| 1 | # 2024-02-08 |
| 2 | |
| 3 | Attendees: delroth, hexa, JulienMalka, lheckemann, raitobezarius, vcunat, |
| 4 | zimbatm |
| 5 | |
| 6 | ## [hexa, delroth] EMS Migration |
| 7 | |
| 8 | Context: https://github.com/NixOS/infra/issues/325 |
| 9 | |
| 10 | - PR for Synapse and its dependencies is up. |
| 11 | - https://github.com/NixOS/infra/pull/336 |
| 12 | - [Julien] What's the status of the backup module? |
| 13 | - Split off into its own PR and merged already: |
| 14 | https://github.com/NixOS/infra/pull/345 |
| 15 | - raito and Ron met with Matrix / EMS folks at FOSDEM 2024 |
| 16 | - They have scripts for GDPR compliance (user data purge), but we need to ask |
| 17 | them by email. |
| 18 | - Then we can get a clean DB dump, presumably without user data. |
| 19 | - Not sure whether we sent an email or not. But Graham might be in contact |
| 20 | directly, and EMS folks made him an offer to do the data deletion. |
| 21 | - Worst case Graham/DetSys will pay for the extension of the EMS plan. |
| 22 | - Probably no hurry anymore from the infra side. Foundation board is |
| 23 | monitoring this to make sure we have a solution at some point. |
| 24 | |
| 25 | ## [delroth] Should we publish these notes more widely? |
| 26 | |
| 27 | - There is a trend towards publishing notes on Discourse, etc. for visibility. |
| 28 | - [delroth] My thoughts: we should archive (edited) notes in Git somewhere in |
| 29 | our docs/ folder, update a Discourse thread every 2 weeks. |
| 30 | - I of course volunteer to take care of this :) |
| 31 | - Consensus: let’s do it. |
| 32 | |
| 33 | ## [delroth] Packet/EQM access to infra-core |
| 34 | |
| 35 | - Our builders are very, very outdated. But risky to try and update stuff with 0 |
| 36 | debugging capabilities. |
| 37 | - Any reason why infra-core shouldn’t have full Packet/EQM access like we have |
| 38 | Hetzner access? |
| 39 | - Not entirely clear who currently has access? |
| 40 | - [zimbatm] Got access from eelco last weekend, will delegate. |
| 41 | - [raito] Does nix-netboot-serve run on our infra? |
| 42 | - [hexa] Yes, on eris. The images are also built from our infra, it’s a Hydra |
| 43 | jobset. But the jobset has not successfully completed for a year. |
| 44 | - [hexa] We can update stuff, but we have no way to debug issues if we do so. |
| 45 | - zimbatm took care of it live, woo! |
| 46 | |
| 47 | ## [raito] Stay in the loop of infrastructure matters |
| 48 | |
| 49 | - How should work be split between zimbatm/raito? |
| 50 | - Would like access to private infra stuff to act as secondary. |
| 51 | - In general: who should have ownership to accounts? |
| 52 | - A bunch of GH org owners for example are inactive. |
| 53 | - Not really aligned with any subgroup e.g. foundation board. |
| 54 | - [zimbatm] I think the foundation should have access, but unfortunately the |
| 55 | foundation also doesn’t have the best personal security to hold those |
| 56 | credentials. |
| 57 | - [zimbatm] Maybe it should be the infra team instead? i.e. |
| 58 | delroth/hexa/vcunat/… |
| 59 | - [raito] That would work too, as long as it’s active folks who can take care |
| 60 | of day to day stuff. I don’t care that it’s specifically me, just that we |
| 61 | don’t get blocked due to not finding an owner. |
| 62 | - [zimbatm] I don’t feel like I can make that decision alone right now. Let’s |
| 63 | find some kind of organization which makes sense. |
| 64 | - Raito got invited into the private infra matrix channel (at least, for now) |
| 65 | |
| 66 | ## [Julien] NixOS wiki collaboration w/ infra team |
| 67 | |
| 68 | - We have a bunch of candidate sysadmins in mind. Do we want to merge this into |
| 69 | non-critical-infra? |
| 70 | - [Julien] I’m a bit biased since I’m sitting on both sides of this discussion, |
| 71 | but I think this would be a good onramp to bring more people into |
| 72 | non-critical-infra. |
| 73 | - [zimbatm] We can subdivide permissions on the Hetzner Cloud side of things, |
| 74 | but I’m not sure whether we should share stuff further. |
| 75 | - [hexa] They have their setup mostly figured out already, including backups. We |
| 76 | can let them run with it for now, and we can always pick it up later. |
| 77 | - [linus] What about inviting them to non-critical-infra and just giving them |
| 78 | access to all the non-critical-infra? Even if they just want to maintain the |
| 79 | wiki. |
| 80 | - [hexa] It’s about responsible for all of it. I don’t think we should grant |
| 81 | unneeded access. |
| 82 | - [Julien] +1. |
| 83 | - [delroth] I feel like if it’s official, we should treat it as such and |
| 84 | onboard it as part of non-critical infra. Doesn’t require giving them access |
| 85 | to everything. |
| 86 | - [linus] If it is official, then it should be maintained by the official |
| 87 | infra team |
| 88 | - [hexa] I think we’re mostly in agreement then. |
| 89 | - [delroth] non-critical-infra should be restricted to the relevant directories |
| 90 | and go through PRs for touching other stuff |
| 91 | - [Julien] They probably want to iterate fast in the beginning |
| 92 | - [delroth] They should get a dedicated machine on Hetzner Cloud, that they |
| 93 | can play with |
| 94 | - [Julien] Too much shared code will increase reliance on core infra members. |
| 95 | - [delroth] Action items |
| 96 | - Let’s give them SSH access to a Hetzner Cloud VM |
| 97 | - Or a separate project so they get direct access to machines. Might already |
| 98 | be done. |
| 99 | - Let’s make sure we agree on the idea of moving this to non-critical-infra in |
| 100 | the short/mid-term future |
| 101 | - Provision DNS etc. |
| 102 | |
| 103 | ## External requests |
| 104 | |
| 105 | - Hydra DB access (raitobezarius) |
| 106 | - Hashing out details in https://github.com/NixOS/infra/issues/348 |
| 107 | - CA derivations for Hydra (Ericson2314) |
| 108 | - Nix 2.20 broke interop with the old Nix 2.13 we run on builders. Rolled back |
| 109 | to 2.19. |
| 110 | - https://github.com/NixOS/nix/issues/9961 |
| 111 | - DB schema change applied. |
| 112 | |
| 113 | ## Ongoing projects |
| 114 | |
| 115 | - [delroth] Hoping to complete the nixops deprecation this week. Then: |
| 116 | core/non-critical-infra alignment. |