This role will still handle setting up nginx and rsyncd, due to specific
configuration requirements these services have.

We're also effectively relieving build.archlinux.org of rsyncd duties as
it is not something it should be doing anyway.

mailman: update mkinitcpio URL in arch-projects mailing list description

See merge request !654

mkinitcpio moved from GitHub to gitlab.archlinux.org.
See #474.

I think this was renamed when Keycloak switched to Quarkus.

keycloak: remove /auth from all Keycloak endpoints

See merge request !655

From [1]: "By default, the new Quarkus distribution removes /auth from
           the context-path."

[1] https://www.keycloak.org/migration/migrating-to-quarkus

matrix: Enable backchannel logouts from keycloak to synapse

See merge request !653

SQLAlchemy 1.4 no longer accepts engine URLs of the form postgres://.

https://docs.sqlalchemy.org/en/20/changelog/changelog_14.html#change-3687655465c25a39b968b4f5f6e9170b

CacheDir, as configured by common's pacman.conf task, already includes
the local package mirror when available (on mirrors, gemini and build).

This worked because riscv was the only nginx-enabled mirror.

Fixes: 43eb814b ("Combine sync{archive,debug,riscv} into mirrorsync")

sshd: adjust /etc/ssh and includes dir permissions

See merge request !651

There is no reason these should have such restrictive permissions, and
missing the execute bit appears to be a mistake. Let /etc/ssh keep the
mode from the package (0755). Use the same for the includes directory.

Update archmanweb to v1.5

See merge request !650

aurweb: new release

See merge request !649

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Migrate PostgreSQL to C.UTF-8

Closes #470

See merge request !643

C.UTF-8 is installed by default, so we can avoid messing with locale-gen
by using that.

All the postgres servers (excluding matrix due to[1]) have been migrated
with the following commands:
# sudo -u postgres pg_dumpall > d
# sed "s/LOCALE = 'C'/LOCALE = 'C.UTF-8'/" -i d
# systemctl stop postgresql.service
# mv /var/lib/postgres/data{,.old}
$ ansible-playbook --diff -t postgres playbooks/<host>.yml
# sudo -u postgres psql < d

[1] https://github.com/matrix-org/synapse/blob/19a57f4a3710d6c3f7cc9d031e0e59bc2ed3b052/docs/postgres.md#fixing-incorrect-collate-or-ctype

Fix #470

Set the base_path provider attribute to "/auth" until we move the /auth
endpoint to be served from the root of https://accounts.archlinux.org/.

- hcloud: 1.34.3 -> 1.35.2
- hetznerdns: 2.1.0 -> 2.2.0

archwiki: upgrade to 1.38.4-1

See merge request !647

security-tracker: bump version to 0.14.1

See merge request !646

Using an inline statement eats the blank line after it; to overcome this
switch to an inline expression, which also happens to be easier to read.

- enable_gzip: grafana listens on localhost, nginx handles compression
- admin_user: initial admin creation is disabled in our config
- strict_transport_security: the same header is set by nginx
- strict_transport_security_max_age_seconds: unused without the above

- common: for deciding when to install/configure smartmontools
- install_arch: installing ucode update only on physical hosts

prometheus_exporters: ignore smartctl exit code 64

See merge request !645

On asia.mirror.pkgbuild.com, 'smartctl -a --json $disk' has been exiting
with code 64. From smartctl(1) code 64 corresponds to "Bit 6: The device
error log contains records of errors". Since we're not interested in old
errors, ignore it.

Tidy up the inventory a bit

See merge request !644