Should protect the filesystem from the script going amok and nuking the
filesystem (shouldn't happen).

Fix #272

Without a location block, nginx always executes the return block causing
a 302 which makes certbot unable to renew as it follows redirects.

The file should not be on the main domain as it adds unnecessary
complexity to the archweb role and there is a bigger chance that we
unintentionally break connectivity checking (which has happened in the
past[1][2]).

This doesn't remove the file from the main domain[3], as we need to ship
a updated NetworkManager package first.

[1] https://www.reddit.com/r/archlinux/comments/keai0g/does_anyone_know_if_this_is_normal/
[2] https://www.reddit.com/r/gnome/comments/ke9ytm/network_manager_popup/
[3] http://www.archlinux.org/check_network_status.txt

Fix #239

As mediawiki does not support PHP 8 yet in the current LTS release, we
have to stay with PHP 7.

The mirrors.kernel.org mirror seems to have network issues for us from
aur.archlinux.org which makes the aurweb-aurblup service fail from time
to time. Switch to our own mirror as we are in control.

Update fluxbb to the latest commit with PHP 8 compatibility, fix
permissions being to strict so http can't access it and rate limit
searching.

As reported in FS#69614 the lock should be before the delete for when
another sync job is running rsync can't move the files as they are
removed.

A lot of our systems have a "hardware" watchdog (ex: all the Hetzner
cloud servers) so let's use it.

Prefer using lists of maps with consistent keys.

yaml: truthy value should be one of [false, true] (truthy)
yaml: wrong indentation: expected 4 but found 2 (indentation)
yaml: too few spaces before comment (comments)
yaml: missing starting space in comment (comments)
yaml: too many blank lines (1 > 0) (empty-lines)
yaml: too many spaces after colon (colons)
yaml: comment not indented like content (comments-indentation)
yaml: no new line character at the end of file (new-line-at-end-of-file)
load-failure: Failed to load or parse file
parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.

As flyspray does not support PHP 8 as of yet, transition to the php7
package by simply introducing a new php7_fpm role.

arch-audit hung as it was started before there was a working internet
connection. To work around this issue, add proper Wants/After targets
for network-online.target and for the rebuilderd textcollector let it
start after rebuilderd.service is "online".

sourceballs wasn't able to generate any new tarballs due to not being
able to sudo due to systemd hardening.

If the protection is enabled, saying any of these words shortly after
joining triggers a ban.

The monitoring on luna fails randomly and we have no proof that the mail
server does not work. Disable it for now until it works in a stable
fashion.

This adds a collaborative markdown editor as newly offered service which
is available via login for all Arch Linux Staff with an option to allow
anonymous edits by users (not default). Users are managed via keycloak
and require the Staff role to be allowed in, non staff keycloak users
currently will receive an internal server error due to an upstream
issue.

According to 'doc/maintenance.txt' the usermaint service needs to be
every 2 hours. To remove the last login IP address of all users that did
not login for 7 days.

Closes: #106