gitlab_runner: Set reasonable NOFILE limits to avoid bugs

See merge request archlinux/infrastructure!693

The default limits cause issues as reported upstream[1][2], it also
breaks the mkinitcpio CI[3]. So match the limits set in systemd since
v240[4].

[1] https://github.com/moby/moby/issues/38814
[2] https://github.com/containerd/containerd/pull/7566
[3] archlinux/mkinitcpio/mkinitcpio@da223d2f
[4] https://github.com/systemd/systemd/blob/4f44d2c4f76922a4f48dd4473e6abaca40d7e555/NEWS#L6556-L6590

Move GitLab's container registry to a dedicated domain (registry.al.org)

See merge request archlinux/infrastructure!697

It looks more professional and we can move it to a dedicated box if the
load increases.

This syncs the lock file with the latest change where we switched the
provider for uptimerobot

terraform: update stage2 provider version declaration

See merge request archlinux/infrastructure!696

Levente Polyak authored 2 years ago and Levente Polyak committed 2 years ago

In commit d31f8404 we changed the
terraform provider for uptimerobot. Reflect this change in the terraform
lock file and provider version declaration.

terraform: fix package maintainer team groups

See merge request archlinux/infrastructure!695

Levente Polyak authored 2 years ago and Levente Polyak committed 2 years ago

Previously we have declared explicit resources for the roles under the
root. This lead to the desired groups getting created twice, once via
toSet of the package maintainer team and once per resource under the
root.

Furthermore remove the package maintainer roles, currently we do not
need any roles to define permissions. We can simply use the groups to
easily assign users into. Those group assignments can be queries for
example by gluebuddy to act upon or queried by a saml client.

Fixes 941563f2

terraform: add junior packager groups and roles for core/extra

See merge request archlinux/infrastructure!674

Leonidas Spyropoulos authored 2 years ago and Levente Polyak committed 2 years ago

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Add "noqa no-changed-when" tags to handlers using the command module.
Perhaps it is wrong of ansible-lint to flag these, since handlers are
not the best place to have conditional execution.

[1] https://github.com/keycloak/keycloak/pull/15746

Fix #501

terraform: update uptimerobot to a different provider

See merge request archlinux/infrastructure!689

https://blog.uptimerobot.com/december-2022-we-are-introducing-sub-users-and-new-plans/



Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

archwiki: upgrade to 1.39.2-1

See merge request archlinux/infrastructure!694

The credentials are stored in $HOME/.ia instead of $HOME/.config/ia.ini.

Also update the repo URL to point to our GitLab.

Also stop using oauth_auto_login and switch to provider specific
auto_login option.

Offboard kkeen as TU

See merge request archlinux/infrastructure!691

aurweb: update to 6.2.2

See merge request archlinux/infrastructure!692

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

It's incompatible with Keycloak 21.

Re-enabling of metrics is tracked in #499.

[1] https://github.com/aerogear/keycloak-metrics-spi/issues/155

Add yan12125 to multilib group

See merge request archlinux/infrastructure!690

common: smartd.conf: disable long self-tests

Closes #498

See merge request archlinux/infrastructure!687

The disks on gemini show increased write latency every now and then,
and this appears to correlate with when long self-tests are running.

Fixes #498

Chonky packages are chonky. The extra 25G should last us 6-12 months.

Add jail for http users

See merge request archlinux/infrastructure!683

Jelle van der Waa authored 2 years ago and Jelle van der Waa committed 2 years ago

Currently the tracker is hammered by a scraper which causes high load if
we don't actually ban the user.

tasks/upgrade-servers: upgrade Keycloak box first

Closes #496

See merge request archlinux/infrastructure!685

matrix.archlinux.org doesn't like it when accounts.archlinux.org is
unavailable at start-up. Try to work around this by upgrading
accounts.archlinux.org first and doing a health check before proceeding
to update the rest of the servers.

Fixes: #496

90 seconds isn't enough time for keycloak's ExecStartPre cmd to finish.