GitLab

This change ensures that NGINX always allows access to ACME challenge
files, even when the server is configured with restrictive access
controls.

It seems that the 6 months between releases is becoming the norm and it
feels comfortable enough.

Merge branch 'debian11_lxc_host' of https://github.com/stefangweichinger/debops into stefangweichinger-debian11_lxc_host

Merge branch 'tinc-filter-host' of https://github.com/julien-lecomte/debops into julien-lecomte-tinc-filter-host

Merge branch 'opendkim-ansible-29-compat' of https://github.com/imrejonk/debops into imrejonk-opendkim-ansible-29-compat

Commit 0909d02f introduced management of the iptables backend symlink
using the 'alternatives' system, but this caused an error on Debian 9
systems:

```
TASK [ferm : Manage iptables backend using alternatives]
fatal: [unifi.ciphermail.com]: FAILED! => changed=false
  msg: Specified path /usr/sbin/iptables-nft does not exist
```

This commit restores the old behaviour on Debian 9.

This omits the `regenerate` parameter in opendkim__keys when using
Ansible < 2.10, as it is not supported prior to that release.

Merge branch 'port-lxc_ssh' of https://github.com/stefangweichinger/debops into stefangweichinger-port-lxc_ssh