The zabbix-agent on apollo (where zabbix-server) receives a connecting
on it's local ipv6 address instead of it's hostname. Make a conditional
to work around this issue.

Reduce the access to phrik.archlinux.org to only demize by for now
defines arch_users in phrik's host_vars. Add a polkit rule to allow
users in the phrik group to restart phrik.

Uniformly use the expension flag instead of the modifier.

Use single quotes instead of backslashes for the outer quoting to reduce
the amount of quoting needed.

Apparently 1.0 is about 3-4G max, which is too much, while 0.1 is about
~700M. Set it to the default of 0.5.

We've seen matrix.archlinux.org dip deep into swap.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Needed because we still have the login (command) shell to deal with.

Added Morgan Adamiec as a new bug wrangler. He got an archlinux.org email, so pushed
his key and created his user on orion. Also, upon FFY00 request, changed his shell to
bash.

Update to the 2019 conference report

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Add some new systemd hardening features to network related services.

ansible 2.9.0 has a new git module feature gpg_whitelist which is an
array of allowed keys. If a tag or commit was signed with a different
key ansible aborts.

Signed-off-by: Jelle van der Waa <jelle@archlinux.org>

Signed-off-by: Sven-Hendrik Haase <svenstaro@gmail.com>

This enables lastlog so that we also see which accounts are used for
email only even if they are not used for SSH.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The wiki requires an nginx cache for mediawiki's static assets which are
served through PHP causing an exhaustion of php-fpm workers. Caching in
nginx is a good way to circumvent this.