matrix.archlinux.org: Configure static DNS via networking role

See merge request !479

Hetzner DNS has been delaying many responses for 5 seconds, causing
outgoing federation work to pile up, almost running into OOM before we
noticed.

I don't know if were being throttled because federation makes a *lot* of
requests. Anyway, using Cloudflare DNS seems to solve it.

Enable DNSOverTLS for this because we can.

I don't know why this wasn't enabled.

This one is pretty spammy with warnings that don't mean much.

Other caches around this code use 500000 entries, so just copy that.

Fix #386

Ref #388

Be more explicit about selecting allowed repos because these were missed
in previous onboardings.

These groups are no longer required as docker/arch-boxes images are
build by Gitlab.

Closes: #389

This cache was seeing constant evictions at its former size (70k).

With a size of 200k it now stabilizes at ~122k entries with a
significant drop in server load.

Now that Pantalaimon refuses operations until it has sync'ed with the
homeserver, we need to give it time to do so or Mjolnir will refuse to
start.

Looks like a oversight when he was offboarded as DevOps.
As support staff he shouldn't have access to

This subdomain hosts gitlab CI produced and updated notes for
unreproducible packages.

prometheus: add matrix metrics and dashboard

Closes #290

See merge request !473

Leonidas Spyropoulos authored 3 years ago and Kristian Klausen committed 3 years ago

The dashboards is from [1] and fixed with:
sed 's/${DS_PROMETHEUS}/$datasource/g' -i synapse.json

[1] https://github.com/matrix-org/synapse/tree/c167e09fe58d3a256fb1c763b391ad6633d2507d/contrib/grafana



Closes: #290

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

!473

It was removed in:
d9fdafb0 ("Use archlinux-contrib over git submodule")
c380c429 ("Remove old task to symlink checkservices to /usr/local/bin")

New networking role shared.

Closes #288

See merge request !355

en is the prefix for ethernet according to systemd.net-naming-scheme(7)

Leonidas Spyropoulos authored 3 years ago and Kristian Klausen committed 3 years ago

Redundant since this commit:
bdd538ec ("Use unbound for rspamd DNS resolving")

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Leonidas Spyropoulos authored 3 years ago and Kristian Klausen committed 3 years ago

This is shared between common and install_arch roles

Closed: #288

Signed-off-by: Leonidas Spyropoulos <artafinde@gmail.com>

Disabled in:
0ae67c4a ("postfix: Disable STARTTLS Submission (port 587)")

archlinux/infrastructure#377

syncarchive: Drop --delay-updates; breaks incremental scan

See merge request archlinux/infrastructure!472

The --delay-updates option results in 6G memory usage per archive mirror
for a total of ~18G memory used on gemini when all three archive mirrors
are syncing. Less important (but still revelant!) is the memory usage on
each mirror, which climbs to about 11G during each synchronization.

Removing the --delay-updates option should be OK considering the archive
hosts data that almost never changes. Without this option, rsync is able
to do a sequential scan which uses 90M of memory (per archive mirror) on
gemini and about 250M on each mirror individually.

syncrepo tweaks now that rsync has fixed the stale .~tmp~ issue

See merge request archlinux/infrastructure!471

This reflects the recent changes made to syncrepo.

Using a temporary directory outside of /srv/ftp was meant to protect
against incomplete files from being synced by downstream mirrors. It
does not achieve this to much effect though; each file gets uploaded
to the temporary directory but then immediately moved under a .~tmp~
directory at its target location (.~tmp~ because of --delay-updates,
otherwise the file would be renamed to its final path).

The `--delay-updates` option by itself sufficiently protects against
temp files being transferred to downstream mirrors; when used by the
receiver, it automatically adds an exclude rule for ~.tmp~, behaving
exactly like we want it to. As such, the `--temp-dir` option doesn't
provide any further benefit and can be removed.