Signed-off-by: Florian Pritz <bluewind@xinu.at>

Installing some services and config files doesn't really matter. What
matters is if they are enabled so only use the conditional there. The
rest is easier and less confusing if it just installs the files all the
time. Otherwise we'd need a second task that performs the other case and
then if we change something we'd also have to adjust that task. That's
unnecessarily error prone.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Harden the unit by limiting access to the system and dissallowing
privilege escalation.

sch_fq used to be required by BBR but this is no longer the case after
a fallback to internal pacing was implemented in Linux 4.13. Plus, BBR
was recently disabled on Arch's infra.

Now, we could just set the default qdisc to fq_codel for all machines,
but it seems the default for multiqueue network interfaces is sch_mq +
fq_codel sub-qdiscs (one per tx queue).

I am not sure how to cleanly implement the above multiqueue distinction
in Ansible, so drop the default_qdisc configuration. I will then adjust
affected machines manually to remove any configured qdiscs.

BBR behaves badly when it is not the sole connection. It slows down
other streams (bbr and cubic) and generally doesn't scale well when
deployed widely. Let's disable it so we don't make the internet for
others worse.

https://ripe76.ripe.net/presentations/10-2018-05-15-bbr.pdf

https://kanboard.archlinux.org/public/task/117/7dd7510424e4229247e8e0b90bf43e1553fce86cdf8475b60edc956ed5a8



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This unit has no ExecStop nor do we want a timeout for ExecStop but we
want one for ExecStart.

Our roles are switched to python3 and have to be updated to install the
python3 variant of modules to deploy the role.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Currently .all/ keeps symlinks for each package file that point to the
actual file. We also track all files in the /pacakages/ tree separated
into directories based on their pkgname. This rewrite rule matches the
.all/ URLs to the /packages/ directory tree so that we can eventually
delete the symlinks from .all/.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This text is no longer relevant since zabbix configuration is now
handled via ansible and not via the zabbix website.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Update django to 1.11.18 security release

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Context: https://lists.archlinux.org/pipermail/arch-projects/2019-January/005063.html



Signed-off-by: Florian Pritz <bluewind@xinu.at>

arch-audit -u also recommends updating to testing packages, while this
is not something we recommend or want.

Add monitoring for our PostgreSQL DB size using a similiar construct as
the MySQL DB size monitoring with a perl script.