archwiki: LocalSettings.php: give registered users the 'writeapi' right

See merge request !601

Adding/removing pages from the whitelist when using the Vector skin requires the write API now.
Without this, regular users get this error:

    You're not allowed to edit this wiki through the API.

archwiki: upgrade to 1.38.1-1

See merge request !598

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

- $wgScriptExtension was removed in MW 1.31
- $wgDBmysql5 was removed in MW 1.33
- $wgShowIPinHeader was removed in MW 1.27
- $wgUseETag was removed in MW 1.28
- $wgEnableWriteAPI was removed in MW 1.32
- $wgShowSQLErrors was removed in MW 1.37

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

$wgFragmentMode = [ 'html5', 'legacy' ]; is the default value since
MediaWiki 1.37:
https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:$wgFragmentMode

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

These were fixed in MediaWiki 1.38

Jakub Klinkovský authored 2 years ago and Kristian Klausen committed 2 years ago

Also updated some settings:

- The $wgShellLocale setting was removed from MediaWiki, see
  https://www.mediawiki.org/wiki/Special:MyLanguage/MediaWiki_1.38
- The "new" Vector skin got a name "vector-2022" and can be set simply
  by $wgDefaultSkin = 'vector-2022'; see
  https://www.mediawiki.org/wiki/Skin:Vector/2022#Note_about_1.38_release

archweb: use a whitelist for files in /iso/

See merge request !595

Allow only .sig, .torrent and .txt.

This is done to prevent downloading files such as https://archlinux.org/iso/latest/arch/boot/x86_64/vmlinuz-linux.

Add kpcyrd to multilib group

See merge request !600

install_arch: use versionless bootstrap tarball

See merge request !596

Since release 2022.07.01, there is a versionless bootstrap tarball file (archlinux-bootstrap-x86_64.tar.gz). See https://github.com/pierres/archiso-manager/pull/12.

"latest" is a valid version, so there is no need to check for the exact version number anymore.

archwiki: disable Lockdown extension

See merge request !597

This restores public access to recent changes, page history etc. which
was disabled in September 2019 due to misbehaving crawlers - see commits
https://github.com/archlinux/archwiki/commit/f2c518d3df94e9ad6898fdd03cac982902f8ac36
and https://github.com/archlinux/archwiki/commit/8595e8d66141e608db794f1deef3e52cb36e5e78.

Let's hope that our robots.txt has been improved since then and the
server load will not increase much. If it proves to be still a problem,
this commit can be reverted and we will figure out better solution.

Add new domain for project documentation (archlinux.page)

See merge request archlinux/infrastructure!594

Ref: archlinux/monthly-reports!1

Ref: archlinux/repod!65

We want non-DevOps to be able to deploy project documentation (ex:
repod) with GitLab Pages and a separate domain was considered the only
sensible solution due to security issues[1].

[1] https://github.blog/2013-04-09-yummy-cookies-across-domains/

- IPMI credentials for luna.archlinux.org
- Entry with no credentials for PIA boxes

Give artafinde access to the mailman servers

See merge request !593

artafinde wants to help with the mailman3 migration[1], so give him
access to the mailman servers.

[1] archlinux/infrastructure#59

Add Gandi account

See merge request !589

We want to deploy project documentation (ex: repod) with GitLab Pages
and due to security concerns[1], they should be deployed on a separate
domain.

Hetzner's Registration Robot[2] only supports a few TLDs and all the
good names have already been taken, and therefore we need a new domain
registrar. SPI has a partnership with Gandi, so Gandi it is.

[1] https://www.hetzner.com/registrationrobot
[2] https://github.blog/2013-04-09-yummy-cookies-across-domains/

This box somehow gets a compression ratio of over 12; bump its zram
fraction accordingly, to stop getting alerts about high swap usage.

borg_client: drop Restart=on-failure from services

See merge request !592

When a backup job fails it is usually something we want to look into and
understand its root cause before restarting the backup job. Therefore we
need to disable the restart-on-failure behavior we had previously set up.

prometheus: split crt.sh lookups into new script

See merge request !591

roles/prometheus/defaults/main.yml used to include a comment with the
commands used to generate a list of HTTPS endpoints to check. Move it
into a proper script and fix it to generate the correct current list.

Add top 15 prometheus metrics for gitlab exporter

See merge request !590

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Ref #456

/usr/lib/systemd/system is for vendor-provided service unit files.

/tmp free space is generally limited on these smaller virtual servers,
so use /var/tmp which is more spacious. debuginfod uses this to cache
recently extracted files from archives.

debuginfod.archlinux.org runs into high swap often, but also gets good
compression ratio; try upping the zram size to 100% of RAM (from 50%).

We don't want our users tracked by a third party.