Wiki says "Do not download it from a mirror" and it sounds more secure.

Fixes: 503b08db ("install_arch: verify bootstrap image signature")

Symlinking home.json to archive.json causes a duplicate, as both
dashboards have the same uid, and Grafana won't keep the dashboards
updated when there are duplicates[1]. Instead just change
default_home_dashboard_path to point to the archive.json dashboard.

[1] "dashboards provisioning provider has no database write permissions
     because of duplicates"

install_arch: verify bootstrap image signature

Closes #458

See merge request archlinux/infrastructure!641

Matt Nelson authored 2 years ago and Evangelos Foutras committed 2 years ago

Fixes #458.

Cleanup onboarding and offboarding template

Closes #372

See merge request archlinux/infrastructure!627

Fixes: 2c69e12d ("Extend onboarding information for signing keys")

We have offered a arch mail address, for support staff, for over a
year[1][2] and the only difference, is that support staff must only be
granted SSH access to mail.archlinux.org. SSH access to
homedir.archlinux.org is also allowed, but it is opt-in[3].

[1] 7287d6d3 ("archroles: Add support-staff group")
[2] 50c3e0f9 ("archusers: Support restricting users to specific hosts")
[3] e0e52552 ("Allow Alad access to homedir.archlinux.org")

Fix #372

Since [1][2].

[1] archlinux/gluebuddy@8a105288
[2] archlinux/infrastructure!524

[1] https://lists.archlinux.org/archives/list/staff@lists.archlinux.org/thread/3LFY3OVV4MHXR2WTYDFS6EWNATGFCE3E/

Reaching out to the user is cumbersome, especially if the user is being
offboarded due to inactivity.

Fixes: bb000824 ("mailman: Second batch of mailman3 migrated lists")

aurweb: enable goaurrpc metrics

See merge request archlinux/infrastructure!640

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>
Co-authored-by: Kristian Klausen <kristian@klausen.dk>
Co-authored-by: moson-mo <mo-son@mailbox.org>

3690/tcp -> svn

The nginx role already enables the http and https services.

4242/tcp -> quassel
 113/tcp -> ident

51820/udp -> wireguard

WireGuard was setup to provide a internal network with confidentiality,
authenticity and integrity[1]. This migrate the remaining Prometheus
exporters to use the internal WireGuard network.

[1] 664deb67 ("WireGuard all hosts")

Fix #384

aurweb: setup goaurrpc

See merge request !639

Expose aurweb RPC using goaurrpc to reduce the load on the server.
Additionally we can now geo-serve this ro reduce load and bandwidth.

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

aurweb: setup git gc for all aurweb git repos

See merge request !638

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Move the 'sshd_enable_includes' override to aur's host vars instead of
specifying it as part of playbooks/aur.archlinux.org. Otherwise, would
break the AUR's SSH auth if ssh.d/aurweb_config does not get included.

aurweb: release 6.1.7 - git archives

See merge request !636

Kevin Morris authored 2 years ago and Leonidas Spyropoulos committed 2 years ago

This commit brings in four new routes to nginx:
- /archives/metadata.git
- /archives/users.git
- /archives/pkgbases.git
- /archives/pkgnames.git

See https://gitlab.archlinux.org/archlinux/aurweb/-/blob/master/doc/git-archive.md



For now, we will be updating the repositories once every 10 minutes.

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>
Co-signed by:  Kevin Morris <kevr@0cost.org>

lint: add fqcn and no-free-form to skip_list for ansible-lint 6.8.0

See merge request !635

This format is too pervasive in our infra code, no way we're fixing all
824 instances. (At least not without a notably increased snack budget.)

We were already ignoring fqcn-builtins which is now an alias for
fqcn[action-core] in ansible-lint 6.8.0. The latter started complaining
about fqcn[action] as well, so just opt out of all fqcn checks.

group_vars/all was enabling just the sshd jail so move this into the
fail2ban role defaults. patchwork, security and wiki were redefining
fail2ban_jails without deviating from the group_vars/all default and
can therefore be dropped.

I have needed to use compsize on multiple occasions, and thus had to
temporarily install it. As it is already installed on 9 machines and
is generally useful, make it part of the standard tool set for btrfs.

The traffic hitting ping.archlinux.org has lately been exhausting its
default nf_conntrack_max limit of 64k. Bump it to 256k (which is also
the default limit found on systems with more than 4G of memory).

Suggested-by: Kristian Klausen <kristian@klausen.dk>

Kill the mailman2 server and put the mailman3 server in its place

Closes #59

See merge request !628