GitLab

Use more accurate bins for the latency histograms (10ms-20s, with
a growth factor of 1.4142).

Allows for customizing the resulting NGINX configuration to suit
particular requirements that aren't easily handled by the backend
application.

Horizontal endpoints are HTTP endpoints served on all domains hosted
by the infrastructure - normally used for services handling
"well-known" URLs.

Provide a run-parts reload directory for services to put their
custom reload scripts in. Replaces the previous hard-coded reload
of nginx, which isn't appropriate on non-frontend hosts.

Removes the need for services using /etc/credentials/public to be in
the special "replds-acme" group, which introduced coupling between the
public credentials interface and its implementation.

Instead, we just run the replds@acme daemon under the
public-credentials group.

There is no need to hold on to selfsigned certs once the ACME
automation takes over: this removes the requirement for the link-based
switch mechanism we had in place. We can instead just make everything
in /etc/credentials/public a real directory, create the selfsigned
cert there if missing, and just overwrite everything periodically from
the replds@acme directory.

Replace custom-errors.conf and site-limits.conf with a more generic
site-common.conf, that also includes HSTS and other top-level site
functionality.

Due to the multiple frontends we can't trigger the reload from the
ACME automation daemon.

Credentials are now installed on-demand, selected by type (http, tcp,
other) or type + service.

This just intercepts the /favicon.ico URL at the nginx level, if the
site defines its own (at a different URL), that one will be used instead.

ai3/prod#31

This reverts commit dd609e0e.

We are quite confident this won't fix the issue