Brings support for managing Primary IPs.

There's a bit of a chicken and egg situation here but it's preferable to
manage the server's attributes the same way as all of the cloud servers.

gitlab: include task to prune unused docker images

See merge request archlinux/infrastructure!603

After starting a new container with the latest version of GitLab, opt to
remove older docker images so they do not take up disk space needlessly.

Add new mirrors in Seoul and Sydney

See merge request archlinux/infrastructure!602

Also tweak the documentation on rebuilderd workers and add runner1.

We do not really want to make all mirrors run mirrorcheck, so make it
conditional based on whether archweb_mirrorcheck_locations is defined.

The sshd role needs to open a firewall hole and will fail if firewalld
isn't present. Also place the wireguard role right after firewall role
because it is needed by promtail further down.

The upstream `sample_config.yaml` is now minimal, so we cannot diff with
it anymore.

archwiki: LocalSettings.php: give registered users the 'writeapi' right

See merge request archlinux/infrastructure!601

Adding/removing pages from the whitelist when using the Vector skin requires the write API now.
Without this, regular users get this error:

    You're not allowed to edit this wiki through the API.

archwiki: upgrade to 1.38.1-1

See merge request archlinux/infrastructure!598

Jakub Klinkovský authored Jul 04, 2022 and Kristian Klausen committed Jul 05, 2022

- $wgScriptExtension was removed in MW 1.31
- $wgDBmysql5 was removed in MW 1.33
- $wgShowIPinHeader was removed in MW 1.27
- $wgUseETag was removed in MW 1.28
- $wgEnableWriteAPI was removed in MW 1.32
- $wgShowSQLErrors was removed in MW 1.37

Jakub Klinkovský authored Jul 03, 2022 and Kristian Klausen committed Jul 05, 2022

$wgFragmentMode = [ 'html5', 'legacy' ]; is the default value since
MediaWiki 1.37:
https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:$wgFragmentMode

Jakub Klinkovský authored Jul 03, 2022 and Kristian Klausen committed Jul 05, 2022

These were fixed in MediaWiki 1.38

Jakub Klinkovský authored Jul 03, 2022 and Kristian Klausen committed Jul 05, 2022

Also updated some settings:

- The $wgShellLocale setting was removed from MediaWiki, see
  https://www.mediawiki.org/wiki/Special:MyLanguage/MediaWiki_1.38
- The "new" Vector skin got a name "vector-2022" and can be set simply
  by $wgDefaultSkin = 'vector-2022'; see
  https://www.mediawiki.org/wiki/Skin:Vector/2022#Note_about_1.38_release

archweb: use a whitelist for files in /iso/

See merge request archlinux/infrastructure!595

Allow only .sig, .torrent and .txt.

This is done to prevent downloading files such as https://archlinux.org/iso/latest/arch/boot/x86_64/vmlinuz-linux.

Add kpcyrd to multilib group

See merge request archlinux/infrastructure!600

install_arch: use versionless bootstrap tarball

See merge request archlinux/infrastructure!596

Since release 2022.07.01, there is a versionless bootstrap tarball file (archlinux-bootstrap-x86_64.tar.gz). See https://github.com/pierres/archiso-manager/pull/12.

"latest" is a valid version, so there is no need to check for the exact version number anymore.

archwiki: disable Lockdown extension

See merge request archlinux/infrastructure!597

This restores public access to recent changes, page history etc. which
was disabled in September 2019 due to misbehaving crawlers - see commits
https://github.com/archlinux/archwiki/commit/f2c518d3df94e9ad6898fdd03cac982902f8ac36
and https://github.com/archlinux/archwiki/commit/8595e8d66141e608db794f1deef3e52cb36e5e78.

Let's hope that our robots.txt has been improved since then and the
server load will not increase much. If it proves to be still a problem,
this commit can be reverted and we will figure out better solution.

Add new domain for project documentation (archlinux.page)

See merge request archlinux/infrastructure!594

Ref: archlinux/monthly-reports!1

Ref: archlinux/repod!65

We want non-DevOps to be able to deploy project documentation (ex:
repod) with GitLab Pages and a separate domain was considered the only
sensible solution due to security issues[1].

[1] https://github.blog/2013-04-09-yummy-cookies-across-domains/

- IPMI credentials for luna.archlinux.org
- Entry with no credentials for PIA boxes

Give artafinde access to the mailman servers

See merge request archlinux/infrastructure!593

artafinde wants to help with the mailman3 migration[1], so give him
access to the mailman servers.

[1] archlinux/infrastructure#59