postfix: Install PCRE explicit after package split[1]

See merge request archlinux/infrastructure!317

[1] https://lists.archlinux.org/pipermail/arch-dev-public/2021-January/030284.html

gemini takes a long time to run backups and it would sometimes produce false positives for not having backed up for some time.
The higher threshold should help with those false positives.

AUR systemd hardening

See merge request archlinux/infrastructure!287

This service only requires MySQL access and ability to submit an email.

This service only requires MySQL access and access to the aur home
directory (/srv/http/aurweb) to write the package/pkgbase/user files.

This service only requires MySQL access, network connection access and
the ability to create an pyalpm handle to sync the pacman db's to update
the blacklist.

This service only requires MySQL access for deleting old, empty reserved
aurweb pkgbases.

This service only requires MySQL access for updating the per-package
popularity counts.

arch_boxes_sync: Quick service filesystem hardening

See merge request archlinux/infrastructure!315

Should protect the filesystem from the script going amok and nuking the
filesystem (shouldn't happen).

Add new role which sync arch-boxes images to the repos

Closes #272

See merge request archlinux/infrastructure!296

Fix #272

Without a location nginx will always return

See merge request archlinux/infrastructure!313

Without a location block, nginx always executes the return block causing
a 302 which makes certbot unable to renew as it follows redirects.

"Move" NM connectivity check file to a subdomain

Closes #239

See merge request !311

The file should not be on the main domain as it adds unnecessary
complexity to the archweb role and there is a bigger chance that we
unintentionally break connectivity checking (which has happened in the
past[1][2]).

This doesn't remove the file from the main domain[3], as we need to ship
a updated NetworkManager package first.

[1] https://www.reddit.com/r/archlinux/comments/keai0g/does_anyone_know_if_this_is_normal/
[2] https://www.reddit.com/r/gnome/comments/ke9ytm/network_manager_popup/
[3] http://www.archlinux.org/check_network_status.txt

Fix #239

Remove uneeded OpenDKIM doc

See merge request archlinux/infrastructure!309

Switch the archwiki to PHP 7

See merge request archlinux/infrastructure!308

As mediawiki does not support PHP 8 yet in the current LTS release, we
have to stay with PHP 7.

Switch to our own mirror for aurblup

See merge request archlinux/infrastructure!294

The mirrors.kernel.org mirror seems to have network issues for us from
aur.archlinux.org which makes the aurweb-aurblup service fail from time
to time. Switch to our own mirror as we are in control.

Bbs php8

See merge request archlinux/infrastructure!306

Update fluxbb to the latest commit with PHP 8 compatibility, fix
permissions being to strict so http can't access it and rate limit
searching.

Lock before deleting files

See merge request archlinux/infrastructure!307

As reported in FS#69614 the lock should be before the delete for when
another sync job is running rsync can't move the files as they are
removed.

common: Use the "hardware" watchdog

See merge request archlinux/infrastructure!304

A lot of our systems have a "hardware" watchdog (ex: all the Hetzner
cloud servers) so let's use it.

Prefer using lists of maps with consistent keys.