@cryptotaxi247 / infra
Code Commits Issues Pulls Sessions CI/CD
main
main
md 3.15 KB
View source Raw

2025-04-17

Atttendees: zimbatm, arian, erethon, hexa, Mic92, jfly

  • zimbatm:

    • Official leadership rotation to hexa
    • Rotation permissions for zimbatm and eelco in various places
    • Gandi
    • GitHub
    • others...

  • erethon:

  • hexa:

    • Onboarding US Macs (delegated to Arian)
    • Winter has worked on getting Apple Business and Mosyle
    • DNS migration
    • Prompted by shared access with Marketing to Netlify
    • Adopted hopeful-rivest (RX170)
    • Mailserver
    • Authenticated Receive Chain
    • Will get Commit Access to nixos-mailserver
    • nixcon.org Mail Migration

  • arian:

    • AWS Account cleanup and audit
    • Did an audit of all access to the Logicblox account
    • Can somebody copy over the messages I sent in infra-internal about my research there? I lost access to my Matrix history due to deleting it because of the spam issue.
    • Going to disable unused high-privilege IAM roles and users that are probably from the Logicblox days ``` I am going to disable the roles accessible by that account now. And I suggest we delete them in a few weeks if nobody complains?

    There is also some other external account ids that are in use:

    • 297794765570 (has read only access. Seems to be from the same time as 33233536009 which has access to the same read only role).
    • CrowdStrike (has access to audit logs. hasn't accessed our account on like 500 days. Delete?)
    • CloudCheckr (accessed some metadata a few hours ago. Seems to be an AWS cost management tool)
    • Fastly logs (this makes sense)
    • Duckbill Group (makes sense but maybe we can delete now?) ``` - Do we want to terraform the AWS management account? - Want to enable CloudTrail audit logging for all our accounts in our management account. - Working on moving AMI builds out of Hydra to GHA. Almost done. Uses qemu emulation for the aarch64 build as opposed to KVM but works fine. https://github.com/NixOS/amis/pull/262 - Mic and I had the plan to do the same for ISOs at https://github.com/NixOS/images - do we still want to work on that? - Planning to meet up with edef semi-regularly regarding s3 stuff - Wanted to look into the Glacier migration or Intelligent Tiering - 60 EUR worth of access to "old paths" - Intelligent Tiering Transitions might easily become more expensive than that

  • Mic92

    • Idea: Fastly Pull-Through Cache for GitHub Releases
    • To have stable URLs and allowing us to move them in the backend as needed

  • jfly

    • Does a cache hit by fastly prevent an access log entry at AWS S3?
    • Cache at fastly can be hot, while things are in low priority tier at AWS S3