Onboard gromit as Junior DevOps

Closes #543

See merge request archlinux/infrastructure!767

gromit is our newest Junior DevOps[1] and will get access to:
* bugs.archlinux.org: for helping with the bug migration
* wiki.archlinux.org: for helping with (archwiki) maintenance

[1] https://lists.archlinux.org/archives/list/arch-devops@lists.archlinux.org/message/2LAOGIVY33MZLBZCDSQHDQVQNEULLUTW/

Fix #543

aurweb: Enable traceback for sandbox environments

See merge request archlinux/infrastructure!768

Enable error reporting for internal server errors and show stack trace
on a sandbox/dev environment.

Signed-off-by: moson <moson@archlinux.org>

Update Antiz's SSH key

See merge request archlinux/infrastructure!766

Kristian Klausen authored 1 year ago and Levente Polyak committed 1 year ago

There is no reason for exposing the service to the whole internet nor
communicating without encryption. It could be fixed by restricting the
firewall rule to the public IP of the gitlb server and running it over
HTTPS or we could just use our existing WG network.

To allow gitlab to send requests to a private network address, the IP
has been allowlisted[1]. The endpoint also expects a "secret token"[2],
so it won't accept events from e.g. users creating a webhook with the
same URL.

[1] https://docs.gitlab.com/ee/security/webhooks.html#allow-outbound-requests-to-certain-ip-addresses-and-domains
[2] https://docs.gitlab.com/ee/user/project/integrations/webhooks.html#validate-payloads-by-using-a-secret-token

There is no reason for this and we very rarely use the console anyway.

Ref #541

archwiki: rename archtu group to archpackager

See merge request archlinux/infrastructure!765

Trusted Users are now called Package Maintainers.
See the discussion in https://wiki.archlinux.org/title/ArchWiki_talk:Requests#Trusted_User_name_change

Once this is deployed, the users need to be migrated to the new group
by running:

    php ./maintenance/migrateUserGroup.php archtu archpackager

Related to #533

Closes: #542
Fixes: 722cc5bf ("aurweb: release 6.2.8")

The role has been renamed[1], so rename the bylaw subdomain.

tu-bylaws.aur.a.o will be kept around for some time redirecting to
package-maintainer-bylaws.aur.a.o.

[1] rfcs!7

Ref #533

aurweb: release 6.2.8

See merge request archlinux/infrastructure!762

* bump version
* services: rename tuvotereminder to votereminder
* nginx: redirect /tu to /package-maintainer
* nginx: remove /trusted-user/TUbylaws.html redirect

Signed-off-by: moson <moson@archlinux.org>

archwiki: Update to version 1.40.1-3

See merge request archlinux/infrastructure!764

This includes several minor ui fixes.

Signed-off-by: Christian Heusel <christian@heusel.eu>

Now matching the config in dbscripts itself. Also sort the repos.

Offboard remy as Developer

See merge request archlinux/infrastructure!755

Jelle van der Waa authored 1 year ago and Kristian Klausen committed 1 year ago

Ref #527

archwiki: update to mediawiki 1.40

See merge request archlinux/infrastructure!747

- fix crash when $wgFooterIcons.poweredby is no set
- account for Extension:Renameuser being bundeled with 1.40
- enable the nosniff header for /images
- switch to running maintenance scripts via run.php

Signed-off-by: Christian Heusel <christian@heusel.eu>

Adding the extension was discussed here:
https://wiki.archlinux.org/index.php?title=ArchWiki_talk:Maintenance_Team&oldid=788677#Replace_PNG_images_with_SVG



Signed-off-by: Christian Heusel <christian@heusel.eu>

This also enables the Extension:VisualEditor on user pages.

Addition was positively discussed here:
https://wiki.archlinux.org/index.php?oldid=788677#Enable_the_DiscussionTools_extension



Signed-off-by: Christian Heusel <christian@heusel.eu>

this has been positively discussed here:
https://wiki.archlinux.org/index.php?oldid=788677#Enable_the_Thanks_extension



Signed-off-by: Christian Heusel <christian@heusel.eu>

dbscripts: fix createlinks for binaries in non-standard locations

See merge request archlinux/infrastructure!758

In FS#79592 we encountered yet another case where sogrep was not able to
detect the necessary rebuild because the binaries reside in the
non-standard path "/usr/share/$pkgname/bin/" which we currently do not
take into account.

This commit fixes this behaviour by also taking files symlinked from one
of the standard locations into account.

Adding secondary workstation key for torxed

See merge request archlinux/infrastructure!761

Re #537

dbscripts: add missing gitconfig file

See merge request archlinux/infrastructure!756