New buildserver

See merge request archlinux/infrastructure!791

Requested by @anthraxx 

The servers have been configured with the common and firewalld roles.

archbuild: Adapt the sudoers file to the new group structure

Closes #560

See merge request archlinux/infrastructure!787

fixes archlinux/infrastructure#560



Signed-off-by: Christian Heusel <christian@heusel.eu>

Give gromit access to the build server

See merge request archlinux/infrastructure!788

related to archlinux/infrastructure!787



Signed-off-by: Christian Heusel <christian@heusel.eu>

archwiki: update robots.txt

See merge request archlinux/infrastructure!785

Jakub Klinkovský authored 1 year ago and Christian Heusel committed 1 year ago

- The /index.php? rule disallows all URLs with this prefix, so using
  longer prefixes does not make sense.
- Allow indexing of the Help: namespace which contains relevant text.
- Keep the intention of disallowing special namespaces, including the
  File: alias for Image: and using the /title/ path and colon separator
  for the namespace prefix.

improve on-/offboarding templates

See merge request archlinux/infrastructure!780

Signed-off-by: Christian Heusel <christian@heusel.eu>

archwiki: Update to version 1.41.0-2

See merge request archlinux/infrastructure!784

https://phabricator.wikimedia.org/T353985



Signed-off-by: Christian Heusel <christian@heusel.eu>

This also switches from Extension:NativeSVGHandler to the now builtin
$wgSVGNativeRendering which was introduced in version 1.41.0.

Signed-off-by: Christian Heusel <christian@heusel.eu>

It was not supposed to go in the commit and it will be added at later
date, when it is ready(ish).

Fixes: 122eb202 ("Add dedicated Fastly billing account")

The new key is under pubkeys/heftig_nitrokey.pub, and pubkeys/heftig.pub
was renamed to pubkeys/heftig_yubikey.pub. Update root_ssh_keys to refer
to "heftig_nitrokey.pub" as "heftig.pub" does not exist anymore.

Fixes: 13a4bddf ("pubkeys/heftig: Add my new Nitrokey, reorganize")

Follow-up to merge request archlinux/infrastructure!786. New key is
already trusted by four master keys in archlinux-keyring 20231222-1.

archlinux/archlinux-keyring#254

pubkeys/heftig: Add my new Nitrokey, reorganize

See merge request archlinux/infrastructure!786

Otherwise the page tends to get cluttered up with inactive users.

It needs to match Prometheus' scrape_interval setting, so
$__rate_interval does not drop below the minimum interval.

Fixes the following error logged to the journal:

> prometheus-mysqld-exporter[2247]: ts=2023-12-24T13:16:45.938Z
> caller=exporter.go:173 level=error msg="Error from scraper"
> scraper=slave_status target=localhost:3306 err="Error 1227 (42000):
> Access denied; you need (at least one of) the SLAVE MONITOR privilege(s)
> for this operation"

[1] https://github.com/prometheus/mysqld_exporter/issues/640

The form action RegistrationProfile has been removed in Keycloak 23.

Relevant information from the upgrading guide [1]:

> The validation of user attributes as well as creation of the user
> including all that user’s attributes is handled by
> RegistrationUserCreation form action and hence RegistrationProfile
> is not needed anymore.

[1] https://www.keycloak.org/docs/23.0.0/upgrading/#removed-registrationprofile-form-action



Co-authored-by: Kristian Klausen <kristian@klausen.dk>

Grafana complains otherwise:

logger=provisioning.dashboard type=file name=default
t=2023-12-23T21:25:35.96456815Z level=error msg="failed to save dashboard"
file=/var/lib/grafana/dashboards/dashboards/archive.json
error="Unique identifier needed to be able to get a dashboard"

The format of the MySQL user credentials has been slightly changed:
https://github.com/prometheus/mysqld_exporter/releases/tag/v0.15.0

So he can help updating gitlab.

Fix #554

Our free plan no longer supports 60-second interval for monitors.

keycoak: Make last name optional and enable v3 of the account console

See merge request archlinux/infrastructure!730

We have a few staff and users who prefer using a alias/mononym, so let's
make it optional.

Since our custom Keycloak theme does not use v3[1][2] of the account
console yet, it is not aware that the last name is optional, so
unfortunately the user cannot change "personal info" in the account
console without also specifying the last name. This only affects the
account console, the initial user configuration can be done without
specifying a last name.

[1] https://gitlab.archlinux.org/archlinux/keycloak-archlinux-theme/-/blob/238889fb36d512f0baa328fad00531ef53c14c1f/lib/src/main/resources/theme/archlinux/account/theme.properties#L1
[2] https://www.keycloak.org/2023/04/keycloak-2110-released#_experimental_account_console_version_3