orion: migrate torrent tracker from luna to orion

Add a role for the hefur torrent tracker. A simple
service which runs on tracker.archlinux.org. Note that our setup
overrides a few things of the systemd service.
Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>

README.md

@@ -53,6 +53,7 @@ The following steps should be used to update our managed servers:
 - repos/sync (repos.archlinux.org)
 - sources (sources.archlinux.org)
 - archive (archive.archlinux.org)
+- torrent tracker hefurd (tracker.archlinux.org)
 
 ### apollo
 
@@ -73,7 +74,6 @@ The following steps should be used to update our managed servers:
 #### Services
 - build server (pkgbuild.com)
 - releng
-- torrent tracker (hefurd)
 - sogrep
 - /~user/ webhost
 - irc bot (phrik)

docs/torrent-tracker.txt

+# ISO Torrent Tracker
+
+Arch Linux runs a torrent tracker for the Arch Linux ISO on
+tracker.archlinux.org and the tracker software used is hefur.
+
+The torrent files are rsync'd from rsync.archlinux.org to the server where
+hefurd.

playbooks/orion.yml

@@ -25,3 +25,4 @@
     - { role: archweb, archweb_site: false, archweb_services: true, archweb_donor_import: true, archweb_mirrorcheck_locations: [5, 6], tags: ['archweb'] }
     - { role: sources, sources_domain: "sources.archlinux.org", sources_dir: "/srv/sources", tags: ['sources'] }
     - { role: archive, archive_domain: "archive.archlinux.org", archive_dir: "/srv/archive", tags: ['archive'] }
+    - { role: hefur, ftp_iso_dir: '/srv/ftp/iso', tags: ['torrenttracker']}

roles/hefur/tasks/main.yml

+---
+- name: install required packages
+  pacman: name=hefur
+
+- name: create override dir
+  file: path=/etc/systemd/system/hefurd.service.d state=directory
+
+- name: copy systemd override
+  template: src=override.conf.j2 dest=/etc/systemd/system/hefurd.service.d/override.conf owner=root group=root mode="u=rw,g=r,o=r"
+
+- name: start and enable hefurd service
+  service: name="hefurd.service" enabled=yes state=started
+
+- name: open firewall hole for hefurd
+  firewalld: port=6969/tcp permanent=true state=enabled immediate=yes
+  when: configure_firewall
+  tags:
+    - firewall

roles/hefur/templates/override.conf.j2

+[Service]
+ExecStart=
+ExecStart=/usr/bin/hefurd -disable-peers-page -torrent-dir {{ ftp_iso_dir }}
+Restart=on-failure
+NoNewPrivileges=true
+ProtectSystem=strict
+MemoryMax=1G