The PoC has concluded.

This reverts commit 37fb120a (Provision server for buildbot POC, 2022-05-12).

To my knowledge they were never used and the new buildbtw[1] project is
following another path.

[1] https://gitlab.archlinux.org/archlinux/buildbtw

This reverts commit 3a555a1a (Provision workers (servers) for the buildbot POC, 2024-01-19).

As per my announcement to arch-devops[1] and staff, this adds a Mumble
server for Arch Linux.

The password for the special root user SuperAdmin is automatically
generated on first launch and printed to the logs. I went ahead and
added it to the vault. It should not usually be required to login as
SuperAdmin though as long as there are user admins around.

This uses certbot for local certificates.

[1] https://lists.archlinux.org/archives/list/arch-devops@lists.archlinux.org/thread/AHAOSTGFJTLQDSXLWFORDKGR6RDVHYEI/

It never gained traction and it has been dormant for over three years.

[1] https://gitlab.archlinux.org/archlinux/reproducible-archlinux-notes

It failed to reboot during the last upgrade procedure. Upon logging into
the Equinix Metal console, we discovered that we lack access to all 4 of
the servers sponsored by Equinix Metal. They are under the CNCF account,
and it's not possible to transfer them to our organization.

Equinix Metal is being sunset, and the remaining 3 servers will also go
away on June 30th 2026. We can keep them until then, or until they fail
to boot like seoul.mirror.pkgbuild.com.

alpm-buildinfo and alpm-types have been consolidated into the alpm
project[1], for which GitLab Pages was recently configured[2][3].

Requested by @dvzrv.

[1] https://gitlab.archlinux.org/archlinux/alpm/alpm
[2] archlinux/alpm/alpm#32
[3] 3d54b56c ("Add GitLab Pages for alpm")

Requested by Orhun[1].

[1] archlinux/alpm/alpm!9

pacman/curl does not utilize HTTP/3, but it makes sense to enable
regardless to ensure consistency.

We self-host the authoritative nameservers for the geo domains, so the
configuration has been tweaked to add the HTTPS DNS record for each geo
domain.

Ref #606

This should have been added in the HTTP/3 commits[2][3], but it was my
understanding that it was not supported by Hetzner DNS. It apparently is
supported but not documented.

Cloudflare has a blog post[4] explaining how this speeds up HTTP/3
negotiation. Basically, the clients can connect over HTTP/3 right away,
rather than having to connect with an older protocol (probably HTTP/2 in
our case) and then upgrade to HTTP/3 (based on the Alt-Svc header).

Our domains are HSTS preloaded[1], so it would not speed up HTTPS
negotiation in most cases.

[1] https://datatracker.ietf.org/doc/html/rfc9460
[2] 8dfa7e8c ("nginx: Add plumbing for enabling HTTP/3 conditionally")
[3] 28e0f03c ("Enable HTTP/3 for {,aur.,wiki.}archlinux.org")
[4] https://blog.cloudflare.com/speeding-up-https-and-http-3-negotiation-with-dns
[5] https://hstspreload.org/

Ref #606

pkgbuild_org_a    -> pkgbuild_com_a
pkgbuild_org_aaaa -> pkgbuild_com_aaaa

CPX51 is a bit expensive (€54.4/mo) and based on performance monitoring
the CX52 should accomplish the same job at a much lower cost (€31.9/mo).

Starting September 2024 the lower pricing on our grandfathered CX11
cloud server will go away. Thus, the price will be the same as CX22.

CX11  -> CX22: Same price and better specs!
CX21  -> CX22: Cheaper price and same specs!
CX31  -> CX32: Cheaper price and better specs!
CPX11 -> CX22: Same price and similar spec! (for consistency)
CPX21 -> CX32: Cheaper price and better specs!
CPX41 -> CX42: Cheaper price and similar specs!

Some of the CX11 servers are not rescaled as they are on older, cheaper
grandfathered plans.

[1] https://www.hetzner.com/news/new-cx-plans/

See https://lists.archlinux.org/archives/list/arch-mirrors@lists.archlinux.org/thread/TZJGUW52AHGUNCK6DHUAJFX7OLN6VQXW/ for more details.

Related to #531



Co-authored-by: Kristian Klausen <kristian@klausen.dk>
Signed-off-by: Christian Heusel <christian@heusel.eu>

The server was created on 2023-05-27 with tf and announced the next
day[1]. It is becoming annoying to keep a unstaged change around, so new
tf changes can be deployed, so let's just commit the change.

[1] #257 (comment 96721)

Requested by Allan on IRC (-devops).

New server; same CPU and RAM as previous one, hopefully more stable.

As announced[2][3] the bugtracker has been migrated to gitlab, so
bugs.a.o can be decommissioned and replaced with a static copy[1](to
avoid link rot).

[1] https://gitlab.archlinux.org/archlinux/bugs-archive/
[2] https://archlinux.org/news/bugtracker-migration-to-gitlab-completed/
[3] https://lists.archlinux.org/hyperkitty/list/arch-dev-public@lists.archlinux.org/thread/WYXDTJ3TR2DWRQCDZK44BQDH67IDVGTS/

Fix #550
Fix #551

Requested by @anthraxx 

The servers have been configured with the common and firewalld roles.

It was not supposed to go in the commit and it will be added at later
date, when it is ready(ish).

Fixes: 122eb202 ("Add dedicated Fastly billing account")

I don't expect more GitHub Pages to be set up, so using a explict
resource instead of abstracting it, is fine I think.

[1] https://github.com/archlinux/archinstall/issues/2098

The role has been renamed[1], so rename the bylaw subdomain.

tu-bylaws.aur.a.o will be kept around for some time redirecting to
package-maintainer-bylaws.aur.a.o.

[1] rfcs!7

Ref #533

The VMs created in the Hetzner cloud sandbox project must be accessible
with a DNS name. This creates a dedicated DNS zone for this purpose.

For now this zone will only be used by the aurweb project, so it can
create DNS records for the VMs it creates. This is needed so the dynamic
created environment can be accessed over HTTPS.

[1] https://docs.gitlab.com/ee/ci/review_apps/

Bugbuddy is the upcoming tool for assigning package bugs to the proper
folks. The bugbuddy role will be created at a later date when the tool
is ready.

We are not sure where this CNAME was originally used. DNS records were
transferred to Terraform sometime in 2020 so we lack history for them.

[1] archlinux/alpm/alpm-types#36

Until we get our situation with uptimerobot fixed, we are redirecting
status.archlinux.org to the standard uptimerobot URL, that is provided
with their free plan. Once/if we re-gain our premium access, we can
simply revert this MR.

Initial setup bootstrapped from arch-boxes repo [1], default user 'arch'
removed after.

https://gitlab.archlinux.org/archlinux/arch-boxes/-/jobs/157024/artifacts/browse/output



Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

With rsync.sandbox being gone from archlinux_org_cname, the indentation
needs to be adjusted.

This has moved to production.

GitLab is configured to use OpenSearch from its admin panel[2].

[1] https://docs.gitlab.com/ee/user/search/advanced_search.html
[2] https://docs.gitlab.com/ee/integration/advanced_search/elasticsearch.html#enable-advanced-search

Fix #159

New feature by Hetzner, primary IPs are a way to manage addresses
assigned to each cloud server. This allows having IPv6-only boxes.

Newer = better.

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

It looks more professional and we can move it to a dedicated box if the
load increases.

Chonky packages are chonky. The extra 25G should last us 6-12 months.

Enabling debug packages by default has resulted in more debug packages.

Nobody could have foreseen this.