- IPMI credentials for luna.archlinux.org
- Entry with no credentials for PIA boxes

Give artafinde access to the mailman servers

See merge request archlinux/infrastructure!593

artafinde wants to help with the mailman3 migration[1], so give him
access to the mailman servers.

[1] archlinux/infrastructure#59

Add Gandi account

See merge request archlinux/infrastructure!589

We want to deploy project documentation (ex: repod) with GitLab Pages
and due to security concerns[1], they should be deployed on a separate
domain.

Hetzner's Registration Robot[2] only supports a few TLDs and all the
good names have already been taken, and therefore we need a new domain
registrar. SPI has a partnership with Gandi, so Gandi it is.

[1] https://www.hetzner.com/registrationrobot
[2] https://github.blog/2013-04-09-yummy-cookies-across-domains/

This box somehow gets a compression ratio of over 12; bump its zram
fraction accordingly, to stop getting alerts about high swap usage.

borg_client: drop Restart=on-failure from services

See merge request archlinux/infrastructure!592

When a backup job fails it is usually something we want to look into and
understand its root cause before restarting the backup job. Therefore we
need to disable the restart-on-failure behavior we had previously set up.

prometheus: split crt.sh lookups into new script

See merge request archlinux/infrastructure!591

roles/prometheus/defaults/main.yml used to include a comment with the
commands used to generate a list of HTTPS endpoints to check. Move it
into a proper script and fix it to generate the correct current list.

Add top 15 prometheus metrics for gitlab exporter

See merge request archlinux/infrastructure!590

Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>

Ref #456

/usr/lib/systemd/system is for vendor-provided service unit files.

/tmp free space is generally limited on these smaller virtual servers,
so use /var/tmp which is more spacious. debuginfod uses this to cache
recently extracted files from archives.

debuginfod.archlinux.org runs into high swap often, but also gets good
compression ratio; try upping the zram size to 100% of RAM (from 50%).

We don't want our users tracked by a third party.

Extend the removal of the dashes from unencrypted YAML documents to
encrypted ones as well.

Fixes: a9e0790f ("Remove the three dashes from all YAML documents")

ansible-lint 6.3.0 throws an error about this.

Remove the three dashes from all YAML documents

See merge request archlinux/infrastructure!586

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

There is no need to run all playbooks for this.

loki: pull changes made to loki.yml on live

See merge request archlinux/infrastructure!585

The cloud server running Loki isn't powerful enough to do aggressive
query splitting; it makes queries execute slower and generates a lot
more queries, resulting in "too many outstanding requests" in recent
Loki versions. (Maybe a bug?)

The default log level is "info" which logs too much to the journal.

Since upgrading to Loki 2.5, the query frontend was trying to connect to
the wireguard address instead of 127.0.0.1. This appears to be caused by
upstream commit c0bec07e0de1a23cb72e8834069 ("Loki: Implement common net
interface/instance addr") which now defaults to "" instead of 127.0.0.1.

Doubt the Loki team is interested in our usage data, and it's also a
risk to the confidentiality of our logs (even though it's anonymous).

< wCPO> foutrelis: v12 fixes the "all chunks in the same directory"-issue

One month of logs is about 40G and suffices for our log retrieval needs.

Other than avoiding the conditional logic there's no reason to specify
/srv/ftp/pool/{packages,community} as additional cache directories for
all servers.

Restoring the default CacheDir value on machines without a local mirror
allows us to use pacdiff to perform a three-way merge of the few config
files which are easier to rebase this way.

Nothing fancy, just something to prevent automated form submissions.

archwiki: merge LocalSettings.archlinux.org.php from the archwiki git repo into LocalSettings.php.j2

See merge request archlinux/infrastructure!516