aurweb: release 6.1.7 - git archives

This commit brings in four new routes to nginx:
- /archives/metadata.git
- /archives/users.git
- /archives/pkgbases.git
- /archives/pkgnames.git

See https://gitlab.archlinux.org/archlinux/aurweb/-/blob/master/doc/git-archive.md



For now, we will be updating the repositories once every 10 minutes.

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>
Co-signed by:  Kevin Morris <kevr@0cost.org>

roles/aurweb/defaults/main.yml

@@ -8,7 +8,7 @@ aurweb_conf_dir: '/etc/aurweb'
 aurweb_git_dir: "{{ aurweb_dir }}/aur.git"
 aurweb_git_hook: '/usr/local/bin/aurweb-git-update'
 aurweb_nginx_conf: '/etc/nginx/nginx.d/aurweb.conf'
-aurweb_version: 'v6.1.4'
+aurweb_version: 'v6.1.7'
 aurweb_pgp_keys: ['0F985B6F99B6686854C44EC3F7E46DED420788F3', 'DB650286BD9EAE39890D3FE6FE3DC1668CB24956']
 
 aurweb_db: 'aur'

roles/aurweb/tasks/main.yml

@@ -74,6 +74,8 @@
   with_items:
     - aurweb-git.service
     - aurweb-git.timer
+    - aurweb-git-archive.service
+    - aurweb-git-archive.timer
     - aurweb-aurblup.service
     - aurweb-aurblup.timer
     - aurweb-mkpkglists.service
@@ -95,6 +97,7 @@
   service: name={{ item }} enabled=yes state=stopped
   with_items:
     - aurweb-git.timer
+    - aurweb-git-archive.timer
     - aurweb-aurblup.timer
     - aurweb-mkpkglists.timer
     - aurweb-pkgmaint.timer
@@ -305,8 +308,10 @@
   service: name={{ item }} enabled=yes state=started daemon_reload=yes
   with_items:
     - aurweb-git.timer
+    - aurweb-git-archive.timer
     - aurweb-aurblup.timer
     - aurweb-mkpkglists.timer
+    - aurweb-git-archive.timer
     - aurweb-pkgmaint.timer
     - aurweb-popupdate.timer
     - aurweb-tuvotereminder.timer

roles/aurweb/templates/aurweb-git-archive.service.j2

+[Unit]
+Description=Generate and update Git Archive repositories
+Requires=mysqld.service
+After=mysqld.service
+
+[Service]
+Type=oneshot
+User={{ aurweb_user }}
+WorkingDirectory={{ aurweb_dir }}
+ExecStart=/usr/bin/poetry run aurweb-git-archive --spec metadata
+ExecStart=/usr/bin/poetry run aurweb-git-archive --spec users
+ExecStart=/usr/bin/poetry run aurweb-git-archive --spec pkgbases
+ExecStart=/usr/bin/poetry run aurweb-git-archive --spec pkgnames
+
+NoNewPrivileges=true
+LockPersonality=true
+CapabilityBoundingSet=
+ReadWritePaths={{ aurweb_dir }}
+
+PrivateDevices=true
+PrivateTmp=true
+ProtectSystem=strict
+
+MemoryDenyWriteExecute=true
+RemoveIPC=true
+RestrictRealtime=true
+RestrictNamespaces=true
+RestrictSUIDSGID=true
+
+RestrictAddressFamilies=AF_UNIX
+
+ProtectHostname=true
+ProtectControlGroups=true
+ProtectKernelLogs=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectClock=true
+ProtectProc=noaccess
+
+SystemCallArchitectures=native

roles/aurweb/templates/aurweb-git-archive.timer.j2

+[Unit]
+Description=Generate and update Git Archive repositories
+
+[Timer]
+# This is set to 10m intervals as of 09/26/2022. We'll be keeping
+# aurweb-mkpkglists around for two months after v6.1.5 deployment.
+# At that time (two months after deploy), this should be changed
+# to 5m intervals and aurweb-mkpkglists should be removed from use.
+OnStartupSec=10m
+OnUnitActiveSec=10m
+
+[Install]
+WantedBy=timers.target

roles/aurweb/templates/config.j2

@@ -51,6 +51,16 @@ packagesmetaextfile = {{ aurweb_dir }}/web/html/packages-meta-ext-v1.json.gz
 pkgbasefile = {{ aurweb_dir }}/web/html/pkgbase.gz
 userfile = {{ aurweb_dir }}/web/html/users.gz
 
+[git-archive]
+; One week in seconds
+popularity-interval = 604800
+
+; Git Archive repository locations
+metadata-repo = {{ aurweb_dir }}/metadata.git
+users-repo = {{ aurweb_dir }}/users.git
+pkgbases-repo = {{ aurweb_dir }}/pkgbases.git
+pkgnames-repo = {{ aurweb_dir }}/pkgnames.git
+
 [notifications]
 notify-cmd = aurweb-notify
 {# Gitlab project and token used for traceback reports. #}

roles/aurweb/templates/nginx.d.conf.j2

@@ -51,6 +51,32 @@ server {
 	    return 301 https://tu-bylaws.aur.archlinux.org;
     }
 
+    #
+    # smartgit location for Git Archive repositories
+    # Should be shallow-cloned:
+    # `git clone --depth=1 https://aur_location/archives/metadata.git`
+    #
+    # Routes:
+    # - /archives/metadata.git
+    # - /archives/users.git
+    # - /archives/pkgbases.git
+    # - /archives/pkgnames.git
+    #
+    location ~ "^/archives/(metadata|users|pkgbases|pkgnames)(\.git)/(git-(receive|upload)-pack|HEAD|info/refs|objects/(info/(http-)?alternates|packs)|[0-9a-f]{2}/[0-9a-f]{38}|pack/pack-[0-9a-f]{40}\.(pack|idx))" {
+        include      uwsgi_params;
+        uwsgi_pass   smartgit;
+        uwsgi_modifier1 9;
+        uwsgi_param  SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+        uwsgi_param  PATH_INFO /$1.git/$3;
+        uwsgi_param  GIT_HTTP_EXPORT_ALL "";
+        uwsgi_param  GIT_PROJECT_ROOT {{ aurweb_dir }};
+    }
+
+    #
+    # smartgit location for AUR package git repository
+    # Clone packages:
+    # `git clone https://aur_location/pkgname.git`
+    #
     location ~ "^/([a-z0-9][a-z0-9.+_-]*?)(\.git)?/(git-(receive|upload)-pack|HEAD|info/refs|objects/(info/(http-)?alternates|packs)|[0-9a-f]{2}/[0-9a-f]{38}|pack/pack-[0-9a-f]{40}\.(pack|idx))$" {
 	limit_req zone=aurwebgitlimit burst=900 nodelay;
         include      uwsgi_params;