group_vars/all/vault_aurweb.yml

+$ANSIBLE_VAULT;1.1;AES256
+38383639393932666334353834613134353965333939343530636234353536366138346137613636
+3439373136366635623339626236663338623237313135630a333939303839303738653835316430
+37363337386331323263623837373032646438326334623436313034353032386535656139353264
+3834613539356336310a383230373736346434656361333134353136366430393130396466643561
+61356162353661633736356431646538643138383766333763626335393135343363316166656461
+30663961336136356134333231316232653664343839616235396562376436363837356563616136
+656332343163376332636131333166623362

playbooks/aur-dev.archlinux.org.yml

@@ -10,7 +10,7 @@
     - { role: nginx }
     - { role: mariadb, mariadb_innodb_buffer_pool_size: '1G' }
     - { role: sudo }
-    - { role: redis }
+    - { role: valkey }
     - { role: uwsgi }
     - { role: aurweb, aurweb_domain: "{{ aurdev_fqdn }}", aurweb_environment_type: 'dev' }
     - { role: fail2ban }

playbooks/aur.archlinux.org.yml

@@ -11,7 +11,7 @@
     - { role: nginx }
     - { role: mariadb, mariadb_innodb_buffer_pool_size: '1G' }
     - { role: sudo }
-    - { role: redis }
+    - { role: valkey }
     - { role: uwsgi }
     - { role: borg_client, tags: ["borg"] }
     - { role: postfix_null }

roles/aurweb/templates/nginx.d.conf.j2

@@ -128,7 +128,7 @@ server {
         proxy_set_header X-Forwarded-For $remote_addr;
     }
 
-    location /rpc/metrics {
+    location = /rpc/metrics {
         if ($http_authorization != "Bearer {{ vault_goaurrpc_metrics_token }}") {
             return 403;
         }
@@ -138,13 +138,23 @@ server {
     }
 
     location / {
+{% block asgi_proxy  %}
         # Proxy over to aurweb's ASGI application.
         proxy_pass http://{{ aurweb_asgi_bind }};
         proxy_set_header Host $host;
         proxy_set_header X-Forwarded-For $remote_addr;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_set_header X-Forwarded-Ssl on;
+{% endblock %}
 
         limit_req zone=aurweblimit burst=10 nodelay;
     }
+
+    location = /metrics {
+        if ($http_authorization != "Bearer {{ vault_aurweb_metrics_token }}") {
+            return 403;
+        }
+
+{{ self.asgi_proxy() }}
+    }
 }

roles/fail2ban/tasks/main.yml

@@ -34,7 +34,7 @@
   notify:
     - Restart fail2ban
 
-- name: Install firewallcmd-allports.local
+- name: Install firewallcmd-ipset-allports.conf
   template:
     src: "firewallcmd-ipset-allports.conf.j2"
     dest: "/etc/fail2ban/action.d/firewallcmd-ipset-allports.conf"

roles/firewalld/tasks/main.yml

@@ -19,4 +19,5 @@
     service: dhcpv6-client
     state: disabled
     immediate: true
+    permanent: true
   when: configure_firewall

roles/gluebuddy/defaults/main.yml

@@ -4,7 +4,6 @@ gitlab_bots:
   - project_10185_bot2
   - project_19591_bot
   - project_19796_bot
-  - project_10177_bot
   - project_57011_bot_12149c4ff92f18dd46696e89f2f3e703
   - project_57074_bot_740552e9ac20aea79fd0f9d34e757397
   - project_10185_bot_6f3a8a11922b9008fcb92024361b10b6

roles/matrix/files/synapse.service

 [Unit]
 Description=Synapse Matrix homeserver
-Requires=postgresql.service redis.service
+Requires=postgresql.service valkey.service
 Wants=turnserver.service
-After=network.target postgresql.service redis.service turnserver.service
+After=network.target postgresql.service valkey.service turnserver.service
 AssertPathExists=/etc/synapse/homeserver.yaml
 
 [Service]

roles/matrix/tasks/main.yml

@@ -28,10 +28,10 @@
       - pkgconf
       - postgresql-libs
       - python
-      - redis
       - rust
       - tcl
       - tk
+      - valkey
       - yarn
       - zlib
 

roles/prometheus/templates/prometheus.yml.j2

@@ -134,6 +134,8 @@ scrape_configs:
 
   - job_name: aurweb
     scheme: https
+    authorization:
+      credentials: {{ vault_aurweb_metrics_token }}
     static_configs:
       - targets: ['aur.archlinux.org:443']
 

roles/redis/tasks/main.yml

-- name: Install redis
-  pacman: name=redis state=present
-
-- name: Start and enable redis
-  service: name=redis enabled=yes state=started

roles/rspamd/meta/main.yml

@@ -3,4 +3,4 @@ galaxy_info:
   standalone: false
 
 dependencies:
-  - role: redis
+  - role: valkey

roles/valkey/tasks/main.yml

+- name: Install valkey
+  pacman: name=valkey state=present
+
+- name: Start and enable valkey
+  service: name=valkey enabled=yes state=started

tf-stage1/archlinux.tf

@@ -57,7 +57,7 @@ locals {
       domain      = "@"
     }
     "aur.archlinux.org" = {
-      server_type = "cpx51"
+      server_type = "cx52"
       domain      = "aur"
     }
     "bbs.archlinux.org" = {