1
1
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2024-06-02 08:26:05 +02:00
Commit Graph

840 Commits

Author SHA1 Message Date
Sven-Hendrik Haase 57d7edd91d Add forgotten symlink 2019-02-14 04:54:14 +01:00
Sven-Hendrik Haase bf434f107c Modernize install_arch role
- Allow for single and multi disk installs
- Use modern parted module to cut down on manual code
- Allow for specifying concrete drives to use for the system
- Change use from unarchive module which is deprecated to get_url + manual tar
- Allow for DHCP when setting up networking
- When using btrfs, automatically compress with lzo (I'd use zstd but grub can't boot off of zstd yet)
- Use playbook_dir as a relativ search path start to find the pubkeys which is more reliable than just relative path
- Clean pacman cache after base system installation
2019-02-14 04:53:51 +01:00
Jelle van der Waa 8f6d773378 archwiki: update to 1.32.0 2019-02-10 12:27:50 +01:00
Jelle van der Waa 2eaf28b1e1 archweb: update to Python 3 release 2019-02-08 17:22:04 +01:00
Jelle van der Waa b706b96c87 Archweb Python 3 migration 2019-02-08 16:50:26 +01:00
Jan Alexander Steffens (heftig) a879aa4ad1
roles/matrix: Sync homeserver.yaml with upstream 2019-02-07 22:30:33 +01:00
Jan Alexander Steffens (heftig) 9540818e3a
archweb: Add well-known file required for Matrix
https://github.com/matrix-org/synapse/blob/master/docs/MSC1711_certificates_FAQ.md
2019-02-06 00:23:12 +01:00
Jelle van der Waa 5b3b080837 verify if the git commit was signed
Note that the public key has to be in root's keyring.
2019-01-29 20:20:35 +01:00
Florian Pritz d9006d46f7
archbuild: Prevent clean-chroots.service from mounting tmpfs
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-28 18:10:08 +01:00
Florian Pritz ec39579f21
spampd: Raise maxsize argument in service
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-28 10:39:19 +01:00
Florian Pritz 5d4587f8fc
archbuild: Disable units when archbuild_fs is not tmpfs
Installing some services and config files doesn't really matter. What
matters is if they are enabled so only use the conditional there. The
rest is easier and less confusing if it just installs the files all the
time. Otherwise we'd need a second task that performs the other case and
then if we change something we'd also have to adjust that task. That's
unnecessarily error prone.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-24 00:36:52 +01:00
Jelle van der Waa a65a62e259 planet: harden planet generation service
Harden the unit by limiting access to the system and dissallowing
privilege escalation.
2019-01-23 14:19:38 +01:00
Evangelos Foutras 155104d445 common: drop default qdisc configuration
sch_fq used to be required by BBR but this is no longer the case after
a fallback to internal pacing was implemented in Linux 4.13. Plus, BBR
was recently disabled on Arch's infra.

Now, we could just set the default qdisc to fq_codel for all machines,
but it seems the default for multiqueue network interfaces is sch_mq +
fq_codel sub-qdiscs (one per tx queue).

I am not sure how to cleanly implement the above multiqueue distinction
in Ansible, so drop the default_qdisc configuration. I will then adjust
affected machines manually to remove any configured qdiscs.
2019-01-23 03:26:39 +02:00
Jelle van der Waa 47de9a8b9d dbscripts: remove old ip whitelist for repos.archlinux.org 2019-01-21 20:11:28 +01:00
Florian Pritz 186c2faafb
spampd: Remove old BTC Investor rule
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 16:32:55 +01:00
Florian Pritz b85fe7d73b
spampd: Extract english lanuage rules to dedicated file
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 16:32:39 +01:00
Florian Pritz 3ac489db3c
spampd: Minor cleanups and fixes to rules
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 16:28:08 +01:00
Florian Pritz dc7c48f435
spampd: Merge many rule changes from my personal server
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 15:35:10 +01:00
Florian Pritz 3009a89350
spampd: Merge score changes from my personal server
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 15:15:13 +01:00
Florian Pritz 5c1d01356f zabbix-agent: Add item for kernel cpu/memory/IO pressure
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-19 22:28:21 +01:00
Jelle van der Waa 55f473574d archwiki: harden runjobs services 2019-01-19 21:56:46 +01:00
Jelle van der Waa fc8011de2e Harden kanboard cron service 2019-01-19 21:27:06 +01:00
Jelle van der Waa 342d27bd5c Stop => Start
This unit has no ExecStop nor do we want a timeout for ExecStop but we
want one for ExecStart.
2019-01-19 21:19:52 +01:00
Jelle van der Waa 6c35b76a72 postgres: update to python3 dependency
Our roles are switched to python3 and have to be updated to install the
python3 variant of modules to deploy the role.
2019-01-19 00:10:07 +01:00
Florian Pritz 0bf85de82b archwiki: Automatically update registration question when pacman package is updated
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-15 15:22:10 +01:00
Florian Pritz 67a1b894f7 archwiki: Use loop instead of multiple tasks for systemd units
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-15 15:22:10 +01:00
Jelle van der Waa cd4a871b11 grafana: sync upstream configuration file 2019-01-14 22:11:57 +01:00
Jelle van der Waa a4273931c5 reprobuilds: remove repro build nodes 2019-01-14 22:10:02 +01:00
Florian Pritz aeae6cd42b
archwiki: Update pacman string
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-14 15:44:18 +01:00
Florian Pritz 36d8f3974a
php: Merge upstream php.ini changes
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-14 15:16:40 +01:00
Jelle van der Waa 856a6032e4 sync system.conf configuration file from pacnew 2019-01-13 20:29:29 +01:00
Florian Pritz 6cbcba629b
archive: Redirect .all packages to /packages/ tree
Currently .all/ keeps symlinks for each package file that point to the
actual file. We also track all files in the /pacakages/ tree separated
into directories based on their pkgname. This rewrite rule matches the
.all/ URLs to the /packages/ directory tree so that we can eventually
delete the symlinks from .all/.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-13 17:48:21 +01:00
Florian Pritz e0f9bd5777
dbscripts: Disable NoNewPrivileges for cleanup.service
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-13 13:39:48 +01:00
Florian Pritz 367cc0f8c4
zabbix-agent: Install pytthon-zabbix-api on localhost
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-13 13:23:18 +01:00
Jelle van der Waa 3d3ab44d36 archweb: update to latest version
Update django to 1.11.18 security release
2019-01-11 22:26:39 +01:00
Florian Pritz 08e411bfb2
dbscripts: Add sudoers entries for package archive
Context: https://lists.archlinux.org/pipermail/arch-projects/2019-January/005063.html

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-10 16:04:14 +01:00
Jelle van der Waa 8dcb89d7db zabbix-agent: arch-audit exclude testing repo updates
arch-audit -u also recommends updating to testing packages, while this
is not something we recommend or want.
2019-01-07 18:30:50 +01:00
Jelle van der Waa daea84c9bd dbscripts: harden cleanup script 2018-12-30 22:43:36 +01:00
Jelle van der Waa 711db78730 Add postgresql servers group for zabbix-agent role 2018-12-29 23:23:38 +01:00
Jelle van der Waa c9eb2209e5 zabbix-agent: add PostgreSQL DB size monitoring
Add monitoring for our PostgreSQL DB size using a similiar construct as
the MySQL DB size monitoring with a perl script.
2018-12-29 23:12:53 +01:00
Jelle van der Waa 0777baea09 orion: migrate torrent tracker from luna to orion
Add a role for the hefur torrent tracker. A simple
service which runs on tracker.archlinux.org. Note that our setup
overrides a few things of the systemd service.

Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>
2018-12-27 19:58:53 +01:00
Florian Pritz aa10283811
zabbix-agent: Never mark PSK key fetching as changed
It's just a cat and only populates the variable. No need to mark it
changed every time.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2018-12-25 17:24:20 +01:00
Florian Pritz da8bea46ea
Fix deprecated result|failed syntax
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2018-12-25 16:54:32 +01:00
Florian Pritz 0088387540
Replace deprecated pacman with_items usage with direct list
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2018-12-25 16:52:33 +01:00
Florian Pritz d364a72800 Use unbound for DNS and disable resolved when unbound is used
We don't need resolved and it is sometimes buggy so let's just get rid
of it and use unbound like we do on our mail machines already.

Details: 7dd7510424

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2018-12-25 16:39:57 +01:00
Florian Pritz dc0f789315
Add TODO
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2018-12-24 12:35:19 +01:00
Jan Alexander Steffens (heftig) 27a1149062
roles/matrix: Use yarn instead of npm 2018-12-20 20:16:15 +01:00
Jan Alexander Steffens (heftig) e794c4fe60
roles/matrix: Don't restart IRC appservice when restarting synapse 2018-12-20 20:12:18 +01:00
Jan Alexander Steffens (heftig) 5c9922bd19
roles/matrix: Use jemalloc for synapse 2018-12-20 20:11:47 +01:00
Jan Alexander Steffens (heftig) 03d14f846f
roles/matrix: Sync config 2018-12-20 20:08:11 +01:00