I've had mode=755 create garbage already...

postgres must be able to connect to all databases,
else the postgres_db ansible module is broken.

Sets a bunch of settings at once.

Flags for the root filesystem should be specified on the kernel command
line, e.g. rootflags=noatime,discard,compress=lzo . I'd argue having an
entry for / in fstab is harmful since you shouldn't boot with the wrong
flags in the first place.

Since there are no other filesystems, genfstab becomes useless.

lsrepo: A fancy repo content viewer
checklib32: Discovers multilib packages with differing version numbers

This reverts commit 5ec3d1a8.

The server uses forced commands so this doesn't work.

This allows to easily check for backups with no update to the timestamp
on the backup host.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This allows to call borg commands without having to provide the backup
destination each time.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is also the profile we use on our older boxes and apparently users
(see bug, also confirmed via IRC for setups using the settings in
ansible alreadt) are unable to access our sites.

https://bugs.archlinux.org/task/50771



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Include link to mozilla's config generator (looks like the settings
came from there) and update ssl_session_* settings to their current
recommendation.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

devtools expects those to exist so create them automatically. No need
to have users do that themselves.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Sven-Hendrik Haase <svenstaro@gmail.com>

This fixes an issue with utf8 encoding in From headers that starts
appearing with perl 5.24. Dont't ask me why it worked before.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

A simple redirect breaks the syncrepo script because it doesn't follow
redirects. Copy the vhost for now and deduplicate it later.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The settings don't hurt normal http connections if they are defined at
the top level.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

For some reason orion has a netmask of /8 which doesn't work in
hetzner's network since all traffic to other machines must pass through
a switch. Fix this by forcing a /32 netmask.

This change also requires us to set the gateway via the Peer option
because it would otherwise not be reachable.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This allows to change it after deployment

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This allows each host with nginx to easily get some kind of SSL cert
for testing purposes or services where the CN does not matter.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Config copied from nymeria.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Config copied from nymeria with improved indentation.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Reenable this when mailman is actually running on the same box

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>