The intention is to use this config for other domains besides a mirror.

- add the new role to redirect.archlinux.org
- release mirror.pkgbuild.com of all DNS duties

Kevin is MIA, so add my key, so we can do releases.

All servers are part of these groups which makes them redundant.

Keycloak 18.0.0 disallows this by default; enable the legacy behavior
temporarily. When this stops working, we should consider removing the
'redirect_uri' parameter entirely. Should also check if GitLab and/or
Grafafa have implemented support for alternative ways of signing out:

- https://gitlab.com/gitlab-org/gitlab/-/issues/14414
- https://github.com/grafana/grafana/issues/24643

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Bash histories indicate this isn't being used anywhere other than
{build,gemini}.archlinux.org and gemini's filelist is so big that
locate becomes so slow that it's practically useless on this box.

- group_vars/all/vault_mariadb.yml: remove 'zabbix' database user
- misc/vaults/additional-credentials.vault: remove zabbix irc bot
- roles/dbscripts/tasks/main.yml: drop unused tier0 mirror access

The idea bebind this is to be able to give vault access to new DevOps
members without giving away more important credentials like Hetzner's.

These were previously removed temporarily and re-created several minutes
later during the process of deploying archusers to gemini.archlinux.org.

In an effort to stay consistent with the TTL used for the archlinux.org
and pkgbuild.com NS records, as well as slightly improve lookup latency.

PowerDNS provides a neat way to implement GeoIP-based redirection and
automatic failover. With GeoLite2-City database, it is able to select
the closest mirror from a list of IPs we provide. Every 60 seconds it
also checks if the mirror's HTTPS URL is working as expected; if that
check fails, it stops giving it out (this acts as automatic failover).

Without this setting, Git exits with an error when the repository is not
owned by the current user. This messes with our shared srcdest.

Since we are now using the local disk instead of a volume (which can be
scaled up easily) it helps to have a more consistent view of free space.

All database user passwords have been updated to use scram-sha-256, so
there's no need for backward compatibility with md5.

Also remove the suggestion to call delete_old_cluster.sh; it's now being
created under /tmp and it only contains a command to remove the old data
directory. (We can do the latter ourselves after some time has passed.)

Ensure the correct version is installed and matches $FROM_VERSION.

Commit 8f113698b63b15a4e0a4b15d3ee37238c1d1821d upstream:

  Remove analyze_new_cluster script from pg_upgrade

  Since this script just runs vacuumdb anyway, remove the script and
  replace the instructions to run it with instructions to run vacuumdb
  directly.

Not much point in vimdiff'ing pg_hba.conf and postgresql.conf.

Adapt upgrade_pg.sh to avoid manipulating /var/lib/postgres' structure
as the postgres user. Instead, create a new empty data directory owned
by postgres for initdb to use.

It was using a nonexistent target path when copying the renewed cert and
was not reloading postgresql.service in order for it to reload the certs.

Synapse needs the database to be in C locale. Since v1.56.0, it refuses
to start when this is not the case, see [upgrade.md][1].

[1]: https://github.com/matrix-org/synapse/blob/v1.56.0/docs/upgrade.md#change-in-behaviour-for-postgresql-databases-with-unsafe-locale

This brings it in line with the non-JSON "reduced" log format.

Ensure all the nameservers serving the geo.mirror.pkgbuild.com subzone
are working and respond with a valid resource record to A/AAAA queries.