Add new mirrors in Seoul and Sydney

See merge request !602

Also tweak the documentation on rebuilderd workers and add runner1.

We do not really want to make all mirrors run mirrorcheck, so make it
conditional based on whether archweb_mirrorcheck_locations is defined.

The sshd role needs to open a firewall hole and will fail if firewalld
isn't present. Also place the wireguard role right after firewall role
because it is needed by promtail further down.

The upstream `sample_config.yaml` is now minimal, so we cannot diff with
it anymore.

archwiki: LocalSettings.php: give registered users the 'writeapi' right

See merge request !601

Adding/removing pages from the whitelist when using the Vector skin requires the write API now.
Without this, regular users get this error:

    You're not allowed to edit this wiki through the API.

archwiki: upgrade to 1.38.1-1

See merge request !598

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

- $wgScriptExtension was removed in MW 1.31
- $wgDBmysql5 was removed in MW 1.33
- $wgShowIPinHeader was removed in MW 1.27
- $wgUseETag was removed in MW 1.28
- $wgEnableWriteAPI was removed in MW 1.32
- $wgShowSQLErrors was removed in MW 1.37

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

$wgFragmentMode = [ 'html5', 'legacy' ]; is the default value since
MediaWiki 1.37:
https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:$wgFragmentMode

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

These were fixed in MediaWiki 1.38

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

Also updated some settings:

- The $wgShellLocale setting was removed from MediaWiki, see
  https://www.mediawiki.org/wiki/Special:MyLanguage/MediaWiki_1.38
- The "new" Vector skin got a name "vector-2022" and can be set simply
  by $wgDefaultSkin = 'vector-2022'; see
  https://www.mediawiki.org/wiki/Skin:Vector/2022#Note_about_1.38_release

archweb: use a whitelist for files in /iso/

See merge request !595

Allow only .sig, .torrent and .txt.

This is done to prevent downloading files such as https://archlinux.org/iso/latest/arch/boot/x86_64/vmlinuz-linux.

Add kpcyrd to multilib group

See merge request !600

install_arch: use versionless bootstrap tarball

See merge request !596

Since release 2022.07.01, there is a versionless bootstrap tarball file (archlinux-bootstrap-x86_64.tar.gz). See https://github.com/pierres/archiso-manager/pull/12.

"latest" is a valid version, so there is no need to check for the exact version number anymore.

archwiki: disable Lockdown extension

See merge request !597

This restores public access to recent changes, page history etc. which
was disabled in September 2019 due to misbehaving crawlers - see commits
https://github.com/archlinux/archwiki/commit/f2c518d3df94e9ad6898fdd03cac982902f8ac36
and https://github.com/archlinux/archwiki/commit/8595e8d66141e608db794f1deef3e52cb36e5e78.

Let's hope that our robots.txt has been improved since then and the
server load will not increase much. If it proves to be still a problem,
this commit can be reverted and we will figure out better solution.

Add new domain for project documentation (archlinux.page)

See merge request archlinux/infrastructure!594

Ref: archlinux/monthly-reports!1

Ref: archlinux/repod!65

We want non-DevOps to be able to deploy project documentation (ex:
repod) with GitLab Pages and a separate domain was considered the only
sensible solution due to security issues[1].

[1] https://github.blog/2013-04-09-yummy-cookies-across-domains/

- IPMI credentials for luna.archlinux.org
- Entry with no credentials for PIA boxes

Give artafinde access to the mailman servers

See merge request !593

artafinde wants to help with the mailman3 migration[1], so give him
access to the mailman servers.

[1] archlinux/infrastructure#59

Add Gandi account

See merge request !589

We want to deploy project documentation (ex: repod) with GitLab Pages
and due to security concerns[1], they should be deployed on a separate
domain.

Hetzner's Registration Robot[2] only supports a few TLDs and all the
good names have already been taken, and therefore we need a new domain
registrar. SPI has a partnership with Gandi, so Gandi it is.

[1] https://www.hetzner.com/registrationrobot
[2] https://github.blog/2013-04-09-yummy-cookies-across-domains/

This box somehow gets a compression ratio of over 12; bump its zram
fraction accordingly, to stop getting alerts about high swap usage.

borg_client: drop Restart=on-failure from services

See merge request !592

When a backup job fails it is usually something we want to look into and
understand its root cause before restarting the backup job. Therefore we
need to disable the restart-on-failure behavior we had previously set up.

prometheus: split crt.sh lookups into new script

See merge request !591