The archweb_version was on apollo's host_vars. This was removed in
favour of it being on the defaults for the role. Also, a new var
was introduced to configure the repository used for archweb.

Seems unnecessary to run these on machines that only deploy mirrorcheck

Signed-off-by: Florian Pritz <bluewind@xinu.at>

gcc is required by virtualenv to compile some third party modules.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

To correctly be safe for CVE-2016-1247, we need all nginx log dirs
to be owned by both user and group root. Also, since nginx childs
runs as http user, the directories permissions must be 0755, so the
http user can descent into it. Since the logrotate will create the
log files as http:log, the nginx childs will be able to write to the
logs, but will not be able to create files inside those dirs, fully
preventing CVE-2016-1247.

CVE-2016-1247 is a symlink attack on the log dir of nginx since a
reopening of the logs (triggered by logrotate) opens the logs as nginx
instead of root. logrotate creates the proper log files already so
nginx doesn't need write permissions to those directories.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

roles/nginx: Add a handler for reloading nginx and change all the roles to use it, instead of restarting nginx.

roles/archweb: Add a forced_deploy variable to trigger a deploy even when nothing seems to have changed. Also restart memcached on deploys.

roles/archweb: Added a register for virtualenv changes and to deploy archweb in this case. Also changed nginx template to use the main domain.

roles/archweb: Deploy archweb on config changes too. Also, add a check to add ssl_require mode when connecting to remote hosts.

roles/archweb: Create a pgp_import service and a pacman hook to run when archlinux-keyring is updated

roles/archweb: Memcached service.
roles/postgresql: Initial work on SSL support.

roles/archweb: Make archweb install and use it's own memcached service, running as the archweb user and using a socket.

roles/archweb: Nginx deployment, domain variable and other improvements.

I've had mode=755 create garbage already...

Signed-off-by: Florian Pritz <bluewind@xinu.at>