GitLab

We moved identity to aranea long ago, and now terminated orbi entirely.

FSF removed it, update Ansible to match.

Will be needed for the new season.k.o site.

This attempts to keep it from overlapping with leptone/GitLab backups.
We will see if it's actually enough.

This was causing errors like:
telegraf[606]: 2022-03-28T18:51:03Z E! [inputs.disk] [SystemPS] => error
getting disk usage ("/run/docker/netns/928b1711f699"): permission denied

Backup script copied from orbi's.

Server was decommissioned.

To let each server using LDAP connect to orbi via ssh, we need to add
orbi's host key to known_hosts. Doing this automatically from the playbook
was disabled due to the use of hashed hostnames in known_hosts. I have now
manually replaced the orbi entry with a non-hashed hostname on all servers
so I can let the playbook maintain it going forward.

Switching the ssh tunnel from orbi to aranea on all servers later will need
just a single config line changed.

MySQL 8 uses the caching_sha2_password authentication plugin by default,
but this is not compatible with PHP PDO (at least with Identity's PHP 5.6
version). Add a mysqld config file to change back to mysql_native_password.

- Put aranea in 'identity' host group so the playbook runs there and
  installs all the site components.
- Copy encrypted host vars from orbi to aranea (MySQL and LDAP password,
  recaptcha site key, etc).

Switch back to using the PHP PPA instead of my temporary xenial mirror
if the distro is not Ubuntu Xenial, ie. use my mirror only in xenial (semi
reverts cb33f31c). This lets the same code work on both orbi and aranea.

More configuration to be added later.

The Vagrant box doesn't come with package lists, so we need to run
"apt-get update" before any package installation will work.

This is required to upgrade Ubuntu, since mod_fastcgi was removed.

Many of our servers use this Ubuntu PPA to get current PHP packages:
https://launchpad.net/~ondrej/+archive/ubuntu/php

However, orbi is still on Ubuntu Xenial, and that PPA doesn't have Xenial
packages anymore. This means the PHP packages are not installable from the
repository anymore. "apt reinstall php5.6-fpm" will fail, we can't rebuild
orbi if it was needed, and we can't run the KDE Identity vagrant VM.

I mirrored the old xenial packages on my own server, and changed the php
role to use it on orbi. I tested that this works on the vagrant VM.

Maybe in the future we can move the repo elsewhere, but hopefully we'll
upgrade orbi away from xenial soon enough...

(well, I disabled them manually, this change stops ansible from trying to
re-enable them)

Ben did some changes to free space in the storage server, excluding gitlab
logs and stopping backups on rosetta. I'm committing those changes into the
repo.