Fix #177

networking: Make hcloud-init.service more reliable

Closes #371

See merge request !474

Fix #371

Add simple playbook task for upgrading servers

We want to treat our servers as cattle; hopefully when this is fleshed
out a bit more, it can accomplish the job without too many casualties.

See merge request !475

This is done to avoid killing db-update and related processes.

We want to treat our servers as cattle; hopefully when this is fleshed
out a bit more, it can accomplish the job without too many casualties.

It has been applied upstream[1] and released with smartmontools 7.2[2].

[1] https://github.com/smartmontools/smartmontools/commit/61bc85ecadf9e5596b140380fed701a674e38a1b
[2] https://github.com/smartmontools/smartmontools/releases/tag/RELEASE_7_2

This reverts commit b4c97002.

Ref: service-agreements!16

We used to set query_cache_type to 0 in the default settings but we were
also setting query_cache_size to a non-zero/non-default value, which was
in turn re-enabling the query cache. Update the configuration to reflect
the actual cache state and make sure query_cache_size is set to zero for
the "query_cache_type = 0" case.

Now that the setting controls the real state of the query cache, disable
it for bbs.archlinux.org; its hit rate is small compared to insert rate.

Default query_cache_type to 0 and innodb_file_per_table to true.

borg: allow out of place calls

See merge request !435

We force delete in the signal handler as a graceful script execution
already deletes the file. This way we avoid any errors being wrongly
printed.

Signed-off-by: Levente Polyak <anthraxx@archlinux.org>

Main motivation behind this is preparing for doing more automatic
upgrades. The need for ignoring kernel updates isn't clear either.

matrix.archlinux.org: Configure static DNS via networking role

See merge request !479

Hetzner DNS has been delaying many responses for 5 seconds, causing
outgoing federation work to pile up, almost running into OOM before we
noticed.

I don't know if were being throttled because federation makes a *lot* of
requests. Anyway, using Cloudflare DNS seems to solve it.

Enable DNSOverTLS for this because we can.

I don't know why this wasn't enabled.

This one is pretty spammy with warnings that don't mean much.

Other caches around this code use 500000 entries, so just copy that.

Fix #386

Ref #388

Be more explicit about selecting allowed repos because these were missed
in previous onboardings.

These groups are no longer required as docker/arch-boxes images are
build by Gitlab.

Closes: #389

This cache was seeing constant evictions at its former size (70k).

With a size of 200k it now stabilizes at ~122k entries with a
significant drop in server load.