dovecot: Add shared mailbox for the mediation team

Closes #464

See merge request !616

Please see [1] and [2] for a better understanding of how this works.

[1] https://doc.dovecot.org/configuration_manual/authentication/password_databases_passdb/
[2] https://doc.dovecot.org/configuration_manual/authentication/user_databases_userdb/

Fix #464

The Ansible output is too noisy with all the skipped tasks; avoid this
by moving host-speicific tasks into their own files that get included.

Fix lint warnings and errors with ansible-lint 6.6.0

See merge request !631

Seems ansible-lint thinks a task calling the unqualified user module is
"not valid under any of the given schemas (schema[tasks])".

Not sure why this is needed but whatever. 

https://github.com/ansible/schemas/discussions/227

Prevents the following lint failure:

  jinja: You need to install "jmespath" prior to
         running json_query filter (jinja[invalid])

The service was enabled in arch-boxes to account for "hardware clock is
not in UTC, but instead UTC+X"[1], in our case the (VM) hardware clock
is in UTC and we therfor don't need the slow systemd-time-wait-sync
service (+30 seconds).

[1] arch-boxes@e23d3c57

arch_boxes_sync: Pull the artifacts from GitLab's package registry

See merge request archlinux/infrastructure!580

Fixes: 2e799bd1 ("arch_boxes_sync: Create predictable symlinks for latest image files")

arch-boxes has decided to use GitLab's package registry instead of job
artifacts[1].

[1] archlinux/arch-boxes@d04c8274

Fixes: 2e799bd1 ("arch_boxes_sync: Create predictable symlinks for latest image files")

mailman3: allow everyone to post to the arch-wiki-admins mailing list

See merge request !629

The mailing list is used for non-public communication with users, so everyone needs be able to post to it.
It is also the assigned email address of the ArchWiki user "WikiSysop".
See https://wiki.archlinux.org/title/ArchWiki:Maintenance_Team#Who,_when_and_how_to_contact

tf/keycloak: Add openid client for buildbot

See merge request !623

The buildbot POC wants to use Keycloak for user authentication. The
client is public, because it doesn't make sense to have a client secret,
which can't be kept under wrap anyway (it would need to be shipped with
the CLI[1]).

[1] https://gitlab.archlinux.org/foxboron/buildctl

From time to time aurweb is failing with "Too many open files"
errors[1], this could indicate a bug in aurweb or perhaps the limit is
just too low. Let's try doubling the limit and see if it helps.

[1] https://gitlab.archlinux.org/archlinux/aurweb-errors/-/issues/275

The code isn't vulnerable to nginx alias traversal[1][2], nevertheless
it should only match /static/ and not e.g. /staticfoobar.

[1] d94f18a7 ("Fix nginx alias traversal")
[2] https://github.com/yandex/gixy/blob/641060d6355fbb5bd71695928a2bf14a9bcb8bf2/docs/en/plugins/aliastraversal.md

Fixes: 9294828f ("Setup mailman3 server")

Whoosh is used by default, but it is slow at indexing (multiple hours
for just aur-requests) and searching e.g. aur-requests isn't possible
(it is slow and uses 3G+ of memory resulting in it getting OOM-killed).

Xapian indexed everything in just 76 minutes and searching aur-requests
now works and is plenty fast.

Co-authored-by: Evangelos Foutras <evangelos@foutrelis.com>

This avoids triggering a GitLab push rule which rejects files that look
like secrets.

Add GPG master and signing key for Renovate and arch-boxes

See merge request !579

The key is used for signing the releases, so the users can be sure the
images on the mirrors haven't been modified. arch-boxes has been tweaked
to use the key in this MR[1].

[1] arch-boxes!176

Renovate is a tool for: "Automated dependency updates. Multi-platform
and multi-language."[1].

We require all commits pushed directly to official projects to be
signed, so a master key and signing key have been generated for
Renovate. Both keys are stored in renovate.asc and Renovate only has
access to the signing key.

[1] https://github.com/renovatebot/renovate

syncriscv: add role for mirroring the RISC-V port

See merge request !625

Going to be served by all our Geo boxes under riscv.mirror.pkgbuild.com.

Fixes: 578b7819 ("Capitalize the handler name in handler invocations")
Fixes: 26f289b7 ("Capitalize the first letter of all task names")

All lists have been migrated to mailman3[1] and mailman3 is what users
should use, so show its interface by default and not the mailman2
interface.

[1] 75ac7d09 ("mailman: Fourth and final batch of mailman3 migrated lists")

Fixes: 4d8dfb6a ("mailman: Third batch of mailman3 migrated lists")

arch-general
aur-general
aur-requests

It has been decided not to migrate the following unlisted and unused
lists:
arch-magazine
arch-notifications
arch-test
mailman

Fixes: 92586d5b ("change(aurweb): rework ansible config for 6.0.0")

aurweb: bump to v6.1.4

See merge request !626

Required for poetry 1.2 until #1917 is fixed

https://github.com/python-poetry/poetry/issues/1917



Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>