install_arch: use versionless bootstrap tarball

See merge request archlinux/infrastructure!596

Since release 2022.07.01, there is a versionless bootstrap tarball file (archlinux-bootstrap-x86_64.tar.gz). See https://github.com/pierres/archiso-manager/pull/12.

"latest" is a valid version, so there is no need to check for the exact version number anymore.

archwiki: disable Lockdown extension

See merge request !597

This restores public access to recent changes, page history etc. which
was disabled in September 2019 due to misbehaving crawlers - see commits
https://github.com/archlinux/archwiki/commit/f2c518d3df94e9ad6898fdd03cac982902f8ac36
and https://github.com/archlinux/archwiki/commit/8595e8d66141e608db794f1deef3e52cb36e5e78.

Let's hope that our robots.txt has been improved since then and the
server load will not increase much. If it proves to be still a problem,
this commit can be reverted and we will figure out better solution.

Add new domain for project documentation (archlinux.page)

See merge request !594

Ref: archlinux/monthly-reports!1

Ref: repod!65

We want non-DevOps to be able to deploy project documentation (ex:
repod) with GitLab Pages and a separate domain was considered the only
sensible solution due to security issues[1].

[1] https://github.blog/2013-04-09-yummy-cookies-across-domains/

- IPMI credentials for luna.archlinux.org
- Entry with no credentials for PIA boxes

Give artafinde access to the mailman servers

See merge request !593

artafinde wants to help with the mailman3 migration[1], so give him
access to the mailman servers.

[1] archlinux/infrastructure#59

Add Gandi account

See merge request !589

We want to deploy project documentation (ex: repod) with GitLab Pages
and due to security concerns[1], they should be deployed on a separate
domain.

Hetzner's Registration Robot[2] only supports a few TLDs and all the
good names have already been taken, and therefore we need a new domain
registrar. SPI has a partnership with Gandi, so Gandi it is.

[1] https://www.hetzner.com/registrationrobot
[2] https://github.blog/2013-04-09-yummy-cookies-across-domains/

This box somehow gets a compression ratio of over 12; bump its zram
fraction accordingly, to stop getting alerts about high swap usage.

borg_client: drop Restart=on-failure from services

See merge request !592

When a backup job fails it is usually something we want to look into and
understand its root cause before restarting the backup job. Therefore we
need to disable the restart-on-failure behavior we had previously set up.

prometheus: split crt.sh lookups into new script

See merge request !591

roles/prometheus/defaults/main.yml used to include a comment with the
commands used to generate a list of HTTPS endpoints to check. Move it
into a proper script and fix it to generate the correct current list.

Add top 15 prometheus metrics for gitlab exporter

See merge request !590

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Ref #456

/usr/lib/systemd/system is for vendor-provided service unit files.

/tmp free space is generally limited on these smaller virtual servers,
so use /var/tmp which is more spacious. debuginfod uses this to cache
recently extracted files from archives.

debuginfod.archlinux.org runs into high swap often, but also gets good
compression ratio; try upping the zram size to 100% of RAM (from 50%).

We don't want our users tracked by a third party.

Extend the removal of the dashes from unencrypted YAML documents to
encrypted ones as well.

Fixes: a9e0790f ("Remove the three dashes from all YAML documents")

ansible-lint 6.3.0 throws an error about this.

Remove the three dashes from all YAML documents

See merge request !586

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

There is no need to run all playbooks for this.

loki: pull changes made to loki.yml on live

See merge request !585

The cloud server running Loki isn't powerful enough to do aggressive
query splitting; it makes queries execute slower and generates a lot
more queries, resulting in "too many outstanding requests" in recent
Loki versions. (Maybe a bug?)

The default log level is "info" which logs too much to the journal.

Since upgrading to Loki 2.5, the query frontend was trying to connect to
the wireguard address instead of 127.0.0.1. This appears to be caused by
upstream commit c0bec07e0de1a23cb72e8834069 ("Loki: Implement common net
interface/instance addr") which now defaults to "" instead of 127.0.0.1.

Doubt the Loki team is interested in our usage data, and it's also a
risk to the confidentiality of our logs (even though it's anonymous).

< wCPO> foutrelis: v12 fixes the "all chunks in the same directory"-issue