sq verify --signer-cert now expects a fingerprint/key ID.

Sequoia now manages the trust level, so we need to add the fingerprints
and mark those keys trusted before verifying the file.

Add artafinde to dev and multilib groups

See merge request !699

offboaring checklist: add move from active to fellow

See merge request !688

Offboard allan from dev and tu

See merge request !684

https://lists.archlinux.org/archives/list/staff@lists.archlinux.org/message/EFXA72JZ32OFYJ2LSHPOXB2CKHTCHGXQ/



Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Closes: #499

See merge request !702

Seems with keycloak-metrics-spi 3.0.0 all metric names end in _total.

This reverts commit 903129d4

With the release of keycloak-metrics-spi 3.0.0 they added support
for Keycloak > 21.x [1]

[1]: https://github.com/aerogear/keycloak-metrics-spi/pull/157



Resolve: #499

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Onboard torxed as TU

See merge request !701

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

networking: use Quad9 DNS on static network boxes

See merge request !698

Evangelos Foutras authored 1 year ago and Evangelos Foutras committed 1 year ago

Might fix the intermittent "Name or service not known" errors on gemini.

security_tracker: rate limit RSS feeds

See merge request !700

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

group_vars/all/archusers.yml:
Promote artafinde to `dev`.
https://lists.archlinux.org/archives/list/arch-dev@lists.archlinux.org/message/AMAN62A2UERSNWO73G5Y5FRVWBIJNETL/
Also add to `multilib` group (for good measure).

gitlab_runner: Set reasonable NOFILE limits to avoid bugs

See merge request !693

The default limits cause issues as reported upstream[1][2], it also
breaks the mkinitcpio CI[3]. So match the limits set in systemd since
v240[4].

[1] https://github.com/moby/moby/issues/38814
[2] https://github.com/containerd/containerd/pull/7566
[3] archlinux/mkinitcpio/mkinitcpio@da223d2f
[4] https://github.com/systemd/systemd/blob/4f44d2c4f76922a4f48dd4473e6abaca40d7e555/NEWS#L6556-L6590

Move GitLab's container registry to a dedicated domain (registry.al.org)

See merge request !697

It looks more professional and we can move it to a dedicated box if the
load increases.

This syncs the lock file with the latest change where we switched the
provider for uptimerobot

terraform: update stage2 provider version declaration

See merge request !696

Levente Polyak authored 1 year ago and Levente Polyak committed 1 year ago

In commit d31f8404 we changed the
terraform provider for uptimerobot. Reflect this change in the terraform
lock file and provider version declaration.

terraform: fix package maintainer team groups

See merge request !695

Levente Polyak authored 1 year ago and Levente Polyak committed 1 year ago

Previously we have declared explicit resources for the roles under the
root. This lead to the desired groups getting created twice, once via
toSet of the package maintainer team and once per resource under the
root.

Furthermore remove the package maintainer roles, currently we do not
need any roles to define permissions. We can simply use the groups to
easily assign users into. Those group assignments can be queries for
example by gluebuddy to act upon or queried by a saml client.

Fixes 941563f2

terraform: add junior packager groups and roles for core/extra

See merge request !674

Leonidas Spyropoulos authored 2 years ago and Levente Polyak committed 1 year ago

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Add "noqa no-changed-when" tags to handlers using the command module.
Perhaps it is wrong of ansible-lint to flag these, since handlers are
not the best place to have conditional execution.

[1] https://github.com/keycloak/keycloak/pull/15746

Fix #501