The gluebuddy client is required for gluebuddy to retrieve users and
groups membership without being able to change other keycloak data. The
realm-management roles cannot be assigned yet via keycloak as it does
not know about the roles and realm-management client.

sync sshd and grafana configs

See merge request !514

Django security update

tasks: stop arch-svntogit.timer before rebooting

See merge request !520

In a recent execution of the server upgrade task, svntogit was started
shortly before the reboot command was issued. Therefore, it was killed
two seconds into its run, leaving behind a lock file that prevented it
from starting again after gemini was rebooted.

Avoid the above timing issue by stopping the timer before rebooting.

Run a self test every day at 02:00/03:00 and a long tests every
saturday.

Collects the smart data using smartctl and outputs them in the
textcollector dir. This expects smartd to be configured to regularly
self tests on a regular interval to detect if a disk is broken.

tasks: skip reboot when borg-backup{,-offsite} is running

See merge request !518

archwiki: Update to 1.37.1-4

See merge request !517

Without this change, search suggestions don't work.

[1] https://phabricator.wikimedia.org/T288686

Issue: #442

The firefox diffoscope output requires unzip for making the diff
readable.

The gitlab logs are enormous, spammy and are half a terabyte per month.

The `https://archlinux.org/.well-known/matrix/server` response is used
over the SRV record in all cases. We haven't been listening on 8448
since e9e4c114 (June 2019).

dbscripts: Create debug repository directories

See merge request !513

Node's address lookup strips the scope ID from link-local IPv6
addresses, making them invalid and unable to be connected to.

We're getting hit with this since Node 17 because it now defaults to the
`verbatim` dns-result-order and this happens to return the link-local
IPv6 address for `matrix.archlinux.org` first.

Specify `ipv4first` so we return to Node 16's behavior.

We sadly run all that stuff in docker now.