Check the HTTPS DNS records of the following Geo domains:

- geo.mirror.pkgbuild.com
- riscv.mirror.pkgbuild.com

Ensure they return: "1 . alpn=h2,h3 ipv4hint=... ipv6hint=..."

Ref #606

pacman/curl does not utilize HTTP/3, but it makes sense to enable
regardless to ensure consistency.

We self-host the authoritative nameservers for the geo domains, so the
configuration has been tweaked to add the HTTPS DNS record for each geo
domain.

Ref #606

archwiki: Update to 1.42.3-1

See merge request !873

Signed-off-by: Christian Heusel <christian@heusel.eu>

This will be used for issue-bot[1] similar as it is done in the
signstar project[2].

[1] signstar#20 (comment 201743)
[2] https://gitlab.com/gitlab-org/distribution/issue-bot

This will be used to create issues for the monthly reports[1][2].

[1]: project-management!1
[2]: project-management#31



Signed-off-by: Christian Heusel <christian@heusel.eu>

Signed-off-by: Christian Heusel <christian@heusel.eu>

Onboard mh4ckt3mh4ckt1c4s as Junior PM

See merge request !870

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

vault: replace artafinde's RSA with ed25519 key

See merge request !871

https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/QSBPAWQGOT66VHP62ODTMLAICRTBUYP7/

Related to #625



Signed-off-by: Christian Heusel <christian@heusel.eu>

The default set is defective and only covers `twitter.com` and
`youtube.com/shorts`.

Take the [official list][1] and filter it to remove providers that
Synapse rejects.

[1]: https://oembed.com/providers.json

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Currently needs a hack in
/var/lib/synapse/matrix-appservice-irc/node_modules/matrix-appservice-bridge/lib/components/media-proxy.js
to replace the `"http"` require with `"https"` or the proxy won't work.

See: https://github.com/matrix-org/matrix-appservice-bridge/issues/507

Onboard anonfunc as Package Maintainer

Closes #595

See merge request !869

Anonfunc has been a Junior packager for longer then two months.

Fixes: https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/595

tf-stage1: Add HTTPS[1] DNS records for speeding up HTTP/3 negotiation

See merge request !867

This should have been added in the HTTP/3 commits[2][3], but it was my
understanding that it was not supported by Hetzner DNS. It apparently is
supported but not documented.

Cloudflare has a blog post[4] explaining how this speeds up HTTP/3
negotiation. Basically, the clients can connect over HTTP/3 right away,
rather than having to connect with an older protocol (probably HTTP/2 in
our case) and then upgrade to HTTP/3 (based on the Alt-Svc header).

Our domains are HSTS preloaded[1], so it would not speed up HTTPS
negotiation in most cases.

[1] https://datatracker.ietf.org/doc/html/rfc9460
[2] 8dfa7e8c ("nginx: Add plumbing for enabling HTTP/3 conditionally")
[3] 28e0f03c ("Enable HTTP/3 for {,aur.,wiki.}archlinux.org")
[4] https://blog.cloudflare.com/speeding-up-https-and-http-3-negotiation-with-dns
[5] https://hstspreload.org/

Ref #606

Update archmanweb to v1.12

Closes #622

See merge request !868

pkgbuild_org_a    -> pkgbuild_com_a
pkgbuild_org_aaaa -> pkgbuild_com_aaaa

Fixes: 0c976679 ("Deploy tempo")

Fix typos in firewalld and fail2ban roles

See merge request !828

CPX51 is a bit expensive (€54.4/mo) and based on performance monitoring
the CX52 should accomplish the same job at a much lower cost (€31.9/mo).

Switch from redis to valkey

See merge request !863

We do this since the redis package is soon to be deprecated:
https://lists.archlinux.org/archives/list/arch-dev-public@lists.archlinux.org/thread/2ERGX565GSSBUMADBG7DQJYNPJD5GUXD/



Signed-off-by: Christian Heusel <christian@heusel.eu>

The project access token expired ~3 months ago and the CI script has
just been switched to using a job token instead[1]. The project bot user
has zero activity so I decided to delete it.

[1] arch-boxes@afa85791

Fixes: 87b2eddf ("aurweb: enable goaurrpc metrics and dashboard")

We do not usually expose metrics publicly and there is no good reason
for handling aurweb differently.

Fixes: 74757d6b ("Scape aurweb metrics")