind_packages: true
-
-bind9_gateway_acl:
-  - local-net:
-    name: local-net
-    entries:
-      - 127.0.0.0/8
-      - 172.16.0.0/12
-      - 192.168.0.0/16
-      - 10.0.0.0/8
-      - fc00::/7
-      - fe80::/10
-      - ::1/128
-  - internaldns:
-    name: internaldns
-    entries:
-      - '# Nameserver Gateway Stockhausen'
-      - 192.168.11.1
-      - '# Domain Controller Stockhausen'
-      - 192.168.10.3
-      - '# Nameserver Gateway Altenschlirf'
-      - 192.168.10.1
-      - '# Domain Controller Altenschlirf'
-      - 192.168.10.3
-      - 192.168.10.6
-      - 172.16.0.1
-      - '# Nameserver Gateway Novalishaus'
-      - 192.168.81.1
-      - 10.2.11.2
-      - '# Nameserver wolle'
-      - 10.113.12.3
-      - '# Postfix Mailserver'
-      - 192.168.11.2
-      - '# Mail Relay System'
-      - 192.168.10.2
-
-bind9_gateway_listen_on_v6:
-   - none
-
-bind9_gateway_listen_on:
-  - any
-
-#bind9_gateway_allow_transfer: {}
-bind9_gateway_allow_transfer:
-   - internaldns
-
-bind9_transfer_source:  !!str "192.168.11.1"
-bind9_notify_source: !!str "192.168.11.1"
-
-#bind9_gateway_allow_query: {}
-bind9_gateway_allow_query:
-  - local-net
-
-#bind9_gateway_allow_query_cache: {}
-bind9_gateway_allow_query_cache:
-  - local-net
-
-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
-bind9_gateway_allow_recursion:
-  - local-net
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-gateway
-  repo: https://git.oopen.de/firewall/ipt-gateway
-  dest: /usr/local/src/ipt-gateway
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -5,10 +5,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -26,7 +26,7 @@ network_interfaces:
    family: inet
    method: static
    address: 192.168.11.18
-    #gateway: 192.168.11.254
+    # gateway: 192.168.11.254
    netmask: 24

  - device: lan4
@@ -81,7 +81,7 @@ network_interfaces:
    netmask: 24


-  - device: lan6 
+  - device: lan6
    headline: lan6 - holds VLAN 211 device for Network Telefons Stockhausen
    auto: false
    family: inet
@@ -136,7 +136,7 @@ network_interfaces:

    # ----------
    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
+    #
    #    apt-get install ifenslave
    # ----------
  - device: bond0
@@ -186,7 +186,7 @@ network_interfaces:

    # ----------
    # Note: Install the 'ifenslave' package, necessary to enable bonding:
-    # 
+    #
    #    apt-get install ifenslave
    # ----------
  - device: sfp0
@@ -200,7 +200,7 @@ network_interfaces:
      - 192.168.11.1
      - 192.168.10.3
    search: ga.netz ga.intra
-    #bond:
+    # bond:
    #  slaves: lan3 lan11
    #  # Mode 4 (802.3ad)
    #  #
@@ -382,7 +382,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -393,7 +393,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 192.168.10.1
+  - 192.168.10.1


 # ---
@@ -451,7 +451,6 @@ cron_user_special_time_entries:
    insertafter: PATH


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -587,28 +586,28 @@ bind9_gateway_acl:
      - 192.168.10.2

 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - internaldns
+  - internaldns

-bind9_transfer_source:  !!str "192.168.11.1"
+bind9_transfer_source: !!str "192.168.11.1"
 bind9_notify_source: !!str "192.168.11.1"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -632,4 +631,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -83,8 +83,8 @@ default_user:
 sudo_users:
  - chris
  - sysadm
-  - maadmin
  - wadmin
+  - maadmin


 # ---
@@ -123,7 +123,6 @@ sshd_permit_root_login: !!str "prohibit-password"
 # ---


-
 # ==============================


@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -195,7 +195,6 @@ sshd_permit_root_login: !!str "prohibit-password"
 # ---


-
 # ==============================


@@ -6,10 +6,10 @@


 # If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
-network_manage_devices: True
+network_manage_devices: true

 # Should the interfaces be reloaded after config change?
-network_interface_reload: False
+network_interface_reload: false

 network_interface_path: /etc/network/interfaces.d
 network_interface_required_packages:
@@ -38,7 +38,7 @@ network_interfaces:
    #  - "91.239.100.100"   # anycast.censurfridns.dk

    # optional additional subnets/ips subnets: []
-    # subnets: 
+    # subnets:
    #   - '192.168.123.0/24'
    #   - '192.168.124.11/32'

@@ -66,7 +66,7 @@ network_interfaces:

  - device: eno2
    # use only once per device (for the first device entry)
-    headline: eno2 - LAN Interface VLAN definition 
+    headline: eno2 - LAN Interface VLAN definition
    auto: true
    family: inet
    method: manual
@@ -95,10 +95,10 @@ network_interfaces:
    # nameservers:
    #  - "194.150.168.168"  # dns.as250.net
    #  - "91.239.100.100"   # anycast.censurfridns.dk
-    #nameservers:
+    # nameservers:
    #  - 192.168.11.1
    #  - 192.168.10.3
-    #search: ga.netz ga.intra
+    # search: ga.netz ga.intra


 # ---
@@ -176,8 +176,8 @@ systemd_resolved: true
 #    Servername für DNS-over-TLS: dot.ffmuc.net
 #    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
 resolved_nameserver:
-  - 192.168.11.1 
-  - 192.168.10.1 
+  - 192.168.11.1
+  - 192.168.10.1
  - 192.168.11.3

 # search domains
@@ -185,7 +185,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -196,7 +196,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -311,4 +311,3 @@ sudo_users:
 # ---

 root_user: {}
-
@@ -86,7 +86,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 192.168.11.1
+  - 192.168.11.1


 # ---
@@ -108,14 +108,14 @@ insert_root_ssh_keypair: true

 root_ssh_keypair:
  - name: id-rsa-dehydrated
-    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated
+    priv_key_src: ga-st-mail.ga.netz/root/.ssh/ga-st-mail-id_rsa-dehydrated
    priv_key_dest: /root/.ssh/id_rsa-dehydrated
-    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
+    pub_key_src: ga-st-mail.ga.netz/root/.ssh/ga-st-mail-id_rsa-dehydrated.pub
    pub_key_dest: /root/.ssh/id_rsa-dehydrated.pub
  - name: id-rsa-opendkim
-    priv_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim
+    priv_key_src: ga-st-mail.ga.netz/root/.ssh/ga-st-mail-id_rsa-opendkim
    priv_key_dest: /root/.ssh/id_rsa-opendkim
-    pub_key_src: ga-st-mail/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
+    pub_key_src: ga-st-mail.ga.netz/root/.ssh/ga-st-mail-id_rsa-opendkim.pub
    pub_key_dest: /root/.ssh/id_rsa-opendkim.pub

 default_user:
@@ -206,49 +206,6 @@ sudo_users:
 # vars used by roles/common/tasks/copy_files.yml
 # ---

-copy_plain_files:
-
-  # /root/bin/monitoring
-  #
-  - name: monitoring_check_cert_for_dovecot.conf
-    src_path: ga-st-mail/root/bin/monitoring/conf/check_cert_for_dovecot.conf
-    dest_path: /root/bin/monitoring/conf/check_cert_for_dovecot.conf
-
-  # /root/bin/postfix
-  #
-  - name: postfix_create_opendkim_key.conf
-    src_path: ga-st-mail/root/bin/postfix/conf/create_opendkim_key.conf
-    dest_path: /root/bin/postfix/conf/create_opendkim_key.conf
-
-  - name: postfix_postfix_add_mailboxes.conf
-    src_path: ga-st-mail/root/bin/postfix/conf/postfix_add_mailboxes.conf
-    dest_path: /root/bin/postfix/conf/postfix_add_mailboxes.conf
-
-  - name: postfix_sent_userinfo_postfix.conf
-    src_path: ga-st-mail/root/bin/postfix/conf/sent_userinfo_postfix.conf
-    dest_path: /root/bin/postfix/conf/sent_userinfo_postfix.conf
-
-  - name: postfix_whitelist_mb_sigs.conf
-    src_path: ga-st-mail/root/bin/postfix/conf/whitelist_mb_sigs.conf
-    dest_path: /root/bin/postfix/conf/whitelist_mb_sigs.conf
-
-
-copy_plain_files_postfwd_host_specific:
-
-  # Postfix Firewall postfwd
-  #
-  - name: postfwd.wl-user
-    src_path: ga-st-mail/etc/postfix/postfwd.cf
-    dest_path: /etc/postfix/postfwd.cf
-
-
-#copy_template_files: []
-#
-#  - name: mailsystem_install_amavis.conf
-#    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
-#    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf
-
-

 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
@@ -256,7 +213,7 @@ copy_plain_files_postfwd_host_specific:

 hostname: mx.gemeinschaft-altenschlirf.de
 ipv4_address: 192.168.11.2
-#ipv6_address: 
+# ipv6_address:

 admin_email: it@gemeinschaft-altenschlirf.org
 is_relay_host: !!str "false"
@@ -270,7 +227,7 @@ db_in_use: !!str "true"
 postfix_db_type: PostgreSQL
 postfix_db_name: postfix
 postfix_db_user: postfix
-#postfix_db_host:
+# postfix_db_host:
 postfix_db_pass: R_wuKauoTE7+AJg9

 # install_amavis.conf
@@ -279,34 +236,36 @@ mp_receipt_number: 106015125438
 si_authorisation_signature: abb4ec6b194639f3d123154f1b971843a3b8751d8c1bcdc7d07ed6db26621b11bca0e23d2a42b60aef3f7b7803a1466a964d90c7b1e82d67c7680c8f46b59a4e

 # install_postfixadmin.conf
-# 
+#
 website_name_postfixadmin: adm.gemeinschaft-altenschlirf.de

-email_welcome_message: "\n
-Hallo,\n
+email_welcome_message: |

-Ihre/Deine neue E-Mail Adresse ist eingerichtet.\n
+  Hallo,

-IT Team Gemeinschaft Altenschlirf\n
+  Ihre/Deine neue E-Mail Adresse ist eingerichtet.

--\n
-Gemeinschaft Altenschlirf  |   Phone:  +49 6647 / 9606 0\n
-Müser Straße 1             |   Fax:    +49 6647 / 9606 179\n
-D-36358 Herbstein          |   E-Mail: it@gemeinschaft-altenschlirf.de\n
-"
+  IT Team Gemeinschaft Altenschlirf
+
+  --
+
+  Gemeinschaft Altenschlirf  |   Phone:  +49 6647 / 9606 0
+  Müser Straße 1             |   Fax:    +49 6647 / 9606 179
+  D-36358 Herbstein          |   E-Mail: it@gemeinschaft-altenschlirf.de

 # install_update_dovecot.conf
 #
 dovecot_from_address: "Administrator E-Mail <postmaster@gemeinschaft-altenschlirf.de>"
 dovecot_reply_to: "postmaster@gemeinschaft-altenschlirf.de"
 webmailer_address: "https://webmail.gemeinschaft-altenschlirf.de"
-salutation: "IT Team Gemeinschaft Altenschlirf\n
+salutation: |
+  IT Team Gemeinschaft Altenschlirf

--\n
-Gemeinschaft Altenschlirf  |   Phone:  +49 6647 / 9606 0\n
-Müser Straße 1             |   Fax:    +49 6647 / 9606 179\n
-D-36358 Herbstein          |   E-Mail: it@gemeinschaft-altenschlirf.de\n
-"
+  --
+
+  Gemeinschaft Altenschlirf  |   Phone:  +49 6647 / 9606 0
+  Müser Straße 1             |   Fax:    +49 6647 / 9606 179
+  D-36358 Herbstein          |   E-Mail: it@gemeinschaft-altenschlirf.de

 # install_upgrade_roundcube-webmail.conf
 #
@@ -317,10 +276,10 @@ autoreply_hostname: autoreply.gemeinschaft-altenschlirf.de
 roundcube_db_type: pgsql
 roundcube_db_name: roundcubemail
 roundcube_db_user: roundcube
-#roundcube_db_host:
+# roundcube_db_host:
 roundcube_db_pass: 'K3TbMmTfnCXdj4vz'

-#roundcube_acl_plugin: true
+# roundcube_acl_plugin: true

 roundcube_product_name: Gemeinschaft Altenschlirf - Webmailer
 roundcube_support_url: https://www.gemeinschaft-altenschlirf.de
@@ -88,7 +88,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -99,7 +99,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 192.168.11.3
+  - 192.168.11.3


 # ---
@@ -209,7 +209,6 @@ sudo_users:
 # ---


-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---
@@ -86,7 +86,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - ga.netz
@@ -97,7 +97,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 192.168.10.1
+  - 192.168.10.1
   - 192.168.10.3


@@ -195,19 +195,18 @@ sudo_users:

  # Postfix Firewall postfwd
  #
-  #- name: postfwd.wl-user
+  # - name: postfwd.wl-user
  #  src_path: ga-st-mail/etc/postfix/postfwd.wl-user
  #  dest_path: /etc/postfix/postfwd.wl-user


-#copy_template_files: []
+# copy_template_files: []
 #
 #  - name: mailsystem_install_amavis.conf
 #    src_path: usr/local/src/mailsystem/conf/install_amavis.conf.j2
 #    dest_path: /usr/local/src/mailsystem/conf/install_amavis.conf


-
 # ---
 # vars used by roles/common/tasks/config_files_mailsystem_scripts.yml
 # ---
@@ -1,148 +0,0 @@
---
-
-# ---
-# vars used by roles/ansible_dependencies
-# ---
-
-
-# ---
-# vars used by roles/ansible_user
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/basic.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sshd.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/apt.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/systemd-resolved.yml
-# ---
-
-systemd_resolved: true
-
-# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
-#   Primäre DNS-Adresse: 38.132.106.139
-#   Sekundäre DNS-Adresse: 194.187.251.67
-#
-# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
-#   primäre DNS-Adresse
-#      IPv4: 1.1.1.1
-#      IPv6: 2606:4700:4700::1111
-#   sekundäre DNS-Adresse
-#      IPv4: 1.0.0.1
-#      IPv6: 2606:4700:4700::1001 
-# 
-# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
-#   primäre DNS-Adresse
-#      IPv4: 8.8.8.8
-#      IPv6: 2001:4860:4860::8888
-#   sekundäre DNS-Adresse
-#      IPv4: 8.8.4.4
-#      IPv6: 2001:4860:4860::8844
-#
-# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
-#   primäre DNS-Adresse
-#      IPv4: 9.9.9.9  
-#      IPv6: 2620:fe::fe 
-#   sekundäre DNS-Adresse
-#      IPv4: 149.112.112.112
-#      IPv6: 2620:fe::9
-#
-# OpenNIC - https://www.opennic.org/
-#      IPv4: 195.10.195.195 - ns31.de 
-#      IPv4: 94.16.114.254  - ns28.de 
-#      IPv4: 51.254.162.59  - ns9.de   
-#      IPv4: 194.36.144.87  - ns29.de
-#      IPv6: 2a00:f826:8:2::195 - ns31.de
-# 
-# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS) 
-#    IPv4: 5.1.66.255
-#    IPv6: 2001:678:e68:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    IPv4: 185.150.99.255
-#    IPv6: 2001:678:ed0:f000::
-#    Servername für DNS-over-TLS: dot.ffmuc.net
-#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
-resolved_nameserver:
-  - 185.12.64.2
-  - 2a01:4ff:ff00::add:1
-
-# search domains
-#
-# If there are more than one search domains, then specify them here in the order in which 
-# the resolver should also search them
-#
-#resolved_domains: []
-resolved_domains:
-  - ~.
-  - oopen.de
-
-resolved_dnssec: false
-
-# dns.as250.net: 194.150.168.168
-#
-resolved_fallback_nameserver:
-   - 194.150.168.168
-
-
-# ---
-# vars used by roles/common/tasks/users.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/users-systemfiles.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/webadmin-user.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/sudoers.yml
-# ---
-#
-# see: roles/common/tasks/vars
-
-sudoers_file_user_back_svn_privileges:
-  - 'ALL=(root) NOPASSWD: /usr/bin/svnadmin'
-
-
-# ---
-# vars used by roles/common/tasks/caching-nameserver.yml
-# ---
-
-
-# ---
-# vars used by roles/common/tasks/git.yml
-# ---
-
-git_firewall_repository:
-  name: ipt-server
-  repo: https://git.oopen.de/firewall/ipt-server
-  dest: /usr/local/src/ipt-server
-
-# ==============================
-
-
-# ---
-# vars used by scripts/reset_root_passwd.yml
-# ---
-
-root_user:
-  name: root
-  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -0,0 +1,147 @@
+---
+
+# ---
+# vars used by roles/ansible_dependencies
+# ---
+
+
+# ---
+# vars used by roles/ansible_user
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/basic.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sshd.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/apt.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/systemd-resolved.yml
+# ---
+
+systemd_resolved: true
+
+# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
+#   Primäre DNS-Adresse: 38.132.106.139
+#   Sekundäre DNS-Adresse: 194.187.251.67
+#
+# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
+#   primäre DNS-Adresse
+#      IPv4: 1.1.1.1
+#      IPv6: 2606:4700:4700::1111
+#   sekundäre DNS-Adresse
+#      IPv4: 1.0.0.1
+#      IPv6: 2606:4700:4700::1001
+#
+# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
+#   primäre DNS-Adresse
+#      IPv4: 8.8.8.8
+#      IPv6: 2001:4860:4860::8888
+#   sekundäre DNS-Adresse
+#      IPv4: 8.8.4.4
+#      IPv6: 2001:4860:4860::8844
+#
+# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
+#   primäre DNS-Adresse
+#      IPv4: 9.9.9.9
+#      IPv6: 2620:fe::fe
+#   sekundäre DNS-Adresse
+#      IPv4: 149.112.112.112
+#      IPv6: 2620:fe::9
+#
+# OpenNIC - https://www.opennic.org/
+#      IPv4: 195.10.195.195 - ns31.de
+#      IPv4: 94.16.114.254  - ns28.de
+#      IPv4: 51.254.162.59  - ns9.de
+#      IPv4: 194.36.144.87  - ns29.de
+#      IPv6: 2a00:f826:8:2::195 - ns31.de
+#
+# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
+#    IPv4: 5.1.66.255
+#    IPv6: 2001:678:e68:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    IPv4: 185.150.99.255
+#    IPv6: 2001:678:ed0:f000::
+#    Servername für DNS-over-TLS: dot.ffmuc.net
+#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
+resolved_nameserver:
+  - 185.12.64.2
+  - 2a01:4ff:ff00::add:1
+
+# search domains
+#
+# If there are more than one search domains, then specify them here in the order in which
+# the resolver should also search them
+#
+# resolved_domains: []
+resolved_domains:
+  - ~.
+  - oopen.de
+
+resolved_dnssec: false
+
+# dns.as250.net: 194.150.168.168
+#
+resolved_fallback_nameserver:
+  - 194.150.168.168
+
+
+# ---
+# vars used by roles/common/tasks/users.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/users-systemfiles.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/webadmin-user.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/sudoers.yml
+# ---
+#
+# see: roles/common/tasks/vars
+
+sudoers_file_user_back_svn_privileges:
+  - 'ALL=(root) NOPASSWD: /usr/bin/svnadmin'
+
+
+# ---
+# vars used by roles/common/tasks/caching-nameserver.yml
+# ---
+
+
+# ---
+# vars used by roles/common/tasks/git.yml
+# ---
+
+git_firewall_repository:
+  name: ipt-server
+  repo: https://git.oopen.de/firewall/ipt-server
+  dest: /usr/local/src/ipt-server
+
+# ==============================
+
+
+# ---
+# vars used by scripts/reset_root_passwd.yml
+# ---
+
+root_user:
+  name: root
+  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
@@ -83,7 +83,6 @@ resolved_nameserver:
  - 2a01:4f8:0:1::add:9999


-
 # ---
 # vars used by roles/common/tasks/users.yml
 # ---
@@ -133,4 +132,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -1,4 +1,5 @@
 ---
+# yamllint disable rule:line-length

 # ---
 # vars used by role firewall
@@ -30,8 +31,8 @@ sshd_ports:
  - 1036

 sshd_listen_address:
-   - '::'
-   - '0.0.0.0'
+  - '::'
+  - '0.0.0.0'

 sshd_host_keys:
  - /etc/ssh/ssh_host_rsa_key
@@ -68,7 +69,7 @@ sshd_allowed_users:
 #      - diffie-hellman-group-exchange-sha256
 #      - diffie-hellman-group14-sha1
 #
-#sshd_kexalgorithms: {}
+# sshd_kexalgorithms: {}
 sshd_kexalgorithms:
  - curve25519-sha256
  - curve25519-sha256@libssh.org
@@ -83,7 +84,7 @@ sshd_kexalgorithms:
 #      - chacha20-poly1305@openssh.com
 #      - aes256-gcm@openssh.com
 #      - aes256-ctr
-#sshd_ciphers: {}
+# sshd_ciphers: {}
 sshd_ciphers:
  - chacha20-poly1305@openssh.com
  - aes256-gcm@openssh.com
@@ -92,13 +93,13 @@ sshd_ciphers:
  - aes192-ctr
  - aes128-ctr

-#sshd_macs: {}
+# sshd_macs: {}
 sshd_macs:
  - hmac-sha2-256-etm@openssh.com
  - hmac-sha2-512-etm@openssh.com
  - umac-128-etm@openssh.com

-#sshd_hostkeyalgorithms: {}
+# sshd_hostkeyalgorithms: {}
 sshd_hostkeyalgorithms:
  - ssh-ed25519
  - ssh-ed25519-cert-v01@openssh.com
@@ -107,12 +108,12 @@ sshd_hostkeyalgorithms:
  - rsa-sha2-256-cert-v01@openssh.com
  - rsa-sha2-512-cert-v01@openssh.com

-#sshd_kexalgorithms:
+# sshd_kexalgorithms:
 #  - curve25519-sha256@libssh.org
 #  - diffie-hellman-group-exchange-sha256
 #  - diffie-hellman-group14-sha1

-#sshd_ciphers:
+# sshd_ciphers:
 #  - chacha20-poly1305@openssh.com
 #  - aes256-gcm@openssh.com
 #  - aes256-ctr
@@ -220,7 +221,7 @@ default_user:
    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
    shell: /bin/bash
    ssh_keys:
-     - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5IhVprsvVOcFPbZzD9xR0nCjZ/9qVG6RhLJ7QBSts81nRvLwnmvcMBHSf5Rfaigey7Ff5dLHfJnxRE0KDATn6n2yd/5mXpn2GAA8hDVfhdsmsb5U7bROjZNr8MmIUrP7c3msUGx1FtvzhwxtyvIWOFQpWx+W5biBa6hFjIxT1pkUJqe6fclp7xbGYKZiqZRBS4qKG5CpKnisuOYDsqYPND+OkU+PShoxGVzp1JywIVze7qeKv6GyYbRA9SP9Np+5Mit6B21Io4zOI81c2Rz6sPX7mwEAQEs7iCm2hzG8qJws45Lb4ERqDkVEVhGNUyHjHgGebS1sZx1mLExdurXlPm1l/EamkncDFDCutHXtLP7lsFFiym7fKUjSEgiiLmyu5Xm+mwZvesKa1FYNaeiFWfYZpCJrNzIk+ffs+mgg3kmL4Sd4Ooy7jXPX+WJe5Xyh1KLU/+Wj2TVrhN+LbmupYAti/Wgd3DA1v601svmG82aLmyJRtKC0rGMePH3kDbtqU72kYpzI8mXERe1TIQ00Z77kQBR/7BF/9y5/0YmYDcXt1wNCoSie+mzz3xYcEdLAc7T+DhYpd4M6VgWnuz/exzRzhQwoSdEKkEED8CpEoBrEWEiMdrlElGmlkVomLU7P9i9j1rshX/pAq0asnqeSoPdC3vNbU3keiJQnhIHECvw== chris@luna'
+      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5IhVprsvVOcFPbZzD9xR0nCjZ/9qVG6RhLJ7QBSts81nRvLwnmvcMBHSf5Rfaigey7Ff5dLHfJnxRE0KDATn6n2yd/5mXpn2GAA8hDVfhdsmsb5U7bROjZNr8MmIUrP7c3msUGx1FtvzhwxtyvIWOFQpWx+W5biBa6hFjIxT1pkUJqe6fclp7xbGYKZiqZRBS4qKG5CpKnisuOYDsqYPND+OkU+PShoxGVzp1JywIVze7qeKv6GyYbRA9SP9Np+5Mit6B21Io4zOI81c2Rz6sPX7mwEAQEs7iCm2hzG8qJws45Lb4ERqDkVEVhGNUyHjHgGebS1sZx1mLExdurXlPm1l/EamkncDFDCutHXtLP7lsFFiym7fKUjSEgiiLmyu5Xm+mwZvesKa1FYNaeiFWfYZpCJrNzIk+ffs+mgg3kmL4Sd4Ooy7jXPX+WJe5Xyh1KLU/+Wj2TVrhN+LbmupYAti/Wgd3DA1v601svmG82aLmyJRtKC0rGMePH3kDbtqU72kYpzI8mXERe1TIQ00Z77kQBR/7BF/9y5/0YmYDcXt1wNCoSie+mzz3xYcEdLAc7T+DhYpd4M6VgWnuz/exzRzhQwoSdEKkEED8CpEoBrEWEiMdrlElGmlkVomLU7P9i9j1rshX/pAq0asnqeSoPdC3vNbU3keiJQnhIHECvw== chris@luna'

 sudo_users:
  - alex
@@ -272,4 +273,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
@@ -98,7 +98,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - 123.netz
@@ -108,7 +108,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -219,4 +219,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $y$j9T$IVBTpn.OrI6YiQ9q3fA8b1$Y1bmID5yXJbKfoLFt1VmQs6LezeTj5/1M9ppZBD2Pn4
-
@@ -93,7 +93,7 @@ resolved_nameserver:
 # If there are more than one search domains, then specify them here in the order in which
 # the resolver should also search them
 #
-#resolved_domains: []
+# resolved_domains: []
 resolved_domains:
  - ~.
  - kanzlei-kiel.netz
@@ -103,7 +103,7 @@ resolved_dnssec: false
 # dns.as250.net: 194.150.168.168
 #
 resolved_fallback_nameserver:
-   - 194.150.168.168
+  - 194.150.168.168


 # ---
@@ -227,28 +227,28 @@ bind9_gateway_acl:
      - 192.168.100.30

 bind9_gateway_listen_on_v6:
-   - none
+  - none

 bind9_gateway_listen_on:
  - any

-#bind9_gateway_allow_transfer: {}
+# bind9_gateway_allow_transfer: {}
 bind9_gateway_allow_transfer:
-   - internaldns
+  - internaldns

-bind9_transfer_source:  !!str "192.168.100.1"
+bind9_transfer_source: !!str "192.168.100.1"
 bind9_notify_source: !!str "192.168.100.1"

-#bind9_gateway_allow_query: {}
+# bind9_gateway_allow_query: {}
 bind9_gateway_allow_query:
  - local-net

-#bind9_gateway_allow_query_cache: {}
+# bind9_gateway_allow_query_cache: {}
 bind9_gateway_allow_query_cache:
  - local-net

-bind9_gateway_recursion:  !!str "yes"
-#bind9_gateway_allow_recursion: {}
+bind9_gateway_recursion: !!str "yes"
+# bind9_gateway_allow_recursion: {}
 bind9_gateway_allow_recursion:
  - local-net

@@ -271,4 +271,3 @@ git_firewall_repository:
 root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
-
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
chris	965ad5cde2	fix: specify ansible.builtin.template for service file and configuration deployments	2026-07-30 23:48:29 +02:00
chris	9c6094cef8	add host ki-fm.oopen.de	2026-07-30 12:54:19 +02:00
chris	4f8e5f4454	fix(file-ah-common.yml): correct indentation for samba user group assignments	2026-07-30 01:53:06 +02:00
chris	ca02faf748	fix(sshd_config.j2): update condition for SFTP subsystem configuration to use common variable	2026-07-30 01:38:49 +02:00
chris	1c1ae9464c	fix(yum.yml): change package state to 'present' for consistency and improve comment clarity	2026-07-29 23:40:23 +02:00
chris	451baa5f9a	fix(sudoers.yml): improve formatting of comments for clarity in sudoers configuration tasks	2026-07-29 23:34:58 +02:00
chris	b87c60c41e	fix(samba-remove-user.yml): enhance command structure and error handling for samba user removal tasks	2026-07-29 23:32:24 +02:00
chris	e125f9952f	fix(samba-user.yml): improve command structure and enhance error handling for samba user management	2026-07-29 23:30:04 +02:00
chris	71e9cf6551	fix(show.yml): improve formatting of hostname display message for clarity	2026-07-29 23:21:15 +02:00
chris	fc9c1548c3	fix(sshd.yml): standardize variable names for SSHD configuration facts and improve clarity	2026-07-29 18:08:17 +02:00
chris	b5a4edc181	fix(webadmin-user.yml): standardize variable names for local template directory references	2026-07-29 18:03:07 +02:00
chris	fea739f0e6	fix(webadmin-user.yml): update inventory checks and standardize variable names for clarity	2026-07-29 17:53:55 +02:00
chris	e72d9aac70	fix(users.yml): replace deprecated 'authorized_key' with 'ansible.posix.authorized_key' for improved compatibility	2026-07-29 17:46:31 +02:00
chris	eece49f53b	fix(users-systemfiles.yml): standardize variable names and improve clarity in user file checks and backups	2026-07-29 17:44:18 +02:00
chris	b14e82c6c2	fix(git.yml): improve error handling and register results for backup and samba repositories	2026-07-29 17:31:36 +02:00
chris	56ba319f2f	fix(redis-server.yml): standardize variable names and improve configuration clarity	2026-07-28 22:47:20 +02:00
chris	c443ce7c79	fix(yml): update SSH keypair paths for ga-al-relay and ga-st-mail configurations	2026-07-28 22:47:03 +02:00
chris	dc61dfc049	fix(yml): uncomment and standardize commented configuration options for clarity	2026-07-28 22:04:09 +02:00
chris	81e1f3fb3e	fix(ntp.yml): standardize variable naming and replace command with copy module for backup	2026-07-28 22:03:46 +02:00
chris	86aec11206	fix(common.yml): update SSH keypair paths for b.mx and d.mx configurations	2026-07-28 21:55:46 +02:00
chris	b3babf6831	fix(mail-common.yml): update SSH keypair paths and format email messages for clarity	2026-07-28 21:28:43 +02:00
chris	4d92340f9b	chore(ansible): clean up host_vars YAML and normalize mail text blocks	2026-07-28 21:24:03 +02:00
chris	ae60fa01a5	refactor(mx-common.yml): update paths for SSH keypair and file configurations delete: remove obsolete postfix configuration files for rate limiting and user info	2026-07-28 02:16:07 +02:00
chris	9181734c51	fix(systemd-services): add condition to prevent service management for specific lxc_guest items	2026-07-28 01:52:41 +02:00
chris	1849c6d72d	refactor(systemd-services): streamline service checks for Debian and RedHat OS	2026-07-28 01:24:58 +02:00
chris	5525fa3e73	refactor(systemd-resolved): rename facts to common_resolved variables for consistency	2026-07-28 01:10:41 +02:00
chris	5832d0b938	chore(main.yml): clear apt_remove list and comment out previous entries	2026-07-28 01:02:48 +02:00
chris	4310ae08b0	fix(copy_files.yml): correct formatting of template files task	2026-07-28 00:48:36 +02:00
chris	385b4a6802	refactor(copy_files.yml): simplify template file handling by removing redundant tasks	2026-07-28 00:46:19 +02:00
chris	c30543280b	feat(git.yml): enhance error handling for backup and samba server repository installations	2026-07-28 00:36:36 +02:00
chris	7e5fe673cf	feat(postfwd.cf): add final=yes to rate limiting rules for enhanced message handling	2026-07-28 00:32:28 +02:00
chris	032ea670ef	chore(main.yml): remove commented-out entries for authorized SSH keys	2026-07-28 00:13:02 +02:00
chris	00457b2ac7	chore(first-run.yml): remove obsolete first-run tasks for package installation	2026-07-28 00:11:19 +02:00
chris	095f5de034	feat(git.yml): enhance version handling for git repositories to prioritize 'master' if available	2026-07-28 00:02:49 +02:00
chris	e60c1b81d1	feat(git.yml): add version handling for git repository installations	2026-07-27 22:16:45 +02:00
chris	eb2c7cc15a	chore(main.yml): set default git branch to main; Also includes various unrelated housekeeping updates in this file.	2026-07-27 22:16:27 +02:00
chris	f39babaf5d	feat(common): add host-tree file/template overrides and skip global items when host overrides exist	2026-07-27 21:55:27 +02:00
chris	b40d3249fb	Refactor variable names in samba-config-server.yml for consistency and clarity	2026-07-21 01:28:32 +02:00
chris	720fb84fb4	Refactor variable name for clarity and update condition in nfs.yml	2026-07-21 00:55:07 +02:00
chris	70eeebe4c4	roles/common/tasks/mysql.yml: remove trailing spaces.	2026-07-21 00:53:27 +02:00
chris	baba4c4b7d	Refactor variable names in motd.yml for consistency and clarity	2026-07-21 00:48:33 +02:00
chris	ab4ef8f831	Refactor variable names in git.yml for consistency and clarity	2026-07-21 00:42:05 +02:00
chris	618eaa0bf7	Refactor variable names in cron.yml for consistency and clarity	2026-07-21 00:25:21 +02:00
chris	924e6bbf03	Refactor variable names in copy_files.yml for consistency and clarity	2026-07-21 00:24:25 +02:00
chris	03951153c1	Refactor caching-nameserver.yml for consistency and clarity in variable naming	2026-07-21 00:22:39 +02:00
chris	ee5819c82c	Remove update_cache parameter from util-linux-extra installation task in basic.yml	2026-07-20 23:52:43 +02:00
chris	062d1a6fc7	Refactor variable names in apt.yml for consistency and clarity	2026-07-20 23:48:19 +02:00
chris	81398e847e	Refactor Ansible tasks to use fully qualified module names and improve code consistency - Updated all tasks to use fully qualified module names (e.g., ansible.builtin.shell, ansible.builtin.copy) for clarity and to avoid ambiguity. - Replaced deprecated 'yum' module with 'dnf' for package management on RedHat-based systems. - Improved formatting and consistency in task definitions, including the use of double quotes for strings and consistent indentation. - Removed unnecessary comments and whitespace to enhance readability. - Ensured that conditions and loops are consistently formatted across all tasks.	2026-07-20 23:09:30 +02:00
chris	bc330beebf	Refactor Ansible tasks in basic.yml to use module prefixes and improve variable naming consistency	2026-07-20 22:57:13 +02:00
chris	ba1d600cd8	Refactor ansible tasks in apt-gateway.yml to include module prefixes and improve variable naming consistency	2026-07-20 22:49:38 +02:00
chris	de82385bec	Add virus filter include and exclude file configurations for Samba shares	2026-07-20 17:42:15 +02:00
chris	509dc48851	Add unprotected interface configuration for Docker network in ipt-server.yml and new Samba share for Windows-Server-2025-Backup in common.yml	2026-07-20 11:00:53 +02:00
chris	88928adddb	Remove debug task for displaying cron variables in cron.yml	2026-07-17 18:37:24 +02:00
chris	ef7c88f64d	Add host variable files for various hosts and update DNS configurations - Created `wiki-common.yml` for wiki.cadus.org with DNS settings and git repository configurations. - Added `www-common.yml` for www.oopen.de including SFTP group creation and root user password. - Introduced `zapata-alt-common.yml` for zapata-alt.opp.netz with network interface configurations, Samba user reorganize 'host_vars'	2026-07-17 18:26:32 +02:00
chris	ed8887e5be	Add debug task to display cron variables and improve formatting in cron.yml	2026-07-17 18:24:56 +02:00
chris	4f7da3ae5d	Add check for legacy /etc/apt/sources.list existence before backup in apt.yml	2026-07-17 18:24:14 +02:00
chris	d68e39127a	Add deb822 source templates for Debian backports and security repositories	2026-07-13 21:24:24 +02:00
chris	3ab7d16906	Update apt_initial_install_trixie: add bind9-dnsutils, man-db, python3 packages and remove duplicates	2026-07-13 21:23:50 +02:00
chris	ff3ed5060a	Disable recycle bin for Samba shares by setting vfs_object_recycle to false	2026-07-13 17:08:41 +02:00
chris	79d360b2bc	Refactor apt-migrate-to-trixie.yml: clean up comments, improve task definitions, and ensure proper permissions for backup files	2026-07-13 17:07:30 +02:00
chris	12ba240411	Adjust host spezific setting of variables.	2026-07-02 20:39:18 +02:00
chris	7223219b08	Extensions for the Postfix policyd service. Allow exceptions for the number of messages and the number of recipients.	2026-07-02 20:38:19 +02:00
chris	3b4ba60bb7	Add ipt-server.yml for backup.oopen.de with initial firewall configuration	2026-06-29 16:46:15 +02:00
chris	e74fca04a2	Update migration guide: add step to freeze current firewall rules and create ipt-server.yml for a.ns.oopen.de with initial configuration	2026-06-29 11:38:20 +02:00
chris	ba5683864a	Add sudo to iptables-save commands in migration guide for proper permissions	2026-06-29 08:20:02 +02:00
chris	1171d156b7	Add sudo to iptables-save commands in migration guide for proper permissions	2026-06-29 08:16:53 +02:00
chris	682a08b53e	Refactor extract-fw-host-vars.py to improve quoted value handling and add fw_manage_config to generated YAML; create ipt-server.yml for a.mx.oopen.de with initial configuration	2026-06-29 08:13:40 +02:00
chris	b9e5b0f5e2	ile-dissens.dissens.netz.yml: add user 'nano.nowak'.	2026-06-29 00:53:10 +02:00
chris	db2cdabee1	Update ipt-server role: add Jitsi TCP/UDP ports to defaults and remove obsolete entries from host_vars	2026-06-28 11:45:37 +02:00
chris	25b0e026f2	Update ipt-server role: add Jitsi TCP/UDP ports to defaults and remove obsolete entries from host_vars	2026-06-28 11:35:12 +02:00
chris	48bc4296da	Add fw_manage_config to ipt-server.yml for cl-01.oopen.de	2026-06-27 22:56:27 +02:00
chris	f149b09892	Refactor ipt-server role: update migration and README for hostname variable usage; remove obsolete ipt-server.yml for cloud-01.oopen.de	2026-06-27 22:38:12 +02:00
chris	7db2b7ee9b	Update ipt-server role: specify hosts in ipt-server.yml and add configuration for cloud-01.oopen.de	2026-06-27 22:23:49 +02:00
chris	5a98895b66	Role ipt-server: rename 'host_vars/<server-name>/ipt_firewall.yml' to 'host_vars/<server-name>/ipt-server.yml'.	2026-06-27 02:32:15 +02:00
chris	92d2c31ecc	Role ipt-server: rename 'host_vars/<server-name>/ipt_firewall.yml' to 'host_vars/<server-name>/ipt-server.yml'.	2026-06-27 02:28:16 +02:00
chris	9798ca9cd6	Add ipt-server role with firewall configuration and management - Created handlers for reloading systemd and restarting firewall services. - Implemented tasks to ensure the existence of configuration directories and files. - Deployed host-specific and shared configuration files using templates. - Added scripts for managing IPv4 and IPv6 firewalls. - Configured systemd service units for ipt-firewall and ip6t-firewall. - Enabled and started firewall services on system boot.	2026-06-26 19:30:01 +02:00
chris	0158e3738f	file-km: add group 'wildvang' to uiserb 'zeina'.	2026-06-26 00:52:43 +02:00
chris	f309e8cb1c	Add new host entry and update Samba configuration - Added 'file-km-alt.anw-km.netz' to the hosts file in multiple locations. - Updated Samba configuration to change the maximum file size for virus filtering from 25 MB to 15 MB, with commented-out options for 50 MB and 25 MB. - Created a new host variable file for 'file-km-alt.anw-km.netz' with detailed network interface and Samba share configurations, including user definitions and permissions.	2026-06-19 11:49:11 +02:00
chris	84d5a653c5	Update network configurations and add new host variables - Modified network interface settings for gw-mbr.oopen.de, changing IP addresses and adding an alias for IPMI. - Refactored network interface configuration for o28.oopen.de, consolidating and updating device settings, including bridge configurations and DNS settings. - Added new user 'farina' to samba_user in zapata.opp.netz.yml. - Updated hosts file to include new entries for ak-plan.oopen.de and adjusted existing entries for clarity. - Created new host variable files for ak-plan.oopen.de, cl-ndm.oopen.de, and psono-ndm.oopen.de with comprehensive configurations for systemd-resolved and cron jobs.	2026-06-18 14:15:47 +02:00
chris	1c7ad75f47	Add virusfilter support to Samba homes and shares configuration	2026-06-01 02:54:54 +02:00
chris	55bdcba049	Add virusfilter support to Samba homes and shares	2026-06-01 02:54:25 +02:00