roles/sshd: Restrict forwarding even further by allowing forwarding only for regular users and only on build servers for now.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

stack pacakges currently hit the limit for some reason. There are ~1300
files to upload, but the default limit is 1024. The uploader throws an
exception and retires just to fail again. For now, just raise the limit
until the initial upload is over. Or leave it because it doesn't hurt.
Probably.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The service works, but sometimes exits. Using Restart=on-failure does
not work with Type=oneshot services so this is the next best thing for
automatic continuation.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Jelle van der Waa <jelle@archlinux.org>

This has multiple benefits:
- We don't have to wait until Ansible 2.8 (which will be when the official hcloud dynamic inventory provider will be included)
- We can expand the script to group servers by labels if required
- We can use the vault to automatically get the hetzner cloud token which is not possible otherwise

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Add flask-migrate as new dependency, this release makes the tracker
compatible with python-flask-sqlalchemy 1.3.1.

Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>

I realize this is less than ideal but I think we can accept it for the short time until the required releases are stable