"Disabling revoked keys in keyring" when running "pacman-key --populate"
is very slow (easily +20 seconds), in our case the boot is now ~27
seconds faster (tested on secure-runner1). The pacman master private key
is removed to prevent malicious actors from injecting packages, a new
key is generated by pacman-init.service on boot.

[1] https://archlinux.org/news/qemu-700-changes-split-package-setup/

Changes:
- Switch to arch-boxes' base image
- Verify the base image's signature
- Use the new "latest" symlink, instead of parsing the HTML for
  finding the latest arch-boxes image[1]
- Create the base image by using arch-chroot and friends, instead of
  creating a full-blown VM
- Create the VMs from domain XML template instead of virt-clone
- Switch mirror to geo.mirror.pkgbuild.com
- Try to follow "filesystem hierarchy" standards for where to place
  configuration (id_ed25519) and "vendor data" (arch-boxes.asc and
  domain_template.xml)
- Use a ed25519 key instead of RSA key
- Only start the "update base image" server if network and DNS are up
- Misc fixes and cleanups

[1] !552

Upstream now provides a solution for setting the "staging dir" for
fastzip[1].

[1] https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/3130

For some workloads running in a container is too restrictive, ex:
arch-boxes (loop device, filesystem mount, pacstrap) and archiso
(pacstrap). Currently they both run a TCG accelerated QEMU VM, which is
very slow and painful to work with. We should provide a better option to
our users!

This adds a hardware accelerated VM for this kinds of workloads, which
is way faster and you can do whatever you like (mostly)!

Fix #283

The service hardening options have been included in geoipupdate 4.9.0-3.

[1] https://bugs.archlinux.org/task/75434

This is meant as a extra "backup" and as another way for our users to
fetch PKGBUILDs from the AUR. It also allows the community to create
their own (perhaps better) "AUR" API/database as all essential data is
now available (this + [2]).

At the monent this is experimental and we aren't committing to keeping
it around.

[1] https://github.com/archlinux/aur
[2] http://aur.archlinux.org/packages-meta-ext-v1.json.gz

This allows to retain all default hardening options that memcached@.service has.

The glibc 2.35-6 package ships with the C.UTF-8 locale included which
means there is now a usable UTF-8 locale available by default.

en_US.UTF-8 will still be generated because PostgreSQL clusters are
created with that locale. Migrating the clusters to C.UTF-8 is
possible, but that requires dumping and recreating them.

* Remove www. from archlinux.org,
* Use HTTPS for the license link,
* Update $wgGitRepositoryViewers,
* Update comments referencing paths and URLs.

After starting a new container with the latest version of GitLab, opt to
remove older docker images so they do not take up disk space needlessly.

Also tweak the documentation on rebuilderd workers and add runner1.

The upstream `sample_config.yaml` is now minimal, so we cannot diff with
it anymore.

Adding/removing pages from the whitelist when using the Vector skin requires the write API now.
Without this, regular users get this error:

    You're not allowed to edit this wiki through the API.

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

- $wgScriptExtension was removed in MW 1.31
- $wgDBmysql5 was removed in MW 1.33
- $wgShowIPinHeader was removed in MW 1.27
- $wgUseETag was removed in MW 1.28
- $wgEnableWriteAPI was removed in MW 1.32
- $wgShowSQLErrors was removed in MW 1.37

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

$wgFragmentMode = [ 'html5', 'legacy' ]; is the default value since
MediaWiki 1.37:
https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:$wgFragmentMode

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

These were fixed in MediaWiki 1.38

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

Also updated some settings:

- The $wgShellLocale setting was removed from MediaWiki, see
  https://www.mediawiki.org/wiki/Special:MyLanguage/MediaWiki_1.38
- The "new" Vector skin got a name "vector-2022" and can be set simply
  by $wgDefaultSkin = 'vector-2022'; see
  https://www.mediawiki.org/wiki/Skin:Vector/2022#Note_about_1.38_release

Allow only .sig, .torrent and .txt.

This is done to prevent downloading files such as https://archlinux.org/iso/latest/arch/boot/x86_64/vmlinuz-linux.

Since release 2022.07.01, there is a versionless bootstrap tarball file (archlinux-bootstrap-x86_64.tar.gz). See https://github.com/pierres/archiso-manager/pull/12.

"latest" is a valid version, so there is no need to check for the exact version number anymore.

This restores public access to recent changes, page history etc. which
was disabled in September 2019 due to misbehaving crawlers - see commits
https://github.com/archlinux/archwiki/commit/f2c518d3df94e9ad6898fdd03cac982902f8ac36
and https://github.com/archlinux/archwiki/commit/8595e8d66141e608db794f1deef3e52cb36e5e78.

Let's hope that our robots.txt has been improved since then and the
server load will not increase much. If it proves to be still a problem,
this commit can be reverted and we will figure out better solution.

Ref: archlinux/monthly-reports!1

Ref: repod!65

We want non-DevOps to be able to deploy project documentation (ex:
repod) with GitLab Pages and a separate domain was considered the only
sensible solution due to security issues[1].

[1] https://github.blog/2013-04-09-yummy-cookies-across-domains/

When a backup job fails it is usually something we want to look into and
understand its root cause before restarting the backup job. Therefore we
need to disable the restart-on-failure behavior we had previously set up.

roles/prometheus/defaults/main.yml used to include a comment with the
commands used to generate a list of HTTPS endpoints to check. Move it
into a proper script and fix it to generate the correct current list.

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

/usr/lib/systemd/system is for vendor-provided service unit files.