The service ships package-lock.json and not yarn.lock, and we should
honor that. Also, ansible's integration with npm seems to be better.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Ensure we only allow to dpeloy commits that were signed with keys we
mark as trusted signing keys for the security tracker.

Without flushing the handlers the maintenance mode only kicks in after
all tasks are finished, which kind of defeats the purpose of the
maintenance.
By forcing to flush handlers we early reload the nginx service to have
maintenance in place before any tasks continue to execute.

- add python-sqlalchemy-continuum as new dependency
- call database upgrade target after each deploy
- outsource version identifier into a variable
- disable systemd timer during maintenance

Signed-off-by: Levente Polyak <anthraxx@archlinux.org>

Calculate the hit rate and used cache upfront which is easier then doing
it in grafana/zabbix.

docs/maintenance.txt: Add the documentation for the maintenance mode with example on how to plug it into another role.

playbooks/apollo: Split the security tracker role into multiple lines and add the nginx configuration
roles/security_tracker: Plug in the maintenance mode

roles/maintenance: Add to the nginx maintenance file the option for having multiple domains. Fix the 503.html path.

Switch from apcu caching to memcached with 512 MiB so that we have a
sustained cached instead of a php-fpm worker based cache which has a
shorter lifetime of 2000 requests before the worker get's killed and
respawned.

The latest tag removes the $wgLogo url which reduces one request per
page load.

With apcu caching the wiki get's ~ 40 req/s more and the latency of the
wiki lowers.

Signed-off-by: Florian Pritz <bluewind@xinu.at>