GitLab

Use the acme-storage reload-hooks mechanism.

This reverts commit 747ec0ac.

mariadb-users: refactor account-automation grants

See merge request !99

Use append_privs instead

rsync: wait for vpn0 interface

See merge request !98

jabber: let ejabberd wait for ldap before starting

See merge request !97

Depend on the interface via systemd devices, and remove the Restart
workaround.

* tinc@vpn0.service - Tinc net vpn0
   Active: active (running) since Sat 2020-10-10 17:31:00 UTC; 18h ago

and four seconds later:

* sys-devices-virtual-net-vpn0.device - /sys/devices/virtual/net/vpn0
   Active: active (plugged) since Sat 2020-10-10 17:31:04 UTC; 18h ago

The tinc@vpn0.service dependency is weak, the service is reported as
started before the interface is actually up. Automatically restart as a
workaround.

Fixes #200

"Fixes" a race at boot where the tor service is reported as started but
not listening yet.

Fixes #201

Install mysql defaults files with credentials for various instances

See merge request !94

Even connections from the local server are not going to be accounted
as 'localhost' because they might not use the UNIX socket.

Defaults files are installed only where needed, for remote access to
MySQL instances of a specific type in the same group of hosts.

This might allow us to decouple account-automation credentials later
on, at an instance level.

We have to add % and localhost separately.

It was 5 by default, which is a bit short for some searches.

Add a MTA-STS policy

See merge request !93