This box somehow gets a compression ratio of over 12; bump its zram
fraction accordingly, to stop getting alerts about high swap usage.

borg_client: drop Restart=on-failure from services

See merge request !592

When a backup job fails it is usually something we want to look into and
understand its root cause before restarting the backup job. Therefore we
need to disable the restart-on-failure behavior we had previously set up.

prometheus: split crt.sh lookups into new script

See merge request !591

roles/prometheus/defaults/main.yml used to include a comment with the
commands used to generate a list of HTTPS endpoints to check. Move it
into a proper script and fix it to generate the correct current list.

Add top 15 prometheus metrics for gitlab exporter

See merge request !590

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Ref #456

/usr/lib/systemd/system is for vendor-provided service unit files.

/tmp free space is generally limited on these smaller virtual servers,
so use /var/tmp which is more spacious. debuginfod uses this to cache
recently extracted files from archives.

debuginfod.archlinux.org runs into high swap often, but also gets good
compression ratio; try upping the zram size to 100% of RAM (from 50%).

We don't want our users tracked by a third party.

Extend the removal of the dashes from unencrypted YAML documents to
encrypted ones as well.

Fixes: a9e0790f ("Remove the three dashes from all YAML documents")

ansible-lint 6.3.0 throws an error about this.

Remove the three dashes from all YAML documents

See merge request !586

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

There is no need to run all playbooks for this.

loki: pull changes made to loki.yml on live

See merge request !585

The cloud server running Loki isn't powerful enough to do aggressive
query splitting; it makes queries execute slower and generates a lot
more queries, resulting in "too many outstanding requests" in recent
Loki versions. (Maybe a bug?)

The default log level is "info" which logs too much to the journal.

Since upgrading to Loki 2.5, the query frontend was trying to connect to
the wireguard address instead of 127.0.0.1. This appears to be caused by
upstream commit c0bec07e0de1a23cb72e8834069 ("Loki: Implement common net
interface/instance addr") which now defaults to "" instead of 127.0.0.1.

Doubt the Loki team is interested in our usage data, and it's also a
risk to the confidentiality of our logs (even though it's anonymous).

< wCPO> foutrelis: v12 fixes the "all chunks in the same directory"-issue

One month of logs is about 40G and suffices for our log retrieval needs.

Other than avoiding the conditional logic there's no reason to specify
/srv/ftp/pool/{packages,community} as additional cache directories for
all servers.

Restoring the default CacheDir value on machines without a local mirror
allows us to use pacdiff to perform a three-way merge of the few config
files which are easier to rebase this way.

Nothing fancy, just something to prevent automated form submissions.

archwiki: merge LocalSettings.archlinux.org.php from the archwiki git repo into LocalSettings.php.j2

See merge request !516

archwiki: merge LocalSettings.archlinux.org.php from the archwiki git repo into LocalSettings.php.j2

Merge https://github.com/lahwaacz/archlinux-mediawiki/blob/cache/LocalSettings.archlinux.org.php.
There is no need to separate these files since LocalSettings.archlinux.org.php is only used by ArchWiki.
Keeping it all in one file provides a clearer view of what options are actually set.

Related to https://github.com/archlinux/archwiki/pull/31.

asia.mirror.pkgbuild.com has been offline for 12 days so far while we
wait for a NIC replacement. Should have taken it out of DNS NS duties
earlier but better late than never.

It needs the extra RAM.

Vagrant Cloud has been used for years by arch-boxes[1] for publishing
Vagrant boxes. Access to the organization[2] was handed out to a few
members of the DevOps team and the creator of the organization
(arch-boxes maintainer at the time).

With this commit the control of the organization is handed over to the
DevOps team through a new Vagrant Cloud account.

[1] https://gitlab.archlinux.org/archlinux/arch-boxes
[2] https://app.vagrantup.com/archlinux/

Fixes: 9294828f ("Setup mailman3 server")

Tweaking access to the abuse filter[1].

[1] https://github.com/archlinux/archwiki/pull/52

LocalSettings: allow only sysops and cosysops to view public abuse filters and logs