@cryptotaxi247 / infra / commits / a8e0a883

meeting-notes: fmt

Martin Weinelt committed May 1, 2025 at 19:00 UTC a8e0a88364c973680d66a16a4f372dc1ef66dac0
1 file changed +55 -42
docs/meeting-notes/2025-05-01.md
+55 -42
@@ -3,52 +3,65 @@
3 Attendees: hexa, mightyiam, mic92, jfly, picnoir, mightyiam
4
5 - hexa:
6 - - hydra-server abuse management
7 - - loki for nginx analyzing the access logs
8 - - internal grafana instance for access to sensitive data (e.g. PII)
9 - - looking at whether go-away can better reflect our needs
10 - - hydra-queue-runner work
11 - - runnables are steps that can be sent to builder to realize
12 - - we have far more linux capacity than darwin capacity and the queue runner often stacks up darwin runnables, but cannot satisfy linux runnables
13 - - effectively preventing us from increasing linux capacity
14 - - Every two weeks meeting with Simon
15 - - hydra is modular, components use the database to synchronize
6 + - hydra-server abuse management
7 + - loki for nginx analyzing the access logs
8 + - internal grafana instance for access to sensitive data (e.g. PII)
9 + - looking at whether go-away can better reflect our needs
10 + - hydra-queue-runner work
11 + - runnables are steps that can be sent to builder to realize
12 + - we have far more linux capacity than darwin capacity and the queue runner
13 + often stacks up darwin runnables, but cannot satisfy linux runnables
14 + - effectively preventing us from increasing linux capacity
15 + - Every two weeks meeting with Simon
16 + - hydra is modular, components use the database to synchronize
17
18 - jfly
18 - - can we put our meetings on the nixos cal? https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com
19 - - TODO: jeremy will add
19 + - can we put our meetings on the nixos cal?
20 + https://calendar.google.com/calendar/u/0/embed?src=b9o52fobqjak8oq8lfkhg3t0qg@group.calendar.google.com
21 + - TODO: jeremy will add
22 - mailserver
21 - - mxlogin.com (mxroute) Deliverability: unclear what's going on with Valentin's email (https://github.com/NixOS/infra/issues/668)
22 - - Bounces from GMail: does anyone have any ideas for this? https://github.com/NixOS/infra/issues/650
23 - - Leaking email: https://github.com/NixOS/infra/issues/649
24 - - TODO: try BCC-ing the people we're forwarding to (`recipient_bcc_maps` instead of virtual alias maps)
25 - - ARC: are we OK to enable it? https://github.com/NixOS/infra/pull/634
26 - - Test it on another mailserver first
27 -
28 -- Mic92:
29 - - Get rid of nix/hydra overlay to make sure we are not mixing nix from unstable with nixpkgs from stable
30 - - Would likes to reproduce cgroups build issues in NixOS infra
23 + - mxlogin.com (mxroute) Deliverability: unclear what's going on with
24 + Valentin's email (https://github.com/NixOS/infra/issues/668)
25 + - Bounces from GMail: does anyone have any ideas for this?
26 + https://github.com/NixOS/infra/issues/650
27 + - Leaking email: https://github.com/NixOS/infra/issues/649
28 + - TODO: try BCC-ing the people we're forwarding to (`recipient_bcc_maps`
29 + instead of virtual alias maps)
30 + - ARC: are we OK to enable it? https://github.com/NixOS/infra/pull/634
31 + - Test it on another mailserver first
32 +
33 +- Mic92:
34 + - Get rid of nix/hydra overlay to make sure we are not mixing nix from
35 + unstable with nixpkgs from stable
36 + - Would likes to reproduce cgroups build issues in NixOS infra
37
38 - picnoir:
33 - - Cache key rotation https://github.com/NixOS/rfcs/pull/149
34 - - Minimal approach, no HSM etc.
35 - - Generate new key on hydra machine
36 - - Sign everything with two keys
37 - - PR in Nix has been merged, not in a stable release yet, but cherry-pickable
38 - - Rollover is easy for NixOS, but not so for Nix users on other Distros
39 - - Nix already hardcodes the current signing key for cache.nixos.org
40 - - We could investigate if we can also ship the new one that way
41 - - Set up and maintain public information about keys, the period in which they were used to sign packages
42 - - Blocked on social issue, needing to take charge
43 - - Testing on staging hydra
44 - - Remote-Signing (PR by Raito exists, https://github.com/NixOS/nix/pull/9076) would be nice, not super trivial, but also new failure point
45 - - Can fail in a lot of ways, since the channel between the signing infra and the queue-runner/nix is undefined, and e.g. over the network is not trivial
46 - - Next steps:
47 - - Staging Hydra setup to validate the setup/migration script.
48 - - Investigate Nix upgrade path.
39 + - Cache key rotation https://github.com/NixOS/rfcs/pull/149
40 + - Minimal approach, no HSM etc.
41 + - Generate new key on hydra machine
42 + - Sign everything with two keys
43 + - PR in Nix has been merged, not in a stable release yet, but
44 + cherry-pickable
45 + - Rollover is easy for NixOS, but not so for Nix users on other Distros
46 + - Nix already hardcodes the current signing key for cache.nixos.org
47 + - We could investigate if we can also ship the new one that way
48 + - Set up and maintain public information about keys, the period in which
49 + they were used to sign packages
50 + - Blocked on social issue, needing to take charge
51 + - Testing on staging hydra
52 + - Remote-Signing (PR by Raito exists,
53 + https://github.com/NixOS/nix/pull/9076) would be nice, not super trivial,
54 + but also new failure point
55 + - Can fail in a lot of ways, since the channel between the signing infra
56 + and the queue-runner/nix is undefined, and e.g. over the network is not
57 + trivial
58 + - Next steps:
59 + - Staging Hydra setup to validate the setup/migration script.
60 + - Investigate Nix upgrade path.
61
62 - mightyiam/jfly:
51 - - Code: https://github.com/molybdenumsoftware/pr-tracker
52 - - Demo: https://pr-tracker.snow.jflei.com/
53 - - Alternatives: Replicate the Github Webhooks via pub/sub for anyone
54 - - Demonstrate the need for this, then we may consider making it an official nixos.org deployment
63 + - Code: https://github.com/molybdenumsoftware/pr-tracker
64 + - Demo: https://pr-tracker.snow.jflei.com/
65 + - Alternatives: Replicate the Github Webhooks via pub/sub for anyone
66 + - Demonstrate the need for this, then we may consider making it an official
67 + nixos.org deployment