@cryptotaxi247 / infra
Code Commits Issues Pulls Sessions CI/CD
main
main
md 5.33 KB
View source Raw

2024-02-08

Attendees: delroth, hexa, JulienMalka, lheckemann, raitobezarius, vcunat, zimbatm

[hexa, delroth] EMS Migration

Context: https://github.com/NixOS/infra/issues/325

  • PR for Synapse and its dependencies is up.
  • [Julien] What's the status of the backup module?
  • raito and Ron met with Matrix / EMS folks at FOSDEM 2024
    • They have scripts for GDPR compliance (user data purge), but we need to ask them by email.
    • Then we can get a clean DB dump, presumably without user data.
    • Not sure whether we sent an email or not. But Graham might be in contact directly, and EMS folks made him an offer to do the data deletion.
    • Worst case Graham/DetSys will pay for the extension of the EMS plan.
    • Probably no hurry anymore from the infra side. Foundation board is monitoring this to make sure we have a solution at some point.

[delroth] Should we publish these notes more widely?

  • There is a trend towards publishing notes on Discourse, etc. for visibility.
  • [delroth] My thoughts: we should archive (edited) notes in Git somewhere in our docs/ folder, update a Discourse thread every 2 weeks.
    • I of course volunteer to take care of this :)
  • Consensus: let’s do it.

[delroth] Packet/EQM access to infra-core

  • Our builders are very, very outdated. But risky to try and update stuff with 0 debugging capabilities.
  • Any reason why infra-core shouldn’t have full Packet/EQM access like we have Hetzner access?
    • Not entirely clear who currently has access?
    • [zimbatm] Got access from eelco last weekend, will delegate.
  • [raito] Does nix-netboot-serve run on our infra?
    • [hexa] Yes, on eris. The images are also built from our infra, it’s a Hydra jobset. But the jobset has not successfully completed for a year.
    • [hexa] We can update stuff, but we have no way to debug issues if we do so.
  • zimbatm took care of it live, woo!

[raito] Stay in the loop of infrastructure matters

  • How should work be split between zimbatm/raito?
  • Would like access to private infra stuff to act as secondary.
  • In general: who should have ownership to accounts?
    • A bunch of GH org owners for example are inactive.
    • Not really aligned with any subgroup e.g. foundation board.
    • [zimbatm] I think the foundation should have access, but unfortunately the foundation also doesn’t have the best personal security to hold those credentials.
    • [zimbatm] Maybe it should be the infra team instead? i.e. delroth/hexa/vcunat/…
    • [raito] That would work too, as long as it’s active folks who can take care of day to day stuff. I don’t care that it’s specifically me, just that we don’t get blocked due to not finding an owner.
    • [zimbatm] I don’t feel like I can make that decision alone right now. Let’s find some kind of organization which makes sense.
  • Raito got invited into the private infra matrix channel (at least, for now)

[Julien] NixOS wiki collaboration w/ infra team

  • We have a bunch of candidate sysadmins in mind. Do we want to merge this into non-critical-infra?
  • [Julien] I’m a bit biased since I’m sitting on both sides of this discussion, but I think this would be a good onramp to bring more people into non-critical-infra.
  • [zimbatm] We can subdivide permissions on the Hetzner Cloud side of things, but I’m not sure whether we should share stuff further.
  • [hexa] They have their setup mostly figured out already, including backups. We can let them run with it for now, and we can always pick it up later.
  • [linus] What about inviting them to non-critical-infra and just giving them access to all the non-critical-infra? Even if they just want to maintain the wiki.
    • [hexa] It’s about responsible for all of it. I don’t think we should grant unneeded access.
    • [Julien] +1.
    • [delroth] I feel like if it’s official, we should treat it as such and onboard it as part of non-critical infra. Doesn’t require giving them access to everything.
    • [linus] If it is official, then it should be maintained by the official infra team
    • [hexa] I think we’re mostly in agreement then.
  • [delroth] non-critical-infra should be restricted to the relevant directories and go through PRs for touching other stuff
    • [Julien] They probably want to iterate fast in the beginning
    • [delroth] They should get a dedicated machine on Hetzner Cloud, that they can play with
    • [Julien] Too much shared code will increase reliance on core infra members.
  • [delroth] Action items
    • Let’s give them SSH access to a Hetzner Cloud VM
    • Or a separate project so they get direct access to machines. Might already be done.
    • Let’s make sure we agree on the idea of moving this to non-critical-infra in the short/mid-term future
    • Provision DNS etc.

External requests

Ongoing projects

  • [delroth] Hoping to complete the nixops deprecation this week. Then: core/non-critical-infra alignment.