Move backup-related variable defaults from the database roles into the
borg_client role. Also check group membership to guard installation of
database backup helper scripts.

Fixes: 26f289b7 ("Capitalize the first letter of all task names")

ansible-lint 6.5.0 complains about:

  name: All names should start with an
        uppercase letter. (name[casing])

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

We used to set query_cache_type to 0 in the default settings but we were
also setting query_cache_size to a non-zero/non-default value, which was
in turn re-enabling the query cache. Update the configuration to reflect
the actual cache state and make sure query_cache_size is set to zero for
the "query_cache_type = 0" case.

Now that the setting controls the real state of the query cache, disable
it for bbs.archlinux.org; its hit rate is small compared to insert rate.

Default query_cache_type to 0 and innodb_file_per_table to true.

yaml: truthy value should be one of [false, true] (truthy)
yaml: wrong indentation: expected 4 but found 2 (indentation)
yaml: too few spaces before comment (comments)
yaml: missing starting space in comment (comments)
yaml: too many blank lines (1 > 0) (empty-lines)
yaml: too many spaces after colon (colons)
yaml: comment not indented like content (comments-indentation)
yaml: no new line character at the end of file (new-line-at-end-of-file)
load-failure: Failed to load or parse file
parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.

Zabbix has been replaced by Prometheus for monitoring our services.

The prometheus-mysqld-exporter connects over localhost to collect
stats, so networking has to be enabled. mariadb's default is to serve on
0.0.0.0, so change the configuration to serve on localhost.

Jakub Klinkovský authored 4 years ago and Jelle van der Waa committed 4 years ago

The upstream default value is 2000 since 10.1.7:
https://mariadb.com/kb/en/server-system-variables/#table_open_cache

See also commit f164d000

The previous task creating the "zabbix_agent" user in the database stays
here as it actually needs the mariadb role. But note that it uses a
hardcoded name "zabbix_agent" for setting the password. The zabbix_agent
uses a different variable ("{{zabbix_agent_mysql_password}}") in the
my.cnf.j2 template, but I don't see where the variable is defined...

Upstream mariadb has with a default server much higher defaults and our
servers have plenty of ram to spare as well.

We always run mariadb on the host where the service is located which
requires a mariadb database.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Remvoed in mariadb 10.3.0

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This is used by ansible to run mysql queries, e.g. when adding users.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The discovery script now uses a regex and no longer cares where exactly
accounting is enabled. Follow systemd upstream by enabling it by
default.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Disable firewall because python2 module is not avaible and the tasks
fail which makes the playbooks fail and leads to handlers not being run.

https://github.com/ansible/ansible/issues/24855



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

We don't use it so it doesn't need to listen.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The defaults for max_allowed_packet (1M) and innodb_log_file_size (5) are too small for doing larger imports.
Increase the max_allowed_packet to 16M and innodb_log_file_size to 64M.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

If the service is started before the config is copied, we can't recover
from a typo in the config file because maraidb will refused to start. At
least not without manually fixing that typo. This way the typo can be
fixed in ansible and then deployed normally.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>