infrastructure/roles/archwiki/templates/LocalSettings.php.j2

<?php
# This file was automatically generated by the MediaWiki 1.19.0
# installer. If you make manual changes, please keep track in case you
# need to recreate them later.
#
# See docs/Configuration.md for all configurable settings
# and their default values, but don't forget to make changes in _this_
# file, not there.
#
# Further documentation for configuration settings may be found at:
# https://www.mediawiki.org/wiki/Manual:Configuration_settings

# Protect against web entry
if ( !defined( 'MEDIAWIKI' ) ) {
	exit;
}

##
## General settings
##

$wgSecretKey = "{{ vault_archwiki_wg_secret_key }}";

# Site upgrade key. Must be set to a string (default provided) to turn on the
# web installer while LocalSettings.php is in place
$wgUpgradeKey = "{{ vault_archwiki_wg_upgrade_key }}";

$wgSitename      = "ArchWiki";

## The protocol and server name to use in fully-qualified URLs
$wgServer           = "https://wiki.archlinux.org";

# Time zone
$wgLocaltimezone = 'UTC';

# Site language code, should be one of the list in ./languages/data/Names.php
$wgLanguageCode = "en";

# Allow to change the page language
$wgPageLanguageUseDB = true;
$wgGroupPermissions['sysop']['pagelang'] = true;

## The URL base path to the directory containing the wiki;
## defaults for all runtime URL paths are based off of this.
## For more information on customizing the URLs
## (like /w/index.php/Page_title to /wiki/Page_title) please see:
## https://www.mediawiki.org/wiki/Manual:Short_URL
$wgScriptPath = "";
$wgArticlePath = "/title/$1";
# $wgUsePathInfo is not necessary: https://github.com/wikimedia/mediawiki/blob/bb92c4d1acc029eed0f6848360dff5b2436695fc/includes/WebRequest.php#L151-L153
#$wgUsePathInfo = true;

## The URL path to static resources (images, scripts, etc.)
$wgResourceBasePath = $wgScriptPath;

## The relative URL path to the skins directory
$wgStylePath        = "$wgScriptPath/skins";

## The relative URL path to the logo.
## Set to an empty string so no logo is loaded by default.
$wgLogos = ["1x" => ""];

## For attaching licensing metadata to pages, and displaying an
## appropriate copyright notice / icon. GNU Free Documentation
## License and Creative Commons licenses are supported so far.
$wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright
$wgRightsUrl = "https://www.gnu.org/copyleft/fdl.html";
$wgRightsText = "GNU Free Documentation License 1.3 or later";
$wgRightsIcon = "$wgResourceBasePath/resources/assets/licenses/gnu-fdl.png";

# Query string length limit for ResourceLoader. You should only set this if
# your web server has a query string length limit (then set it to that limit),
# or if you have suhosin.get.max_value_length set in php.ini (then set it to
# that value)
# TODO: -1 is the default
$wgResourceLoaderMaxQueryLength = -1;

$wgGitRepositoryViewers['https://github.com/(.*?)(.git)?'] = 'https://github.com/$1/commit/%H';
$wgGitRepositoryViewers['https://gitlab.archlinux.org/(.*?)(.git)?'] = 'https://gitlab.archlinux.org/$1/-/commit/%H';

$wgJobRunRate = 0;
$wgRunJobsAsync = 1;

# Enable support for userscripts and user-stylesheets (FS#46699)
$wgAllowUserJs = true;
$wgAllowUserCss = true;


##
## Database settings
##

$wgDBtype           = "mysql";
$wgDBserver         = "localhost";
$wgDBname = "{{ archwiki_db }}";
$wgDBuser = "{{ archwiki_db_user }}";
$wgDBpassword = "{{ vault_archwiki_db_password }}";

# MySQL specific settings
$wgDBprefix         = "";

# MySQL table options to use during installation or update
$wgDBTableOptions   = "ENGINE=InnoDB, DEFAULT CHARSET=binary";


##
## Email settings
##

## UPO means: this is also a user preference option

$wgEnableEmail      = true;
$wgEnableUserEmail  = true; # UPO

$wgEmergencyContact = "webmaster@archlinux.org";
$wgPasswordSender   = "noreply+wiki@archlinux.org";

$wgEnotifUserTalk      = true; # UPO
$wgEnotifWatchlist     = true; # UPO
$wgEmailAuthentication = true;

# avoid bouncing of user-to-user emails (FS#26737)
$wgUserEmailUseReplyTo = true;

$wgSMTP = array(
 'host'     => "localhost", // could also be an IP address. Where the SMTP server is located
 'IDHost'   => "wiki.archlinux.org",      // Generally this will be the domain name of your website (aka mywiki.org)
 'port'     => 25,                 // Port to use when connecting to the SMTP server
 'auth'     => false,               // Should we use SMTP authentication (true or false)
 #'username' => "my_user_name",     // Username to use for SMTP authentication (if being used)
 #'password' => "my_password"       // Password to use for SMTP authentication (if being used)
);


##
## Cache and performance settings
##

## memcached settings
$wgMainCacheType = CACHE_MEMCACHED;
$wgParserCacheType = CACHE_MEMCACHED;
$wgMessageCacheType = CACHE_MEMCACHED;
$wgMemCachedServers = [ "unix://{{ archwiki_memcached_socket }}" ];

## Set $wgCacheDirectory to a writable directory on the web server
## to make your wiki go slightly faster. The directory should not
## be publicly accessible from the web.
$wgCacheDirectory = "$IP/../cache/data";
$wgEnableSidebarCache = true;
$wgUseCdn = true;
$wgCdnServers = [ '127.0.0.1' ];
$wgInternalServer = 'http://wiki.archlinux.org';

# CSS-based preferences supposedly cause about 20 times slower page loads
# https://phabricator.wikimedia.org/rSVN63707
$wgAllowUserCssPrefs = false;

## Uncomment this to disable output compression
# $wgDisableOutputCompression = true;


##
## Security headers
##

$wgReferrerPolicy = ["no-referrer-when-downgrade"];
$wgEditPageFrameOptions = "DENY";


##
## Media settings
##

## To enable image uploads, make sure the 'images' directory
## is writable, then set this to true:
$wgEnableUploads  = true;
#$wgUseImageMagick = true;
#$wgImageMagickConvertCommand = "/usr/bin/convert";

# InstantCommons allows wiki to use images from https://commons.wikimedia.org
$wgUseInstantCommons  = false;

## If you want to use image uploads under safe mode,
## create the directories images/archive, images/thumb and
## images/temp, and make them all writable. Then uncomment
## this, if it's not already uncommented:
#$wgHashedUploadDirectory = false;

## Enable native SVG rendering
$wgFileExtensions[] = 'svg';
$wgSVGNativeRendering = true;

## Allow uploading WOFF2 fonts
$wgFileExtensions[] = 'woff2';


##
## Skin settings
##

wfLoadSkin( 'Timeless' );
wfLoadSkin( 'Vector' );
$wgVectorResponsive = true;
$wgVectorLanguageInMainPageHeader = true;
$wgDefaultSkin = 'vector-2022';

wfLoadExtension( 'ArchLinux' );
$wgArchHome = 'https://archlinux.org/';
$wgArchNavBar = array(
			'Home' => 'https://archlinux.org/',
			'Packages' => 'https://archlinux.org/packages/',
			'Forums' => 'https://bbs.archlinux.org/',
			'Wiki' => 'https://wiki.archlinux.org/',
			'GitLab' => 'https://gitlab.archlinux.org/archlinux',
			'Security' => 'https://security.archlinux.org/',
			'AUR' => 'https://aur.archlinux.org/',
			'Download' => 'https://archlinux.org/download/'
		);
$wgArchNavBarSelectedDefault = 'Wiki';
$wgFooterIcons = [
	"copyright" => [
		"copyright" => [],
	],
	"poweredby" => [
		"mediawiki" => [
			"src" => null,
		],
	],
];

##
## User roles
##
## User roles are groups without permissions: they only serve to clarify the
## main function of the user in the wiki, and they must be associated to
## specific access levels (see below) as needed.
##

$wgGroupPermissions['maintainer'] = array();
$wgGroupPermissions['translator'] = array();
$wgGroupPermissions['archdev'] = array();
$wgGroupPermissions['archpackager'] = array();
$wgGroupPermissions['archstaff'] = array();
$wgGroupPermissions['administrator_fellow'] = array();


##
## Access levels
##
## These groups shouldn't be used to define the _role_ of users, but only the
## extent of the permissions that they have in the wiki; if a user is given
## an access level greater than 'user', their role (see above) must be
## specified as well.
##

# disable anonymous editing
$wgEmailConfirmToEdit = true;
$wgDisableAnonTalk = true;
$wgGroupPermissions['*']['edit'] = false;

# extra rights for sysop
$wgGroupPermissions['sysop']['deleterevision']  = true;
$wgGroupPermissions['sysop']['deletelogentry']  = true;
if ( isset( $wgGroupPermissions['interface-admin'] ) ) {
    $wgGroupPermissions['sysop'] += $wgGroupPermissions['interface-admin'];
}
if ( isset( $wgGroupPermissions['suppress'] ) ) {
    $wgGroupPermissions['sysop'] += $wgGroupPermissions['suppress'];
}

# disable uploads by normal users
$wgGroupPermissions['user']['upload']          = false;
$wgGroupPermissions['user']['reupload']        = false;
$wgGroupPermissions['user']['reupload-shared'] = false;
$wgGroupPermissions['autoconfirmed']['upload'] = false;

# co-sysop's rights
$wgGroupPermissions['cosysop']['autopatrol'] = true;
$wgGroupPermissions['cosysop']['patrol'] = true;
$wgGroupPermissions['cosysop']['noratelimit'] = true;
$wgGroupPermissions['cosysop']['suppressredirect'] = true;
$wgGroupPermissions['cosysop']['rollback'] = true;
$wgGroupPermissions['cosysop']['browsearchive'] = true;
$wgGroupPermissions['cosysop']['apihighlimits'] = true;
$wgGroupPermissions['cosysop']['unwatchedpages'] = true;
$wgGroupPermissions['cosysop']['deletedhistory'] = true;
$wgGroupPermissions['cosysop']['deletedtext'] = true;

# privileged's rights
$wgGroupPermissions['privileged']['patrolmarks'] = true;
$wgGroupPermissions['privileged']['noratelimit'] = true;
$wgGroupPermissions['privileged']['suppressredirect'] = true;

# additional page-protection levels
$wgRestrictionLevels[] = 'editprotected2';
$wgGroupPermissions['sysop']['editprotected2'] = true;
$wgGroupPermissions['cosysop']['editprotected2'] = true;
$wgGroupPermissions['privileged']['editprotected2'] = true;

# disable user account creation via API
$wgAPIModules['createaccount'] = 'ApiDisabled';
# remove 'writeapi' right from unregistered users
$wgGroupPermissions['*']['writeapi'] = false;
# stricter conditions for 'autoconfirmed' promotion
$wgAutoConfirmAge = 86400*3; // three days
# require at least 20 normal edits before granting the 'writeapi' right
$wgAutoConfirmCount = 20;

# Enforce basic editing etiquette (FS#46190)
# We set the defaults for "minordefault" (disabled), "forceeditsummary"
# (enabled) and "showrollbackconfirmation" (enabled) options and hide them
# from the user preferences dialog. Note that hiding the user preferences with
# $wgHiddenPrefs results in everybody using the defaults, regardless of the
# users' earlier preference.
$wgDefaultUserOptions["minordefault"] = 0;
$wgDefaultUserOptions["forceeditsummary"] = 1;
$wgDefaultUserOptions["showrollbackconfirmation"] = 1;
$wgHiddenPrefs[] = "minordefault";
$wgHiddenPrefs[] = "forceeditsummary";
$wgHiddenPrefs[] = "showrollbackconfirmation";


##
## Namespaces
##

# Main
# Enable subpages in the main namespace (FS#39668)
$wgNamespacesWithSubpages[NS_MAIN] = true;

# Template
# Restrict editing to autoconfirmed users
$wgNamespaceProtection[NS_TEMPLATE] = array( 'editsemiprotected' );

# DeveloperWiki
define("NS_DEVELOPERWIKI", 3000);
define("NS_DEVELOPERWIKI_TALK", 3001);
$wgExtraNamespaces[NS_DEVELOPERWIKI] = "DeveloperWiki";
$wgExtraNamespaces[NS_DEVELOPERWIKI_TALK] = "DeveloperWiki_talk";
$wgNamespacesWithSubpages[NS_DEVELOPERWIKI] = true;
$wgNamespacesWithSubpages[NS_DEVELOPERWIKI_TALK] = true;
$wgContentNamespaces[] = NS_DEVELOPERWIKI;
$wgNamespacesToBeSearchedDefault[NS_DEVELOPERWIKI] = true;
$wgNamespaceProtection[NS_DEVELOPERWIKI] = array( 'editprotected2' );


##
## Additional extensions
##

wfLoadExtension( 'Nuke' );

# AbuseFilter extension
wfLoadExtension( 'AbuseFilter' );
$wgAbuseFilterLogPrivateDetailsAccess = true;
$wgAbuseFilterPrivateDetailsForceReason = true;

$wgGroupPermissions['*']['abusefilter-view'] = false;
$wgGroupPermissions['*']['abusefilter-log'] = false;
$wgGroupPermissions['*']['abusefilter-log-detail'] = false;
$wgGroupPermissions['cosysop']['abusefilter-view'] = true;
$wgGroupPermissions['cosysop']['abusefilter-log'] = true;
$wgGroupPermissions['cosysop']['abusefilter-log-detail'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify'] = true;
$wgGroupPermissions['sysop']['abusefilter-view'] = true;
$wgGroupPermissions['sysop']['abusefilter-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-log-detail'] = true;
$wgGroupPermissions['sysop']['abusefilter-privatedetails'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-restricted'] = true;
$wgGroupPermissions['sysop']['abusefilter-modify-global'] = true;
$wgGroupPermissions['sysop']['abusefilter-revert'] = true;
$wgGroupPermissions['sysop']['abusefilter-view-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-log-private'] = true;
$wgGroupPermissions['sysop']['abusefilter-hide-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-hidden-log'] = true;
$wgGroupPermissions['sysop']['abusefilter-privatedetails-log'] = true;
$wgGroupPermissions['sysop']['renameuser'] = true;

# filter groups
$wgAbuseFilterValidGroups = array( 'default', 'proofed' );
$wgAbuseFilterEmergencyDisableThreshold = array(
    'default' => 0.5,
    'proofed' => 1.0,
);
$wgAbuseFilterEmergencyDisableCount = array(
    'default' => 10,
    'proofed' => 65535,
);

# CheckUser extension
wfLoadExtension( 'CheckUser' );
$wgGroupPermissions['sysop']['checkuser'] = true;
$wgGroupPermissions['sysop']['checkuser-log'] = true;

# ParserFunctions extension
wfLoadExtension( 'ParserFunctions' );

# Interwiki extension
wfLoadExtension( 'Interwiki' );
$wgGroupPermissions['sysop']['interwiki'] = true;

# TitleKey extension
# Suppress deprecation warning, see https://phabricator.wikimedia.org/T353985
$wgDeprecationReleaseLimit = "1.0";
wfLoadExtension( 'TitleKey' );

# BounceHandler extension
wfLoadExtension( 'BounceHandler' );
$wgBounceHandlerInternalIPs = ["{{hostvars['mail.archlinux.org']['ipv4_address']}}", "{{hostvars['mail.archlinux.org']['ipv6_address']}}"];
$wgVERPprefix = "wikibounce";
$wgVERPdomainPart = "archlinux.org";
$wgDebugLogFile = "/dev/null";
$wgDebugLogGroups = array(
	'BounceHandler' => '/var/log/archwiki/bouncehandler.log',
	);


# CAPTCHA
wfLoadExtensions([ 'ConfirmEdit', 'ConfirmEdit/QuestyCaptcha' ]);
$wgCaptchaTriggers['edit'] = false;
$wgCaptchaTriggers['create'] = false;
$wgCaptchaTriggers['addurl'] = false;
$wgCaptchaTriggers['createaccount'] = true;
$wgCaptchaTriggers['badlogin'] = true;
$wgCaptchaQuestions = [
    'What is the output of: <code>LC_ALL=C pacman -V|sed -r "s#[0-9]+#$(date -u +%m)#g"|base32|head -1</code>' => trim(file_get_contents("{{ archwiki_question_answer_file }}"))
];

# Restrict expensive actions to logged in users
#wfLoadExtension( 'Lockdown' );
#$wgSpecialPageLockdown['Recentchanges'] = [ 'user' ];
#$wgSpecialPageLockdown['Newpages'] = [ 'user' ];
#$wgSpecialPageLockdown['Recentchangeslinked'] = [ 'user' ];
#$wgSpecialPageLockdown['Log'] = [ 'user' ];
#$wgSpecialPageLockdown['Diff'] = [ 'user' ];
#$wgActionLockdown['history'] = ['user'];

# UserMerge extension
wfLoadExtension( 'UserMerge' );
$wgGroupPermissions['sysop']['usermerge'] = true;
# Allow merging users with "Anonymous" (user_id 0)
$wgReservedUsernames[] = 'Anonymous';

# Improved interface for editing wikitext
wfLoadExtension( 'WikiEditor' );

# Syntax highlighting in WikiEditor
wfLoadExtension( 'CodeMirror' );
$wgDefaultUserOptions['usecodemirror'] = 1;

# Syntax highlighting for JavaScript, CSS and Lua
wfLoadExtension( 'CodeEditor' );

# DarkMode extension
wfLoadExtension( 'DarkMode' );

# Thanks extension
wfLoadExtension( 'Echo' );
wfLoadExtension( 'Thanks' );

# Discussion Tools
$wgVisualEditorAvailableNamespaces = [
    NS_MAIN => false,
    "Talk" => false,
    "User" => false,
    "File" => false,
    "Category" => false,
    NS_DEVELOPERWIKI => false,
];

wfLoadExtension( 'VisualEditor' );
wfLoadExtension( 'Linter' );
wfLoadExtension( 'DiscussionTools' );

##
## Temporary settings for maintenance
##

# temporary disable registration; reverted 2016-6-26 bluewind
#$wgGroupPermissions['*']['createaccount'] = false;

# $wgReadOnly = 'Database migration in progress. We`ll be back in a few minutes.';