networking: use Quad9 DNS on static network boxes

See merge request !698

Evangelos Foutras authored Apr 01, 2023 and Evangelos Foutras committed Apr 06, 2023

Might fix the intermittent "Name or service not known" errors on gemini.

security_tracker: rate limit RSS feeds

See merge request !700

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

gitlab_runner: Set reasonable NOFILE limits to avoid bugs

See merge request archlinux/infrastructure!693

The default limits cause issues as reported upstream[1][2], it also
breaks the mkinitcpio CI[3]. So match the limits set in systemd since
v240[4].

[1] https://github.com/moby/moby/issues/38814
[2] https://github.com/containerd/containerd/pull/7566
[3] archlinux/mkinitcpio/mkinitcpio@da223d2f
[4] https://github.com/systemd/systemd/blob/4f44d2c4f76922a4f48dd4473e6abaca40d7e555/NEWS#L6556-L6590

Move GitLab's container registry to a dedicated domain (registry.al.org)

See merge request !697

It looks more professional and we can move it to a dedicated box if the
load increases.

This syncs the lock file with the latest change where we switched the
provider for uptimerobot

terraform: update stage2 provider version declaration

See merge request !696

Levente Polyak authored Mar 27, 2023 and Levente Polyak committed Mar 31, 2023

In commit d31f8404 we changed the
terraform provider for uptimerobot. Reflect this change in the terraform
lock file and provider version declaration.

terraform: fix package maintainer team groups

See merge request !695

Levente Polyak authored Mar 27, 2023 and Levente Polyak committed Mar 31, 2023

Previously we have declared explicit resources for the roles under the
root. This lead to the desired groups getting created twice, once via
toSet of the package maintainer team and once per resource under the
root.

Furthermore remove the package maintainer roles, currently we do not
need any roles to define permissions. We can simply use the groups to
easily assign users into. Those group assignments can be queries for
example by gluebuddy to act upon or queried by a saml client.

Fixes 941563f2

terraform: add junior packager groups and roles for core/extra

See merge request !674

Leonidas Spyropoulos authored Feb 05, 2023 and Levente Polyak committed Mar 27, 2023

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Add "noqa no-changed-when" tags to handlers using the command module.
Perhaps it is wrong of ansible-lint to flag these, since handlers are
not the best place to have conditional execution.

[1] https://github.com/keycloak/keycloak/pull/15746

Fix #501

terraform: update uptimerobot to a different provider

See merge request !689

https://blog.uptimerobot.com/december-2022-we-are-introducing-sub-users-and-new-plans/



Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

archwiki: upgrade to 1.39.2-1

See merge request !694

The credentials are stored in $HOME/.ia instead of $HOME/.config/ia.ini.

Also update the repo URL to point to our GitLab.

Also stop using oauth_auto_login and switch to provider specific
auto_login option.

Offboard kkeen as TU

See merge request !691

aurweb: update to 6.2.2

See merge request !692

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

It's incompatible with Keycloak 21.

Re-enabling of metrics is tracked in #499.

[1] https://github.com/aerogear/keycloak-metrics-spi/issues/155

Add yan12125 to multilib group

See merge request !690

common: smartd.conf: disable long self-tests

Closes #498

See merge request !687

The disks on gemini show increased write latency every now and then,
and this appears to correlate with when long self-tests are running.

Fixes #498

Chonky packages are chonky. The extra 25G should last us 6-12 months.

Add jail for http users

See merge request !683