We don't want mirror.pkgbuild.com's DNS server to be a
single-point-of-failure, so this commit adds multiple authoritative DNS
servers for the zone. The extra DNS servers are run on the geomirror
servers.

The _acme-challenge zone, used for obtaining certificates, is run solely
on mirror.pkgbuild.com's DNS server, to avoid syncing DNS records
between the servers (KISS).

With the PHP->Python port done[1][2], there isn't much need for aur-dev
anynmore. Most things can also be tested locally and aur-dev haven't got
any love since the port (ex: allowing the aurweb maintainers to deploy
without asking DevOps).

[1] https://lists.archlinux.org/pipermail/aur-general/2022-February/036786.html
[2] !525

This is needed for prometheus memcached exporter to work.

(AUR doesn't seem to use memcached anymore, but changed it for
consistency.)

Does not seem possible to communicate with hosts in the same subnet
without going through the gateway. Matches the configuration of our
other dedicated servers at Hetzner.

Add vault variables described in !532 (for aur-dev this time).

Kind of sensitive information that doesn't need to be available to all
hosts.

Change docs/ssh-known_hosts.txt to be partially managed by Ansible, so
custom entries can be added to the top of the file. Use the new format
to write down the host keys of our two borg hosts.

Kevin Morris authored 3 years ago and Evangelos Foutras committed 3 years ago

[foutrelis: add vault variables described in !532]

Signed-off-by: Kevin Morris <kevr@0cost.org>
Signed-off-by: Evangelos Foutras <evangelos@foutrelis.com>

The two secrets: vault_aurweb_{secret,postmaster}

Using GitLab's official backup tool takes too much time and, more
importantly, space; /srv/gitlab is a bit over 430G but backing it
up nearly exhausts its 1TB volume.

As we're creating btrfs snapshots and backing those up with borg, it
seems unnecessary to also create tarballs of the same data. GitLab's
documentation mentions snapshots as a viable backup strategy, and to
the restored system it should seem like recovering from a power loss.

[1] https://docs.gitlab.com/ee/raketasks/backup_restore#alternative-backup-strategies

The sponsored mirrors have a ton of storage, but mirror.pkgbuild.com
doesn't, so debug packages aren't synced to it.

[1] {america,asia,europe}.mirror.pkgbuild.com

Fixes: 91f9df69 ("Add missing wireguard for gluebuddy")

Fixes: d88c0b95 ("Initialize gluebuddy host")

New username; separate and longer account manager + storage passwords.

Also, have to use --remote-path=borg1 when interacting with rsync.net.

It's not available as a shell anymore after tools were removed from it.

Hetzner DNS has been delaying many responses for 5 seconds, causing
outgoing federation work to pile up, almost running into OOM before we
noticed.

I don't know if were being throttled because federation makes a *lot* of
requests. Anyway, using Cloudflare DNS seems to solve it.

Enable DNSOverTLS for this because we can.

en is the prefix for ethernet according to systemd.net-naming-scheme(7)

Leonidas Spyropoulos authored 3 years ago and Kristian Klausen committed 3 years ago

Redundant since this commit:
bdd538ec ("Use unbound for rspamd DNS resolving")

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

CPU: Intel Xeon E5-2620 -> E-2288G
Disk: 2x~1TB -> 2x~500GB

It's been running out of swap during borg-backup and seems to get good
compression ratios; try upping the zram size to 100% of RAM (from 50%).

zswap seems like the better choice when a backing swap partition exists.

Add a default rate limit for 20 req/s for the uwsgi endpoint and
automatically ban users who reach this limit. The nginx-limit-req rule
does not ban users who reach the rss limit as these are not likely DoS
attempts.

This is meant as a internal authenticated and encrypted network which we
can use for internal services, we don't want to expose to the internet
or when encryption is desired but not easily implementable.

nginx, certbot, postfix and mailman are still missing and the DNS is
still pointing to luna.

Fix #325

Ansible complains if the fail2ban_jails dictionary is missing the
nginx_limit_req key. Adding this as default failse.

Bugfix from: e5773374

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Fix #193

To negate high cpu spikes from abusers/bots who scan our services, we
now fail2ban them.

Sven-Hendrik Haase authored 3 years ago and Kristian Klausen committed 3 years ago

Co-authored-by: Kristian Klausen <kristian@klausen.dk>

Gitlab can show our alertmanager alerts only for > reporter and create
issues from alerts on gitlab.