Add hedgedoc as new service

See merge request archlinux/infrastructure!292

This adds a collaborative markdown editor as newly offered service which
is available via login for all Arch Linux Staff with an option to allow
anonymous edits by users (not default). Users are managed via keycloak
and require the Staff role to be allowed in, non staff keycloak users
currently will receive an internal server error due to an upstream
issue.

Enable aurweb-usermaint timer

Closes #106

See merge request archlinux/infrastructure!290

According to 'doc/maintenance.txt' the usermaint service needs to be
every 2 hours. To remove the last login IP address of all users that did
not login for 7 days.

Closes: #106

Remove dragon (fixes #267)

Closes #267

See merge request archlinux/infrastructure!291

Restart failed backups (fixes #270)

Closes #270

See merge request archlinux/infrastructure!288

The reason is that we might want to independently retry the offsite backup in case it fails but not rerun the primary backup in that case.
This isn't possible with the current setup and so we'll have to split this up into two oneshot services.
The way it works is that borg-backup.service will schedule borg-backup-offsite.service to run after it which ensures that
no two backups are running at the same time and also that they can be indendently retried if one of them fails.

Add a btrfs prometheus exporter

See merge request archlinux/infrastructure!282

Collect prometheus btrfs errors from the btrfs command from btrfs-progs
which since 5.10 supports json output for device stats. The collected
errors will in the future trigger an alert when the errors reach a
certain treshold.

Add my build host key to build.archlinux.org

See merge request archlinux/infrastructure!286

Document how to add a new mirror

See merge request archlinux/infrastructure!283

Add build.archlinux.org

See merge request archlinux/infrastructure!285

To allow packagers to test their changes in the testing repos, enable
them for rebuilderd.

Make Kape archive mirror, also regular mirrors.

Closes #231

See merge request archlinux/infrastructure!284

To reduce bandwidth on mirror.pkgbuild.com.

Closes: #231

Setup monitoring of SMTP, SMTP Submission(s), IMAPS and POP3S

See merge request archlinux/infrastructure!206

dovecot: Only enable needed sieve extensions

See merge request archlinux/infrastructure!257

Kristian Klausen authored 4 years ago and Frederik Schwan committed 4 years ago

The enotify extension can be used to send mails as other users, so let's
only enabled the sieve extensions, which we need.
The extensions was found by running `grep require` on the existing sieve
user scripts. mailbox wasn't in that list, but it is used by the global
spam-to-folder.sieve script.

Configure mediawiki's security headers

See merge request archlinux/infrastructure!278

Mediawiki allows the configuration of Referrer policy, which is set to
the same value as archlinux.org, retaining the referrer for https://
links as they might be beneficial as promotion. Set the X-Frame-Options
header to deny framing.

improve terraform handling of virtual machine domains

See merge request archlinux/infrastructure!280

machine.domain has been an mandatory attribute which creates
<domain>.archlinux.org entries automagically. For migrations this can be
a problem if <domain>.archlinux.org supposed to point to a different
machine. Adding the new machine with the same domain leads to additional
DNS entries. The DNS ends up pointing to both machines in this case.
By making the domain attribute optional for machines, we allow the new
machines to be created without any domain pointing to them.

Monitor man.archlinux.org

See merge request archlinux/infrastructure!281

Merge sogrep (createlinks script) into dbscripts

See merge request archlinux/infrastructure!279

Databases used by sogrep are fetched by syncrepo from gemini, no point
in duplicating this work; consider this to be part of roles/dbscripts.

Deploy archmanweb v1.1

See merge request archlinux/infrastructure!277

GitLab becomes unhappy if it can't poll localhost.