Morten Linderud authored 4 years ago and Jelle van der Waa committed 4 years ago

Signed-off-by: Morten Linderud <morten@linderud.pw>

Morten Linderud authored 4 years ago and Jelle van der Waa committed 4 years ago

Signed-off-by: Morten Linderud <morten@linderud.pw>

We do not want full scope to be allowed for the gitlab openid client. In
fact we already have it disabled, however the latest provider seems to
have changed something which makes terraform to have the desire to
change this to true. Set it explicitly to false to avoid changing
behavior.

This reverts commit 8e4eac7d.

Revert this feature as its part of a keycloak change that must go
through review via a merge request.

This reverts commit cadfd2c5.

Revert this feature as its part of a keycloak change that must go
through review via a merge request.

This reverts commit 5446a3d0.

Revert this feature as its part of a keycloak change that must go
through review via a merge request.

fail2ban is no longer a dependency of the archwiki role.

reproducible.archlinux.org has no memcached installed.

`terraform plan` tried to remove it.

Upstream mariadb has with a default server much higher defaults and our
servers have plenty of ram to spare as well.

Install keycloak-metrics-spi and configure it to provide prometheus
endpoints available as auth/realms/$realm/metrics. The prometheus
metrics are behind basic_auth as some metrics might be sensitive or can
be used by attackers. #23

Jelle van der Waa authored 4 years ago and Sven-Hendrik Haase committed 4 years ago

Closes: #12

We've stopped providing kvm and virtualbox special devices as they are not actually necessary.

This never really worked to well and since basically all PIA boxes that we
balanced to have died by now and it's also pretty slow.

The magnet uri's and torrent files no longer include a torrent tracker
link so running the service is obsolete.

This PIA box was never btrfs, so do not set it as such as it will enable
the btrfs scrub timer.

As of now we don't use interactive web terminals, the open ports are
removed on all runners manually.

https://docs.gitlab.com/ee/administration/integration/terminal.html#security

As repro3 is Ubuntu and it's default shell is dash, set -o pipefail is
not supported.

It isn't used and Postfix was never configured to use it.

Added a new server for the mail migration.

Add federation_reader as a another worker.

Both boxes died and are no longer responsive, retire them.

Added the missing msa_header_checks to that tasks.