Fixes: 26f289b7 ("Capitalize the first letter of all task names")

ansible-lint 6.5.0 complains about:

  name: All names should start with an
        uppercase letter. (name[casing])

This allows to retain all default hardening options that memcached@.service has.

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

PHP7 will likely be removed from the repos soon[1]. Time to upgrade! :)

[1] https://archlinux.org/todo/php-7-retiredment/

Jakub Klinkovský authored 3 years ago and Kristian Klausen committed 3 years ago

We've hit this problem at least twice in the past, last time with the new
Vector skin update. With this change it should not be necessary to do
anything manually after an update.

As mediawiki does not support PHP 8 yet in the current LTS release, we
have to stay with PHP 7.

yaml: truthy value should be one of [false, true] (truthy)
yaml: wrong indentation: expected 4 but found 2 (indentation)
yaml: too few spaces before comment (comments)
yaml: missing starting space in comment (comments)
yaml: too many blank lines (1 > 0) (empty-lines)
yaml: too many spaces after colon (colons)
yaml: comment not indented like content (comments-indentation)
yaml: no new line character at the end of file (new-line-at-end-of-file)
load-failure: Failed to load or parse file
parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.

It should make it easier to change how the certificates is issued.
Ex: If we want to switch to ECDSA certificates in the future or replace
certbot with something else.

- home directory needs 751 - nginx accesses it to serve static files
- cache and sessions directories are used only by PHP -> 750
- uploads is public -> 755

Note that the "fix home permissions" task was duplicated. Other tasks
fixing permissions were moved above.

Frederik Schwan authored 4 years ago and Sven-Hendrik Haase committed 4 years ago

also use systemd instead of service module

This was an attempt to block too many requests from bots but it leads to
an increase of cpu usage and blocking wiki administrators.

fail2ban role now protects postfix, dovecot and sshd. other roles can drop
configuration files into /etc/fail2ban/jail.d/*.local to enable fail2ban to
monitor it's service.

Introduce a variable to set the memcached memory size.

Switch from apcu caching to memcached with 512 MiB so that we have a
sustained cached instead of a php-fpm worker based cache which has a
shorter lifetime of 2000 requests before the worker get's killed and
respawned.

With apcu caching the wiki get's ~ 40 req/s more and the latency of the
wiki lowers.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This requires the update script to be run so add a handler for it.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Make the role fully idempotent by pinning the version and also use a variable
for setting the repository.

The intl package is required for mediawiki.

Added the certbot command to create the certificate on the first run of the role.
Also install the archwiki-runjobs, archwiki-prune-cache service and timers and the
archwiki-runjobs-wait service. Enable the timers and start them as well as the runjobs-wait
service.

Create the required directories on the first run of the role and make sure they
keep the required permissions.

Deploy LocalSettings.php with the changes required to run archwiki.

Add the tasks that create the archwiki user, clone the repo, create the db
and the db user and also configure the php-fpm daemon.