meeting-notes: add 2025-04-17
Martin Weinelt committed
Apr 17, 2025 at 18:33 UTC
7ba8d5f0fd6d4051c481f0240429dd60663a2e6d
1 file changed
+68
docs/meeting-notes/2025-04-17.md
new
+68
@@ -0,0 +1,68 @@
1
+# 2025-04-17
2
+
3
+Atttendees: zimbatm, arian, erethon, hexa, Mic92, jfly
4
+
5
+- zimbatm:
6
+ - Official leadership rotation to hexa
7
+ - Rotation permissions for zimbatm and eelco in various places
8
+ - Gandi
9
+ - GitHub
10
+ - others...
11
+
12
+- erethon:
13
+ - Security bug tracker: Development is restarting
14
+ - https://tracker.security.nixos.org/
15
+ - Want to restart makemake.ngi.nixos.org, who has access to the Hetzner Robot account if things go south?
16
+ - Remote KVM via Infra
17
+ - Infra-Build holds Hetzner Accesss
18
+ - @Mic92 mentioned Hetzner supporting Subaccounts, let's investigate that
19
+ - Go-neb Deprecation
20
+ - Still WIP
21
+ - https://github.com/NixOS/infra/issues/549#issuecomment-2782452767
22
+ - Links to Grafana/Prometheus/Alertmanager would be useful
23
+
24
+- hexa:
25
+ - Onboarding US Macs (delegated to Arian)
26
+ - Winter has worked on getting Apple Business and Mosyle
27
+ - DNS migration
28
+ - Prompted by shared access with Marketing to Netlify
29
+ - Adopted hopeful-rivest (RX170)
30
+ - Mailserver
31
+ - Authenticated Receive Chain
32
+ - Will get Commit Access to nixos-mailserver
33
+ - nixcon.org Mail Migration
34
+
35
+- arian:
36
+ - AWS Account cleanup and audit
37
+ - Did an audit of all access to the Logicblox account
38
+
39
+ - Can somebody copy over the messages I sent in infra-internal about my research there? I lost access to my Matrix history due to deleting it because of the spam issue.
40
+ - Going to disable unused high-privilege IAM roles and users that are probably from the Logicblox days
41
+ ```
42
+ I am going to disable the roles accessible by that account now. And I suggest we delete them in a few weeks if nobody complains?
43
+
44
+ There is also some other external account ids that are in use:
45
+
46
+ * 297794765570 (has read only access. Seems to be from the same time as 33233536009 which has access to the same read only role).
47
+ * CrowdStrike (has access to audit logs. hasn't accessed our account on like 500 days. Delete?)
48
+ * CloudCheckr (accessed some metadata a few hours ago. Seems to be an AWS cost management tool)
49
+ * Fastly logs (this makes sense)
50
+ * Duckbill Group (makes sense but maybe we can delete now?)
51
+ ```
52
+
53
+ - Do we want to terraform the AWS management account?
54
+ - Want to enable CloudTrail audit logging for all our accounts in our management account.
55
+ - Working on moving AMI builds out of Hydra to GHA. Almost done. Uses qemu emulation for the aarch64 build as opposed to KVM but works fine. https://github.com/NixOS/amis/pull/262
56
+ - Mic and I had the plan to do the same for ISOs at https://github.com/NixOS/images - do we still want to work on that?
57
+ - Planning to meet up with edef semi-regularly regarding s3 stuff
58
+ - Wanted to look into the Glacier migration or Intelligent Tiering
59
+ - 60 EUR worth of access to "old paths"
60
+ - Intelligent Tiering Transitions might easily become more expensive than that
61
+
62
+- Mic92
63
+ - Idea: Fastly Pull-Through Cache for GitHub Releases
64
+ - To have stable URLs and allowing us to move them in the backend as needed
65
+
66
+- jfly
67
+ - Does a cache hit by fastly prevent an access log entry at AWS S3?
68
+ - Cache at fastly can be hot, while things are in low priority tier at AWS S3