refactor

22 files changed, 512 insertions, 109 deletions

diff --git a/Makefile b/Makefile
deleted file mode 100644
index ce976fa..0000000
--- a/Makefile
+++ /dev/null
@@ -1,30 +0,0 @@
-SHELL = /bin/bash
-
-all: config.db
-.PHONY: all
-
-clean:
-	rm -f -- $(filter-out $(pkgfiles),$(wildcard *.pkg.tar.xz))
-.PHONY: clean
-
-pkgbuilds = $(sort $(wildcard *.PKGBUILD))
-$(foreach p,$(pkgbuilds), $(eval $(shell BUILDFILE=$(abspath $p); . "$$BUILDFILE"; echo $(patsubst %.PKGBUILD,%,$p).pkgfile=$$pkgname-$$pkgver-$$pkgrel-any.pkg.tar.xz)))
-$(foreach p,$(patsubst %.PKGBUILD,%,$(pkgbuilds)), \
-  $(eval pkgfiles += $($p.pkgfile))                \
-  $(eval $($p.pkgfile): $p.PKGBUILD)               )
-
-%.pkg.tar.xz: common.sh
-	makepkg -d -p $(filter %.PKGBUILD,$^)
-
-%.db %.db.tar.gz %.files %.files.tar.gz: .var.pkgfiles $(pkgfiles)
-	rm -f $*.db $*.db.tar.gz $*.files $*.files.tar.gz
-	repo-add $*.db.tar.gz $(filter %.pkg.tar.xz,$^)
-	touch --no-create --no-dereference $*.db $*.db.tar.gz $*.files $*.files.tar.gz
-
-.var.pkgfiles: $(pkgbuilds)
-
-.var.%: FORCE
-	@printf '%s' '$(subst ','\\'',$($*))' | sed 's/^/#/' | ./write-ifchanged $@
--include $(wildcard .var.*)
-.PHONY: FORCE
-.SECONDARY:
diff --git a/TODO b/TODO
new file mode 100644
index 0000000..9de5ceb
--- /dev/null
+++ b/TODO
@@ -0,0 +1,4 @@
+- grub
+- filesystems
+- pacman
+- ssh
diff --git a/build b/build
new file mode 100755
index 0000000..0c70c8e
--- /dev/null
+++ b/build
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+pkgfilename() (
+	BUILDFILE="$(realpath -ms -- "$1")"
+	. "$BUILDFILE"
+	echo $pkgname-$pkgver-$pkgrel-any.pkg.tar.xz
+)
+
+main() {
+	local src pkg
+	local pkgs=()
+	for src in *.PKGBUILD; do
+		pkg="$(pkgfilename "$src")"
+		while ! { test "$src" -ot "$pkg" && test config.sh -ot "$pkg"; } 2>/dev/null; do
+			makepkg -d -p "$src"
+			pkg="$(pkgfilename "$src")"
+		done
+		pkgs+=("$pkg")
+	done
+
+	for pkg in "${pkgs[@]}"; do
+		if test "$pkg" -nt config.db.tar.gz; then
+			rm -f config.{db,files}{,.tar.gz}
+			repo-add config.db.tar.gz "${pkgs[@]}"
+			return
+		fi
+	done
+}
+
+main "$@"
diff --git a/clean b/clean
new file mode 100755
index 0000000..98eb4cc
--- /dev/null
+++ b/clean
@@ -0,0 +1,2 @@
+#!/bin/sh
+rm -f -- *.mw *.pkg.* config.*
\ No newline at end of file
diff --git a/common.sh b/common.sh
index d2fcb5f..371b557 100644
--- a/common.sh
+++ b/common.sh
@@ -34,7 +34,7 @@ EOF
 )
 
 add-unit() (
-	install -dm755 "${1%/*}"
+	install -d "${1%/*}"
 	base="$(sed 's/@[^.]*\./@./' <<<"${1##*/}")"
 	srcs=(
 		"etc/systemd/system/${1##*/}"
@@ -55,3 +55,12 @@ add-unit() (
 add-file() {
 	install -Dm644 /dev/stdin "$@"
 }
+
+preamble() {
+	cd "$pkgdir"
+}
+
+postamble() {
+	install -Dm644 "$BUILDFILE" -t "usr/share/doc/config"
+	backup=($(find "$pkgdir" -type f -printf '%P\n'))
+}
diff --git a/config-proton-base.PKGBUILD b/config-box-proton-base.PKGBUILD
index 7b3d2c1..10e269d 100644
--- a/config-proton-base.PKGBUILD
+++ b/config-box-proton-base.PKGBUILD
@@ -1,14 +1,14 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160724
-
-depends=(linux-libre-lts grub haveged netctl)
-conflicts=(linux-libre)
+pkgver=20161106.2
 
 package() {
-cd "$pkgdir"
+preamble
 
 # ## Base setup
 
+depends+=(linux-libre-lts grub haveged)
+conflicts+=(linux-libre)
+
 add-file etc/hostname <<EOF
 proton.parabola.nu
 EOF
@@ -31,14 +31,16 @@ ln -s ../../ca-certificates/extracted/tls-ca-bundle.pem etc/ssl/certs/ca-certifi
 install -d etc/ssl/private
 ln -s ../../letsencrypt/live/$(cat etc/hostname) etc/ssl/private/myhostname
 
-# ## timedate
+# ### timedate
 
 ln -s ../usr/share/zoneinfo/Europe/London etc/localtime
 
 # Use timesyncd NTP client daemon.
 add-unit etc/systemd/system/sysinit.target.wants/systemd-timesyncd.service
 
-# ## networking
+# ### networking
+
+depends+=(netctl)
 
 add-file etc/netctl/ethernet-static <<EOF
 Description='Basic static ethernet connection'
@@ -55,5 +57,5 @@ EOF
 
 netctl-enable ethernet-static
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-winston-base.PKGBUILD b/config-box-winston-base.PKGBUILD
index 71940d6..67d9a8b 100644
--- a/config-winston-base.PKGBUILD
+++ b/config-box-winston-base.PKGBUILD
@@ -1,13 +1,12 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160724
-
-depends=(linux-libre-lts grub haveged irqbalance netctl)
-conflicts=(linux-libre)
+pkgver=20161106.5
 
 package() {
-cd "$pkgdir"
+preamble
 
 # ## Base setup
+depends+=(linux-libre-lts grub haveged irqbalance)
+conflicts+=(linux-libre)
 
 add-file etc/hostname <<EOF
 winston.parabola.nu
@@ -38,14 +37,16 @@ ln -s ../../ca-certificates/extracted/tls-ca-bundle.pem etc/ssl/certs/ca-certifi
 install -d etc/ssl/private
 ln -s ../../letsencrypt/live/$(cat etc/hostname) etc/ssl/private/myhostname
 
-# ## timedate
+# ### timedate
 
 ln -s ../usr/share/zoneinfo/Iceland etc/localtime
 
 # Use timesyncd NTP client daemon.
 add-unit etc/systemd/system/sysinit.target.wants/systemd-timesyncd.service
 
-# ## networking
+# ### networking
+
+depends+=(netctl)
 
 # `/etc/udev/rules.d/80-net-setup-link.rules` is a symlink to
 # `/dev/null`, which disables new-style [predictable network interface
@@ -53,7 +54,7 @@ add-unit etc/systemd/system/sysinit.target.wants/systemd-timesyncd.service
 # old-style names (`eth0`).
 #
 # [0]: https://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames/
-install -dm755 etc/udev/rules.d
+install -d etc/udev/rules.d
 ln -s /dev/null etc/udev/rules.d/80-net-setup-link.rules
 
 # The netctl profile eth0-static just has the network information from
@@ -70,5 +71,5 @@ EOF
 
 netctl-enable eth0-static
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-certbot.PKGBUILD b/config-mgmt-certbot.PKGBUILD
index 014e10d..a5393a4 100644
--- a/config-certbot.PKGBUILD
+++ b/config-mgmt-certbot.PKGBUILD
@@ -1,17 +1,17 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160724
-
-depends=(certbot)
+pkgver=20161106.6
 
 package() {
-cd "$pkgdir"
+preamble
 
-# Winston uses the [certbot][] ACME client to get certificates from
+# Use the [certbot][] ACME client to get certificates from
 # [Let's Encrypt][].
 #
 # [certbot]: https://www.parabola.nu/packages/community/any/certbot/
 # [Let's Encrypt]: https://letsencrypt.org/
 
+depends+=(certbot)
+
 # All domains handled by the server are shoved in as Subject
 # Alternative Names in a single certificate. This makes configuring
 # nginx easier.
@@ -181,5 +181,5 @@ add-file etc/sudoers.d/10-certbot <<EOF
 keys ALL=(ALL) NOPASSWD: /etc/ssl/misc/certbot-hook
 EOF
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-etckeeper.PKGBUILD b/config-mgmt-etckeeper.PKGBUILD
index 88aa419..61b60b7 100644
--- a/config-etckeeper.PKGBUILD
+++ b/config-mgmt-etckeeper.PKGBUILD
@@ -1,10 +1,10 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160713.11
-
-depends=(etckeeper pristine-etc-keeper)
+pkgver=20161106.3
 
 package() {
-cd "$pkgdir"
+preamble
+
+depends+=(etckeeper pristine-etc-keeper)
 
 # [etckeeper][] is configured to use git (the default) to keep track
 # of changes in `/etc`. The systemd unit etckeeper.timer is enabled,
@@ -32,23 +32,6 @@ add-file -m755 etc/etckeeper/commit.d/40git-ignore <<EOF
 git ls-files --ignored --exclude-standard -z|xargs -0r git rm --cached --
 EOF
 
-# etckeepr has been configured to run the pre-commit hook at exta
-# times, to work around a bug[0].
-#
-# [0]: https://etckeeper.branchable.com/todo/metadata_changes_don__39__t_cause_a_new_commit/
-add-file -m755 etc/etckeeper/unclean.d/20pre-commit <<EOF
-#!/bin/sh
-# pre-commit hook for etckeeper, to store metadata and do sanity checks
-set -e
-etckeeper pre-commit -d /etc
-EOF
-add-file -m755 etc/etckeeper/commit.d/20pre-commit <<EOF
-#!/bin/sh
-# pre-commit hook for etckeeper, to store metadata and do sanity checks
-set -e
-etckeeper pre-commit -d /etc
-EOF
-
 # It as also been configured to maintain a list of installed packages
 # as `/etc/.installed-packages.txt`.
 add-file -m755 etc/etckeeper/pre-commit.d/25list-installed <<EOF
@@ -66,7 +49,7 @@ EOF
 # The etckeeper update-ignore hook is customized to ignore a couple
 # more files in `/etc` (and avoid ignoring `/etc/mtab`).  We ignore
 # `resolv.conf` because it is managed by [resolvconf][openresolv].
-
+#
 # [openresolv]: https://www.parabola.nu/packages/core/any/openresolv/
 add-file -m755 etc/etckeeper/update-ignore.d/02custom <<_EOF_
 #!/bin/bash
@@ -104,5 +87,5 @@ add-file etc/pacman.d/.gitignore <<EOF
 /gnupg/
 EOF
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-pacman-mirrorlist-repomirror.PKGBUILD b/config-mgmt-pacman-mirrorlist-repomirror.PKGBUILD
index fa658bd..8c0391b 100644
--- a/config-pacman-mirrorlist-repomirror.PKGBUILD
+++ b/config-mgmt-pacman-mirrorlist-repomirror.PKGBUILD
@@ -1,15 +1,15 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160713.3
+pkgver=20161106.2
 
 provides=(pacman-mirrorlist)
 conflicts=(pacman-mirrorlist)
 
 package() {
-cd "$pkgdir"
+preamble
 
 add-file etc/pacman.d/mirrorlist <<EOF
 Server = https://repomirror.parabola.nu/\$repo/os/\$arch
 EOF
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-users-base.PKGBUILD b/config-mgmt-users-base.PKGBUILD
index 1e64139..bc50ba8 100644
--- a/config-users-base.PKGBUILD
+++ b/config-mgmt-users-base.PKGBUILD
@@ -1,10 +1,10 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160713.3
+pkgver=20161106.2
 
 package() {
-cd "$pkgdir"
+preamble
 
-install -dm755 etc
+install -d etc
 install -dm750 etc/sudoers.d
 add-file etc/sudoers.d/00-wheel <<EOF
 %wheel ALL=(ALL) ALL
@@ -16,5 +16,5 @@ ExecStart=/bin/bash -c '/usr/bin/pwck -r && /usr/bin/pwck -s'
 ExecStart=/bin/bash -c '/usr/bin/grpck -r && /usr/bin/grpck -s'
 EOF
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-uwsgi.PKGBUILD b/config-mgmt-uwsgi.PKGBUILD
index 663f00c..634bcff 100644
--- a/config-uwsgi.PKGBUILD
+++ b/config-mgmt-uwsgi.PKGBUILD
@@ -1,16 +1,16 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160713
-
-depends=(uwsgi)
+pkgver=20161106.2
 
 package() {
-cd "$pkgdir"
+preamble
 
 # Wherever possible, we should use uWSGI for process management of our
 # HTTP services.  This allows for much more consistent management and
 # configuration than the hodge-podge of PHP-FPM, manage.py, fcgiwrap,
 # et c. that we used to have on Proton.
 
+depends+=(uwsgi)
+
 # uWSGI is the program, uwsgi is the protocol it speaks with nginx.  A
 # pool of workers is called a vassal, and is configured in
 # `/etc/uwsgi/${vassal}.ini`, and activated by
@@ -57,5 +57,5 @@ EOF
 # Individual vassal configurations are documented in the section for
 # the service that they provide, not here.
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-service-git.PKGBUILD b/config-service-git.PKGBUILD
index 607c519..689adfa 100644
--- a/config-service-git.PKGBUILD
+++ b/config-service-git.PKGBUILD
@@ -1,10 +1,10 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160713.2
-
-depends=(git cgit uwsgi-plugin-cgi config-uwsgi)
+pkgver=20161106.2
 
 package() {
-cd "$pkgdir"
+preamble
+
+depends+=(git)
 
 add-file -m755 etc/ssl/misc/certbot-get.d/10-git <<EOF
 #!/bin/bash
@@ -22,17 +22,18 @@ PATH=/srv/git/.local/bin:/bin
 0	*	*	*	*	chronic bash -c "update-gitmeta 'Update from cron' 2>&1"
 EOF
 
-
 # ## transport: git protocol
 
 add-unit etc/systemd/system/sockets.target.wants/git-daemon.socket
 
 # ## transport: HTTPS
 
+depends+=(cgit uwsgi-plugin-cgi config-mgmt-uwsgi nginx config-mgmt-certbot)
+
 # The git web interface is cgit, which is managed by uWSGI speaking
 # uwsgi/modifier1=9, which is the variant of the uwsgi protocol for
 # CGI requests.
-add-file etc/nginx/sites/server-git.parabola.nu.conf <<EOF
+add-file etc/nginx/sites/server-git_parabola_nu.conf <<EOF
 # -*- Mode: nginx; nginx-indent-level: 8; indent-tabs-mode: t -*-
 
 server {
@@ -40,8 +41,8 @@ server {
 	listen 443 ssl http2;
 	listen [::]:443 ssl http2;
 
-	error_log  /var/log/nginx/nginx.http.git.parabola.nu.error.log  error;
-	access_log /var/log/nginx/nginx.http.git.parabola.nu.access.log specific;
+	error_log  /var/log/nginx/nginx.http.git_parabola_nu.error.log  error;
+	access_log /var/log/nginx/nginx.http.git_parabola_nu.access.log specific;
 
 	location / {
 		try_files \$uri @cgit;
@@ -61,7 +62,7 @@ add-file etc/uwsgi/git.ini <<EOF
 master = true
 processes = 1
 
-uid = http
+uid = %n
 gid = http
 
 plugins = cgi
@@ -71,5 +72,5 @@ EOF
 
 add-unit etc/systemd/system/sockets.target.wants/uwsgi@git.socket
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-service-myhostname.PKGBUILD b/config-service-myhostname.PKGBUILD
new file mode 100644
index 0000000..c13560b
--- /dev/null
+++ b/config-service-myhostname.PKGBUILD
@@ -0,0 +1,41 @@
+. ${BUILDFILE%/*}/common.sh
+pkgver=20161106.2
+
+package() {
+preamble
+
+add-file etc/nginx/sites/server-myhostname.conf <<EOF
+# -*- Mode: nginx; nginx-indent-level: 8; indent-tabs-mode: t -*-
+
+server {
+	server_name \$hostname;
+	listen 443 ssl http2;
+	listen [::]:443 ssl http2;
+
+	error_log  /var/log/nginx/nginx.http.myhostname.error.log  error;
+	access_log /var/log/nginx/nginx.http.myhostname.access.log specific;
+
+	location = / {
+		uwsgi_pass unix:/run/uwsgi/myhostname.sock;
+		uwsgi_modifier1 9; # Standard CGI request
+		include uwsgi_params;
+	}
+}
+EOF
+
+add-file etc/uwsgi/myhostname.ini <<EOF
+[uwsgi]
+master = true
+processes = 1
+
+uid = nobody
+gid = http
+
+plugins = cgi
+cgi = /srv/http/myhostname/sysinfo
+EOF
+
+add-unit etc/systemd/system/sockets.target.wants/uwsgi@myhostname.socket
+
+postamble
+}
diff --git a/config-service-projects.PKGBUILD b/config-service-projects.PKGBUILD
index 71cd152..d938140 100644
--- a/config-service-projects.PKGBUILD
+++ b/config-service-projects.PKGBUILD
@@ -1,17 +1,17 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160713.1
-
-depends=(git cgit uwsgi-plugin-cgi config-uwsgi)
+pkgver=20161106.2
 
 package() {
-cd "$pkgdir"
+preamble
+
+depends+=(nginx config-mgmt-certbot)
 
 add-file -m755 etc/ssl/misc/certbot-get.d/10-projects <<EOF
 #!/bin/bash
 echo projects.{parabola.nu,parabolagnulinux.org}
 EOF
 
-add-file etc/nginx/sites/server-projects.parabola.nu.conf <<EOF
+add-file etc/nginx/sites/alias-projects_parabola_nu.conf <<EOF
 # -*- Mode: nginx; nginx-indent-level: 8; indent-tabs-mode: t -*-
 
 server {
@@ -23,5 +23,5 @@ server {
 }
 EOF
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-pacman-mirrorlist-repo.PKGBUILD b/config-service-repo.PKGBUILD
index 49354f0..4319b03 100644
--- a/config-pacman-mirrorlist-repo.PKGBUILD
+++ b/config-service-repo.PKGBUILD
@@ -1,15 +1,15 @@
 . ${BUILDFILE%/*}/common.sh
-pkgver=20160713.3
+pkgver=20161106.2
 
 provides=(pacman-mirrorlist)
 conflicts=(pacman-mirrorlist)
 
 package() {
-cd "$pkgdir"
+preamble
 
 add-file etc/pacman.d/mirrorlist <<EOF
-Server = https://repo.parabola.nu/\$repo/os/\$arch
+Server = file:///srv/repo/main/$repo/os/$arch
 EOF
 
-backup=($(find "$pkgdir" -type f -printf '%P\n'))
+postamble
 }
diff --git a/config-service-wiki.PKGBUILD b/config-service-wiki.PKGBUILD
new file mode 100644
index 0000000..c8809a3
--- /dev/null
+++ b/config-service-wiki.PKGBUILD
@@ -0,0 +1,112 @@
+. ${BUILDFILE%/*}/common.sh
+pkgver=20161106.2
+
+package() {
+preamble
+
+depends+=(uwsgi-plugin-php php-apcu-bc php-intl)
+depends+=(mariadb imagemagick config-mgmt-uwsgi config-mgmt-certbot)
+depends+=(git)
+
+add-file -m755 etc/ssl/misc/certbot-get.d/10-git <<EOF
+#!/bin/bash
+echo wiki.{parabola.nu,parabolagnulinux.org}
+EOF
+
+add-file etc/nginx/sites/server-wiki_parabola_nu.conf <<EOF
+# -*- Mode: nginx; nginx-indent-level: 8; indent-tabs-mode: t -*-
+
+server {
+	server_name wiki.parabola.nu;
+	listen 443 ssl http2;
+	listen [::]:443 ssl http2;
+
+	error_log  /var/log/nginx/nginx.http.wiki_parabola_nu.error.log  error;
+	access_log /var/log/nginx/nginx.http.wiki_parabola_nu.access.log specific;
+
+	location = /favicon.ico {
+		alias /srv/http/\$server_name/skins/ArchLinux/favicon.ico;
+	}
+
+	location = /robots.txt {
+		alias /srv/http/\$server_name/robots.txt;
+	}
+
+	index index.php;
+	location /                     { root /var/empty; try_files /bogus @rewrite; }
+	location /images/              { }
+	location /skins/               { }
+	location /resources/           { }
+	location /api.php              { root /var/empty; try_files /bogus @php; }
+	location /api.php5             { root /var/empty; try_files /bogus @php; }
+	location /img_auth.php         { root /var/empty; try_files /bogus @php; }
+	location /img_auth.php5        { root /var/empty; try_files /bogus @php; }
+	location /index.php            { root /var/empty; try_files /bogus @php; }
+	location /index.php5           { root /var/empty; try_files /bogus @php; }
+	location /load.php             { root /var/empty; try_files /bogus @php; }
+	location /load.php5            { root /var/empty; try_files /bogus @php; }
+	location /opensearch_desc.php  { root /var/empty; try_files /bogus @php; }
+	location /opensearch_desc.php5 { root /var/empty; try_files /bogus @php; }
+	location /profileinfo.php      { root /var/empty; try_files /bogus @php; }
+	location /thumb.php            { root /var/empty; try_files /bogus @php; }
+	location /thumb.php5           { root /var/empty; try_files /bogus @php; }
+	location /thumb_handler.php    { root /var/empty; try_files /bogus @php; }
+	location /thumb_handler.php5   { root /var/empty; try_files /bogus @php; }
+	location /wiki.phtml           { root /var/empty; try_files /bogus @php; }
+
+	location @rewrite {
+		rewrite ^/(.*)\$ /index.php?title=\$1&\$args;
+	}
+
+	location @php {
+		uwsgi_cache_key \$host\$request_uri;
+		uwsgi_cache_valid 5m;
+		#uwsgi_cache one;
+
+		include uwsgi_params;
+		uwsgi_modifier1 14; # Standard PHP request
+		uwsgi_pass unix:/run/uwsgi/wiki.sock;
+	}
+}
+EOF
+
+add-file etc/cron.spool/wiki <<EOF
+0 0 * * * /srv/http/wiki.parabola.nu/FunnyQuestion.conf.php.sh
+EOF
+
+add-file etc/uwsgi/wiki.ini <<EOF
+[uwsgi]
+master = true
+processes = 4
+
+uid = %n
+gid = http
+
+plugins = php
+
+# Native code is faster than PHP fallback code
+php-set = extension=intl.so
+
+# Required for MediaWiki
+php-set = extension=iconv.so
+
+php-set = extension=mysqli.so
+
+# Enable OPcache bytecode caching
+php-set = zend_extension=opcache.so
+
+# Enable APCu object caching (related to LocalSettings.php:$wgMainCacheType=CACHE_ACCEL)
+php-set = extension=apcu.so
+php-set = extension=apc.so
+
+# Restrict the files that can be opened:
+# - /srv/http/wiki.parabola.nu: duh, the PHP code
+# - /usr/bin: to check for diff3, imagemagick, et c.
+# - /tmp: eh?
+php-set = open_basedir=/srv/http/wiki.parabola.nu:/usr/bin:/tmp
+EOF
+
+add-unit etc/systemd/system/sockets.target.wants/uwsgi@wiki.socket
+
+postamble
+}
diff --git a/doc b/doc
new file mode 100755
index 0000000..abc6b42
--- /dev/null
+++ b/doc
@@ -0,0 +1,16 @@
+#!/usr/bin/make -f
+SHELL = bash -o pipefail
+
+pkgbuilds = $(sort $(wildcard *.PKGBUILD))
+
+config.mw: .var.pkgbuilds $(patsubst %.PKGBUILD,%.mw,$(pkgbuilds))
+	cat $(sort $(filter %.mw,$^)) > $@
+
+%.mw: %.PKGBUILD ./pkgbuild2mw.0 ./pkgbuild2mw.1 ./pkgbuild2mw.2
+	< $< ./pkgbuild2mw.0 | ./pkgbuild2mw.1 | ./pkgbuild2mw.2 | cat -s > $@
+
+.var.%: FORCE
+	@printf '%s' '$(subst ','\\'',$($*))' | sed 's/^/#/' | ./write-ifchanged $@
+-include $(wildcard .var.*)
+.PHONY: FORCE
+.SECONDARY:
diff --git a/pandoc.rb b/pandoc.rb
new file mode 100644
index 0000000..9c12351
--- /dev/null
+++ b/pandoc.rb
@@ -0,0 +1,77 @@
+require 'open3'
+require 'json'
+
+module Pandoc
+	def self.prog
+		@prog ||= 'pandoc'
+	end
+	def self.prog=(val)
+		@prog = val
+	end
+	def self.load(fmt, input)
+		cmd = Pandoc::prog + " -t json"
+		unless fmt.nil?
+			cmd += " -f " + fmt
+		end
+		str = input
+		if str.respond_to? :read
+			str = str.read
+		end
+		json = ''
+		errors = ''
+		Open3::popen3(cmd) do |stdin, stdout, stderr|
+			stdin.puts(str)
+			stdin.close
+			json = stdout.read
+			errors = stderr.read
+		end
+		unless errors.empty?
+			raise errors
+		end
+		return Pandoc::AST::new(json)
+	end
+
+	class AST
+		def initialize(json)
+			@js = JSON::parse(json)
+		end
+
+		def [](key)
+			Pandoc::AST::js2sane(@js[0]["unMeta"][key])
+		end
+
+		def to(format)
+			cmd = Pandoc::prog + " -f json -t " + format.to_s
+			output = ''
+			errors = ''
+			Open3::popen3(cmd) do |stdin, stdout, stderr|
+				stdin.puts @js.to_json
+				stdin.close
+				output = stdout.read
+				errors = stderr.read
+			end
+			unless errors.empty?
+				raise errors
+			end
+			return output
+		end
+
+		def self.js2sane(js)
+			if js.nil?
+				return js
+			end
+			case js["t"]
+			when "MetaList"
+				js["c"].map{|c| js2sane(c)}
+			when "MetaInlines"
+				js["c"].map{|c| js2sane(c)}.join()
+			when "Space"
+				" "
+			when "MetaString"
+				js["c"]
+			when "Str"
+				js["c"]
+			end
+		end
+	end
+end
diff --git a/pkgbuild2mw.0 b/pkgbuild2mw.0
new file mode 100755
index 0000000..78efcf5
--- /dev/null
+++ b/pkgbuild2mw.0
@@ -0,0 +1,116 @@
+#!/usr/bin/env ruby
+# coding: utf-8
+load 'pandoc.rb'
+
+class Translator
+	def initialize(file)
+		@file = file
+		@line = ''
+	end
+
+	def getline
+		@line = @file.readline
+	end
+
+	def is_md
+		@line.start_with? "#"
+	end
+	def section_md
+		section = ""
+		while @line.start_with? "#"
+			section += @line.sub(/^# ?/, '')
+			getline
+		end
+		puts "\n\n#{Pandoc::load('markdown', section).to('mediawiki')}\n\n"
+	end
+
+	def is_hd
+		not /(.*)[^<]<<\s*([^<]\S+)/.match(@line).nil?
+	end
+	def section_hd
+		m = /(.*)[^<]<<\s*([^<]\S+)/.match(@line)
+		return if m.nil?
+		prefix = m[1]
+		eot = m[2]
+		getline
+		body = ""
+		while @line != "#{eot}\n"
+			body += @line
+			getline
+		end
+		getline
+		puts "\n\n{{hc|#{prefix}|<nowiki>#{body.chomp}</nowiki>}}\n\n"
+	end
+
+	def section_sh
+		section = ""
+		while true
+			if is_md
+				puts "\n\n{{bc|<nowiki>#{section.chomp}</nowiki>}}\n\n" unless section.gsub("\n", '') == ""
+				section_md
+				section = ""
+			elsif is_hd
+				puts "\n\n{{bc|<nowiki>#{section.chomp}</nowiki>}}\n\n" unless section.gsub("\n", '') == ""
+				section_hd
+				section = ""
+			elsif @line == "}\n"
+				puts "\n\n{{bc|<nowiki>#{section.chomp}</nowiki>}}\n\n" unless section.gsub("\n", '') == ""
+				return
+			else
+				if @line.start_with? 'add-unit '
+					puts "\n\n{{bc|<nowiki>#{section.chomp}</nowiki>}}\n\n" unless section.gsub("\n", '') == ""
+					puts "f* {{ic|/#{@line.sub('add-unit ', '').chomp}}}"
+					section = ""
+					getline
+					next
+				end
+				m = /^ln -s (.*) (\S*)$/.match(@line)
+				if not m.nil?
+					puts "\n\n{{bc|<nowiki>#{section.chomp}</nowiki>}}\n\n" unless section.gsub("\n", '') == ""
+					puts "f* {{ic|/#{m[2]}}}: {{ic|-> #{m[1]}}}"
+					section = ""
+					getline
+					next
+				end
+				if @line == "preamble\n" or @line == "postamble" or @line.start_with? 'install -d'
+					getline
+					next
+				end
+				if @line.start_with? 'netctl-enable '
+					puts "\n\n{{bc|<nowiki>#{section.chomp}</nowiki>}}\n\n" unless section.gsub("\n", '') == ""
+					unit="netctl@#{`systemd-escape -- #{@line.sub(/^netctl-enable /, '')}`.chomp}.service"
+					puts "f* {{ic|/etc/systemd/system/#{unit}}}"
+					puts "f* {{ic|/etc/systemd/system/multi-user.target.wants/#{unit}}}"
+					getline
+					next
+				end
+				m = /^depends\+?=\((.*)\)/.match(@line)
+				if not m.nil?
+					m[1].split(/\s+/).each do |pkg|
+						puts "p* {{ic|#{pkg}}"
+					end
+					getline
+					next
+				end
+				m = /^conflicts\+?=\((.*)\)/.match(@line)
+				if not m.nil?
+					puts "p* group:{{ic|base}} except for {{ic|#{m[1]}}}"
+					getline
+					next
+				end
+				section += @line
+				getline
+			end
+		end
+	end
+
+	def run
+		while @line != "package() {\n"
+			getline
+		end
+		getline
+		section_sh
+	end
+end
+
+Translator.new(STDIN).run()
diff --git a/pkgbuild2mw.1 b/pkgbuild2mw.1
new file mode 100755
index 0000000..6d6aa89
--- /dev/null
+++ b/pkgbuild2mw.1
@@ -0,0 +1,5 @@
+#!/bin/bash
+
+sed -r \
+    -e 's@^\{\{hc\|add-file ([^|]*)\|(.*)\}\}$@f* {{ic|/\1}}: {{ic|\2}}@' \
+    -e 's@^\{\{hc\|add-file ([^|]*)\|@f* {{ic|/\1}}\n&@'
diff --git a/pkgbuild2mw.2 b/pkgbuild2mw.2
new file mode 100755
index 0000000..272a7b6
--- /dev/null
+++ b/pkgbuild2mw.2
@@ -0,0 +1,34 @@
+#!/usr/bin/env ruby
+
+$pfix = ''
+$ffix = ''
+$body = ''
+
+def flush
+	if $pfix != ''
+		puts 'Packages installed:'
+		puts $pfix.split("\n").sort.join("\n")
+	end
+	if $ffix != ''
+		puts 'Files affected:'
+		puts $ffix.split("\n").sort.join("\n")
+	end
+	puts $body
+	$pfix = ''
+	$ffix = ''
+	$body = ''
+end
+
+STDIN.each_line do |line|
+	if line.start_with? "p*"
+		$pfix += line[1,line.length]
+	elsif line.start_with? "f*"
+		$ffix += line[1,line.length]
+	elsif line.start_with? '='
+		flush
+		puts line
+	else
+		$body += line
+	end
+end
+flush