* Move modules installation:
We need some modules to be installed when doing the DB init. (alembic)
* Remove double entry for starting "aurweb-git-archive.timer"
* Link update wrapper after creating git repo
* Fix permissions cgit deploy

Signed-off-by: moson <moson@archlinux.org>

So far the for loop recognized filenames with spaces as different words:

$ for f in $(find pkg -type f); do echo "$f"; done
pkg/usr/bin/Surge
XT
Effects
pkg/usr/bin/Surge
XT

While the correct output here would have been:
pkg/usr/bin/Surge XT Effects
pkg/usr/bin/Surge XT

We fix this by just passing everything directly to readelf, which also
removes the loop overhead. This results in a significant speedup for
packages with a lot of libraries and binaries.

fixes: #524


Co-Authored-By: Evangelos Foutras <evangelos@foutras.com>

Commit 8e6d5474 ("sshd: use drop-in for basic sshd configuration")
changed the sshd_config.j2 template to contain only overridden bits of
sshd_config. However, it did not account for the install_arch role use
of the same template which was still installed to /etc/ssh/sshd_config.

Fix install_arch to install to etc/ssh/sshd_config.d/override.conf too.

Fixes: 8e6d5474 ("sshd: use drop-in for basic sshd configuration")

Aurweb wants to use terraform to create VMs in the Hetzner cloud sandbox
project and it must store the terraform state somewhere. The state can
be stored in GitLab[1], but unfortunately the access is not very
granular. So to avoid handing the CI pipeline too much access to the
aurweb project, a new project has been created, to store only the
terraform state, and an associated project access token.

[1] https://docs.gitlab.com/ee/user/infrastructure/iac/terraform_state.html

This is meant to be used in the Hetzner cloud sandbox project, so SSH
keys can be injected when a new VM is created from e.g. a CI pipeline,
so that the CI pipeline can SSH to the newly created VM.

The EC2 metadata service is used over the Hetzner metadata service, as
it is supported by more providers (including Hetzner).

Extend the role (previously used for ACME DNS verifications only) to
support dynamic DNS functionality planned for sandbox.archlinux.page.

Add timeseries visualizations for number of requests by status and type.

Convert "graph" vis. types to "timeseries" for Users and Packages.
("graph" is deprecated)

Signed-off-by: moson <moson@archlinux.org>

This saves us from having to rebase on every upstream config change.

The same drop-in functionality is now provided by the openssh package
via /etc/ssh/sshd_config.d/.

Requested by @torxed to be able to commit from a pipeline.

[1] https://gitlab.archlinux.org/archlinux/teams/mirror-administrator/arch-mirrors

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

With aurweb!743 we expose those gauges directly from /metrics

Signed-off-by: moson <moson@archlinux.org>

Rename "search_requests_total" to "aur_search_requests_total"

Related MR: aurweb!743

Signed-off-by: moson <moson@archlinux.org>

We have 100 max connections to Libera.

Leveraging devtools 1.0.4, install systemd snippets which
  - distribute CPU and IO equally between users,
  - distribute CPU and IO equally between build containers of a user,
  - prefer distributing CPU and IO to things that are not build
    containers, and
  - copy our user oomd config for users to apply to build containers.

faillock has often been locking me out of my mailbox because it counts
failed authentication attempts against my user; turn this off and rely
on fail2ban to block instances of account password brute-forcing by IP.

This allows the pads to be named nicely instead of having just a random string as URL.

For example the draft of the monthly report in july could be located at "https://md.archlinux.org/2023-07_monthly-report" instead of "https://md.archlinux.org/UF9Y235qTRe8XS3qxUVeJA".

https://docs.hedgedoc.org/references/url-scheme/#freeurl-mode



Signed-off-by: Christian Heusel <christian@heusel.eu>

The HTTP code must be 2xx for probe_success to indicate that the probe
succeeded, if not an alert will be sent.

Fixes: 653f8011 ("Add GitLab Pages for alpm-types[1]")

As per docs: https://docs.gitlab.com/ee/user/project/pages/introduction.html#customize-the-default-folder

[1] archlinux/alpm/alpm-types#36

Jelle van der Waa authored 1 year ago and Leonidas Spyropoulos committed 1 year ago

Apply the same rate limitting and fail2ban rules for aur.archlinux.org

* Remove API Requests panel (no values; replaced by goaurrpc dashboard)
* Add panel to visualize new metrics for search requests
* Set default timespan to 1 day (from 30d)

Ref: aurweb@814ccf6b
Signed-off-by: moson <moson@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

We do not want our packagers on gemini to hit the rate-limit.

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Until we get our situation with uptimerobot fixed, we are redirecting
status.archlinux.org to the standard uptimerobot URL, that is provided
with their free plan. Once/if we re-gain our premium access, we can
simply revert this MR.

To match Matrix.org. The limit also applies to files we need to retrieve
from other servers.