Fixes: 7fdcc769 ("Revert "dbscripts: Add tmpfiles.d/rsyncd.conf for abs and friends"")
Signed-off-by: Christian Heusel <christian@heusel.eu>

pita strudl authored 8 months ago and pita strudl committed 8 months ago

We try to ensure an atomic operation of the lastsync file. This requires creating a tmp file which needs to be ignored.
This should take care of having empty lastsync files being served.
Possible cause is that the IO is stuck thus taking several seconds to write the lastsync timestamp.
This causes mirrors to download the empty file which causes checks to fail.

One year of mirrorlogs keeps a table of 5000 MB which is rather large as
we only show 7 days of logs. Keep it 6 months as maybe in the future
mirror operators are interested in older data.

Keep postgresql connections around for 5 minutes this avoids expensive
authentication requests.

certbot switched to ECDSA by default about two years ago, following
[recommended practices][1].

We are currently using RSA with 4096 bits, which is extremely slow to
sign. Using ECDSA should give us a nice speedup.

[1]: https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29

This reduces the session cache size and adds the
`DHE-RSA-CHACHA20-POLY1305` cipher.

This allows serving a stale response even to the request that triggers
an update. This should ensure all requests finish quickly.

With just `proxy_cache_use_stale updating`, the request that attempts to
update the cache waits for the response, while all other requests get to
use the stale response.

Currently archweb is badly overloaded and can take over half a minute to
respond. Pacman is not that patient and fails the download.

planet.archlinux.org redirects to https://archlinux.org/planet which
then redirects to https://archlinux.org/planet/. Skip one extra
redirect.

As we aren't the speediest at checking, this is fine.

This rate limits the endpoint which does things (ie. uwsgi). 10 requests
per second was already a lot, so 5 should be fine, realistically it can
go lower as we have a burst.

See: #600

Missed this earlier for the upgrade to Loki 3.0.

Loki 3.0 requires this to be set when retention is enabled.

This is needed to upgrade to Loki 3.0.

[1] https://gitlab.archlinux.org/archlinux/nvchecker-poc

This contains fixes to the ArchLinux extension for MediaWiki 1.42.

This will used to increase the level of automation.

Signed-off-by: Christian Heusel <christian@heusel.eu>

We're leaking pending EDUs in the federation writer since about
2023-10-28.

See: https://github.com/matrix-org/synapse/issues/13901

related to archlinux/infrastructure#531



Fixes: c31dd330 ("prepare the split of repo and archive server")
Signed-off-by: Christian Heusel <christian@heusel.eu>

There is no need to split up partitioning into per-partition tasks.
Use long options for readability.

Use an uppercase LABEL to avoid a warning from mkfs.fat:

    mkfs.fat: Warning: lowercase labels might not work properly on some systems

Use something other than "efi" as the label since some firmware do not
like it. While this is not really an issue for Arch infrastructure, since
there is zero change that this will be run on any MSI hardware with its
broken firmware, it is best to simply folow the wiki anyway. See
https://wiki.archlinux.org/title/EFI_system_partition#Firmware_does_not_see_the_EFI_directory

sgdisk does not align the partition size/end by default. The
`-I`/`--align-end` option needs to be used to enable alignment. See
https://wiki.archlinux.org/title/Advanced_Format#Partition_alignment

Additionally use the partition names (PARTLABELs) that gdisk and cgdisk
set (but sgdisk doesn't) and follow the Discoverable Partitions
Specification by useing the appropriate partition for the root partition.
See https://wiki.archlinux.org/title/Partitioning#Single_root_partition

It is unclear why this was added, as we can just use the default lock
file path (/var/run/rsyncd.lock). Using a non-default path was not added
in the offending commit, but remove it in this revert commit
nevertheless, so the commit can be reverted.

This reverts commit e4e07516.

[1] c55b448c ("Add GitLab Pages for pacman")

Fixes: c55b448c ("Add GitLab Pages for pacman")