Commits · e794c4fe6032b00de1404dd87d3b6b09b254e78c · Sébastien Luttringer / infrastructure

This project is mirrored from https://gitlab.archlinux.org/archlinux/infrastructure. Pull mirroring failed Sep 01, 2020.
Repository mirroring has been paused due to too many failed attempts. It can be resumed by a project maintainer or owner.

20 Dec, 2018 5 commits
- roles/matrix: Don't restart IRC appservice when restarting synapse · e794c4fe
  Jan Alexander Steffens (heftig) authored Dec 20, 2018
  
  e794c4fe
- roles/matrix: Use jemalloc for synapse · 5c9922bd
  Jan Alexander Steffens (heftig) authored Dec 20, 2018
  
  5c9922bd
- roles/matrix: Sync config · 03d14f84
  Jan Alexander Steffens (heftig) authored Dec 20, 2018
  
  03d14f84
- roles/matrix: Upgrade synapse to Python 3 · b7073b58
  Jan Alexander Steffens (heftig) authored Dec 20, 2018
  
  b7073b58
- roles/matrix: Change log level to ERROR · 03e66d8c
  Jan Alexander Steffens (heftig) authored Dec 20, 2018
  
  03e66d8c
15 Dec, 2018 1 commit

security_tracker: harden system service · 6134cf9a

Jelle van der Waa authored Dec 15, 2018

Mount /usr, /etc read only, protect the /home, /tmp and kernel
directories. Also disallow privilige escalation.

6134cf9a

14 Dec, 2018 1 commit

archbuild: allow passing through the SOURCE_DATE_EPOCH variable · 6560a2df

Eli Schwartz authored Dec 14, 2018 and

Florian Pritz committed Dec 14, 2018

When using restrictive sudoers profiles, the builtin mechanism for
whitelisting this variable on the sudo command line does not work.

Explicitly whitelist it anyway by matching on the ARCHBUILD role.

6560a2df

13 Dec, 2018 1 commit
- Update services in README · 1c25da63
  Jelle van der Waa authored Dec 13, 2018
  
  1c25da63
10 Dec, 2018 2 commits
- archusers: Set empty password when creating accounts · ce5dcc73
  Florian Pritz authored Dec 10, 2018
```
This hopefully allows users to use `passwd` to set a password which is
necessary for email.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  ce5dcc73
- docs/email: Explain email client settings for users · add58596
  Florian Pritz authored Dec 10, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  add58596
07 Dec, 2018 1 commit
- Add new TU - Daniel M. Capella · f5fb5c43
  Florian Pritz authored Dec 07, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  f5fb5c43
02 Dec, 2018 1 commit
- sshd: validate sshd_config on copying · 51b66f20
  Jelle van der Waa authored Dec 02, 2018
  
  51b66f20
27 Nov, 2018 3 commits

Add my host-specific key used to fetch packages · bd4fd43a
Evangelos Foutras authored Nov 27, 2018
```
Key resides on orion and is used to pull packages from soyuz and sgp.
```
bd4fd43a

archusers: Fix a warning · ff4ebdaf

Jan Alexander Steffens (heftig) authored Nov 27, 2018

[WARNING]: when statements should not include jinja2 templating
delimiters such as {{ }} or {% %}. Found: item not in "{{ arch_users }}"

ff4ebdaf

Update my SSH keys · 32a0c062

Jan Alexander Steffens (heftig) authored Nov 27, 2018

Work key to soyuz because I sync my zsh/nvim/stuff config with it if I
can't reach my home network.

32a0c062

26 Nov, 2018 1 commit
- Add missing space in maximbaz_soyuz.pub · 039f8d9b
  Florian Pritz authored Nov 26, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  039f8d9b
25 Nov, 2018 8 commits

reprobuilds: add reproducible build playbook · f2aa4f13

Jelle van der Waa authored Nov 24, 2018

Add a playbook for our reproducible builds workers. Set's up a sudo user
so that an admin of the reproducible builds project can configure the
worker.

f2aa4f13

Add zabbix templates for reproducible-builds group · 99f72cde
Florian Pritz authored Nov 25, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
99f72cde

zabbix-agent: Add host_groups · ed358f32

Florian Pritz authored Nov 25, 2018



These are required to be set when adding a new host.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

ed358f32

Manage zabbix host configuration via ansible · 4366b9b0

Florian Pritz authored Nov 25, 2018

This currently deploys the same configuration we used to have apart from
some '127.0.0.1' IPs for the agent IP, but those were incorrect anyways.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

4366b9b0

archusers: Remove authorized_keys if no ssh key is defined in archusers · dcc26b26
Florian Pritz authored Nov 25, 2018
```
list

Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
dcc26b26
Add soyuz-only key for Maxim · 49caae39
Florian Pritz authored Nov 25, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
49caae39

archusers: Add support for single-host SSH keys · 28ef4d28

Florian Pritz authored Nov 25, 2018



Some of our users have keys that they only want on a few machines and
reconfigure each time we deploy. Now we can configure and deploy such
keys.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

28ef4d28

Add orion to nginx group for zabbix monitoring · 24840e1a
Florian Pritz authored Nov 23, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
24840e1a

24 Nov, 2018 3 commits
- nymeria: enable mirrorresolv service · c17a91e7
  Jelle van der Waa authored Nov 22, 2018
  
  c17a91e7
- archweb: harden mirrorresolv service · db0a2bd0
  Jelle van der Waa authored Nov 22, 2018
  
  db0a2bd0
- archweb: MaxRunTimeSec has no effect with oneshot · 025a8ce6
  Jelle van der Waa authored Nov 22, 2018
```
Use TimeoutStopSec instead.
```
  025a8ce6
23 Nov, 2018 6 commits
- hosts: update reproducible dns names · 64415ec6
  Jelle van der Waa authored Nov 23, 2018
  
  64415ec6
- archweb update to 2018-11-23 release · 46cf0547
  Jelle van der Waa authored Nov 23, 2018
  
  46cf0547
- upgrade_pg.sh: Copy SSL cert files · 5756e8a1
  Florian Pritz authored Nov 23, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  5756e8a1
- upgrade_pg.sh: Disable after-upgrade removal · 4346bc30
  Florian Pritz authored Nov 23, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  4346bc30
- upgrade_pg.sh: Add safety check to prevent multiple runs · 2456e8fa
  Florian Pritz authored Nov 23, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  2456e8fa
- upgrade_pg.sh: Document what to do when major version error happens · 73da9760
  Florian Pritz authored Nov 23, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  73da9760
21 Nov, 2018 4 commits
- archweb: harden mirrorcheck service · c8c361f6
  Jelle van der Waa authored Nov 21, 2018
```
Disallow changing of kernel options, reading home/tmp and disallow the
service from seeing our /dev.
```
  c8c361f6
- archweb: harden memcached service further · 4489a97c
  Jelle van der Waa authored Nov 21, 2018
```
Don't allow new priviliges, disallow changing kernel tunables/loading
modules and setting cgroups.
```
  4489a97c
- postgres: add upgrade postgres script · af1bff90
  Jelle van der Waa authored Nov 21, 2018
  
  af1bff90
- Add new TU - Brett Cornwall · 65cca332
  Bartłomiej Piotrowski authored Nov 21, 2018
  
  65cca332
20 Nov, 2018 3 commits
- Add new TU - Maxim Baz · c5a14a00
  Florian Pritz authored Nov 20, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  c5a14a00
- postgres: Merge upstream config locale changes · 8a60a8ae
  Florian Pritz authored Nov 20, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  8a60a8ae
- postgres: Merge upstream config WAL size changes · 99c02ad9
  Florian Pritz authored Nov 20, 2018
```
Signed-off-by: Florian Pritz <bluewind@xinu.at>
```
  99c02ad9