This commit brings in four new routes to nginx:
- /archives/metadata.git
- /archives/users.git
- /archives/pkgbases.git
- /archives/pkgnames.git

See https://gitlab.archlinux.org/archlinux/aurweb/-/blob/master/doc/git-archive.md
for a detailed rundown on what these archive repositories are.

For those wishing to use archive metadata, see
https://gitlab.archlinux.org/archlinux/aurweb/-/blob/master/doc/repos/metadata-repo.md#popularity-calculation


for important consumer details.

These git archive repositories are intended to deprecate and supercede
aurweb-mkpkglists within two months of this feature being announced to
AUR helper projects.

For now, we will be updating the repositories once every 10 minutes
internally on the AUR server. When aurweb-mkpkglists is removed, we
should change this to a five minute interval to coincide with the
same interval that aurweb-mkpkglists used. From a client perspective,
they can still use a five minute interval to update their git
repositories, as this will work seamlessly between five minute and ten
minute intervals in terms of git updates.

Signed-off-by: Kevin Morris <kevr@0cost.org>

Ordering "when:" before "block:" makes it more readable I suppose.

Using templates anywhere but the end of the name makes grepping for
errors more difficult.

dovecot: Add shared mailbox for the mediation team

Closes #464

See merge request archlinux/infrastructure!616

Please see [1] and [2] for a better understanding of how this works.

[1] https://doc.dovecot.org/configuration_manual/authentication/password_databases_passdb/
[2] https://doc.dovecot.org/configuration_manual/authentication/user_databases_userdb/

Fix #464

The Ansible output is too noisy with all the skipped tasks; avoid this
by moving host-speicific tasks into their own files that get included.

Fix lint warnings and errors with ansible-lint 6.6.0

See merge request archlinux/infrastructure!631

Seems ansible-lint thinks a task calling the unqualified user module is
"not valid under any of the given schemas (schema[tasks])".

Not sure why this is needed but whatever. 

https://github.com/ansible/schemas/discussions/227

Prevents the following lint failure:

  jinja: You need to install "jmespath" prior to
         running json_query filter (jinja[invalid])

The service was enabled in arch-boxes to account for "hardware clock is
not in UTC, but instead UTC+X"[1], in our case the (VM) hardware clock
is in UTC and we therfor don't need the slow systemd-time-wait-sync
service (+30 seconds).

[1] archlinux/arch-boxes@e23d3c57

arch_boxes_sync: Pull the artifacts from GitLab's package registry

See merge request archlinux/infrastructure!580

Fixes: 2e799bd1 ("arch_boxes_sync: Create predictable symlinks for latest image files")

arch-boxes has decided to use GitLab's package registry instead of job
artifacts[1].

[1] archlinux/arch-boxes@d04c8274

Fixes: 2e799bd1 ("arch_boxes_sync: Create predictable symlinks for latest image files")

mailman3: allow everyone to post to the arch-wiki-admins mailing list

See merge request archlinux/infrastructure!629

The mailing list is used for non-public communication with users, so everyone needs be able to post to it.
It is also the assigned email address of the ArchWiki user "WikiSysop".
See https://wiki.archlinux.org/title/ArchWiki:Maintenance_Team#Who,_when_and_how_to_contact

tf/keycloak: Add openid client for buildbot

See merge request archlinux/infrastructure!623

The buildbot POC wants to use Keycloak for user authentication. The
client is public, because it doesn't make sense to have a client secret,
which can't be kept under wrap anyway (it would need to be shipped with
the CLI[1]).

[1] https://gitlab.archlinux.org/foxboron/buildctl

From time to time aurweb is failing with "Too many open files"
errors[1], this could indicate a bug in aurweb or perhaps the limit is
just too low. Let's try doubling the limit and see if it helps.

[1] https://gitlab.archlinux.org/archlinux/aurweb-errors/-/issues/275

The code isn't vulnerable to nginx alias traversal[1][2], nevertheless
it should only match /static/ and not e.g. /staticfoobar.

[1] d94f18a7 ("Fix nginx alias traversal")
[2] https://github.com/yandex/gixy/blob/641060d6355fbb5bd71695928a2bf14a9bcb8bf2/docs/en/plugins/aliastraversal.md

Fixes: 9294828f ("Setup mailman3 server")

Whoosh is used by default, but it is slow at indexing (multiple hours
for just aur-requests) and searching e.g. aur-requests isn't possible
(it is slow and uses 3G+ of memory resulting in it getting OOM-killed).

Xapian indexed everything in just 76 minutes and searching aur-requests
now works and is plenty fast.

Co-authored-by: Evangelos Foutras <evangelos@foutrelis.com>

This avoids triggering a GitLab push rule which rejects files that look
like secrets.

Add GPG master and signing key for Renovate and arch-boxes

See merge request archlinux/infrastructure!579

The key is used for signing the releases, so the users can be sure the
images on the mirrors haven't been modified. arch-boxes has been tweaked
to use the key in this MR[1].

[1] arch-boxes!176

Renovate is a tool for: "Automated dependency updates. Multi-platform
and multi-language."[1].

We require all commits pushed directly to official projects to be
signed, so a master key and signing key have been generated for
Renovate. Both keys are stored in renovate.asc and Renovate only has
access to the signing key.

[1] https://github.com/renovatebot/renovate

syncriscv: add role for mirroring the RISC-V port

See merge request archlinux/infrastructure!625

Going to be served by all our Geo boxes under riscv.mirror.pkgbuild.com.

Fixes: 578b7819 ("Capitalize the handler name in handler invocations")
Fixes: 26f289b7 ("Capitalize the first letter of all task names")

All lists have been migrated to mailman3[1] and mailman3 is what users
should use, so show its interface by default and not the mailman2
interface.

[1] 75ac7d09 ("mailman: Fourth and final batch of mailman3 migrated lists")

Fixes: 4d8dfb6a ("mailman: Third batch of mailman3 migrated lists")

arch-general
aur-general
aur-requests

It has been decided not to migrate the following unlisted and unused
lists:
arch-magazine
arch-notifications
arch-test
mailman