{"id":16963634,"url":"https://github.com/coderobe/archlinux-infrastructure","last_synced_at":"2026-04-19T19:03:29.390Z","repository":{"id":94539708,"uuid":"201765074","full_name":"coderobe/archlinux-infrastructure","owner":"coderobe","description":"patches to arch linux' infrastructure repository","archived":false,"fork":false,"pushed_at":"2019-08-11T18:07:10.000Z","size":1823,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-21T16:33:26.748Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/coderobe.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-08-11T12:59:23.000Z","updated_at":"2019-08-11T18:07:12.000Z","dependencies_parsed_at":"2023-03-13T16:59:06.869Z","dependency_job_id":null,"html_url":"https://github.com/coderobe/archlinux-infrastructure","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/coderobe/archlinux-infrastructure","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderobe%2Farchlinux-infrastructure","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderobe%2Farchlinux-infrastructure/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderobe%2Farchlinux-infrastructure/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderobe%2Farchlinux-infrastructure/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/coderobe","download_url":"https://codeload.github.com/coderobe/archlinux-infrastructure/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coderobe%2Farchlinux-infrastructure/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32018765,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-18T20:23:30.271Z","status":"online","status_checked_at":"2026-04-19T02:00:07.110Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T23:25:34.328Z","updated_at":"2026-04-19T19:03:29.381Z","avatar_url":"https://github.com/coderobe.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Arch Infrastructure\n\nThis repository contains the complete collection of ansible playbooks and roles for the Arch Linux infrastructure.\n\nIt also contains git submodules so you have to run `git submodule update --init\n--recursive` after cloning or some tasks will fail to run.\n\n## Requirements\n\nInstall these packages:\n  - terraform\n\n### Instructions\n\nAll systems are set up the same way. For the first time setup in the Hetzner rescue system,\nrun the provisioning script: `ansible-playbook playbooks/tasks/install-arch.yml -l $host`.\nThe provisioning script configures a sane basic systemd with sshd. By design, it is NOT idempotent.\nAfter the provisioning script has run, it is safe to reboot.\n\nOnce in the new system, run the regular playbook: `HCLOUD_TOKEN=$(misc/get_key.py misc/vault_hetzner.yml hetzner_cloud_api_key) ansible-playbook playbooks/$hostname.yml`.\nThis playbook is the one regularity used for administrating the server and is entirely idempotent.\n\n#### Note about Ansible dynamic inventories\n\nWe use a dynamic inventory script in order to automatically get information for\nall servers directly from hcloud. You don't really have to do anything to make\nthis work but you should keep in mind to NOT add hcloud servers to `hosts`!\nThey'll be available automatically.\n\n#### Note about first time certificates\n\nThe first time a certificate is issued, you'll have to do this manually by yourself. First, configure the DNS to\npoint to the new server and then run a playbook onto the server which includes the nginx role. Then on the server,\nit is necessary to run the following once:\n\n    certbot certonly --email webmaster@archlinux.org --agree-tos --rsa-key-size 4096 --renew-by-default --webroot -w /var/lib/letsencrypt/ -d \u003cdomain-name\u003e\n\nNote that some roles already run this automatically.\n\n#### Note about packer\n\nWe use packer to build snapshots on hcloud to use as server base images.\nIn order to use this, you need to install packer and then run\n\n    packer build -var $(misc/get_key.py misc/vault_hetzner.yml hetzner_cloud_api_key env) packer/archlinux.json\n\nThis will take some time after which a new snapshot will have been created on the primary hcloud archlinux project.\n\n#### Note about terraform\n\nWe use terraform to provision a part of the infrastructure on hcloud.\nThe very first time you run terraform on your system, you'll have to init it:\n\n    terraform init -backend-config=\"conn_str=postgres://terraform:$(misc/get_key.py group_vars/all/vault_terraform.yml vault_terraform_db_password)@state.cloud.archlinux.org\"\n\nAfter making changes to the infrastructure in `archlinux.fg`, run\n\n    terraform plan\n\nThis will show you planned changes between the current infrastructure and the desired infrastructure.\nYou can then run\n\n    terraform apply\n\nto actually apply your changes.\n\nWe store terraform state on a special server that is the only hcloud server NOT\nmanaged by terraform so that we do not run into a chicken-egg problem. The\nstate server is assumed to just exist so in an unlikely case where we have to\nentirely redo this infrastructure, the state server would have to be manually\nset up.\n\n#### Note about opendkim\n\nThe opendkim DNS data has to be added to DNS manually. The roles verifies that the DNS is correct before starting opendkim.\n\nThe file that has to be added to the zone is `/etc/opendkim/private/$selector.txt`.\n\n\n### Finding servers requiring security updates\n\nArch-audit can be used to find servers in need of updates for security issues.\n\n    ansible all -a \"arch-audit -u\"\n\n#### Updating servers\n\nThe following steps should be used to update our managed servers:\n\n  * pacman -Syu\n  * manually update the kernel, since it is in IgnorePkg by default\n  * sync\n  * checkservices\n  * reboot\n\n## Servers\n\n### vostok\n\n#### Services\n  - backups\n\n### orion\n\n#### Services\n  - repos/sync (repos.archlinux.org)\n  - sources (sources.archlinux.org)\n  - archive (archive.archlinux.org)\n  - torrent tracker hefurd (tracker.archlinux.org)\n\n### apollo\n\n#### Services\n  - bbs (bbs.archlinux.org)\n  - wiki (wiki.archlinux.org)\n  - aur (aur.archlinux.org)\n  - flyspray (bugs.archlinux.org)\n  - mailman\n  - planet (planet.archlinux.org)\n  - bugs (bugs.archlinux.org)\n  - archweb\n  - patchwork\n  - projects (projects.archlinux.org)\n\n### soyuz\n\n#### Services\n  - build server (pkgbuild.com)\n  - releng\n  - sogrep\n  - /~user/ webhost\n  - irc bot (phrik)\n  - matrix\n  - docker images\n  - arch boxes (packer)\n\n### dragon\n\n#### Services\n  - build server (pkgbuild.com)\n  - sogrep\n\n### state.cloud.archlinux.org\n\n#### Services:\n  - postgres server for terraform state\n\n### quassel.archlinux.org\n\n#### Services:\n  - quassel core\n\n## Ansible repo workflows\n\n### Replace vault password and change vaulted passwords\n\n  - Generate a new key and save it as ./new-vault-pw: `pwgen -s 64 1 \u003e new-vault-pw`\n  - `for i in $(ag ANSIBLE_VAULT -l); do ansible-vault rekey --new-vault-password-file new-vault-pw $i; done`\n  - Change the key in misc/vault-password.gpg\n  - `rm new-vault-pw`\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoderobe%2Farchlinux-infrastructure","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcoderobe%2Farchlinux-infrastructure","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoderobe%2Farchlinux-infrastructure/lists"}