Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Migrate PostgreSQL to C.UTF-8

Closes #470

See merge request !643

C.UTF-8 is installed by default, so we can avoid messing with locale-gen
by using that.

All the postgres servers (excluding matrix due to[1]) have been migrated
with the following commands:
# sudo -u postgres pg_dumpall > d
# sed "s/LOCALE = 'C'/LOCALE = 'C.UTF-8'/" -i d
# systemctl stop postgresql.service
# mv /var/lib/postgres/data{,.old}
$ ansible-playbook --diff -t postgres playbooks/<host>.yml
# sudo -u postgres psql < d

[1] https://github.com/matrix-org/synapse/blob/19a57f4a3710d6c3f7cc9d031e0e59bc2ed3b052/docs/postgres.md#fixing-incorrect-collate-or-ctype

Fix #470

Set the base_path provider attribute to "/auth" until we move the /auth
endpoint to be served from the root of https://accounts.archlinux.org/.

- hcloud: 1.34.3 -> 1.35.2
- hetznerdns: 2.1.0 -> 2.2.0

archwiki: upgrade to 1.38.4-1

See merge request !647

security-tracker: bump version to 0.14.1

See merge request !646

Using an inline statement eats the blank line after it; to overcome this
switch to an inline expression, which also happens to be easier to read.

- enable_gzip: grafana listens on localhost, nginx handles compression
- admin_user: initial admin creation is disabled in our config
- strict_transport_security: the same header is set by nginx
- strict_transport_security_max_age_seconds: unused without the above

- common: for deciding when to install/configure smartmontools
- install_arch: installing ucode update only on physical hosts

prometheus_exporters: ignore smartctl exit code 64

See merge request !645

On asia.mirror.pkgbuild.com, 'smartctl -a --json $disk' has been exiting
with code 64. From smartctl(1) code 64 corresponds to "Bit 6: The device
error log contains records of errors". Since we're not interested in old
errors, ignore it.

Tidy up the inventory a bit

See merge request !644

This has become outdated (missing new dedicated servers) and its usage
can be replicated by checking if ansible_virtualization_role == "host".

For Ansible ad hoc commands, '!hcloud' can be used to the same effect.

Repro machines are now placed in the rebuilderd_workers group.

This group is unused and contains fewer than half of our web servers.

Bots are joining earlier and waiting a day before spamming.

Fix #472

grafana: update grafana dashboard for goaurrpc

See merge request !642

Mario Oenning authored 2 years ago and Mario Oenning committed 2 years ago

* Show totals for the last 24 hours (instead of all time)
* Add total search requests pie chart

Signed-off-by: moson-mo <mo-son@mailbox.org>

Wiki says "Do not download it from a mirror" and it sounds more secure.

Fixes: 503b08db ("install_arch: verify bootstrap image signature")

Symlinking home.json to archive.json causes a duplicate, as both
dashboards have the same uid, and Grafana won't keep the dashboards
updated when there are duplicates[1]. Instead just change
default_home_dashboard_path to point to the archive.json dashboard.

[1] "dashboards provisioning provider has no database write permissions
     because of duplicates"

install_arch: verify bootstrap image signature

Closes #458

See merge request !641

Matt Nelson authored 2 years ago and Evangelos Foutras committed 2 years ago

Fixes #458.

Cleanup onboarding and offboarding template

Closes #372

See merge request !627

Fixes: 2c69e12d ("Extend onboarding information for signing keys")

We have offered a arch mail address, for support staff, for over a
year[1][2] and the only difference, is that support staff must only be
granted SSH access to mail.archlinux.org. SSH access to
homedir.archlinux.org is also allowed, but it is opt-in[3].

[1] 7287d6d3 ("archroles: Add support-staff group")
[2] 50c3e0f9 ("archusers: Support restricting users to specific hosts")
[3] e0e52552 ("Allow Alad access to homedir.archlinux.org")

Fix #372

Since [1][2].

[1] gluebuddy@8a105288
[2] !524

[1] https://lists.archlinux.org/archives/list/staff@lists.archlinux.org/thread/3LFY3OVV4MHXR2WTYDFS6EWNATGFCE3E/