Commits on Source (59)
-
Kristian Klausen authoredThis will be used for deleting old packages (i.e. the fortnightly packages which are older than 90 days). I thought using a job token would work (as described in [1]), but that turned out not to be the case as explained in [2]. [1] 242213b2 ("gluebuddy: Remove deleted project bot for arch-boxes") [2] arch-boxes@48ccb457
-
Kristian Klausen authored
The behavior is mentioned in the documentation[1], but gitlab has not always done it this way (e.g. some of the older project bots still exist, even though the project tokens expired several months ago). [1] https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#bot-users-for-projects
-
Kristian Klausen authored
We are not on top of expiring bot tokens and we usually only notice when someone else points it out. It is also a bit cumbersome to add new bot tokens, so avoid the issue altogether, by just extending the lifetime of the bot tokens continuously. Fix #617
-
Kristian Klausen authored
gitlab: Add ruby script for continuous extending of bot tokens Closes #617 See merge request !884
-
Kristian Klausen authored
alpm-buildinfo and alpm-types have been consolidated into the alpm project[1], for which GitLab Pages was recently configured[2][3]. Requested by @dvzrv. [1] https://gitlab.archlinux.org/archlinux/alpm/alpm [2] archlinux/alpm/alpm#32 [3] 3d54b56c ("Add GitLab Pages for alpm")
-
Evangelos Foutras authored
It failed to reboot during the last upgrade procedure. Upon logging into the Equinix Metal console, we discovered that we lack access to all 4 of the servers sponsored by Equinix Metal. They are under the CNCF account, and it's not possible to transfer them to our organization. Equinix Metal is being sunset, and the remaining 3 servers will also go away on June 30th 2026. We can keep them until then, or until they fail to boot like seoul.mirror.pkgbuild.com.
-
Kristian Klausen authored
Fixes: 7ea1eb29 ("gitlab_runner: Refactor libvirt-executor")
-
Kristian Klausen authored
This differs from the way we install packages in all the other roles, so revert the commit to ensure consistency. This reverts commit ab1d8e84.
-
Sven-Hendrik Haase authored
-
Sven-Hendrik Haase authored
Improve ansible logging to be more human readable See merge request !887
-
Sven-Hendrik Haase authored
-
Sven-Hendrik Haase authored
Fix packer and update plugins See merge request !888
-
Evangelos Foutras authored
Also regenerate the list of Prometheus Blackbox targets, adding: - https://london.mirror.pkgbuild.com - https://package-maintainer-bylaws.aur.archlinux.org
-
Jan Alexander Steffens (heftig) authored
-
Jan Alexander Steffens (heftig) authored
-
Jan Alexander Steffens (heftig) authored
-
Jan Alexander Steffens (heftig) authored
-
Kristian Klausen authored
It never gained traction and it has been dormant for over three years. [1] https://gitlab.archlinux.org/archlinux/reproducible-archlinux-notes
-
Sven-Hendrik Haase authored
As per my announcement to arch-devops[1] and staff, this adds a Mumble server for Arch Linux. The password for the special root user SuperAdmin is automatically generated on first launch and printed to the logs. I went ahead and added it to the vault. It should not usually be required to login as SuperAdmin though as long as there are user admins around. This uses certbot for local certificates. [1] https://lists.archlinux.org/archives/list/arch-devops@lists.archlinux.org/thread/AHAOSTGFJTLQDSXLWFORDKGR6RDVHYEI/
-
Sven-Hendrik Haase authored
Add Mumble server See merge request !886
-
Christian Heusel authoredKeeping up with the sequoia interface changes is no fun and has caused us work previously, therefore replace it with rsop which has a standardized interface. Co-Authored-by:
David Runge <dvzrv@archlinux.org> Signed-off-by:
Christian Heusel <christian@heusel.eu>
-
Christian Heusel authored
gitlab_runner: Replace sq usage with rsop See merge request !890
-
Kristian Klausen authored
The naming of yaml files should be consistent.
-
Kristian Klausen authored
With the last commit[1], we now lint the misc host_vars files and the indentation is off for some of the files. [1] b0f46412 ("Add missing .yml suffix to the misc host_vars files")
-
Kristian Klausen authored
Fixes: 24e73359 ("Decommission patchwork.archlinux.org and replace it with a static copy[1]")
-
Kristian Klausen authored
To my knowledge they were never used and the new buildbtw[1] project is following another path. [1] https://gitlab.archlinux.org/archlinux/buildbtw This reverts commit 3a555a1a (Provision workers (servers) for the buildbot POC, 2024-01-19).
-
Kristian Klausen authored
The PoC has concluded. This reverts commit 37fb120a (Provision server for buildbot POC, 2022-05-12).
-
Kristian Klausen authored
The PoC has concluded. This reverts commit c56fbb55 (tf/keycloak: Add openid client for buildbot, 2022-09-01).
-
Kristian Klausen authored
The last submodule was removed in [1] more than 4 years ago. [1] d9fdafb0 ("Use archlinux-contrib over git submodule")
-
Levente Polyak authoredThis seems to be a leftover from the migration of our packager roles. All packagers should be able to upload sources to our packages directory, hence change the permissions from the junior-dev group to the junior-packager group. Fixes #637
-
Christian Heusel authored
Recently somebody complained that the email only reached them after the password reset link had already become invalid, which is definitely something that can happen with the previously set 5min timeout. 5 minutes timeout are too short aswell for any complex email analysis setup or greylisting, and we therefore bump this value to one hour, which is still short enough from a security perspective but gives our users a bit more time to act on the reset. Signed-off-by: -
Christian Heusel authored
tf-stage2: use 1h timeout for keycloak pw resets See merge request !889
-
Jan Alexander Steffens (heftig) authored
-
Jan Alexander Steffens (heftig) authored
-
Christian Heusel authored
Requested by dvzrv[1] and implemented in this MR[2]. [1]: signstar#91 [2]: signstar!125 Signed-off-by:
-
Christian Heusel authored
tf-stage1: Add GitLab Pages for Signstar See merge request !892
-
Jan Alexander Steffens (heftig) authored
-
Levente Polyak authored
We are hitting a lot of permission problems lately for sources that are co maintained. The culprint were wrong facl permissions that have not been adjusted since we renamed TU to Packager. Reflect this change by fixing the groups in the archbuild tasks to use junior-dev and junior-packager.
-
Evangelos Foutras authored
-
Jan Alexander Steffens (heftig) authored
-
Jan Alexander Steffens (heftig) authored
-
Sven-Hendrik Haase authored
We had load problems before and this seems to fix it for now.
-
Christian Heusel authored
The project now has a centralized landing page hosted in the root directory which we can observe instead of the docs for one specific crate. Related to archlinux/alpm/alpm#76 Related to archlinux/alpm/alpm!57 Signed-off-by:
-
Christian Heusel authored
The project now has a centralized landing page hosted in the root directory which we can observe instead of the docs for one specific crate. Related to signstar#124 Related to signstar!131 Signed-off-by:
-
Christian Heusel authored
Fixes #641 Signed-off-by:
-
Kristian Klausen authored
-
Kristian Klausen authored
It was forgotten once[1] to update it in both places, so avoid that issue in the future, by moving it to a variable. [1] c370c9d0 ("gitlab_runner: Update concurreny math to reflect the new VM size")
-
Kristian Klausen authored
This removes 13 instances of [1] and 1 instance of the IP address from the job log. The latter was fixed by no longer waiting for SSH in the "run" stage, which is unnecessary as we wait for SSH in the "prepare" stage. [1] Warning: Permanently added '192.168.122.xxx' (ED25519) to the list of known hosts.
-
Kristian Klausen authored
The prepare stage runs "echo "Running on $(hostname)...""[1], resulting in "bash: line 7: hostname: command not found" and it outputting "Running on ..." as the hostname command is provided by inetutils, which is not installed. Fix it by "monkey patching" it to use "hostnamectl hostname" and inject the hostname with SMBIOS[2][3]. Injecting creds with SMBIOS may also be useful in the future, e.g. for injecting an ephemeral SSH public key. [1] https://gitlab.com/gitlab-org/gitlab-runner/-/blob/v17.5.2/shells/bash.go?ref_type=tags#L452-L456 [2] https://systemd.io/CREDENTIALS/ [3] https://github.com/systemd/systemd/pull/30814
-
Kristian Klausen authored
All libvirt volume management is now handled through virsh instead of direct file system access. As a volume cannot be uploaded in an atomic way, the current active volume is now tracked in a file on disk. This may allow us to run the script with less privileges and use polkit for libvirt access control[1]. [1] https://libvirt.org/aclpolkit.html
-
Kristian Klausen authored
This means that there is no need to make runner-specific changes to the image, so in theory the image could be build centrally (e.g. in the arch-boxes project[1]) and then distributed to the runner hosts. This change also make the SSH keys ephemeral. [1] https://gitlab.archlinux.org/archlinux/arch-boxes
-
Kristian Klausen authored
This reverts commit 466230e4. This has been fixed in pacman[1], so it is no longer unreasonably slow. Some quick testing at runner1 indicates that this only saves five seconds at best, so IMO it is not worth the complexity to continue doing this. This revert does not revert the timeout back to 60 seconds, but keeps it at 30 seconds. [1] pacman/pacman!16
-
Kristian Klausen authored
It makes more sense to build the image in arch-boxes than building it on each runner, especially considering that arch-boxes already have all the necessary infrastructure, so we can avoid maintaining similar code in two repositories and avoid running losetup, mount, arch-chroot etc. (as root) on the runners. The arch-boxes MR[1] has a little more context. [1] archlinux/arch-boxes!200
-
Kristian Klausen authored
From the kernel patch series[1]: "This series provides an asynchronous means of reporting free guest pages to a hypervisor so that the memory associated with those pages can be dropped and reused by other processes and/or guests on the host. Using this it is possible to avoid unnecessary I/O to disk and greatly improve performance in the case of memory overcommit on the host."[1] The runner hosts may be memory overcommitted if there is too many running VMs and containers at the same time, which this should help to avoid. [1] https://lore.kernel.org/linux-mm/20200211224416.29318.44077.stgit@localhost.localdomain/
-
Kristian Klausen authored
This should not change anything as the VMs are short-lived (15 minutes at the most), so it is just added for good measure.
-
Kristian Klausen authored
There is no technical reason for this at the moment, but UEFI is the de facto firmware for x86-64, so let's be modern.
-
Kristian Klausen authored
libvirt-executor improvements See merge request !881
-
Kristian Klausen authored
With the support for network.wireguard.* credentials[1] in systemd v256[2], we can now easily avoid storing the credentials centrally in our ansible vault, which is preferable as it makes the private keys less exposed. It may also make fine-grained access easier in the future[3] as there is no longer a vault file for each server. All the keys have been rotated and the new private keys are only stored on the servers. [1] https://github.com/systemd/systemd/pull/30826 [2] https://github.com/systemd/systemd/releases/tag/v256 [3] #64
-
Kristian Klausen authored
Remove the WG private keys from the vault and store them only on the servers See merge request !891
Showing
- .gitmodules 0 additions, 0 deletions.gitmodules
- ansible.cfg 1 addition, 0 deletionsansible.cfg
- docs/geomirrors.md 0 additions, 1 deletiondocs/geomirrors.md
- docs/servers.md 6 additions, 1 deletiondocs/servers.md
- docs/ssh-hostkeys.txt 9 additions, 9 deletionsdocs/ssh-hostkeys.txt
- docs/ssh-known_hosts.txt 5 additions, 5 deletionsdocs/ssh-known_hosts.txt
- docs/wireguard.md 1 addition, 1 deletiondocs/wireguard.md
- group_vars/all/archusers.yml 0 additions, 8 deletionsgroup_vars/all/archusers.yml
- group_vars/all/dyn_dns.yml 5 additions, 0 deletionsgroup_vars/all/dyn_dns.yml
- group_vars/all/gitlab_bots.yml 1 addition, 2 deletionsgroup_vars/all/gitlab_bots.yml
- group_vars/all/vault_dyn_dns_keys.yml 25 additions, 19 deletionsgroup_vars/all/vault_dyn_dns_keys.yml
- group_vars/all/vault_mumble_server.yml 10 additions, 0 deletionsgroup_vars/all/vault_mumble_server.yml
- group_vars/all/vault_patchwork.yml 0 additions, 14 deletionsgroup_vars/all/vault_patchwork.yml
- group_vars/geo_mirrors/misc.yml 1 addition, 0 deletionsgroup_vars/geo_mirrors/misc.yml
- host_vars/accounts.archlinux.org/misc.yml 3 additions, 0 deletionshost_vars/accounts.archlinux.org/misc.yml
- host_vars/accounts.archlinux.org/vault_wireguard.yml 0 additions, 9 deletionshost_vars/accounts.archlinux.org/vault_wireguard.yml
- host_vars/america.mirror.pkgbuild.com/misc.yml 1 addition, 1 deletionhost_vars/america.mirror.pkgbuild.com/misc.yml
- host_vars/america.mirror.pkgbuild.com/vault_wireguard.yml 0 additions, 9 deletionshost_vars/america.mirror.pkgbuild.com/vault_wireguard.yml
- host_vars/archlinux.org/misc.yml 1 addition, 1 deletionhost_vars/archlinux.org/misc.yml
- host_vars/archlinux.org/vault_wireguard.yml 0 additions, 9 deletionshost_vars/archlinux.org/vault_wireguard.yml
.gitmodules
deleted
100644 → 0
group_vars/all/vault_mumble_server.yml
0 → 100644
group_vars/all/vault_patchwork.yml
deleted
100644 → 0