Enable kernel lockdown in confidentiality mode to restrict how the root user can interact with the kernel.
See https://wiki.archlinux.org/title/Security#Kernel_lockdown_mode and https://man.archlinux.org/man/kernel_lockdown.7

This could prevent a scenario where a malicious kernel module or access to some interface that kernel lockdown prevents, would allow or assist in escaping the KVM.
It is not very likely as there needs to be an exploitable vulnerability in the hypervisor.
To make it more secure, the host too would need to enable kernel lockdown.

In the end this may only give some sense of security, but, as we all know, that's all that matters anyway.

arch-commits
arch-security
aur-dev
pacman-contrib
pacman-dev

mailman3: IaC list configurations

Closes #254

See merge request !610

It is cumbersome to manage the list configurations from the web ui and
easy for them to diverge, so let's instead manage them with Ansible.

Fix #254

The default of 0.5 has proven insufficient on at least 3 boxes so far.

They should never have been in two files.

Fixes: 98704c48 ("root_ssh: Add additional SSH key for klausenbusk")

Ref #469

We moved away from raid6 a while back; update the host var to reflect
the current configuration.

aurweb: bump to 6.1.2 version

See merge request !624

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

The WKD logic has been moved to the archlinux-keyring project[1][2].

[1] archlinux-keyring!166
[2] archlinux-keyring!169

This box is very sussy and really likes to fill up its zram swap:

  [root@reproducible ~]# zramctl
  NAME       ALGORITHM DISKSIZE  DATA  COMPR TOTAL STREAMS MOUNTPOINT
  /dev/zram0 lzo-rle       1.9G  1.5G 183.4M  196M       1 [SWAP]

  [root@reproducible ~]# free -m
                 total        used        free      shared  buff/cache   available
  Mem:            1928         529          73           5        1325        1236
  Swap:           1927        1543         384

Fixes: 4a5748ea ("Bump zram-fraction to 1.0 for reproducible.archlinux.org")

Fixes: 26f289b7 ("Capitalize the first letter of all task names")

Otherwise it can't open our letsencrypt certs. It will setuid to
`turnserver` itself.

We get a lot of unauthorized STUN requests in the logs.

Fixes: 26f289b7 ("Capitalize the first letter of all task names")

archusers: Make kgizdov dev

See merge request !622

See #468

Fixes: 511b6ca4 ("misc/vault-keyring-client.sh: add flock workaround")

Update archmanweb to v1.4

See merge request !618

Fixes for ansible-lint 6.5.0

See merge request !620

This avoid having extra-long lines and works fine for task-based rules.

This might be a bug in ansible-lint 6.5.0, but it appears to ignore all
our 'skip_ansible_lint' tags. Fix this by replacing them with noqa tags.

ansible-lint 6.5.0 complains about:

  name: All names should start with an
        uppercase letter. (name[casing])

Useful if we wanted to create a Geo-based archive consisting of machines
in the archive_mirrors group (though this will likely not happen because
it'd break archlinux-repro due to the ~4 hour sync delay).

When the GeoIP databases get refreshed (weekly), we want PowerDNS to
reload them. Do this by running pdns_control reload in ExecStartPost.

Ref #465

Fix #463

Fix #453

aurweb: Make SSH faster by avoiding slow Poetry (~2,5 sec faster)

See merge request !612