Add an hour of delay to spread out borg backup jobs from multiple
servers and other jobs which are scheduled to run at OnCalendar=daily.

We're not using LDAP after all.

It's pretty complicated to express what we want but we eventually succeeded. We even found a bug in Keycloak while implementing this and had to patch the package.

Disallow all pages with /index.php? as this excludes wiki history pages
which are shown as
https://wiki.archlinux.org/index.php?title=Lala&action=history to allow
us to remove the lockdown plugin.

Use with_items to make adding sync configurations easier.

Use Gitlab's official backup tool for dumping the database, git
repositories and other data with a wrapper script similiar to the
postgres and mysql backup scripts.

Signed-off-by: Jelle van der Waa <jelle@archlinux.org>

If they are not checked first, we will run into a situation where we ask the user twice to provide an OTP.

This wrapper automatically handles auth and server via Ansible vault information that we have already.

As flyspray has no captcha for registering, we deploy this stop gap
measure to stop bots registering spam accounts.

We ran at the bare minimum and cx51 should last us some time.

oidentd was used for matrix but was moved away from in
04b4c61e and phpinfo was only created to test php-fpm.

This was an attempt to block too many requests from bots but it leads to
an increase of cpu usage and blocking wiki administrators.