| 1 | # 2024-04-18 |
| 2 | |
| 3 | Attendees: delroth, Janik, dgrig, vcunat, raitobezarius, hexa, Linus, Weija |
| 4 | |
| 5 | ## Topics |
| 6 | |
| 7 | - [delroth] Bringing up the topic of Keycloak / Kanidm again |
| 8 | - We'll probably want it for Jitsi? I'd also love to drop user management |
| 9 | stuff from Hydra. |
| 10 | - Other use cases: |
| 11 | - Wiki? (I'm guessing mediawiki can SAML) |
| 12 | - Pads? (for meeting notes that we'd rather not have vandalized) |
| 13 | - Calendar? |
| 14 | - Hydra? https://github.com/NixOS/hydra/pull/1298 |
| 15 | - [hexa] Requirements: |
| 16 | - GitHub login, and being able to read organization membership info |
| 17 | - Maybe Dex can do what we want as well? Proxy to backend apps |
| 18 | - @raitobezarius in chat: |
| 19 | [oauth2-proxy](https://oauth2-proxy.github.io/oauth2-proxy/configuration/providers/github/) |
| 20 | as well exist |
| 21 | - @raitobezarius in chat: |
| 22 | [SATOSA Proxy](https://github.com/IdentityPython/SATOSA) can be used to |
| 23 | do SAML2<->Social Login |
| 24 | |
| 25 | - [delroth] releases.nixos.org S3 costs |
| 26 | - tl;dr discovered last week that the bandwidth costs rose significantly for |
| 27 | no known reason |
| 28 | - Shape of the growth looks organic but there shouldn't really be anything |
| 29 | causing it. |
| 30 | - Fastly logs analysis showed nothing interesting. |
| 31 | - Some access is blocked by |
| 32 | [eelco not sharing credentials](https://github.com/NixOS/infra/pull/388#discussion_r1545856527) |
| 33 | - Enabled S3 logging, haven't analyzed yet. |
| 34 | - Cost Explorer might be indicating that this isn't actually |
| 35 | releases.nixos.org but something else in eu-west-1 also using S3? But then |
| 36 | what? (or is Cost Explorer broken? wouldn't be too surprising) |
| 37 | |
| 38 | - [Janik] Jitsi on non-critical-infra |
| 39 | - nixpkgs+infra PRs were reviewed |
| 40 | - Still blocked on tracking down a bug |
| 41 | - Probably will land soon (if someone helps with debugging) |
| 42 | |
| 43 | - [delroth] What do we still not have access to? |
| 44 | |
| 45 | | Hostname | System | Location | Purpose | Access <br>infra-build | Access <br>infra | Comment | |
| 46 | | ------------------------------ | -------------- | ---------- | --------------------------- | ---------------------- | ---------------- | ----------------------------------------- | |
| 47 | | haumea.nixos.org | x86_64-linux | Hetzner | Hydra database | have | \- | | |
| 48 | | makemake.nixos.org | x86_64-linux | Hetzner | NGI Hydra | \- | \- | via https://github.com/ngi-nix/ngi0-infra | |
| 49 | | intense-heron.mac.nixos.org | aarch64-darwin | Hetzner | Hydra builder | want | \- | | |
| 50 | | sweeping-filly.mac.nixos.org | aarch64-darwin | Hetzner | Hydra builder | want | \- | | |
| 51 | | maximum-snail.mac.nixos.org | aarch64-darwin | Hetzner | Hydra builder | want | \- | | |
| 52 | | growing-jennet.mac.nixos.org | aarch64-darwin | Hetzner | Hydra builder | want | \- | | |
| 53 | | enormous-catfish.mac.nixos.org | aarch64-darwin | Hetzner | Hydra builder | want | \- | | |
| 54 | | rhea.nixos.org | x86_64-linux | Hetzner | Hydra | have | \- | | |
| 55 | | caliban.nixos.org | x86-64-linux | Hetzner | NC-Infra | have | x | | |
| 56 | | aa-hetzner-1.nixos.org | aarch64-linux | Hetzner | Hydra | have | \- | config import infra repo todo | |
| 57 | | pluto.nixos.org | x86_64-linux | Hetzner | Monitoring, Channel-Scripts | have | \- | | |
| 58 | | aarch64.nixos.community | aarch64-linux | Equinix | Community/ofborg builder | \- | \- | on demand | |
| 59 | | 208.83.1.145 | aarch64-darwin | Macstadium | OfBorg builder | want | \- | | |
| 60 | | 208.83.1.173 | x86_64-darwin | Macstadium | OfBorg builder | want | \- | | |
| 61 | | 208.83.1.175 | x86_64-darwin | Macstadium | OfBorg builder | want | \- | | |
| 62 | | 208.83.1.181 | aarch64-darwin | Macstadium | OfBorg builder | want | \- | | |
| 63 | | 208.83.1.186 | x86_64-darwin | Macstadium | OfBorg builder | want | \- | | |
| 64 | | ofborg-core | x86_64-linux | Equinix | OfBorg controller | want | \- | on demand | |
| 65 | | netboot-foundation | x86_64-linux | Equinix | ? | \- | \- | on demand | |
| 66 | | ofborg-evaluator0 | x86_64-linux | Equinix | OfBorg evaluator/builder | want | | on demand | |
| 67 | | ofborg-evaluator1 | x86_64-linux | Equinix | OfBorg evaluator/builder | want | | on demand | |
| 68 | | ofborg-evaluator2 | x86_64-linux | Equinix | OfBorg evaluator/builder | want | | on demand | |
| 69 | | ofborg-evaluator3 | x86_64-linux | Equinix | OfBorg evaluator/builder | want | | on demand | |
| 70 | | ofborg-evaluator4 | x86_64-linux | Equinix | OfBorg evaluator/builder | want | | on demand | |
| 71 | | small-c3.large.arm64 | aarch64-linux | Equinix | Hydra builder | have | \- | on demand | |
| 72 | | big-parallel-c3.large.arm64 | aarch64-linux | Equinix | Hydra builder | have | \- | on demand | |
| 73 | |
| 74 | ## Changelog: |
| 75 | |
| 76 | - Removed unused apps on the infra repo |
| 77 | - Slack (unused) |
| 78 | - Removed apps from release-wiki repo |
| 79 | - HackMD (unused) |
| 80 | - Removed unused apps on the org level |
| 81 | - Bors (discontinued) |
| 82 | - Marvin-MK2 (discontinued) |
| 83 | - Travis-CI (unused) |
| 84 | - Hydra web UI is fast^W not as slow now (+ other improvements) |
| 85 | - https://github.com/NixOS/hydra/commit/6189ba9c5e5308e17a7d1fb7f38443272a70f072 |
| 86 | - Queue runner CPU-heavy operations throttling: |
| 87 | https://github.com/NixOS/hydra/commit/a51bd392a22fba5b0a0d90e2204a608b78c37ce1 |
| 88 | - Fastly shielding location fixed for releases.nixos.org and tarballs.nixos.org |
| 89 | (used to go transatlantic for no good reason) |
| 90 | - http:// redirects to https:// for all our S3 buckets except cache.nixos.org |
| 91 | (broke nix-index, temporarily reverted) |