A new editor was introduced in the most recent mediawiki update which
comes with images from a new extension location

Fix deploying archweb on gemini

Monitor borg repo sizes

See merge request !431

gitlab-backup: Set GZIP_RSYNCABLE=yes so borg can dedup

See merge request !429

gitlab-backup produces gzipped tarballs that cannot be meaningfully
deduplicated by borg.  This can be mitigated by passing --rsyncable
to gzip.

The above is verified by creating two new borg repositories, adding
the two most recent gitlab.archlinux.org archives to both, with the
difference of re-compressing the tarballs with `gzip -1 --rsyncable`
before adding them to the second repository.

In the first case, the 215.97 GB backup archive gets compressed and
deduplicated down to 176.24 GB. With --rsyncable it gets reduced to
just 12.79 GB. These numbers are for /srv/gitlab/data/backups only,
but the other non-tarballed files get sufficiently deduped already.

Based on the above, I am hoping to see the borg repository for gitlab
shrink over time from the current 3 TB to around 600 GB which is more
manageable.

Loki is using a lot of storage (~8GB per week).

gitlab-pages uses the API source by default now[2] but DNS resolution is
broken[3] so we need to use the disk config source.
Reported upstream here[4].

[1] https://docs.gitlab.com/ee/administration/pages/#gitlab-pages-doesnt-work-after-upgrading-to-gitlab-140-or-above
[2] https://gitlab.com/gitlab-org/gitlab-pages/-/commit/9a30f40a785ffe586a79a75ebebabda5f513b76f
[3] https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/4243
[4] https://gitlab.com/gitlab-org/gitlab/-/issues/331699#note_608473496

Keycloak doesn't support Java 16 (yet)[1].

[1] https://issues.redhat.com/browse/KEYCLOAK-18307

flyspray: Add redirect for archlinux-keyring migrated tasks[1]

Closes #320

See merge request !419

[1] archlinux/archlinux-keyring#9

To be used as we begin migrating Flyspray tasks to GitLab.

Fix #320

aurweb: Use a different db password for aur and aur-dev

Closes #325

See merge request !420

Fix #325

Add webhook when creating read-only GH mirrors which closes PRs

Closes #80

See merge request !423

Fix #80

Create a redirect for the CoC

Closes #354

See merge request !421

Fix #354

keycloak: Re-sync with version 13.0.0 changes

See merge request !374

Leonidas Spyropoulos authored 3 years ago and Jelle van der Waa committed 3 years ago

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Update archmanweb to v1.2

See merge request !426

Jakub Klinkovský authored 3 years ago and Kristian Klausen committed 3 years ago

Co-authored-by: Kristian Klausen <kristian@klausen.dk>

fail2ban: Add nginx_limit_req to all dicts

See merge request !422

Ansible complains if the fail2ban_jails dictionary is missing the
nginx_limit_req key. Adding this as default failse.

Bugfix from: e5773374

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

gitlab_runner: Check runner configuration into git

Closes #193

See merge request !417

Fix #193

gitlab_runner: Add service to cleanup docker artifacts produced by the runner

See merge request !387

Fix spoofable X-Forwarded-For header for some proxied services

Closes #292

See merge request !416

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

X-Forwarded-For is defined as X-Forwarded-For: <client>, <proxy1>,
<proxy2>, and it was set to $proxy_add_x_forwarded_for which is
basically $http_x_forwarded_for,$remote_addr and headers from the client
can't be trusted!

Fix #292