Since 257 DynamicUser sets PrivateTmp=disconnected making debuginfod
unable to read/write to /var/tmp/ properly  hampering debuginfod's
functioning.

You can't `systemctl reload debuginfod` after installing the systemd
unit we need a daemon-reload.

We want to roll out HTTP/3 slowly, so this adds the necessary plumbing
and makes it possible to enable it per host.

Instead of adding the conditional logic to each nginx template, the 443
listen config is moved out into a snippet which is managed by the nginx
role.

HTTP/3 uses QUIC which is built on UDP. UDP is connectionless and
therefore reuseport[1][2] must be used to ensure that UDP packets for
the same QUIC connection is directed to the same worker. reuseport can
only be enabled once, so a default_server is added to the
"inventory_hostname vhost" for SSL/QUIC (reuseport is only enabled for
the latter). ssl_reject_handshake[3] is enabled as that allows enabling
SSL/QUIC without specifying a certificate.

[1] https://nginx.org/en/docs/http/ngx_http_core_module.html#listen
[2] https://lwn.net/Articles/542629/
[3] http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake

Ref #606

Robin Candau authored 9 months ago and Robin Candau committed 9 months ago

> 2024/06/02 11:05:53 \[warn\] 30324#30324: the "listen ... http2" directive is deprecated, use the "http2" directive instead

Fixes #589

Fixes: 26f289b7 ("Capitalize the first letter of all task names")

ansible-lint 6.5.0 complains about:

  name: All names should start with an
        uppercase letter. (name[casing])

/usr/lib/systemd/system is for vendor-provided service unit files.

/tmp free space is generally limited on these smaller virtual servers,
so use /var/tmp which is more spacious. debuginfod uses this to cache
recently extracted files from archives.

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

Using the fastest gzip compression level to avoid burning too much CPU.

Morten Linderud authored 3 years ago and Kristian Klausen committed 3 years ago

Signed-off-by: Morten Linderud <morten@linderud.pw>

Morten Linderud authored 3 years ago and Kristian Klausen committed 3 years ago

Signed-off-by: Morten Linderud <morten@linderud.pw>

A dashboard will be added at a later date.

Morten Linderud authored 3 years ago and Kristian Klausen committed 3 years ago

Displays packages

https://debuginfod.archlinux.org/packages/



Signed-off-by: Morten Linderud <morten@linderud.pw>

Morten Linderud authored 4 years ago and Kristian Klausen committed 3 years ago

Signed-off-by: Morten Linderud <morten@linderud.pw>