Almost all of our DNS records have a TTL of 86400 (24 hours) with a few
using a TTL of 600 (some MX and TXT records). The former is too long to
be flexible when a need for fast change(s) arises, and the latter don't
benefit from the low TTL. Standardize on a TTL of 3600 (1 hour) for all
our records.

Keeps us from having to deal with .pacnew files.

Does not seem possible to communicate with hosts in the same subnet
without going through the gateway. Matches the configuration of our
other dedicated servers at Hetzner.

Indirect way to get "configure_network: true".

Fixes these display counters which were tied to aur.archlinux.org:

- Uptime
- RootFS Total
- RAM Total
- SWAP Total

Also add a decimal point to the latter two fields.

No changes made to it; this is to reduce noise in future modifications.

Avoid updating the cache in the same task w/ the upgrade as the former
causes the combined task to always return changed=True. For up-to-date
hosts, stop early instead of following through to the end and skipping
the final reboot task.

Before Ansible 5.4.0, combined cache update + package upgrade would not
always return changed=True but instead depended on whether the were any
packages to upgrade.

Gives the option to downgrade a server in the future, similar to the
default on Hetzner's Cloud Console ("CPU and RAM only").

250 is not a nice round number, whereas 200 is.

Add vault variables described in !532 (for aur-dev this time).

geoipupdate: implement role for use on geo mirrors

See merge request !541

This reverts commit c8d1a39a

Onboard kevr as project maintainer

Closes #438

See merge request !536

Fix #438

Remove our two borg hosts from the inventory

See merge request !540

Do the same for the hostkeys/known_hosts templates and disable fact
gathering.

Kind of sensitive information that doesn't need to be available to all
hosts.

These are managed services and Ansible doesn't run on them. It got
boring writing 'all,!rsync_net,!hetzner_storageboxes' in playbooks
and ad-hoc commands, so remove these borg hosts from our inventory.

Change docs/ssh-known_hosts.txt to be partially managed by Ansible, so
custom entries can be added to the top of the file. Use the new format
to write down the host keys of our two borg hosts.

grafana: Update Loki dashboard

See merge request archlinux/infrastructure!357

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

https://github.com/jenkins-x-charts/grafana-dashboard/pull/5
Kristian Klausen (2):
      loki: Use rate() for both loki_distributor_ingester_{appends,failure}_total
      loki: Fix panel title not starting with a capital letter

aurweb: serve assets from nginx and cache properly

See merge request !538

Jelle van der Waa authored 3 years ago and Jelle van der Waa committed 3 years ago

Make nginx serve static assets to offload gunicorn as for example
loading the home page is making 7 static requests out of 8 requests in
total. Set caching headers for now for 7 days, so browsers don't request
ideally this would be 30 days but let's keep it 7 days for now.

doc: clean up the markdown formatting

See merge request !504

tf/keycloak: Create staff group for "Project Maintainers"

See merge request !535

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

We are onboarding "Project Maintainers" now[1].

[1] https://lists.archlinux.org/private/staff/2022-February/000881.html

Document mail forwarding in the offboard template

See merge request !506