Compare revisions

Kristian Klausen · Leonidas Spyropoulos · Jelle van der Waa · Kristian Klausen · Jakub Klinkovský · Kristian Klausen
--- a/.gitlab/issue_templates/New Official Project.md
+++ b/.gitlab/issue_templates/New Official Project.md
@@ -85,6 +85,11 @@ If you want to add a new official project, here are some guidelines to follow:
   - `Wiki`
   - `Issues`
   - `Projects`
+1. [ ] Go to https://github.com/archlinux/my-example/settings/hooks and add a new webhook
+   - `Payload URL`: `$(misc/get_key.py misc/vault_github.yml github_pull_closer_webhook_url)`
+   - `Content type`: `application/json`
+   - `Which events would you like to trigger this webhook?`
+     - `Let me select individual events.`: `Pull requests`
 1. [ ] In the GitHub description of the mirrored project, append " (read-only mirror)" so that people know it's a mirror.
 1. [ ] Disable `Packages` and `Environments` from being shown on the main page.
 1. [ ] In the website field put the full url to the repository on our GitLab.
--- a/group_vars/all/common.yml
+++ b/group_vars/all/common.yml
@@ -16,3 +16,4 @@ fail2ban_jails:
  sshd: true
  postfix: false
  dovecot: false
+  nginx_limit_req: false
--- a/group_vars/all/vault_aurweb.yml
+++ b/group_vars/all/vault_aurweb.yml
-$ANSIBLE_VAULT;1.1;AES256
-66613036313336393231313839303731346131383434303632626336653231383532333236663031
-6431643637346238646633353039356430363533643332380a303836626635366261383064393339
-32383263356566373061363961623864663038666230306239666562333336343963336631306438
-3638663363323565300a343665383330323837643135653439623733396636616639636364646430
-61653538623662366636396132313031326632313162373063363562353932613136663166663238
-61393464343264306434396462613739613763366333353339343966343137386130636565623836
-313730336638643830386635306261346163
--- a/host_vars/archlinux.org/misc
+++ b/host_vars/archlinux.org/misc
@@ -10,3 +10,4 @@ fail2ban_jails:
  sshd: true
  postfix: false
  dovecot: false
+  nginx_limit_req: false
--- a/host_vars/aur-dev.archlinux.org
+++ b/host_vars/aur-dev.archlinux.org
--- a/host_vars/aur-dev.archlinux.org/vault_aurweb.yml
+++ b/host_vars/aur-dev.archlinux.org/vault_aurweb.yml
+$ANSIBLE_VAULT;1.1;AES256
+34333262646637333030666438633639653163316562626232383765383733323632353635626534
+6136663761633231326438323466366436626635363862370a633832383065626666346436633362
+31346430383730353234313166363665326663316233383561623765393834356661363134663138
+3233653039633830610a356631313330626533313239316662336138306664343436336630653362
+62653538663665336339636162316564323638303864636533393632633337396236653735663236
+65643965636166646165386335636462383866346139393934626335313033636330646239373265
+363331656536343431613936636331646233
--- a/host_vars/aur.archlinux.org
+++ b/host_vars/aur.archlinux.org
--- a/host_vars/aur.archlinux.org/vault_aurweb.yml
+++ b/host_vars/aur.archlinux.org/vault_aurweb.yml
+$ANSIBLE_VAULT;1.1;AES256
+39666139613363323634346538326233393165646338393231386136623839613135623232663665
+6636316361636366623031323331663138313635616431360a373633356434666434303063653564
+61636662616633393039343633376333343266373465646235386437336135346132303162373431
+6232383034626363340a653662373932396435356433616431303861313863363263656162663964
+63653661616438313031323639346236373339656139626561623166373664346438306639343862
+65613735663135653764363935366637313864616563373665393536316438393930306637313261
+633062343032303033303039646165613961
--- a/host_vars/mail.archlinux.org/misc
+++ b/host_vars/mail.archlinux.org/misc
@@ -6,6 +6,7 @@ fail2ban_jails:
  sshd: true
  postfix: true
  dovecot: true
+  nginx_limit_req: false

 ipv4_address: "95.216.189.61"
 ipv6_address: "2a01:4f9:c010:3052::1"

--- a/host_vars/patchwork.archlinux.org/misc
+++ b/host_vars/patchwork.archlinux.org/misc
@@ -8,3 +8,5 @@ fail2ban_jails:
  sshd: true
  postfix: false
  dovecot: false
+  nginx_limit_req: false
+
--- a/host_vars/secure-runner2.archlinux.org
+++ b/host_vars/secure-runner2.archlinux.org
---
-filesystem: "btrfs"
--- a/host_vars/wiki.archlinux.org
+++ b/host_vars/wiki.archlinux.org
@@ -6,3 +6,4 @@ fail2ban_jails:
  sshd: true
  postfix: false
  dovecot: false
+  nginx_limit_req: false
--- a/misc/vault_github.yml
+++ b/misc/vault_github.yml
 $ANSIBLE_VAULT;1.1;AES256
-33623431303030613732373261366564343339366231386166323062303232383135636437363739
-3931333366613637623938313661393434663130323039360a663564663438636665666632323166
-63386634636461626234653233666362376530326135636130366465343661363731393266636638
-3131313235306262660a333230616130633637306638623438636532623534313038633031633135
-33636335336638373835363734376564323234353339333066376562356530353364313031356166
-65363735313464616462396639303534623937363135386335316334323066316561313865633235
-65363063356262656566666164646330363665613136663730656165346161323437616437373366
-65323836636166373464616461633838343030353036353235363738343363396534306236653134
-61613064363131393530623637356363373236646539356135396535376235313561616235393462
-38646434393164626262633339656235333034386663316264613831303638643466383131643361
-30303661393362396137333832343163393561653563396333636232633339353261663733653232
-64343664616566616430323539643266663233373833373235646330633435316134393265303165
-63626162393665383065323232336232626438316164326634333939643566393238326166353939
-65653530663439393061346637323363623731323631626433623765303366376665306136623831
-37373266663433363432336663333335393933303038366561613737366665613237326666386438
-35323839393236643239663337356631613038356534303733666238316666393034623733303563
-62373563353365343230666462363035356530366536353139663339313065396231653663383433
-30653236316164353836636632363962393132343864333132303530326139386439636331303362
-36313232383264656666386632643364363835383163663165616163366334343830663362393737
-32363565633833623937
+63303766353166313665353834656537616437396338333965333363656639316431613838653765
+3236373532383033353065356234333936613861616632650a306436323264626230343233346130
+33316636633366613831316366666334356330323130653430653032663461323538623039643365
+6530393963333032640a663939353539636263356438626139616130643835666533323562623766
+33653830346430653737633839333730373030333663366630396163666561633135343839653930
+63666237666264376166336134323566316537343437343133656136356130623731653734373137
+61643962613833613537653565646433323136663364653231623861626164663963356137623163
+31613463636137356563653138353764303162376132373336333662666662323533643261313531
+33643538656364663939373062613262636164306363366131356137643264643130313830383364
+61633637363565623738663934363133376638653463326130333539316263316362376235643235
+65333031643761323533633165323237633062313363643131656365396431313462396334376438
+64393239393634663438356334346239353132313038653264363361313566316233376566623466
+31373635626562393962396137326431653665336362653663643866373935386438366438356237
+66333332643039623536623334653233346539633763303337363961346533643335373536363363
+66653366613262626337653861663636383630653561303231336639656438383638633062346139
+32383262373032373438653364646564643538363564393638333063363738643131613432356337
+65646161306665653861633733626234643133366435306338353937376338303533663165363834
+39303131356632386537646238666339323136656432393633303437313833353565353963323436
+36326132616431616563373333326630306235373438643838646265363031383631616430663033
+66636365373961386339396236633162313861383566636566303265303331373036303561343834
+37663235343136386530353839643766326561306435663339356464316533383863356661363362
+35643236653931303135383939326163656461616330366339623166623837343961373366613566
+64396231316130623730333165376165313063653561626165613734396634346331623135336264
+63653931316537346337366561303962383031396665316634653836306663306363633766646439
+34636236623338353732356639613162306663356336343663303361326231646363346634366139
+31343035336662613633323935376631616664313561626165343931353436323665366466323234
+62373434633830666461343862323933366366333332353762663333666662646163653039643065
+62613635383266373232383133363737313335353637333666313138303964633862363632623235
+35623763386239323031623437373836303538613737636537396634666462303531626564393132
+65313136306231363933393064366636393830306436643462656238353134393761326665306231
+62356562633964306265363235396139636532653462306432316632633065323532353865646530
+33326663313537643133366362653361616134643963343139373364633636636564313834616239
+3964
--- a/playbooks/man.archlinux.org.yml
+++ b/playbooks/man.archlinux.org.yml
@@ -17,4 +17,4 @@
    - { role: promtail }
    - { role: postgres }
    - { role: uwsgi }
-    - { role: archmanweb, archmanweb_version: 'v1.1' }
+    - { role: archmanweb, archmanweb_version: 'v1.2' }
--- a/roles/archmanweb/tasks/main.yml
+++ b/roles/archmanweb/tasks/main.yml
@@ -15,6 +15,7 @@
      - pyalpm
      - python-chardet
      - python-django
+      - python-django-csp
      - python-psycopg2
      - python-requests
      - python-xtarfile

--- a/roles/keycloak/files/theme/archlinux/account/index.ftl
+++ b/roles/keycloak/files/theme/archlinux/account/index.ftl
@@ -57,7 +57,7 @@
            <#if referrer??>
                var referrer = '${referrer}';
                var referrerName = '${referrerName}';
-                var referrerUri = '${referrer_uri?no_esc}';
+                var referrerUri = '${referrer_uri}'.replace('&amp;', '&');
            </#if>

            <#if msg??>
@@ -146,7 +146,7 @@
 <div id="spinner_screen" style="display:block; height:100%">
    <div style="width: 320px; height: 328px; text-align: center; position: absolute; top:0;	bottom: 0; left: 0;	right: 0; margin: auto;">
                <#if properties.logo?has_content>
-                <img src="${resourceUrl}${properties.logoDark}" alt="Logo" class="brand">
+                <img src="${resourceUrl}${properties.logo}" alt="Logo" class="brand">
                <#else>
                <img src="${resourceUrl}/public/archlinux-logo-dark.svg" alt="Logo" class="brand">
                </#if>

--- a/roles/keycloak/files/theme/archlinux/login/login-config-totp.ftl
+++ b/roles/keycloak/files/theme/archlinux/login/login-config-totp.ftl
 <#import "template.ftl" as layout>
-<@layout.registrationLayout displayInfo=true displayRequiredFields=true; section>
+<@layout.registrationLayout displayRequiredFields=false displayMessage=!messagesPerField.existsError('totp','userLabel'); section>

    <#if section = "header">
        ${msg("loginTotpTitle")}
-
    <#elseif section = "form">
-
-    <div class="alert alert-warning">
-    <span class="${properties.kcFeedbackWarningIcon}"></span>
-    ${kcSanitize(msg("totp-registration-warning"))?no_esc}
-    </div>
-
-    <ol id="kc-totp-settings">
-        <li>
-            <p>${msg("loginTotpStep1")}</p>
-
-            <ul id="kc-totp-supported-apps">
-                <div style="margin-bottom: 10px; float: left; width: 40%">
-                    <h4>Android</h4>
-                    <ul style="margin-top: -5px;">
-                        <li><a target="_blank" rel="noopener noreferrer" href="https://getaegis.app/">Aegis</a></li>
-                        <li><a target="_blank" rel="noopener noreferrer" href="https://github.com/andOTP/andOTP">andOTP</a></li>
-                        <li><a target="_blank" rel="noopener noreferrer" href="https://github.com/helloworld1/FreeOTPPlus">FreeOTP+</a></li>
-                    </ul>
-                </div>
-                <div style="margin-bottom: 10px; float: left; width: 60%">
-                    <h4>iOS</h4>
-                    <ul style="margin-top: -5px;">
-                        <li><a target="_blank" rel="noopener noreferrer" href="https://authy.com/">Authy</a></li>
-                        <li><a target="_blank" rel="noopener noreferrer" href="https://lastpass.com/auth/">LastPass Authenticator</a></li>
-                        <li><a target="_blank" rel="noopener noreferrer" href="https://cooperrs.de/otpauth.html ">OTP Auth</a></li>
-                    </ul>
-                </div>
-            </ul>
-        </li>
-
-        <#if mode?? && mode = "manual">
+        <div class="alert alert-warning">
+            <span class="${properties.kcFeedbackWarningIcon}"></span>
+            ${kcSanitize(msg("totp-registration-warning"))?no_esc}
+        </div>
+        <ol id="kc-totp-settings">
            <li>
-                <p>${msg("loginTotpManualStep2")}</p>
-                <p><span id="kc-totp-secret-key">${totp.totpSecretEncoded}</span></p>
-                <p><a href="${totp.qrUrl}" id="mode-barcode">${msg("loginTotpScanBarcode")}</a></p>
+                <p>${msg("loginTotpStep1")}</p>
+
+                <ul id="kc-totp-supported-apps">
+                    <div style="margin-bottom: 10px; float: left; width: 40%">
+                        <h4>Android</h4>
+                        <ul style="margin-top: -5px;">
+                            <li><a target="_blank" rel="noopener noreferrer" href="https://getaegis.app/">Aegis</a></li>
+                            <li><a target="_blank" rel="noopener noreferrer" href="https://github.com/andOTP/andOTP">andOTP</a></li>
+                            <li><a target="_blank" rel="noopener noreferrer" href="https://github.com/helloworld1/FreeOTPPlus">FreeOTP+</a></li>
+                        </ul>
+                    </div>
+                    <div style="margin-bottom: 10px; float: left; width: 60%">
+                        <h4>iOS</h4>
+                        <ul style="margin-top: -5px;">
+                            <li><a target="_blank" rel="noopener noreferrer" href="https://authy.com/">Authy</a></li>
+                            <li><a target="_blank" rel="noopener noreferrer" href="https://lastpass.com/auth/">LastPass Authenticator</a></li>
+                            <li><a target="_blank" rel="noopener noreferrer" href="https://cooperrs.de/otpauth.html ">OTP Auth</a></li>
+                        </ul>
+                    </div>
+                </ul>
            </li>
-            <li>
-                <p>${msg("loginTotpManualStep3")}</p>
-                <p>
+
+            <#if mode?? && mode = "manual">
+                <li>
+                    <p>${msg("loginTotpManualStep2")}</p>
+                    <p><span id="kc-totp-secret-key">${totp.totpSecretEncoded}</span></p>
+                    <p><a href="${totp.qrUrl}" id="mode-barcode">${msg("loginTotpScanBarcode")}</a></p>
+                </li>
+                <li>
+                    <p>${msg("loginTotpManualStep3")}</p>
+                    <p>
                    <ul>
                        <li id="kc-totp-type">${msg("loginTotpType")}: ${msg("loginTotp." + totp.policy.type)}</li>
                        <li id="kc-totp-algorithm">${msg("loginTotpAlgorithm")}: ${totp.policy.getAlgorithmKey()}</li>
@@ -54,58 +51,75 @@
                            <li id="kc-totp-counter">${msg("loginTotpCounter")}: ${totp.policy.initialCounter}</li>
                        </#if>
                    </ul>
-                </p>
-            </li>
-        <#else>
+                    </p>
+                </li>
+            <#else>
+                <li>
+                    <p>${msg("loginTotpStep2")}</p>
+                    <img id="kc-totp-secret-qr-code" src="data:image/png;base64, ${totp.totpSecretQrCode}" alt="Figure: Barcode"><br/>
+                    <p><a href="${totp.manualUrl}" id="mode-manual">${msg("loginTotpUnableToScan")}</a></p>
+                </li>
+            </#if>
            <li>
-                <p>${msg("loginTotpStep2")}</p>
-                <img id="kc-totp-secret-qr-code" src="data:image/png;base64, ${totp.totpSecretQrCode}" alt="Figure: Barcode"><br/>
-                <p><a href="${totp.manualUrl}" id="mode-manual">${msg("loginTotpUnableToScan")}</a></p>
+                <p>${msg("loginTotpStep3")}</p>
+                <p>${msg("loginTotpStep3DeviceName")}</p>
            </li>
-        </#if>
-        <li>
-            <p>${msg("loginTotpStep3")}</p>
-            <p>${msg("loginTotpStep3DeviceName")}</p>
-        </li>
-    </ol>
+        </ol>

-    <form action="${url.loginAction}" class="${properties.kcFormClass!}" id="kc-totp-settings-form" method="post">
-        <div class="${properties.kcFormGroupClass!}">
-            <div class="${properties.kcInputWrapperClass!}">
-                <label for="totp" class="control-label">${msg("authenticatorCode")}</label> <span class="required">*</span>
-            </div>
-            <div class="${properties.kcInputWrapperClass!}">
-                <input type="text" id="totp" name="totp" autocomplete="off" class="${properties.kcInputClass!}" />
-            </div>
-            <input type="hidden" id="totpSecret" name="totpSecret" value="${totp.totpSecret}" />
-            <#if mode??><input type="hidden" id="mode" name="mode" value="${mode}"/></#if>
-        </div>
+        <form action="${url.loginAction}" class="${properties.kcFormClass!}" id="kc-totp-settings-form" method="post">
+            <div class="${properties.kcFormGroupClass!}">
+                <div class="${properties.kcInputWrapperClass!}">
+                    <label for="totp" class="control-label">${msg("authenticatorCode")}</label> <span class="required">*</span>
+                </div>
+                <div class="${properties.kcInputWrapperClass!}">
+                    <input type="text" id="totp" name="totp" autocomplete="off" class="${properties.kcInputClass!}"
+                           aria-invalid="<#if messagesPerField.existsError('totp')>true</#if>"
+                    />
+
+                    <#if messagesPerField.existsError('totp')>
+                        <span id="input-error-otp-code" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
+                            ${kcSanitize(messagesPerField.get('totp'))?no_esc}
+                        </span>
+                    </#if>

-        <div class="${properties.kcFormGroupClass!}" ${messagesPerField.printIfExists('userLabel',properties.kcFormGroupErrorClass!)}">
-            <div class="${properties.kcInputWrapperClass!}">
-                <label for="userLabel" class="control-label">${msg("loginTotpDeviceName")}</label> <#if totp.otpCredentials?size gte 1><span class="required">*</span></#if>
+                </div>
+                <input type="hidden" id="totpSecret" name="totpSecret" value="${totp.totpSecret}" />
+                <#if mode??><input type="hidden" id="mode" name="mode" value="${mode}"/></#if>
            </div>

-            <div class="${properties.kcInputWrapperClass!}">
-                <input type="text" class="form-control" id="userLabel" name="userLabel" autocomplete="off">
+            <div class="${properties.kcFormGroupClass!}">
+                <div class="${properties.kcInputWrapperClass!}">
+                    <label for="userLabel" class="control-label">${msg("loginTotpDeviceName")}</label> <#if totp.otpCredentials?size gte 1><span class="required">*</span></#if>
+                </div>
+
+                <div class="${properties.kcInputWrapperClass!}">
+                    <input type="text" class="${properties.kcInputClass!}" id="userLabel" name="userLabel" autocomplete="off"
+                           aria-invalid="<#if messagesPerField.existsError('userLabel')>true</#if>"
+                    />
+
+                    <#if messagesPerField.existsError('userLabel')>
+                        <span id="input-error-otp-label" class="${properties.kcInputErrorMessageClass!}" aria-live="polite">
+                            ${kcSanitize(messagesPerField.get('userLabel'))?no_esc}
+                        </span>
+                    </#if>
+                </div>
            </div>
-        </div>

-        <#if isAppInitiatedAction??>
-            <input type="submit"
-                   class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonLargeClass!}"
-                   id="saveTOTPBtn" value="${msg("doSubmit")}"
-            />
-            <button type="submit"
-                    class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonLargeClass!} ${properties.kcButtonLargeClass!}"
-                    id="cancelTOTPBtn" name="cancel-aia" value="true" />${msg("doCancel")}
-            </button>
-        <#else>
-            <input type="submit"
-                   class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}"
-                   id="saveTOTPBtn" value="${msg("doSubmit")}"
-            />
-        </#if>
-    </form>
+            <#if isAppInitiatedAction??>
+                <input type="submit"
+                       class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonLargeClass!}"
+                       id="saveTOTPBtn" value="${msg("doSubmit")}"
+                />
+                <button type="submit"
+                        class="${properties.kcButtonClass!} ${properties.kcButtonDefaultClass!} ${properties.kcButtonLargeClass!} ${properties.kcButtonLargeClass!}"
+                        id="cancelTOTPBtn" name="cancel-aia" value="true" />${msg("doCancel")}
+                </button>
+            <#else>
+                <input type="submit"
+                       class="${properties.kcButtonClass!} ${properties.kcButtonPrimaryClass!} ${properties.kcButtonBlockClass!} ${properties.kcButtonLargeClass!}"
+                       id="saveTOTPBtn" value="${msg("doSubmit")}"
+                />
+            </#if>
+        </form>
    </#if>
 </@layout.registrationLayout>
\ No newline at end of file
--- a/roles/keycloak/files/theme/archlinux/login/webauthn-register.ftl
+++ b/roles/keycloak/files/theme/archlinux/login/webauthn-register.ftl
@@ -26,6 +26,14 @@
        <script type="text/javascript">

            function registerSecurityKey() {
+
+                // Check if WebAuthn is supported by this browser
+                if (!window.PublicKeyCredential) {
+                    $("#error").val("${msg("webauthn-unsupported-browser-text")?no_esc}");
+                    $("#register").submit();
+                    return;
+                }
+
                // mandatory parameters
                let challenge = "${challenge}";
                let userid = "${userid}";
@@ -167,4 +175,4 @@
        </#if>

    </#if>
-    </@layout.registrationLayout>
+    </@layout.registrationLayout>
\ No newline at end of file
--- a/roles/keycloak/files/theme/archlinux/welcome/index.ftl
+++ b/roles/keycloak/files/theme/archlinux/welcome/index.ftl
@@ -29,7 +29,7 @@
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta name="robots" content="noindex, nofollow">

-    <link rel="shortcut icon" href="${resourcesCommonPath}/img/favicon.ico" />
+    <link rel="shortcut icon" href="${resourcesPath}/img/favicon.ico" />

    <#if properties.stylesCommon?has_content>
        <#list properties.stylesCommon?split(' ') as style>
@@ -127,7 +127,7 @@
        </div>
      </div>
      <div class='footer'>
-        <#if properties.displayFooter = "true">
+        <#if properties.displayCommunityLinks = "true">
        <a href="http://www.jboss.org"><img src="welcome-content/jboss_community.png" alt="JBoss and JBoss Community"></a>
        </#if>
      </div>

--- a/roles/matrix/tasks/main.yml
+++ b/roles/matrix/tasks/main.yml
@@ -78,7 +78,7 @@
 - name: install synapse
  pip:
    name:
-      - 'matrix-synapse[postgres,systemd,url_preview,redis,oidc]==1.35.1'
+      - 'matrix-synapse[postgres,systemd,url_preview,redis,oidc]==1.36.0'
    state: latest
    extra_args: '--upgrade-strategy=eager'
    virtualenv: /var/lib/synapse/venv
@@ -92,7 +92,7 @@
 - name: install pantalaimon
  pip:
    name:
-      - 'pantalaimon==0.9.3'
+      - 'pantalaimon==0.10.0'
    state: latest
    extra_args: '--upgrade-strategy=eager'
    virtualenv: /var/lib/synapse/venv-pantalaimon
@@ -148,7 +148,7 @@
  git:
    repo: https://github.com/matrix-org/matrix-appservice-irc
    dest: /var/lib/synapse/matrix-appservice-irc
-    version: 0.26.1
+    version: 0.27.0-rc3
  become: true
  become_user: synapse
  become_method: sudo
No results found