To not run into rate-limits when resolving DNS records from rspamd, use
our own local recursive resolver.

Fix asknot domain

See merge request !349

Eg. https://whatcanidoforfedora.org/ and
https://whatcanidoformozilla.org/. Mea culpa.

Gitlab can show our alertmanager alerts only for > reporter and create
issues from alerts on gitlab.

This adds Last-Modified header support so we should have less cpu spikes
for the archweb-rebuilderd service.

Now that login is restricted to staff members.

Synapse only inspects the userinfo.

matrix: Integrate with Keycloak

Closes #94

See merge request !348

Closes #94

grafana: Add Loki dashboard

See merge request !354

From [1] with the jenkins-x tag removed.

[1] https://github.com/jenkins-x-charts/grafana-dashboard/blob/451e05780b06dc59f8d689c0b64dada315380740/charts/grafana-dashboard/dashboards/loki.json

Avoid needless regex on 301 rewrites

Closes #278

See merge request !353

Closes: #278

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

The redirects are now done by the `redirects` role.

Remove arch32 mirror role

See merge request !352

We no longer mirror arch32 on our servers and this role is currently
broken.

Now that logs are gathered centrally, the team is complaining about the
volume of logs from this server.

Group security/out of date packages alerts

Closes #191

See merge request !351

We want to get notifications of pacman/arch-audit notifications grouped
as otherwise we'll be spammed with ~ X emails for every host.

Closes: #191

prometheus: Make alertmanager.yml only readable by root and alertmanager

See merge request !350

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

It contains secrets, so it shouldn't be world readable.

promtail: Give access to the logrotated nginx access.log files

See merge request !344

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

The files are initially created by nginx as 0644/http:root, but when
logrotate rotates the files it creates the new files as 0640/http:log,
which promtail can't read.

Fix the issue by adding the log group as a supplementary group.

Resolve the users.hosts key not being defined when rolling out the
root_ssh role.

Give klausenbusk root access to {bugs,monitoring}.al.org

See merge request !342

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

klausenbusk is our new newest Junior DevOp and he needs some access:
* bugs.al.org for helping with migrating Flyspray tasks to GitLab
* monitoring.al.org for setting up centralized logging

Revert "Remove NM connectivity check file from al.org"

See merge request !346

This is causing issues for a small business, which can't reach their
"remote systems" anymore due to NM reporting "limited access".
We should be able to revert this in 1-2 weeks.

This reverts commit b909fa58.