| 1 | # 2025-04-17 |
| 2 | |
| 3 | Atttendees: zimbatm, arian, erethon, hexa, Mic92, jfly |
| 4 | |
| 5 | - zimbatm: |
| 6 | - Official leadership rotation to hexa |
| 7 | - Rotation permissions for zimbatm and eelco in various places |
| 8 | - Gandi |
| 9 | - GitHub |
| 10 | - others... |
| 11 | |
| 12 | - erethon: |
| 13 | - Security bug tracker: Development is restarting |
| 14 | - https://tracker.security.nixos.org/ |
| 15 | - Want to restart makemake.ngi.nixos.org, who has access to the Hetzner Robot |
| 16 | account if things go south? |
| 17 | - Remote KVM via Infra |
| 18 | - Infra-Build holds Hetzner Accesss |
| 19 | - @Mic92 mentioned Hetzner supporting Subaccounts, let's investigate that |
| 20 | - Go-neb Deprecation |
| 21 | - Still WIP |
| 22 | - https://github.com/NixOS/infra/issues/549#issuecomment-2782452767 |
| 23 | - Links to Grafana/Prometheus/Alertmanager would be useful |
| 24 | |
| 25 | - hexa: |
| 26 | - Onboarding US Macs (delegated to Arian) |
| 27 | - Winter has worked on getting Apple Business and Mosyle |
| 28 | - DNS migration |
| 29 | - Prompted by shared access with Marketing to Netlify |
| 30 | - Adopted hopeful-rivest (RX170) |
| 31 | - Mailserver |
| 32 | - Authenticated Receive Chain |
| 33 | - Will get Commit Access to nixos-mailserver |
| 34 | - nixcon.org Mail Migration |
| 35 | |
| 36 | - arian: |
| 37 | - AWS Account cleanup and audit |
| 38 | - Did an audit of all access to the Logicblox account |
| 39 | |
| 40 | - Can somebody copy over the messages I sent in infra-internal about my |
| 41 | research there? I lost access to my Matrix history due to deleting it |
| 42 | because of the spam issue. |
| 43 | - Going to disable unused high-privilege IAM roles and users that are |
| 44 | probably from the Logicblox days |
| 45 | ``` |
| 46 | I am going to disable the roles accessible by that account now. And I suggest we delete them in a few weeks if nobody complains? |
| 47 | |
| 48 | There is also some other external account ids that are in use: |
| 49 | |
| 50 | * 297794765570 (has read only access. Seems to be from the same time as 33233536009 which has access to the same read only role). |
| 51 | * CrowdStrike (has access to audit logs. hasn't accessed our account on like 500 days. Delete?) |
| 52 | * CloudCheckr (accessed some metadata a few hours ago. Seems to be an AWS cost management tool) |
| 53 | * Fastly logs (this makes sense) |
| 54 | * Duckbill Group (makes sense but maybe we can delete now?) |
| 55 | ``` |
| 56 | |
| 57 | - Do we want to terraform the AWS management account? |
| 58 | - Want to enable CloudTrail audit logging for all our accounts in our |
| 59 | management account. |
| 60 | - Working on moving AMI builds out of Hydra to GHA. Almost done. Uses qemu |
| 61 | emulation for the aarch64 build as opposed to KVM but works fine. |
| 62 | https://github.com/NixOS/amis/pull/262 |
| 63 | - Mic and I had the plan to do the same for ISOs at |
| 64 | https://github.com/NixOS/images - do we still want to work on that? |
| 65 | - Planning to meet up with edef semi-regularly regarding s3 stuff |
| 66 | - Wanted to look into the Glacier migration or Intelligent Tiering |
| 67 | - 60 EUR worth of access to "old paths" |
| 68 | - Intelligent Tiering Transitions might easily become more expensive than |
| 69 | that |
| 70 | |
| 71 | - Mic92 |
| 72 | - Idea: Fastly Pull-Through Cache for GitHub Releases |
| 73 | - To have stable URLs and allowing us to move them in the backend as needed |
| 74 | |
| 75 | - jfly |
| 76 | - Does a cache hit by fastly prevent an access log entry at AWS S3? |
| 77 | - Cache at fastly can be hot, while things are in low priority tier at AWS |
| 78 | S3 |