| 1 | # 2025-05-01 |
| 2 | |
| 3 | Attendees: hexa, mightyiam, mic92, jfly, picnoir, mightyiam |
| 4 | |
| 5 | - hexa: |
| 6 | - hydra-server abuse management |
| 7 | - loki for nginx analyzing the access logs |
| 8 | - internal grafana instance for access to sensitive data (e.g. PII) |
| 9 | - looking at whether go-away can better reflect our needs |
| 10 | - hydra-queue-runner work |
| 11 | - runnables are steps that can be sent to builder to realize |
| 12 | - we have far more linux capacity than darwin capacity and the queue runner |
| 13 | often stacks up darwin runnables, but cannot satisfy linux runnables |
| 14 | - effectively preventing us from increasing linux capacity |
| 15 | - Every two weeks meeting with Simon |
| 16 | - hydra is modular, components use the database to synchronize |
| 17 | |
| 18 | - jfly |
| 19 | - can we put our meetings on the nixos cal? |
| 20 | https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com |
| 21 | - TODO: jeremy will add |
| 22 | - mailserver |
| 23 | - mxlogin.com (mxroute) Deliverability: unclear what's going on with |
| 24 | Valentin's email (https://github.com/NixOS/infra/issues/668) |
| 25 | - Bounces from GMail: does anyone have any ideas for this? |
| 26 | https://github.com/NixOS/infra/issues/650 |
| 27 | - Leaking email: https://github.com/NixOS/infra/issues/649 |
| 28 | - TODO: try BCC-ing the people we're forwarding to (`recipient_bcc_maps` |
| 29 | instead of virtual alias maps) |
| 30 | - ARC: are we OK to enable it? https://github.com/NixOS/infra/pull/634 |
| 31 | - Test it on another mailserver first |
| 32 | |
| 33 | - Mic92: |
| 34 | - Get rid of nix/hydra overlay to make sure we are not mixing nix from |
| 35 | unstable with nixpkgs from stable |
| 36 | - Would likes to reproduce cgroups build issues in NixOS infra |
| 37 | |
| 38 | - picnoir: |
| 39 | - Cache key rotation https://github.com/NixOS/rfcs/pull/149 |
| 40 | - Minimal approach, no HSM etc. |
| 41 | - Generate new key on hydra machine |
| 42 | - Sign everything with two keys |
| 43 | - PR in Nix has been merged, not in a stable release yet, but |
| 44 | cherry-pickable |
| 45 | - Rollover is easy for NixOS, but not so for Nix users on other Distros |
| 46 | - Nix already hardcodes the current signing key for cache.nixos.org |
| 47 | - We could investigate if we can also ship the new one that way |
| 48 | - Set up and maintain public information about keys, the period in which |
| 49 | they were used to sign packages |
| 50 | - Blocked on social issue, needing to take charge |
| 51 | - Testing on staging hydra |
| 52 | - Remote-Signing (PR by Raito exists, |
| 53 | https://github.com/NixOS/nix/pull/9076) would be nice, not super trivial, |
| 54 | but also new failure point |
| 55 | - Can fail in a lot of ways, since the channel between the signing infra |
| 56 | and the queue-runner/nix is undefined, and e.g. over the network is not |
| 57 | trivial |
| 58 | - Next steps: |
| 59 | - Staging Hydra setup to validate the setup/migration script. |
| 60 | - Investigate Nix upgrade path. |
| 61 | |
| 62 | - mightyiam/jfly: |
| 63 | - Code: https://github.com/molybdenumsoftware/pr-tracker |
| 64 | - Demo: https://pr-tracker.snow.jflei.com/ |
| 65 | - Alternatives: Replicate the Github Webhooks via pub/sub for anyone |
| 66 | - Demonstrate the need for this, then we may consider making it an official |
| 67 | nixos.org deployment |