1
1
mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2024-09-20 01:21:36 +02:00
Commit Graph

1180 Commits

Author SHA1 Message Date
Sven-Hendrik Haase
d5cc2fa74c Add packer stuff 2019-02-14 05:41:14 +01:00
Sven-Hendrik Haase
57d7edd91d Add forgotten symlink 2019-02-14 04:54:14 +01:00
Sven-Hendrik Haase
bf434f107c Modernize install_arch role
- Allow for single and multi disk installs
- Use modern parted module to cut down on manual code
- Allow for specifying concrete drives to use for the system
- Change use from unarchive module which is deprecated to get_url + manual tar
- Allow for DHCP when setting up networking
- When using btrfs, automatically compress with lzo (I'd use zstd but grub can't boot off of zstd yet)
- Use playbook_dir as a relativ search path start to find the pubkeys which is more reliable than just relative path
- Clean pacman cache after base system installation
2019-02-14 04:53:51 +01:00
Florian Pritz
ed51f84f7d
Remove allan from wheel group
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 22:23:47 +01:00
Sven-Hendrik Haase
bd27c2bec2 Add more elaborate OTP instructions 2019-02-10 19:42:10 +01:00
Florian Pritz
2ec6c3adf6 Give Pierre full root access
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:32:18 +01:00
Florian Pritz
cb46185a7f Document what to run when root_access variables are changed
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:32:18 +01:00
Florian Pritz
fe22df835e Add playbook to reencrypt vault key
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:32:18 +01:00
Florian Pritz
6d4c3dee5f
root_access: Sort lists
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:12:37 +01:00
Florian Pritz
8b8abd3d83
Rename group_vars/root_pubkeys to root_access
This better reflects the content (sudo wheel access + root login).

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:07:49 +01:00
Florian Pritz
cba5e3eb1b
Move sudo_users to root_pubkeys.yml
This ensures that all info regarding "who has root" is in one place.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:06:33 +01:00
Florian Pritz
69bc8d008c
Remove dave and ionut from wheel group
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:05:16 +01:00
Jelle van der Waa
8f6d773378 archwiki: update to 1.32.0 2019-02-10 12:27:50 +01:00
Jelle van der Waa
2eaf28b1e1 archweb: update to Python 3 release 2019-02-08 17:22:04 +01:00
Jelle van der Waa
b706b96c87 Archweb Python 3 migration 2019-02-08 16:50:26 +01:00
Jan Alexander Steffens (heftig)
a879aa4ad1
roles/matrix: Sync homeserver.yaml with upstream 2019-02-07 22:30:33 +01:00
Jan Alexander Steffens (heftig)
9540818e3a
archweb: Add well-known file required for Matrix
https://github.com/matrix-org/synapse/blob/master/docs/MSC1711_certificates_FAQ.md
2019-02-06 00:23:12 +01:00
Florian Pritz
3889dbbf1f
Update kanboard to 1.2.8
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-02 20:18:13 +01:00
Jelle van der Waa
5b3b080837 verify if the git commit was signed
Note that the public key has to be in root's keyring.
2019-01-29 20:20:35 +01:00
Florian Pritz
d9006d46f7
archbuild: Prevent clean-chroots.service from mounting tmpfs
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-28 18:10:08 +01:00
Florian Pritz
ec39579f21
spampd: Raise maxsize argument in service
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-28 10:39:19 +01:00
Bartłomiej Piotrowski
d7e53c07c9 Add new TU - Daurnimator 2019-01-27 19:06:49 +01:00
Florian Pritz
69a5b7ac69
Disable tmpfs archbuild on soyuz
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-24 00:38:25 +01:00
Florian Pritz
5d4587f8fc
archbuild: Disable units when archbuild_fs is not tmpfs
Installing some services and config files doesn't really matter. What
matters is if they are enabled so only use the conditional there. The
rest is easier and less confusing if it just installs the files all the
time. Otherwise we'd need a second task that performs the other case and
then if we change something we'd also have to adjust that task. That's
unnecessarily error prone.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-24 00:36:52 +01:00
Jelle van der Waa
a65a62e259 planet: harden planet generation service
Harden the unit by limiting access to the system and dissallowing
privilege escalation.
2019-01-23 14:19:38 +01:00
Evangelos Foutras
155104d445 common: drop default qdisc configuration
sch_fq used to be required by BBR but this is no longer the case after
a fallback to internal pacing was implemented in Linux 4.13. Plus, BBR
was recently disabled on Arch's infra.

Now, we could just set the default qdisc to fq_codel for all machines,
but it seems the default for multiqueue network interfaces is sch_mq +
fq_codel sub-qdiscs (one per tx queue).

I am not sure how to cleanly implement the above multiqueue distinction
in Ansible, so drop the default_qdisc configuration. I will then adjust
affected machines manually to remove any configured qdiscs.
2019-01-23 03:26:39 +02:00
Jelle van der Waa
47de9a8b9d dbscripts: remove old ip whitelist for repos.archlinux.org 2019-01-21 20:11:28 +01:00
Florian Pritz
199e39dddf
Disable BBR TCP congestion control
BBR behaves badly when it is not the sole connection. It slows down
other streams (bbr and cubic) and generally doesn't scale well when
deployed widely. Let's disable it so we don't make the internet for
others worse.

https://ripe76.ripe.net/presentations/10-2018-05-15-bbr.pdf

7dd7510424

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 16:49:01 +01:00
Florian Pritz
186c2faafb
spampd: Remove old BTC Investor rule
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 16:32:55 +01:00
Florian Pritz
b85fe7d73b
spampd: Extract english lanuage rules to dedicated file
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 16:32:39 +01:00
Florian Pritz
3ac489db3c
spampd: Minor cleanups and fixes to rules
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 16:28:08 +01:00
Florian Pritz
7b4510bd49
Add spampd role to luna
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 15:38:05 +01:00
Florian Pritz
dc7c48f435
spampd: Merge many rule changes from my personal server
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 15:35:10 +01:00
Florian Pritz
3009a89350
spampd: Merge score changes from my personal server
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-21 15:15:13 +01:00
Florian Pritz
5c1d01356f zabbix-agent: Add item for kernel cpu/memory/IO pressure
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-19 22:28:21 +01:00
Jelle van der Waa
55f473574d archwiki: harden runjobs services 2019-01-19 21:56:46 +01:00
Jelle van der Waa
fc8011de2e Harden kanboard cron service 2019-01-19 21:27:06 +01:00
Jelle van der Waa
342d27bd5c Stop => Start
This unit has no ExecStop nor do we want a timeout for ExecStop but we
want one for ExecStart.
2019-01-19 21:19:52 +01:00
Jelle van der Waa
637cbd6adb docs: document impi access 2019-01-19 20:12:32 +01:00
Jelle van der Waa
c86e6c8684 kanboard: update to 1.2.7 2019-01-19 19:47:12 +01:00
Jelle van der Waa
6c35b76a72 postgres: update to python3 dependency
Our roles are switched to python3 and have to be updated to install the
python3 variant of modules to deploy the role.
2019-01-19 00:10:07 +01:00
Florian Pritz
0bf85de82b archwiki: Automatically update registration question when pacman package is updated
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-15 15:22:10 +01:00
Florian Pritz
67a1b894f7 archwiki: Use loop instead of multiple tasks for systemd units
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-15 15:22:10 +01:00
Jelle van der Waa
cd4a871b11 grafana: sync upstream configuration file 2019-01-14 22:11:57 +01:00
Jelle van der Waa
a4273931c5 reprobuilds: remove repro build nodes 2019-01-14 22:10:02 +01:00
Florian Pritz
aeae6cd42b
archwiki: Update pacman string
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-14 15:44:18 +01:00
Florian Pritz
36d8f3974a
php: Merge upstream php.ini changes
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-14 15:16:40 +01:00
Florian Pritz
4cb57b2746
Update dbscripts to 20190113
Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-14 00:13:10 +01:00
Jelle van der Waa
856a6032e4 sync system.conf configuration file from pacnew 2019-01-13 20:29:29 +01:00
Florian Pritz
6cbcba629b
archive: Redirect .all packages to /packages/ tree
Currently .all/ keeps symlinks for each package file that point to the
actual file. We also track all files in the /pacakages/ tree separated
into directories based on their pkgname. This rewrite rule matches the
.all/ URLs to the /packages/ directory tree so that we can eventually
delete the symlinks from .all/.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-01-13 17:48:21 +01:00