host_vars/u236610.your-storagebox.de

----
-ansible_ssh_user: "{{ hetzner_storagebox_username }}"
-known_host: "[u236610.your-storagebox.de]:23,[2a01:4f8:b16:3000::68]:23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIICf9svRenC/PLKIL9nk6K/pxQgoiFC41wTNvoIncOxs"

host_vars/wiki.archlinux.org/misc

 ---
 filesystem: btrfs
-memcached_socket: "/var/run/archwiki.sock"
+memcached_socket: "/run/memcached/archwiki.sock"
 
 fail2ban_jails:
   sshd: true

hosts

 [hetzner]
 secure-runner1.archlinux.org
 gemini.archlinux.org
-
-[rsync_net]
-prio.ch-s012.rsync.net
-
-[hetzner_storageboxes]
-u236610.your-storagebox.de
+build.archlinux.org
 
 [packet_net]
 runner2.archlinux.org
@@ -18,6 +13,11 @@ asia.mirror.pkgbuild.com
 america.mirror.pkgbuild.com
 europe.mirror.pkgbuild.com
 
+[geo_mirrors]
+asia.mirror.pkgbuild.com
+america.mirror.pkgbuild.com
+europe.mirror.pkgbuild.com
+
 [archive_mirrors]
 asia.mirror.pkgbuild.com
 america.mirror.pkgbuild.com
@@ -25,7 +25,6 @@ europe.mirror.pkgbuild.com
 
 [borg_clients]
 archlinux.org
-aur-dev.archlinux.org
 state.archlinux.org
 matrix.archlinux.org
 quassel.archlinux.org
@@ -45,10 +44,7 @@ patchwork.archlinux.org
 security.archlinux.org
 md.archlinux.org
 lists.archlinux.org
-
-[borg_hosts]
-prio.ch-s012.rsync.net
-u236610.your-storagebox.de
+gluebuddy.archlinux.org
 
 [public_html]
 homedir.archlinux.org
@@ -57,23 +53,23 @@ homedir.archlinux.org
 bbs.archlinux.org
 bugs.archlinux.org
 aur.archlinux.org
-aur-dev.archlinux.org
 wiki.archlinux.org
 
 [postgresql_servers]
-archlinux.org
-state.archlinux.org
-quassel.archlinux.org
 accounts.archlinux.org
-patchwork.archlinux.org
+archlinux.org
+md.archlinux.org
+matrix.archlinux.org
 man.archlinux.org
+patchwork.archlinux.org
+quassel.archlinux.org
+state.archlinux.org
 
 [nginx]
 archlinux.org
 bbs.archlinux.org
 bugs.archlinux.org
 aur.archlinux.org
-aur-dev.archlinux.org
 wiki.archlinux.org
 patchwork.archlinux.org
 security.archlinux.org
@@ -98,8 +94,6 @@ repro1.pkgbuild.com
 repro2.pkgbuild.com
 
 [memcached]
-aur.archlinux.org
-aur-dev.archlinux.org
 wiki.archlinux.org
 patchwork.archlinux.org
 
@@ -109,7 +103,6 @@ monitoring.archlinux.org
 [node_exporters]
 archlinux.org
 aur.archlinux.org
-aur-dev.archlinux.org
 monitoring.archlinux.org
 gitlab.archlinux.org
 reproducible.archlinux.org
@@ -141,11 +134,12 @@ md.archlinux.org
 man.archlinux.org
 dashboards.archlinux.org
 lists.archlinux.org
+gluebuddy.archlinux.org
+debuginfod.archlinux.org
 
 [wireguard]
 archlinux.org
 aur.archlinux.org
-aur-dev.archlinux.org
 monitoring.archlinux.org
 gitlab.archlinux.org
 reproducible.archlinux.org
@@ -177,6 +171,8 @@ md.archlinux.org
 man.archlinux.org
 dashboards.archlinux.org
 lists.archlinux.org
+gluebuddy.archlinux.org
+debuginfod.archlinux.org
 
 [kape_servers]
 asia.mirror.pkgbuild.com
@@ -184,3 +180,10 @@ america.mirror.pkgbuild.com
 europe.mirror.pkgbuild.com
 repro2.pkgbuild.com
 runner1.archlinux.org
+
+[dedicated_servers]
+gemini.archlinux.org
+build.archlinux.org
+runner1.archlinux.org
+runner2.archlinux.org
+secure-runner1.archlinux.org

misc/borg.sh

@@ -3,15 +3,22 @@
 set -eu
 shopt -s extglob
 
-OFFSITE_HOST=ch-s012.rsync.net
+OFFSITE_HOST=rsync.net
+ROOT_DIR=$(dirname "${0}")/..
 
-decrypted_gpg=$(mktemp)
-trap "rm \"${decrypted_gpg}\"" EXIT
+decrypted_gpg=$(mktemp arch-infrastructure-borg-XXXXXXXXX)
+trap "rm -f \"${decrypted_gpg}\"" EXIT
 [[ "$*" =~ $OFFSITE_HOST ]] && is_offsite=true || is_offsite=false
 
+# Use borg1 as the borg executable on offsite
+remote_path=borg
+if $is_offsite; then
+    remote_path=borg1
+fi
+
 # Find matching key
 matching_key=""
-for gpgkey in borg-keys/!(*-offsite.gpg); do
+for gpgkey in "$ROOT_DIR"/borg-keys/!(*-offsite.gpg); do
     key=$(basename "$gpgkey" .gpg)
     if [[ "$*" =~ $key ]]; then
         matching_key="$key"
@@ -25,8 +32,8 @@ if [[ -z "$matching_key" ]]; then
     echo "No matching keyfile found for this host"
     exit 1
 fi
-gpg --batch --yes --decrypt -aq --output "$decrypted_gpg" borg-keys/"$matching_key.gpg"
+gpg --batch --yes --decrypt -aq --output "$decrypted_gpg" "$ROOT_DIR/borg-keys/$matching_key.gpg"
 
-BORG_KEY_FILE="$decrypted_gpg" borg "$@"
+BORG_KEY_FILE="$decrypted_gpg" borg --remote-path=$remote_path "$@"
 
 rm "$decrypted_gpg"

misc/vault_github.yml

 $ANSIBLE_VAULT;1.1;AES256
-63303766353166313665353834656537616437396338333965333363656639316431613838653765
-3236373532383033353065356234333936613861616632650a306436323264626230343233346130
-33316636633366613831316366666334356330323130653430653032663461323538623039643365
-6530393963333032640a663939353539636263356438626139616130643835666533323562623766
-33653830346430653737633839333730373030333663366630396163666561633135343839653930
-63666237666264376166336134323566316537343437343133656136356130623731653734373137
-61643962613833613537653565646433323136663364653231623861626164663963356137623163
-31613463636137356563653138353764303162376132373336333662666662323533643261313531
-33643538656364663939373062613262636164306363366131356137643264643130313830383364
-61633637363565623738663934363133376638653463326130333539316263316362376235643235
-65333031643761323533633165323237633062313363643131656365396431313462396334376438
-64393239393634663438356334346239353132313038653264363361313566316233376566623466
-31373635626562393962396137326431653665336362653663643866373935386438366438356237
-66333332643039623536623334653233346539633763303337363961346533643335373536363363
-66653366613262626337653861663636383630653561303231336639656438383638633062346139
-32383262373032373438653364646564643538363564393638333063363738643131613432356337
-65646161306665653861633733626234643133366435306338353937376338303533663165363834
-39303131356632386537646238666339323136656432393633303437313833353565353963323436
-36326132616431616563373333326630306235373438643838646265363031383631616430663033
-66636365373961386339396236633162313861383566636566303265303331373036303561343834
-37663235343136386530353839643766326561306435663339356464316533383863356661363362
-35643236653931303135383939326163656461616330366339623166623837343961373366613566
-64396231316130623730333165376165313063653561626165613734396634346331623135336264
-63653931316537346337366561303962383031396665316634653836306663306363633766646439
-34636236623338353732356639613162306663356336343663303361326231646363346634366139
-31343035336662613633323935376631616664313561626165343931353436323665366466323234
-62373434633830666461343862323933366366333332353762663333666662646163653039643065
-62613635383266373232383133363737313335353637333666313138303964633862363632623235
-35623763386239323031623437373836303538613737636537396634666462303531626564393132
-65313136306231363933393064366636393830306436643462656238353134393761326665306231
-62356562633964306265363235396139636532653462306432316632633065323532353865646530
-33326663313537643133366362653361616134643963343139373364633636636564313834616239
-3964
+34366663666237373063313736626639313462333261316465303963636237666330663235326364
+6363623561623637353062646237353765393139353632610a633134373336303065613863613339
+62633733323238356439383462376165633731366235393234303865313133663030386230343636
+6531336235383330650a653366633632616637626631303836373533303262623739623430626637
+62663661303837633635383234613730366431343535383832343234313131343833383265656262
+36656265376237623330393136623664646535616334323434333835303331346132386435323734
+30383439373330333136326436346138386363333764393962356465663166343633613831313262
+61313763666332373936383765373431333535366262626232653039613934383133346635383763
+63393732306461313666636231623138386634353132373139636131643230393464393465666237
+34386563636134613338666664316163333138666165376563386634326130303836613462383733
+30303565626333356435643037323033333837633364613532393332386663623837663837393338
+64363732343065666631326538373533353466376434346639656231386635646439613636303665
+66363836623735313130626561366138303239303966636338396439323032303066383535346134
+33653561666665313763313439316461613330343365333164316632333863623961373738393030
+36303965373832353566633539356532373666313461613835386136633861323161393361316464
+65653837633831366438383539336261653937613563383361366431656232313162623164386337
+36646335623862333035616133363262386338646532306563663963613462346632366362323862
+33343364636233386131326161396330393666643439353835666134313335646234356336386537
+34343035303662633533336537396161323034393366653032623839636130633436333337623739
+65626637316137363534653063613038626262356162643831336331333766323864316137636430
+30623338646135623739626166663839323637363061386465333237633462303734373339303963
+31643066303466626662663361376336326661666132386564326164313436653164346166666462
+31623462373863323462353039333537646462666331613439363234666639313161366261643837
+62663165303137333066666234666531316165396632303936656266663534666665663865386330
+65393263303165393132666561366330306262366637326239313937333662346364663066303463
+63323234623764393438346231636530616664353939626634366137663336333338646661653638
+33306635386537613264306361346662323835643538646133336666366536353065643930633965
+65306137316232313766666536366532643736396534373632323031353361333039393836633630
+64346633623232383661393965333332313065323965353534323631343263336361326533343763
+34653664346430383330653537663837653736346537383238323635643934373563646534613738
+34303237616339373734313130343437373237343366326365363938303134306265313665393364
+63666562316237363235326361656661613131343536633130396638303762356235613731663738
+6565

one-shots/keycloak-importer/archusers.yml

@@ -191,12 +191,6 @@ arch_users:
   #     - dev
   #     - multilib
   #     - tu
-  # eschwartz:
-  #   name: "Eli Schwartz"
-  #   ssh_key: eschwartz.pub
-  #   groups:
-  #     - tu
-  #     - multilib
   # escondida:
   #   name: "Ivy Foster"
   #   ssh_key: escondida.pub

packer/archlinux.json

@@ -10,16 +10,17 @@
             "custom_image": "archlinux"
         },
         "token": "{{ user `hetzner_cloud_api_key` }}",
-        "image": "ubuntu-18.04",
+        "image": "ubuntu-22.04",
         "server_type": "cx11",
         "ssh_username": "root",
-        "location": "nbg1",
+        "location": "fsn1",
         "rescue": "linux64"
     }],
     "provisioners": [{
         "type": "ansible",
         "playbook_file": "playbooks/tasks/install_arch.yml",
         "host_alias": "packer-base-image",
-        "inventory_directory": "."
+        "inventory_directory": ".",
+        "use_proxy": false
     }]
 }

playbooks/accounts.archlinux.org.yml

@@ -5,7 +5,6 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
     - { role: firewalld }
     - { role: wireguard }
     - { role: sshd }

playbooks/all-hosts-basic.yml

 ---
 
 - name: basic setup for all hosts
-  hosts: all,!hetzner_storageboxes,!rsync_net
+  hosts: all
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
     - { role: firewalld }
     - { role: wireguard }
     # reconfiguring sshd may break the AUR on luna (unchecked)
@@ -13,3 +12,4 @@
     - { role: root_ssh }
     - { role: borg_client, tags: ["borg"], when: "'borg_clients' in group_names" }
     - { role: hardening }
+    - { role: fail2ban }

playbooks/archive-mirrors.yml

@@ -4,7 +4,6 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
     - { role: firewalld }
     - { role: wireguard }
     - { role: hardening }

playbooks/archlinux.org.yml

@@ -3,17 +3,11 @@
 - name: "prepare postgres ssl hosts list"
   hosts: archlinux.org
   tasks:
-    - name: assign ipv4 addresses to fact postgres_ssl_hosts4
-      set_fact: postgres_ssl_hosts4="{{ [gemini4] + detected_ips }}"
+    - name: assign ipv4 addresses to fact postgres_hosts4
+      set_fact: postgres_hosts4="{{ [gemini4] + detected_ips }}"
       vars:
-        gemini4: "{{ hostvars['gemini.archlinux.org']['ipv4_address'] }}/32"
-        detected_ips: "{{ groups['mirrors'] | map('extract', hostvars, ['ipv4_address']) | select() | map('regex_replace', '^(.+)$', '\\1/32') | list }}"
-      tags: ["postgres", "firewall"]
-    - name: assign ipv6 addresses to fact postgres_ssl_hosts6
-      set_fact: postgres_ssl_hosts6="{{ [gemini6] + detected_ips }}"
-      vars:
-        gemini6: "{{ hostvars['gemini.archlinux.org']['ipv6_address'] }}/128"
-        detected_ips: "{{ groups['mirrors'] | map('extract', hostvars, ['ipv6_address']) | select() | map('regex_replace', '^(.+)$', '\\1/128') | list }}"
+        gemini4: "{{ hostvars['gemini.archlinux.org']['wireguard_address'] }}/32"
+        detected_ips: "{{ groups['mirrors'] | map('extract', hostvars, ['wireguard_address']) | select() | map('regex_replace', '^(.+)$', '\\1/32') | list }}"
       tags: ["postgres", "firewall"]
 
 - name: setup archlinux.org
@@ -21,16 +15,15 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
     - { role: sshd }
     - { role: root_ssh }
     - { role: borg_client, tags: ["borg"] }
     - { role: certbot }
     - { role: nginx }
-    - { role: postfix, postfix_relayhost: "mail.archlinux.org" }
+    - { role: postfix_null }
     - role: postgres
-      postgres_listen_addresses: "*"
-      postgres_ssl: 'on'
+      postgres_listen_addresses: "localhost, {{ wireguard_address }}"
+      postgres_firewalld_zone: wireguard
     - { role: sudo }
     - { role: uwsgi }
     - { role: memcached }

playbooks/aur-dev.archlinux.org.yml

----
-
-- name: setup aur-dev.archlinux.org
-  hosts: aur-dev.archlinux.org
-  remote_user: root
-  roles:
-    - { role: common }
-    - { role: tools }
-    - { role: sshd, sshd_enable_includes: true }
-    - { role: root_ssh }
-    - { role: certbot }
-    - { role: nginx }
-    - { role: mariadb, mariadb_query_cache_type: '0', mariadb_innodb_file_per_table: true }
-    - { role: sudo }
-    - { role: php_fpm, php_extensions: ['iconv', 'memcached', 'mysqli', 'pdo_mysql'], zend_extensions: ['opcache'] }
-    - { role: memcached }
-    - { role: uwsgi }
-    - { role: borg_client, tags: ["borg"] }
-    - { role: postfix, postfix_relayhost: "mail.archlinux.org" }
-    - { role: fail2ban }
-    - { role: aurweb, aurweb_domain: 'aur-dev.archlinux.org', aurweb_version: 'pu' }
-    - { role: prometheus_exporters }
-    - { role: promtail }
-    - { role: wireguard }

playbooks/aur.archlinux.org.yml

@@ -5,20 +5,18 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
     - { role: sshd, sshd_enable_includes: true }
     - { role: root_ssh }
     - { role: prometheus_exporters }
     - { role: promtail }
     - { role: certbot }
     - { role: nginx }
-    - { role: mariadb, mariadb_query_cache_type: '0', mariadb_innodb_file_per_table: true, mariadb_innodb_buffer_pool_size: '1G' }
+    - { role: mariadb, mariadb_innodb_buffer_pool_size: '1G' }
     - { role: sudo }
-    - { role: php_fpm, php_extensions: ['iconv', 'memcached', 'mysqli', 'pdo_mysql'], zend_extensions: ['opcache'] }
-    - { role: memcached }
+    - { role: redis }
     - { role: uwsgi }
     - { role: borg_client, tags: ["borg"] }
-    - { role: postfix, postfix_relayhost: "mail.archlinux.org" }
+    - { role: postfix_null }
     - { role: fail2ban }
     - { role: aurweb }
     - { role: wireguard }

playbooks/bbs.archlinux.org.yml

@@ -5,17 +5,16 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
     - { role: sshd }
     - { role: root_ssh }
     - { role: certbot }
     - { role: nginx }
-    - { role: mariadb, mariadb_query_cache_type: '0', mariadb_innodb_file_per_table: true }
+    - { role: mariadb, mariadb_query_cache_type: '0', mariadb_innodb_buffer_pool_size: '512M' }
     - { role: sudo }
     - { role: php_fpm, php_extensions: ['apcu', 'iconv', 'intl', 'mysqli'], zend_extensions: ['opcache'] }
     - { role: fluxbb }
     - { role: borg_client, tags: ["borg"] }
-    - { role: postfix, postfix_relayhost: "mail.archlinux.org" }
+    - { role: postfix_null }
     - { role: fail2ban }
     - { role: prometheus_exporters }
     - { role: promtail }

playbooks/bugs.archlinux.org.yml

@@ -5,17 +5,16 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
     - { role: sshd }
     - { role: root_ssh }
     - { role: certbot }
     - { role: nginx }
-    - { role: mariadb, mariadb_query_cache_type: '0', mariadb_innodb_file_per_table: true }
+    - { role: mariadb }
     - { role: sudo }
     - { role: php7_fpm, php_extensions: ['mysqli'], zend_extensions: ['opcache'] }
     - { role: flyspray }
     - { role: borg_client, tags: ["borg"] }
-    - { role: postfix, postfix_relayhost: "mail.archlinux.org" }
+    - { role: postfix_null }
     - { role: fail2ban }
     - { role: prometheus_exporters }
     - { role: promtail }

playbooks/build.archlinux.org.yml

@@ -5,7 +5,7 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
+    - { role: tools, extra_utils: ['setconf'] }
     - { role: sshd }
     - { role: root_ssh }
     - { role: archusers }

playbooks/dashboards.archlinux.org.yml

@@ -5,7 +5,6 @@
     - { role: firewalld }
     - { role: wireguard }
     - { role: common }
-    - { role: tools }
     - { role: sshd }
     - { role: root_ssh }
     - { role: hardening }

playbooks/debuginfod.archlinux.org.yml

+---
+- name: setup debuginfod.archlinux.org
+  hosts: debuginfod.archlinux.org
+  remote_user: root
+  roles:
+    - { role: common }
+    - { role: firewalld }
+    - { role: wireguard }
+    - { role: hardening }
+    - { role: sshd }
+    - { role: root_ssh }
+    - { role: certbot }
+    - { role: nginx }
+    - { role: debuginfod }
+    - { role: syncdebug }
+    - { role: prometheus_exporters }
+    - { role: promtail }

playbooks/gemini.archlinux.org.yml

@@ -4,8 +4,7 @@
   hosts: gemini.archlinux.org
   remote_user: root
   vars:
-    archweb_db_host: 'archlinux.org'
-    dbscripts_commit: '20191022'
+    archweb_db_host: "{{ hostvars['archlinux.org']['wireguard_address'] }}"
   roles:
     - { role: common }
     - { role: tools }
@@ -18,13 +17,13 @@
     - { role: certbot }
     - { role: nginx }
     - { role: archusers }
-    - { role: dbscripts, repos_domain: "repos.archlinux.org", repos_rsync_domain: "rsync.archlinux.org", svntogit_repos: "/srv/svntogit/repos", postgres_ssl: 'on', tags: ['archusers'] }
+    - { role: dbscripts, repos_domain: "repos.archlinux.org", repos_rsync_domain: "rsync.archlinux.org", svntogit_repos: "/srv/svntogit/repos", tags: ['archusers'] }
     - { role: arch_boxes_sync }
     - { role: archweb, archweb_site: false, archweb_services: true, archweb_mirrorcheck_locations: [5, 6] }
     - { role: sources, sources_domain: "sources.archlinux.org", sources_dir: "/srv/sources" }
     - { role: archive }
     - { role: archive_web }
-    - { role: postfix, postfix_relayhost: "mail.archlinux.org" }
+    - { role: postfix_null }
     - { role: fail2ban }
     - { role: prometheus_exporters }
     - { role: promtail }

playbooks/gitlab.archlinux.org.yml

@@ -5,7 +5,6 @@
   remote_user: root
   roles:
     - { role: common }
-    - { role: tools }
     - { role: firewalld }
     - { role: wireguard }
     - { role: sshd }