GitLab

Private rooms are already end-to-end-encrypted (E2EE) by default (at
least if created via Element - didn't test other clients). However the
synapse setting encryption_enabled_by_default_for_room_type: invite led
Element to disallow creating private rooms without E2EE (i.e. the
encryption setting was force-enabled). With the default setting in
Synapse (off) Element will still enable encryption by default, but it
can be disabled at room creation time.

The ipxe EFI netboot image is available in an Arch Linux package since
2021-03-15. Thus it's no longer necessary to keep ipxe/arch_netboot.efi
in this repository. This also enables easy automatic updating of the
image if a new one is released upstream, making the ipxe-update role
obsolete.

So far, no actions are taken to ensure the pacman cache does not grow permanently.
With this role, a post hook removes all cached packets except the last two.

See https://github.com/vector-im/element-web/issues/16774 for more details

Also fix some minor typos etc. along the way.

Previously the --vm option, which got replaced in commit bf88ce21, would
change the install disk from /dev/sda to /dev/vda (intended for our
previous libvirt setup).  This more generalized form has no current use
case in our production environment, but may be used e.g. for testing
with local VMs or other situations.

This reverts commit 7b7035ca.

We don't have any Linux hosts (VMs) with a serial console anymore. Also
enabling serial-getty@{ttyS0,ttyS1}.service on hosts without a serial
console spams the system log with error messages. (This could probably
be fixed with small adjustments to the unit, but it's superflous now
anyway.)

Otherwise, ansible-pull doesn't work because karo is offline right now

Between ansible-pull (including pacman -Syu) and the reboot, the kernel
may fail to load modules (if Arch package 'linux' was updated), services
may run with old configuration etc. We do a reboot every night anyway,
so just move ansible-pull closer to it.

See also #6

https://jinja.palletsprojects.com/en/2.11.x/templates/#whitespace-control
Adding a "+" did not work, so I moved the statement blocks to separate lines.

The VMs will be hosted at the IRB now.

Running domains can be automatically suspended/shutdown at host shutdown using the libvirt-guests.service systemd service. This same service will resume/startup the suspended/shutdown domain automatically at host startup.

Otherwise the inventory script will stacktrace while parsing !vault tags