This is done to avoid killing db-update and related processes.

We want to treat our servers as cattle; hopefully when this is fleshed
out a bit more, it can accomplish the job without too many casualties.

It has been applied upstream[1] and released with smartmontools 7.2[2].

[1] https://github.com/smartmontools/smartmontools/commit/61bc85ecadf9e5596b140380fed701a674e38a1b
[2] https://github.com/smartmontools/smartmontools/releases/tag/RELEASE_7_2

This reverts commit b4c97002.

Ref: service-agreements!16

We used to set query_cache_type to 0 in the default settings but we were
also setting query_cache_size to a non-zero/non-default value, which was
in turn re-enabling the query cache. Update the configuration to reflect
the actual cache state and make sure query_cache_size is set to zero for
the "query_cache_type = 0" case.

Now that the setting controls the real state of the query cache, disable
it for bbs.archlinux.org; its hit rate is small compared to insert rate.

Default query_cache_type to 0 and innodb_file_per_table to true.

borg: allow out of place calls

See merge request !435

We force delete in the signal handler as a graceful script execution
already deletes the file. This way we avoid any errors being wrongly
printed.

Signed-off-by: Levente Polyak <anthraxx@archlinux.org>

Main motivation behind this is preparing for doing more automatic
upgrades. The need for ignoring kernel updates isn't clear either.

matrix.archlinux.org: Configure static DNS via networking role

See merge request !479

Hetzner DNS has been delaying many responses for 5 seconds, causing
outgoing federation work to pile up, almost running into OOM before we
noticed.

I don't know if were being throttled because federation makes a *lot* of
requests. Anyway, using Cloudflare DNS seems to solve it.

Enable DNSOverTLS for this because we can.

I don't know why this wasn't enabled.

This one is pretty spammy with warnings that don't mean much.

Other caches around this code use 500000 entries, so just copy that.

Fix #386

Ref #388

Be more explicit about selecting allowed repos because these were missed
in previous onboardings.

These groups are no longer required as docker/arch-boxes images are
build by Gitlab.

Closes: #389

This cache was seeing constant evictions at its former size (70k).

With a size of 200k it now stabilizes at ~122k entries with a
significant drop in server load.

Now that Pantalaimon refuses operations until it has sync'ed with the
homeserver, we need to give it time to do so or Mjolnir will refuse to
start.

Looks like a oversight when he was offboarded as DevOps.
As support staff he shouldn't have access to