Giancarlo Razzolini authored 4 years ago and Jelle van der Waa committed 4 years ago

tf-stage1/archlinux: Change DNS records for the archweb migration and also increase the machine size

Changed the A and AAAA record for @ to point to the new machine. Also, since we can't have CNAME to
@, change www from CNAME to A and AAAA and point to the new machine too. The other domains were kept
CNAME, but pointing to www in this case. Also, the master-key domain only had an A record, so added an
AAAA record too. The TTL is still at 600, but we can increase after a while.

Giancarlo Razzolini authored 4 years ago and Jelle van der Waa committed 4 years ago

Change the archweb_db_host variable to point to archlinux.org instead of
apollo. This is of particular importance to gemini.

Giancarlo Razzolini authored 4 years ago and Jelle van der Waa committed 4 years ago

Since the network manager package is still pointing to http://www.archlinux.org for its check,
add a variable archweb_network_check_domain and change the nginx conf for both the maintenance
and regular, to allow the check to pass for the www site. Once the package is updated to point to
http://archlinux.org and after a reasonable amount of time has passed, we can remove this.

Giancarlo Razzolini authored 4 years ago and Jelle van der Waa committed 4 years ago

Escape the value, since TXT records need it.

Giancarlo Razzolini authored 4 years ago and Jelle van der Waa committed 4 years ago

Changed the default domain and subsequent redirects to point to archlinux.org for everything.

security tracker: restrict database perms

See merge request archlinux/infrastructure!202

roles/postgres: make the upgrade_pg.sh script more robust

See merge request archlinux/infrastructure!193

Jakub Klinkovský authored 4 years ago and Jelle van der Waa committed 4 years ago

Also mask postgresql.service to make sure that other services with
Wants=postgresql.service and Restart=on-failure will not start it again
during the upgrade.

Jakub Klinkovský authored 4 years ago and Jelle van der Waa committed 4 years ago

Full file path is needed for the file existence check. The bug was
caused by commit 0d2e6e50

Fix missing AAAA record for europe.archive.pkgbuild.com

See merge request archlinux/infrastructure!198

common: Don't setup btrfs-scrub@ for backup snapshot

See merge request archlinux/infrastructure!196

Archive monitoring fixes

See merge request archlinux/infrastructure!185

Ignore high cpu load alerts for repro1/repro2

Closes #240

See merge request !194

Rebuilderd-workers are expected to have a high cpu load.

Closes: #240

Add Archive specific dashboard

See merge request !192

This new dashboard shows the archive size and total amount of packages
over time.

Make nginx be able to read the security tracker assets

See merge request !189

Allow http group to read the security tracker directory for web assets.

Add rgacogne as new TU

See merge request !188

Application results:
https://lists.archlinux.org/pipermail/aur-general/2020-December/036034.html

Move the "Servers" section from the readme to docs/servers.md

See merge request archlinux/infrastructure!200

Add TOC to readme

See merge request archlinux/infrastructure!197

Mention the archive mirrors in our README as offered services

See merge request archlinux/infrastructure!195

Improve the maintenance role and create an archweb custom maintenance nginx template

See merge request archlinux/infrastructure!190

Added some documentation regarding the service_nginx_template variable and the implications of
using it.

Added the missing break; parameter to allow the maintenace remote machine in.

This template is very similar to the regular archweb nginx one with a few notable differences:
- Regardless of the domain, everything will go to the main domain
- It allows the network manager check to pass
- It will use the ip address of the person running the role, and exempt only that ip address from hitting the
  maintenance page. Everybody else should see the maintenance page.

Configured the variable for the custom nginx template used on maintenance mode. It is important that this template handles the maintenance
on it's own. Also, the maintenance mode was running on gemini, even though archweb_site is false there. Add a check for archweb_site, to make
sure the maintenance mode only runs on the machine hosting the site.

Added a task that sets a custom nginx maintenance mode template, if the calling role sets the service_nginx_template
variable. This allows for much greater flexibility, while putting the responsibility of actually setting the maintenance
mode on the calling role.

stop prometheus from gathering bogus security update informations

See merge request archlinux/infrastructure!187