Signed-off-by: Florian Pritz <bluewind@xinu.at>

The script is currently hosted on my private server, but still linked in
the wiki[1]. This way, we can update the wiki to link to this copy of
the script as an official source.

[1] https://wiki.archlinux.org/index.php/DeveloperWiki:NewMirrors



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Upstream being me:
https://git.server-speed.net/users/flo/bin/tree/syncrepo.sh



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

- Allow for single and multi disk installs
- Use modern parted module to cut down on manual code
- Allow for specifying concrete drives to use for the system
- Change use from unarchive module which is deprecated to get_url + manual tar
- Allow for DHCP when setting up networking
- When using btrfs, automatically compress with lzo (I'd use zstd but grub can't boot off of zstd yet)
- Use playbook_dir as a relativ search path start to find the pubkeys which is more reliable than just relative path
- Clean pacman cache after base system installation

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This better reflects the content (sudo wheel access + root login).

Signed-off-by: Florian Pritz <bluewind@xinu.at>

This ensures that all info regarding "who has root" is in one place.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

https://github.com/matrix-org/synapse/blob/master/docs/MSC1711_certificates_FAQ.md

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Note that the public key has to be in root's keyring.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Installing some services and config files doesn't really matter. What
matters is if they are enabled so only use the conditional there. The
rest is easier and less confusing if it just installs the files all the
time. Otherwise we'd need a second task that performs the other case and
then if we change something we'd also have to adjust that task. That's
unnecessarily error prone.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Harden the unit by limiting access to the system and dissallowing
privilege escalation.

sch_fq used to be required by BBR but this is no longer the case after
a fallback to internal pacing was implemented in Linux 4.13. Plus, BBR
was recently disabled on Arch's infra.

Now, we could just set the default qdisc to fq_codel for all machines,
but it seems the default for multiqueue network interfaces is sch_mq +
fq_codel sub-qdiscs (one per tx queue).

I am not sure how to cleanly implement the above multiqueue distinction
in Ansible, so drop the default_qdisc configuration. I will then adjust
affected machines manually to remove any configured qdiscs.

BBR behaves badly when it is not the sole connection. It slows down
other streams (bbr and cubic) and generally doesn't scale well when
deployed widely. Let's disable it so we don't make the internet for
others worse.

https://ripe76.ripe.net/presentations/10-2018-05-15-bbr.pdf

https://kanboard.archlinux.org/public/task/117/7dd7510424e4229247e8e0b90bf43e1553fce86cdf8475b60edc956ed5a8



Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>