meeting-notes: add 2025-05-01
Martin Weinelt committed
May 1, 2025 at 19:00 UTC
8a791b3d6f1e07dc551c78ad4956bcd6b922f63c
1 file changed
+54
docs/meeting-notes/2025-05-01.md
new
+54
@@ -0,0 +1,54 @@
1
+# 2025-05-01
2
+
3
+Attendees: hexa, mightyiam, mic92, jfly, picnoir, mightyiam
4
+
5
+- hexa:
6
+ - hydra-server abuse management
7
+ - loki for nginx analyzing the access logs
8
+ - internal grafana instance for access to sensitive data (e.g. PII)
9
+ - looking at whether go-away can better reflect our needs
10
+ - hydra-queue-runner work
11
+ - runnables are steps that can be sent to builder to realize
12
+ - we have far more linux capacity than darwin capacity and the queue runner often stacks up darwin runnables, but cannot satisfy linux runnables
13
+ - effectively preventing us from increasing linux capacity
14
+ - Every two weeks meeting with Simon
15
+ - hydra is modular, components use the database to synchronize
16
+
17
+- jfly
18
+ - can we put our meetings on the nixos cal? https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com
19
+ - TODO: jeremy will add
20
+ - mailserver
21
+ - mxlogin.com (mxroute) Deliverability: unclear what's going on with Valentin's email (https://github.com/NixOS/infra/issues/668)
22
+ - Bounces from GMail: does anyone have any ideas for this? https://github.com/NixOS/infra/issues/650
23
+ - Leaking email: https://github.com/NixOS/infra/issues/649
24
+ - TODO: try BCC-ing the people we're forwarding to (`recipient_bcc_maps` instead of virtual alias maps)
25
+ - ARC: are we OK to enable it? https://github.com/NixOS/infra/pull/634
26
+ - Test it on another mailserver first
27
+
28
+- Mic92:
29
+ - Get rid of nix/hydra overlay to make sure we are not mixing nix from unstable with nixpkgs from stable
30
+ - Would likes to reproduce cgroups build issues in NixOS infra
31
+
32
+- picnoir:
33
+ - Cache key rotation https://github.com/NixOS/rfcs/pull/149
34
+ - Minimal approach, no HSM etc.
35
+ - Generate new key on hydra machine
36
+ - Sign everything with two keys
37
+ - PR in Nix has been merged, not in a stable release yet, but cherry-pickable
38
+ - Rollover is easy for NixOS, but not so for Nix users on other Distros
39
+ - Nix already hardcodes the current signing key for cache.nixos.org
40
+ - We could investigate if we can also ship the new one that way
41
+ - Set up and maintain public information about keys, the period in which they were used to sign packages
42
+ - Blocked on social issue, needing to take charge
43
+ - Testing on staging hydra
44
+ - Remote-Signing (PR by Raito exists, https://github.com/NixOS/nix/pull/9076) would be nice, not super trivial, but also new failure point
45
+ - Can fail in a lot of ways, since the channel between the signing infra and the queue-runner/nix is undefined, and e.g. over the network is not trivial
46
+ - Next steps:
47
+ - Staging Hydra setup to validate the setup/migration script.
48
+ - Investigate Nix upgrade path.
49
+
50
+- mightyiam/jfly:
51
+ - Code: https://github.com/molybdenumsoftware/pr-tracker
52
+ - Demo: https://pr-tracker.snow.jflei.com/
53
+ - Alternatives: Replicate the Github Webhooks via pub/sub for anyone
54
+ - Demonstrate the need for this, then we may consider making it an official nixos.org deployment