Restart failed backups (fixes #270)

Closes #270

See merge request archlinux/infrastructure!288

The reason is that we might want to independently retry the offsite backup in case it fails but not rerun the primary backup in that case.
This isn't possible with the current setup and so we'll have to split this up into two oneshot services.
The way it works is that borg-backup.service will schedule borg-backup-offsite.service to run after it which ensures that
no two backups are running at the same time and also that they can be indendently retried if one of them fails.

Add a btrfs prometheus exporter

See merge request archlinux/infrastructure!282

Collect prometheus btrfs errors from the btrfs command from btrfs-progs
which since 5.10 supports json output for device stats. The collected
errors will in the future trigger an alert when the errors reach a
certain treshold.

Add my build host key to build.archlinux.org

See merge request archlinux/infrastructure!286

Document how to add a new mirror

See merge request archlinux/infrastructure!283

Add build.archlinux.org

See merge request archlinux/infrastructure!285

To allow packagers to test their changes in the testing repos, enable
them for rebuilderd.

Make Kape archive mirror, also regular mirrors.

Closes #231

See merge request !284

To reduce bandwidth on mirror.pkgbuild.com.

Closes: #231

Setup monitoring of SMTP, SMTP Submission(s), IMAPS and POP3S

See merge request !206

dovecot: Only enable needed sieve extensions

See merge request !257

Kristian Klausen authored 4 years ago and Frederik Schwan committed 4 years ago

The enotify extension can be used to send mails as other users, so let's
only enabled the sieve extensions, which we need.
The extensions was found by running `grep require` on the existing sieve
user scripts. mailbox wasn't in that list, but it is used by the global
spam-to-folder.sieve script.

Configure mediawiki's security headers

See merge request !278

Mediawiki allows the configuration of Referrer policy, which is set to
the same value as archlinux.org, retaining the referrer for https://
links as they might be beneficial as promotion. Set the X-Frame-Options
header to deny framing.

improve terraform handling of virtual machine domains

See merge request !280

machine.domain has been an mandatory attribute which creates
<domain>.archlinux.org entries automagically. For migrations this can be
a problem if <domain>.archlinux.org supposed to point to a different
machine. Adding the new machine with the same domain leads to additional
DNS entries. The DNS ends up pointing to both machines in this case.
By making the domain attribute optional for machines, we allow the new
machines to be created without any domain pointing to them.

Monitor man.archlinux.org

See merge request !281

Merge sogrep (createlinks script) into dbscripts

See merge request !279

Databases used by sogrep are fetched by syncrepo from gemini, no point
in duplicating this work; consider this to be part of roles/dbscripts.

Deploy archmanweb v1.1

See merge request !277

GitLab becomes unhappy if it can't poll localhost.

This host is special and only allows demize to login as user to
administer phrik and no other users/groups should be created on the
machine.

This reverts commit 750c2f6f.

For unknown reasons we basically allowed phrik to allow arbitrary sudo
commands which isn't great as phrik is an irc bot.

Offboard Aaaron

Closes #133

See merge request !276

Closes: #133

tf-stage1/archlinux: Remove unneeded quotation marks from ed25519 domainkey

See merge request !272