arch_boxes_sync: Quick service filesystem hardening

See merge request archlinux/infrastructure!315

Should protect the filesystem from the script going amok and nuking the
filesystem (shouldn't happen).

Add new role which sync arch-boxes images to the repos

Closes #272

See merge request archlinux/infrastructure!296

Fix #272

Without a location nginx will always return

See merge request archlinux/infrastructure!313

Without a location block, nginx always executes the return block causing
a 302 which makes certbot unable to renew as it follows redirects.

"Move" NM connectivity check file to a subdomain

Closes #239

See merge request archlinux/infrastructure!311

The file should not be on the main domain as it adds unnecessary
complexity to the archweb role and there is a bigger chance that we
unintentionally break connectivity checking (which has happened in the
past[1][2]).

This doesn't remove the file from the main domain[3], as we need to ship
a updated NetworkManager package first.

[1] https://www.reddit.com/r/archlinux/comments/keai0g/does_anyone_know_if_this_is_normal/
[2] https://www.reddit.com/r/gnome/comments/ke9ytm/network_manager_popup/
[3] http://www.archlinux.org/check_network_status.txt

Fix #239

Remove uneeded OpenDKIM doc

See merge request archlinux/infrastructure!309

Switch the archwiki to PHP 7

See merge request archlinux/infrastructure!308

As mediawiki does not support PHP 8 yet in the current LTS release, we
have to stay with PHP 7.

Switch to our own mirror for aurblup

See merge request archlinux/infrastructure!294

The mirrors.kernel.org mirror seems to have network issues for us from
aur.archlinux.org which makes the aurweb-aurblup service fail from time
to time. Switch to our own mirror as we are in control.

Bbs php8

See merge request archlinux/infrastructure!306

Update fluxbb to the latest commit with PHP 8 compatibility, fix
permissions being to strict so http can't access it and rate limit
searching.

Lock before deleting files

See merge request archlinux/infrastructure!307

As reported in FS#69614 the lock should be before the delete for when
another sync job is running rsync can't move the files as they are
removed.

common: Use the "hardware" watchdog

See merge request archlinux/infrastructure!304

A lot of our systems have a "hardware" watchdog (ex: all the Hetzner
cloud servers) so let's use it.

Prefer using lists of maps with consistent keys.

Fix linting (ansible-lint v5.0.0)

See merge request archlinux/infrastructure!305

yaml: truthy value should be one of [false, true] (truthy)
yaml: wrong indentation: expected 4 but found 2 (indentation)
yaml: too few spaces before comment (comments)
yaml: missing starting space in comment (comments)
yaml: too many blank lines (1 > 0) (empty-lines)
yaml: too many spaces after colon (colons)
yaml: comment not indented like content (comments-indentation)
yaml: no new line character at the end of file (new-line-at-end-of-file)
load-failure: Failed to load or parse file
parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.

With a dynamic inventory and vault_password_file set it will try to use
them, which of course doesn't work in the CI.

https://github.com/ansible-community/ansible-lint/issues/953

As flyspray does not support PHP 8 as of yet, transition to the php7
package by simply introducing a new php7_fpm role.

Add correct After targets for prometheus_exporters

See merge request archlinux/infrastructure!297

arch-audit hung as it was started before there was a working internet
connection. To work around this issue, add proper Wants/After targets
for network-online.target and for the rebuilderd textcollector let it
start after rebuilderd.service is "online".

Stop excluding the iso dir on mirrors

See merge request archlinux/infrastructure!302