Do not use asterisk on network devices to prevent IP address collisions
on networks. Also use the right network mask for the assigned network.
For runner1 we need to ignore RAs since those routes don't work.

Jelle van der Waa authored 4 years ago and Jelle van der Waa committed 4 years ago

To simplify the archive role, split it up in the web serving part for
the archive-mirrors, gemini and keep the archive role for only the
archive operation. This simplifies the new role as only two lines are
required to setup the the archive mirror website.

Setup Kape servers as archive mirrors (asia,europe,america), Gitlab
runner and Rebuilderd worker. All machines except runner1 are EFI
machines with grub setup and a EFI parition which is not supported by
our ansible install role and is manually rolled out.

Jelle van der Waa authored 4 years ago and Jelle van der Waa committed 4 years ago

The repro3.pkgbuild.com machine was a packet.net box with an Ubuntu
installation. Now converted to an Arch Linux installation managed by
ansible with a new rebuilderd_worker role.

Zabbix has been replaced by Prometheus for monitoring our services.

Jelle van der Waa authored 4 years ago and Jelle van der Waa committed 4 years ago

Orion has been replaced by gemini and for mail by mail.archlinux.org

It used to be Debian pfff

For all hosts we want to have a working fail2ban for sshd brute force
attempts through a group_vars/all. For some hosts an override is
required to enable postfix or dovecot jails.

Allow bounce handling from mail.archlinux.org, the new email server

Extend the memcached service for the AUR to allow the memcached group to
read the socket to obtain statistics.

Jelle van der Waa authored 4 years ago and Sven-Hendrik Haase committed 4 years ago

The PIA boxes are retired.

This is much cleaner because the nginx role does not have to set the
fastcgi_cache variable to "false" by default, which was overridden by
host_vars/apollo.archlinux.org to "wiki", but the value was still
hardcoded in the config.

At first, I was wondering that the cache "zone" name should be
generalized to improve the configuration (from the original per-host to
per-service), but that would be an overkill since the fastcgi cache is
used only for the wiki...

Introduce a new monitoring server with prometheus and alertmanager for
monitoring all our boxes.

This PIA box was never btrfs, so do not set it as such as it will enable
the btrfs scrub timer.

Both boxes died and are no longer responsive, retire them.

It was Debian previously.

Added the missing host_vars file for aur.archlinux.org and changed the README
to reflect it's move.

Apparently the host without prio is the traffic shaped one which has been very slow for us.

In preparation of the move to gemini make it already run the
archive.archlinux.org frontend and the archive-uploader. So the
migration is done in steps.

This reverts commit 81bb41e3.

We actually do need to specify all fields.

Remove jail config from host_vars that just sets the default of false
(disabled).