Match the repo ordering of stock pacman.conf.

Fixes: 4159a61f ("dbscripts: switch to Git packaging")

Jelle van der Waa authored 1 year ago and Jelle van der Waa committed 1 year ago

This drops all svn specific functionality and switches to dbscripts git
version. Drops the community repository as it's merged into extra.

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

The default of 0.5 has proven insufficient on at least 3 boxes so far.

The glibc 2.35-6 package ships with the C.UTF-8 locale included which
means there is now a usable UTF-8 locale available by default.

en_US.UTF-8 will still be generated because PostgreSQL clusters are
created with that locale. Migrating the clusters to C.UTF-8 is
possible, but that requires dumping and recreating them.

Other than avoiding the conditional logic there's no reason to specify
/srv/ftp/pool/{packages,community} as additional cache directories for
all servers.

Restoring the default CacheDir value on machines without a local mirror
allows us to use pacdiff to perform a three-way merge of the few config
files which are easier to rebase this way.

There is a need for build servers to never build against outdated repo
databases, even with syncrepo providing a local mirror that is updated
every minute. To that effect, we adjust mirrorlist on build servers so
the first mirror is the tier0 mirror provided by gemini.

Keep the syncrepo role on build servers in order to have a local cache
of packages and avoid concurrent build jobs downloading the same files
causing them to be corrupted.

Finally, configure gemini to use its own repos (like other mirrors do).

Keeps us from having to deal with .pacnew files.

Main motivation behind this is preparing for doing more automatic
upgrades. The need for ignoring kernel updates isn't clear either.

Leonidas Spyropoulos authored 3 years ago and Kristian Klausen committed 3 years ago

This is shared between common and install_arch roles

Closed: #288

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Benedict Baskar authored 3 years ago and Kristian Klausen committed 3 years ago

Fix #376

Fixes: 678845af ("Add Kape server IPv6 addresses (fixes #230)")

It's been running out of swap during borg-backup and seems to get good
compression ratios; try upping the zram size to 100% of RAM (from 50%).

Without hostname the role does not run.

A lot of our systems have a "hardware" watchdog (ex: all the Hetzner
cloud servers) so let's use it.

Do not use asterisk on network devices to prevent IP address collisions
on networks. Also use the right network mask for the assigned network.
For runner1 we need to ignore RAs since those routes don't work.

journal logs are nice and all, but they are comparatively large and
(mostly) uncompressed. This way we at can at least maintain logs for a
reasonable time frame to investigate issues even if the journal decided
that it has to clean up "old" logs.

The logrotate config uses an archive directory to rotate logs to for
stricter permissions on old logs to increase data protection (EU GDPR).

Signed-off-by: Florian Pritz <bluewind@xinu.at>

- Allow for single and multi disk installs
- Use modern parted module to cut down on manual code
- Allow for specifying concrete drives to use for the system
- Change use from unarchive module which is deprecated to get_url + manual tar
- Allow for DHCP when setting up networking
- When using btrfs, automatically compress with lzo (I'd use zstd but grub can't boot off of zstd yet)
- Use playbook_dir as a relativ search path start to find the pubkeys which is more reliable than just relative path
- Clean pacman cache after base system installation

We don't need resolved and it is sometimes buggy so let's just get rid
of it and use unbound like we do on our mail machines already.

Details: https://kanboard.archlinux.org/public/task/104/7dd7510424e4229247e8e0b90bf43e1553fce86cdf8475b60edc956ed5a8



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The discovery script now uses a regex and no longer cares where exactly
accounting is enabled. Follow systemd upstream by enabling it by
default.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

For memory/cpu accounting to be disabled so that zabbix doesn't try to
monitor all units on the machine.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Not strictly necessary yet, but we don't care about a bunch more files
so better safe than without logs.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Sending many mails at once put us over that limit quite quickly and then
we are missing logs. This default is way too low for server usage.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Mainly interesting for the security tracker, but a faster mirror
doesn't hurt us.

Signed-off-by: Florian Pritz <bluewind@xinu.at>