Nothing fancy, just something to prevent automated form submissions.

archwiki: merge LocalSettings.archlinux.org.php from the archwiki git repo into LocalSettings.php.j2

See merge request !516

archwiki: merge LocalSettings.archlinux.org.php from the archwiki git repo into LocalSettings.php.j2

Merge https://github.com/lahwaacz/archlinux-mediawiki/blob/cache/LocalSettings.archlinux.org.php.
There is no need to separate these files since LocalSettings.archlinux.org.php is only used by ArchWiki.
Keeping it all in one file provides a clearer view of what options are actually set.

Related to https://github.com/archlinux/archwiki/pull/31.

asia.mirror.pkgbuild.com has been offline for 12 days so far while we
wait for a NIC replacement. Should have taken it out of DNS NS duties
earlier but better late than never.

It needs the extra RAM.

Vagrant Cloud has been used for years by arch-boxes[1] for publishing
Vagrant boxes. Access to the organization[2] was handed out to a few
members of the DevOps team and the creator of the organization
(arch-boxes maintainer at the time).

With this commit the control of the organization is handed over to the
DevOps team through a new Vagrant Cloud account.

[1] https://gitlab.archlinux.org/archlinux/arch-boxes
[2] https://app.vagrantup.com/archlinux/

Fixes: 9294828f ("Setup mailman3 server")

Tweaking access to the abuse filter[1].

[1] https://github.com/archlinux/archwiki/pull/52

LocalSettings: allow only sysops and cosysops to view public abuse filters and logs

alertmanager: remove GitLab webhook integration

See merge request !578

Nobody uses this for alert management and we also have Grafana showing
the alerts now.

Removing just the list of vaulted var files triggers a schema violation.

Addresses the following ansible-lint warning:

risky-file-permissions: File permissions unset or incorrect.
roles/install_arch/tasks/main.yml:50

As reported by ansible-lint 6.2.1:

schema: [{'PYTHONPATH': '.'}] is not of type 'object' (schema[tasks])
roles/aurweb/tasks/main.yml:1

schema: [{'SHELL': '/bin/bash'}] is not of type 'object' (schema[tasks])
roles/dbscripts/tasks/main.yml:1

The "line-length" and "braces" rules are now named "yaml[line-length]"
and "yaml[braces]" respectively.

https://github.com/ansible/ansible-lint/pull/2148

With a delay of 30 seconds. Reduce the sleep hack in pantalaimon from 30
to 10 seconds. Hopefully this is going to bring it up reliably.

dovecot: enable the duplicate Sieve extension

See merge request !576

Useful for preventing message duplication when the recipient is also
part of an alias included in Cc (e.g. foutrelis@ + infrastructure@).

borg_client: run compact after pruning on borg 1.2

See merge request !577

Only doing this on the Hetzner storage box for now; waiting for
rsync.net to upgrade to borg 1.2 so we can enable it there too.

[1] https://datatracker.ietf.org/doc/html/rfc8461#section-3.2

Fixes: 0b87cbfd ("mta_sts: Switch to enforce mode and bump max_age to 30 days")

Ansible side of commit 5007c1a8 ("tf-stage1: allow setting the NS
TTL of geo domains"); both values need to match so our geo nameservers
report the same TTL as that returned by the parent zone's nameservers.

When adding a new geo domain or doing other testing, we would want to
use a low TTL to allow for making quick changes to the configuration.

arch-dev
arch-devops
arch-dev-public
arch-mirrors
arch-mirrors-announce
arch-multilib
arch-ports
arch-proaudio
arch-projects
arch-releng
arch-tu
arch-women
staff

Checking the SMTP TLS reports, the last failure was 2021-12-10/11 from
Mail.ru and 2021-08-28/29 from Google.

Bumping the max_age to 30 days as the RFC states: "To mitigate the risks
of attacks at policy refresh time, it is expected that this value
typically be in the range of weeks or greater."[1].

[1] https://datatracker.ietf.org/doc/html/rfc8461

It is run as part of the nntp runner now[1].

[1] https://gitlab.com/mailman/mailman/-/merge_requests/895

Setup mailman3 server

See merge request !437

The server has been reimaged to be sure the playbook and roles work as
intended.

arch-announce
arch-devops-private
arch-events
arch-wiki-admins

mailman-web has been packaged in the community repo and it uses
different paths than my homebrewed PKGBUILD.

We want to migrate to mailman3 as mailman2 is basically unmaintained and
requires Python 2 which is EOL.

Because the mailman and mailman3 packages conflict and we don't want to
perform a big bang migration, mailman3 must be deployed on a separate
server. mailman-web (mailman3's web interface) hasn't been packaged yet,
so for now we are using my homebrewed PKGBUILD[1].

[1] https://gist.github.com/klausenbusk/5982063f95c503754a51ed2fefb8915e

Ref #59

Fixes: afb582b1 ("geomirror: extract acme dns challenge into new role")

debuginfod: let nginx compress octet-stream responses

See merge request !573