geoipupdate: implement role for use on geo mirrors

See merge request !541

This reverts commit c8d1a39a

Onboard kevr as project maintainer

Closes #438

See merge request !536

Fix #438

Remove our two borg hosts from the inventory

See merge request !540

Do the same for the hostkeys/known_hosts templates and disable fact
gathering.

Kind of sensitive information that doesn't need to be available to all
hosts.

These are managed services and Ansible doesn't run on them. It got
boring writing 'all,!rsync_net,!hetzner_storageboxes' in playbooks
and ad-hoc commands, so remove these borg hosts from our inventory.

Change docs/ssh-known_hosts.txt to be partially managed by Ansible, so
custom entries can be added to the top of the file. Use the new format
to write down the host keys of our two borg hosts.

grafana: Update Loki dashboard

See merge request !357

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

https://github.com/jenkins-x-charts/grafana-dashboard/pull/5
Kristian Klausen (2):
      loki: Use rate() for both loki_distributor_ingester_{appends,failure}_total
      loki: Fix panel title not starting with a capital letter

aurweb: serve assets from nginx and cache properly

See merge request !538

Jelle van der Waa authored 3 years ago and Jelle van der Waa committed 3 years ago

Make nginx serve static assets to offload gunicorn as for example
loading the home page is making 7 static requests out of 8 requests in
total. Set caching headers for now for 7 days, so browsers don't request
ideally this would be 30 days but let's keep it 7 days for now.

doc: clean up the markdown formatting

See merge request !504

tf/keycloak: Create staff group for "Project Maintainers"

See merge request !535

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

We are onboarding "Project Maintainers" now[1].

[1] https://lists.archlinux.org/private/staff/2022-February/000881.html

Document mail forwarding in the offboard template

See merge request !506

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

We are usually setting up forwarding when offboarding, so it should be
documented, also we shouldn't keep the forwards around forever.

[1] https://gitlab.archlinux.org/archlinux/btw

We don't have any state for dashboards.archlinux.org we want to persist,
so to avoid any stale data in the database, start with a new empty
in-memory database every time Grafana starts.

It has been on dashboards.archlinux.org for a few weeks.

We are running short on storage and don't really need 3 months of log,
so reduce it to 2 months instead of expanding the disk.

commit 100dbb8781d780d35ad0569222bcda3ef85bbe0a upstream.

archusers: Make foxboron a dev

Closes #440

See merge request !534

After the promotion of foxboron to dev, we have changed his role on archusers
and ran the playbook against the machines.

Without this fix all the Prometheus dashboards failed loading data with:
"Error updating options: origin not allowed".

[1] https://github.com/grafana/grafana/issues/45117#issuecomment-1033842787

See merge request !532

Kevin Morris authored 3 years ago and Evangelos Foutras committed 3 years ago

[foutrelis: add vault variables described in !532]

Signed-off-by: Kevin Morris <kevr@0cost.org>
Signed-off-by: Evangelos Foutras <evangelos@foutrelis.com>

No need to duplicate the logs from /srv/gitlab/logs/.

hardening: use default ptrace scope on buildservers

Closes #424

See merge request !533

Making 'kernel.yama.ptrace_scope' more strict by setting it to '2'
causes failures in elfutils' test suite. While tentatively helpful
on other servers, it seems kind of unnecessary for a build server.

Fixes: #424 (to be reopened though, if more restrictions are found)

It previously used mountpoint="/rootfs" which didn't match any mounts.

Also fix HostOutOfInodes and tweak HostDiskWillFillIn24Hours slightly.