2020-07-07 heroes meeting [19:54:30] good evening [19:54:52] A good evening to all of you... [19:57:53] hi folks! :) [19:57:58] hello [19:59:47] 👋 [20:01:26] https://progress.opensuse.org/issues/67663 has the checklist for today's meeting [20:03:02] yup, so does anyone from the community have questions [20:03:16] item#1 yep [20:03:34] I have one but it's related to the last item in the checklist [20:03:42] hi everybody [20:04:09] (lcp15 - if you want, feel free to continue leading the meeting) [20:04:54] sure, so since it's pretty quiet, do we have any status reports? [20:05:33] Yup [20:06:10] meet.o.o is now not behind NAT anymore and should work with mobile and IPv6-only connections [20:06:50] Also there is a newly set up project where some trainees will package jitsi and provide packages for openSUSE [20:07:15] A new server with a lot more RAM is also on the way [20:07:29] All done. Next ;-) [20:07:32] I have deployed the remaining parts of Matrix infrastructure, and am just waiting for some help from the upstream because there are some database query issues that prevent us from using it fully https://github.com/matrix-org/synapse/issues/7772 [20:08:22] also requested openidc metadatato use with the server https://progress.opensuse.org/issues/68320 [20:08:25] I've continued doing some engagement with the Noggin folks wrt openSUSE, though the bulk of my time since last month was been spent on Leap 15.2, which is finally out! 🥳 [20:09:46] I have upgraded ~75% of the openSUSE infrastructure to openSUSE Leap 15.2 [20:09:54] oh yeah, also reached out to jdsn to have the freeipa server access after 3 weeks (as requested), but got no reply [20:10:23] sorry, forgot to reply - no objections any more from my side [20:10:59] will you now also tell us what was the blocker? ;-) [20:11:19] maybe in less public area :) [20:11:58] not much to say from my side, havent had much time so only a bit of this and bit of that. [20:12:01] choose whatever way works for you ;-) [20:12:32] short and funny one from me - the "one ticket for counter.o.o per release" tradition continued. This time some fonts (for chinese etc.) were missing ;-) [20:13:10] (and also a bit of "this and that") [20:13:32] yay! [20:13:49] wow, that lagged :P [20:13:50] Hi all, sorry for late joint. No update from me since last month. [20:13:59] I started working on migrating countdown to py3, and maybe using gettext instead of functions and dicts with language strings [20:14:06] ah: and I imported some additional opensuse domains in freeipa, that SUSE-IT wants to hand over to the openSUSE heroes [20:14:25] 👍️ [20:14:32] what domains? [20:14:58] just out of curiosity what we are getting :P [20:15:32] lcp15: a lot - let me see if I can print a list here [20:16:26] ...and here they are: opensuse.asia opensuse.com.br opensuse.com.es opensuse.com.mx opensuse.com opensuse.co opensuse.de opensuse.eu opensuse.fr opensuse.gen.tr opensuse.jp opensuse.kr opensuse.mx opensuse.net opensuse.org.cn opensuse-project.com opensuse-project.de opensuse-project. [20:16:26] net opensuse-project.org [20:17:04] great, so we can use opensuse.mx for the new mx servers? [20:17:09] I was gonna say [20:17:17] seems like a perfect opportunity [20:17:20] they all exist in freeipa now - just someone needs to find the time to make them available on our 4 DNS servers [20:17:35] feel free, I would say :-) [20:17:35] nice [20:17:41] there's so much opportunity here [20:17:46] and half of the NS entries still point the wrong way [20:17:52] 😆 [20:18:01] and as suse does, maybe replace infra.opensuse.org with opensuse.de ;) [20:18:09] hell no [20:18:18] bmwiedemann1: you mean the public entries? That's expected, as they are currently just copied over to SUSE-IT from MF-IT [20:18:31] Eighth_Doctor: the servers are in germany after all [20:18:39] I'd be happier if most of them just remained simple and redirected to opensuse.org [20:18:53] bmwiedemann: +1 [20:19:03] well, we could probably point to language specific versions of the website [20:19:03] lcp15: this becomes scary in the moment, when you know you visit a machine running in Provo which has an opensuse.de domain ;-) [20:19:24] kl_eisbaer: opensuse.co for provo then [20:19:27] lcp15: provo-mirror.infra.opensuse.org *SCNR* [20:19:29] ...and no: not all openSUSE servers are in Germany [20:19:49] we can find an address per country [20:20:18] we could use opensuse-project.org for infra instead :P [20:20:19] maybe our shop (wait, what? we have a shop? ;-) could become shop.opensuse.com :D [20:20:28] we have a shop? [20:20:33] I just updated how it looks [20:20:40] we also wanna change providers [20:20:43] sooooo [20:20:43] what are we selling ? [20:20:51] merch [20:20:59] https://shop.opensuse.org/ [20:20:59] lethliel: ah [20:21:42] any more status reports ? [20:21:46] lcp15: right point: we should shortly discuss (and agree) on your new page design for opensuse.org websites, I guess (if you haven't done this already) [20:21:58] normal people have no idea how to find out if shop.opensuse.com really is doing it for the opensuse.org project. so it should better just be a redir to shop.opensuse.org [20:22:03] we just use chameleon theme kl_eisbaer [20:22:10] we are very lazy ;) [20:22:40] lcp15: but I like it. It's easy and - tata - contains all our nice services in the menu :-) [20:23:00] "all" ? [20:23:02] and lizards which shouldn't be there [20:23:12] maybe it's time to work on the redesign of the rest of the pages and make some marketing around this? [20:23:28] Fresh 15.2 -> fresh openSUSE pages :-) [20:23:31] if you know any, report them to marketing team [20:23:39] I'm also doing the error pages slowly [20:23:55] procrastinating on error pages [20:24:12] lcp15: is there a repository for the page templates and maybe even with sub-directories for the services? [20:24:53] well, we use jekyll-theme for this mostly, so you have to do no templating yourself [20:25:06] and from jekyll you can just render your page easily into html [20:25:21] Is there a git repo that contains the layout? [20:25:51] hm: I'm thinking about the login.template pages or pages like https://fontinfo.opensuse.org/ [20:26:03] https://github.com/openSUSE/jekyll-theme/ has the base theme and https://github.com/openSUSE/jekyll-template/ is the template repository for using the theme easily [20:26:04] or https://kernel.opensuse.org/ [20:26:13] I did kernel already [20:26:28] some of them are more or less static ... [20:26:34] https://github.com/openSUSE/kernel-pages/pull/1 [20:27:08] lcp15: hehe: conflict resolving ;-) [20:27:16] yeah, yeah, I will handle this later [20:27:38] fontinfo is annoying, because it's a lot of C stuff with inline templates [20:27:47] Ok :-) So this is mostly for static pages? [20:28:06] that is what jekyll is made for [20:28:10] well chameleon can be used with some more dynamic stuff [20:28:25] we do use it with https://status.opensuse.org too [20:28:40] I am a total webdesign frontend noob [20:28:53] hm, although I believe I redesign that too [20:29:01] lcp15: ..and https://mirrors.opensuse.org/ as well ;-) [20:29:16] kl_eisbaer: was there some switch from static1 to 2 or vice versa? [20:29:18] lcp15: I would love to get it for https://download.opensuse.org as well [20:29:26] lcp15: yes. [20:29:31] lcp15: Perhaps we can talk about that in the next few days If you will find the time? [20:29:37] sure [20:29:57] kl_eisbaer: I'm fairly sure I set new theme on the status, which was reverted [20:30:01] lcp15: I switched to static2 during the network renewal in Nuremberg. And today (or yesterday? sorry) back to status1 [20:30:21] lcp15: My questions would totally overrun this meeting ;-) [20:30:40] kl_eisbaer: it might need to be synced up then, would you fetch stylesheet and header from status2? [20:31:16] lcp15: I copied the database from one to the other "status" host - if there got something lost, please tell me in detail later. I will adjust the scripts in that case. [20:31:32] ah, alright, I will figure it out later then [20:31:57] lethliel: I can imagine, this design stuff is pretty engaging ;) [20:31:58] lcp15: I have the scripts uploaded into our github instance, IMHO. [20:32:29] ...and for download.opensuse.org, we have the theming in a package, but IMHO nowhere on github (yet). [20:32:50] alright [20:33:29] how is mirrors deployed, and from what [20:34:37] as in mirrors.o.o [20:36:22] the basics are comming from a script, that is deployed on olaf.infra.o.o via RPM. This script uses a header template (everything until the table) and a connection to mirrorbrain to generate the HTML pages [20:37:06] I guess the header template is currently only available on olaf, as far as I can remember [20:37:28] alright, that shouldn't be too hard then I guess [20:37:48] maybe we can put that into the package as well - but that's one of the reasons why I'm asking if we might think about a general repository to store such pages [20:38:20] yeah, I was gonna ask guo if we shouldn't have some standard headers/footers generated somewhere easily [20:38:32] since I needed that for status [20:38:55] https://github.com/openSUSE/static.opensuse.org ? [20:39:21] well, not really, it would probably be an app that would give you html after setting some settings [20:39:30] something simple like that [20:39:45] lcp15: looking forward to that app :-) [20:39:55] yeah, if I manage to find the time [20:40:29] https://debuginfod.opensuse.org/ for example would be something similar ... it's just one single page with some text and links. Nothing more. [20:40:35] if it's only about generating the template and splitting it into header and footer - jekyll + some sed magic? [20:41:25] I wonder if maybe we could get back to the agenda ? [20:41:36] yeah, I kinda also wanna have split css stuff, so we don't have to use everything for the cases like status (although we would use the entire chameleon for mirrors and download so idk) [20:41:36] cboltz: it depends: some pages (like the debuginfod) are simple HTML pages, nothing more. Some other pages (mirrors.o.o or download.o.o) are generated on the fly or via cron job locally [20:42:02] yeah, right, reviewing old tickets [20:42:14] these pages need separate header & footer files - and the rest will be done by the "on the fly services" [20:42:21] pjessen: you are right, sorry. [20:42:40] kl_eisbaer: right - for the header/footer split, sed could help [20:42:58] (and with that - back to the agenda ;-) [20:43:06] cboltz: topic, please ;-) (but only partly, I guess ;-) [20:43:38] ...as there is no need for sed (that's done by the tools), just a need for the header and footer files [20:44:02] I would propose we skip "review old tickets" and leave it for another time ? [20:44:24] + [20:44:35] yeah, it seems like a good idea, since I haven't looked at the tickets for a few weeks due to busy anyway [20:44:37] pjessen: just in case you have not prepared for that topic (as I haven't) [20:44:54] If I only know when "other time" is ;-) - but nevertheless, agreed [20:45:03] the next is forums support, and I don't know what that is [20:45:13] so pjessen, take it away [20:45:14] yeah - I added that item. [20:45:21] we have currently ~150 open tickets - I was already happy a few days ago, when we were down to 120. But now we have 15.2 ;-) [20:45:39] (I feel some bad debt growing with those old tickets nobody looks at) [20:46:00] basically, new forums issues turn up regularly and seem to be heading my way :-) [20:46:11] Perhaps we should schedule another meetint to just review these tickets? [20:46:28] pjessen: what issues turn up? [20:46:46] pjessen: hopefully, there is no DB problem any longer since the migration to the galera cluster? [20:47:06] kl_eisbaer: nono, just regular maintenance stuff. recently some index had to be rebuilt. [20:47:28] BTW: did I announce that we are running the latest Galera 4 cluster (based on MariaDB 10.4.13) on Leap 15.2 ? :-D [20:47:41] we are also likely to see people wanting their posts deleted and such (next topic). [20:47:42] awesome [20:47:48] nice [20:48:39] basically - I'm not keen on getting intimately familiar with vBul and it's operation, so the job is up for grabs :-) [20:48:56] pjessen: so - to make it a bit more clear to me - you need help with the "forum admin job" ? [20:49:08] if it falls onto me, that would mean me very much rushing an upgrade to discourse :P [20:49:19] kl_eisbaer: _we_ need help :-) [20:49:47] lcp15: I guessed you had to work already on a lot of other "tickets" ;-) [20:49:55] pjessen: who is we? [20:50:05] well, I did before the vb migration [20:50:08] kl_eisbaer: we = us = heroes. [20:50:13] after it I kinda ignored forums [20:50:39] deps for discourse are a nightmare and I haven't had the time to take care of everything, but I was really close the last time I tried [20:50:44] pjessen: ah, ok. Maybe we should think about an Email on opensuse-project@ ? [20:51:11] or check the forum stats and ask 3 active people there if they are interested in the job? [20:51:16] kl_eisbaer: I waqs wondring if maybe the current admins might want to help out [20:51:17] I kinda wish we could get one of the forum mods to be able to access vb from the inside btw [20:51:30] lcp15: +1 [20:51:32] so they can also kinda function as "admins" [20:52:15] pjessen: you mean the Provo Admins? If you have their contact data... ...ping them. We can offer them a nice work environment and challenging topics :-) [20:52:51] no, knurpht, malcolmlewis and such others [20:53:29] kl_eisbaer: witzbold :-) [20:53:32] they know Leap better than many of us because support is a bitch, so they would be really helpful :P [20:54:03] The machine is SLES [20:54:36] I'm surprised we don't have any of those admins here tonight [20:54:48] s/admins/moderators/ [20:54:48] feel free to ask. a freeipa account and VPN to get access will not take long. Just tell them to open a ticket and we are ready to go ;-) [20:55:03] malcolm machine is connected, I see his name. [20:55:05] robin_listas: practically the same thing [20:55:16] but noted [20:56:17] maybe as an action item for me - talk to the forum mods and see what they say about taking more of an inside role? [20:56:44] pjessen: good idea [20:56:50] yeah, sounds good [20:57:06] if there is a Mod-only area on the forums, post it there? [20:58:04] bmwiedemann1: I have a good link to the three mods, I'll bring it up directly. [20:58:42] so is the topic exhausted? [20:58:50] lcp15: for now :-) [20:59:05] so how about talking about the GDPR requests again [20:59:18] the most boring, but important topic [21:00:23] definitively [21:00:36] we have had some requests over the past month, and we don't have a definitive way to deal with them afaik [21:00:57] I have added my input to a couple of the tickets, yesterday and today, but that's only part of it. [21:01:27] there were also some GDPR requests where people later found that they wanted to keep some of it (probably more a reaction to the SCC account mails= [21:01:49] hello folks, first, let me say thanks for your work. :) on the GDPR topic legals from SUSE were asking if could be possible to have a privacy@opensuse for channeling the requests [21:02:11] deneb_alpha: a mailing list ? [21:02:19] pjessen, a kind of [21:02:36] probably better to have another place on redmine, as in tickets [21:03:02] there's a GDPR project in redmine for working on GDPR topics with SUSE legals [21:03:06] rather a ticket queue than a list [21:03:07] lcp15: well, I was wondering about that, but we are all very good at procrastinating [21:03:09] https://progress.opensuse.org/projects/opensuse-admin-wiki/wiki/GDPR [21:03:51] kl_eisbaer, thanks for the link [21:03:55] this is a start from one of our last meetings, trying to collect information about a) which systems are affected and b) how to automate that stuff [21:04:25] kl_eisbaer, this is great! thanks for sharing. [21:04:44] pjessen: that applies to all the infra work ;) [21:04:50] The problem is, that we need to find some nice admins or developers, who can write smal scripts for each service, that are either grabbing out the relevant information or delete an account on the services [21:05:41] kl_eisbaer: for some services that is not that easy to handle. [21:05:48] yeah, some softwares already have those scripts [21:05:54] some systems currently allow an admin to manually edit/delete an account - but I would love to see a more automated way - otherwise we will not be able to handle this correctly. [21:05:54] one of the request was to have an easy way to communicate with external people. or, let me rephrase, an easy way for externals to contact the legal entity and ask for GDPR topics etc [21:05:57] some others are gonna be a nightmare [21:06:01] kl_eisbaer: gee, I forgot I wrote all that in the wiki [21:06:19] If I think of OBS deleting users would kill the history [21:06:36] lethliel: bugzilla too ? [21:06:37] from my point of view, we should start with one service and test how it goes. [21:06:48] maybe we need to define what exactly to delete before writing scripts - for example, what if someone sends a delete requests for wiki contributions? [21:07:01] pjessen: I hope you are ready for rewriting that to fit mailman3, because I want to deploy it real soon [21:07:05] >:D [21:07:06] kl_eisbaer, sounds like a good plan [21:07:10] (and if we "only" delete the user, who will be the owner of those edits?) [21:07:19] mind you - afaik, we are not obliged to delete what is required for operations. [21:07:31] cboltz: usually a blank user is chosen [21:07:35] users can be anonymized to deleted@example.com [21:07:35] cboltz: you might think about a "anonymous" user, who could be used instead. [21:07:36] cboltz, we use ananoymous in the forum, we will not delete content [21:07:37] so we would need a blank account [21:08:13] ok, is the username "deleted" still available in our account system? ;-) [21:08:37] cboltz: exterminated? [21:08:42] I think we need to define general options, that each script understands (like "delete user $foo") - and each script for each service should handle these general options in a way, that is adjusted for each service. [21:08:44] I don't think we have a way to check outside of creating the account [21:09:11] but to make things more interesting: technically that would mean merging users in the wiki ($user_to_delete into "deleted") - and Mediawiki keeps a log of such user merges, which will contain $user_to_delete [21:09:37] The important part (and that's one of the reasons why I started the wiki page): we should define the "general options" first... [21:10:02] Yes. [21:10:02] cboltz: just rename $user_to_delete to deleted123 [21:10:07] I have recently done an edit of the list archives, just because some dude left his name in a post. took me an easy 30mins [21:10:26] ...and we should document (at least roughly) how a service will behave [21:10:31] bmwiedemann1: that also leaves $user_to_delete in the user rename log [21:10:36] And we should just clarify what needs to be deleted. [21:10:46] lethliel: exactly! [21:11:13] for me that's an AI for everyone to add this information in the wiki page for "his" service. [21:11:20] I don't think you have to worry about the logs. Logs are logs. Only worry about the published data [21:11:33] lethliel, that is something that SUSE legals can provide. [21:11:38] after we have that information, we can have a 2nd discussion if this is enough for a beginning or if we need more... [21:11:47] deneb_alpha: yes please. [21:11:57] robin_listas: the wikis tend to have their logs public as special:$whateverLog [21:12:08] oh. [21:12:15] exactly ;-) [21:12:28] pjessen, the list of services active and what is logged/where is an important start for legals [21:12:48] deneb_alpha: the list of services is on status.opensuse.org ;-) [21:12:52] deneb_alpha: hmm i knew that one was going to boomerang [21:13:02] deneb_alpha: Will you contact them? [21:13:36] okay, so kl_eisbaer was right - first a list of service and what is stored/logged [21:13:38] lethliel, pjessen I was tasked to work on this topic [21:13:49] Ah :-) [21:14:13] I know how to delete users in synapse at the very least [21:14:35] cboltz, yep, I know about status but a bit of help will be appreciated :) [21:14:37] lcp15: so please put your knowledge into the wiki [21:14:40] although, that's gonna only be our local server deletion, since all the data is federated, you will have to ask every node to remove stuff [21:15:01] none of our business, just mentioning ;) [21:15:51] in theory we should have a description of the process (for each service). having clear status of what we are storing, how long, why etc [21:15:55] deneb_alpha: just think of status.o.o as an overview or checklist - and for the full loop, you can subscribe to status updates on status.o.o with your mail address, so keep in mind that status.o.o is not listed on itsself ;-) [21:16:12] cboltz, ok, thanks [21:16:27] indeed make sense to follow that list [21:16:34] I'd like to remind everyone about what kl [21:16:50] I'd like to remind everyone about what kl_eisbaer said - an AI for everyone to add this information in the wiki page for "his" service [21:17:23] So if I get it right this would be the approach? https://etherpad.opensuse.org/p/GDPR [21:17:39] thankfully most of my stuff is static pages :P [21:18:18] lethliel, yep, the process is that [21:18:29] lcp15: don't forget that we have at least author names on news.o.o, lizards.o.o archive etc. ;-) [21:18:31] and as I wrote, happy to support on this topic [21:18:48] cboltz, yep, also there [21:19:10] cboltz: that's a very exclusive number of people [21:19:33] practical question: I've seen a request where only mail address and realname were given - how can we map that to a username? [21:19:58] cboltz: I have had two of those this week. good question. [21:20:11] (for example, searching the wiki based on the mail address is nearly impossible - well, grepping the database dump, but... ;-) [21:20:21] based on email maybe? [21:20:35] cboltz, for what I opened via ticket, the request was shared by suse legal and usually there's the person sending the request that is providing the info for being identified [21:21:01] pjessen, the request I opened were from suse legals. [21:21:07] the bigger issue is that people may write their name differently depending on context, like that german ö and oe thing [21:21:17] I will take the action item for OBS (to identify what is logged) [21:21:17] cboltz: I guess we might end up in a lot of scripts doing stuff directly in the database. But IMHO especially for mediawiki, there is some GDPR stuff in the newer releases already [21:21:20] deneb_alpha: yep, I understand [21:21:43] the info are directly shared by the person. if they are not providing the right info, well, not our business ;) [21:21:49] kl_eisbaer: will you ever skip a chance to remind me that I have to do an update? ;-) [21:21:57] cboltz: kl_eisbaer: I did quite a bit of grepping about in the forums database today. [21:22:18] cboltz: your wiki servers are getting closer to connect ... :-P [21:22:28] connect is dead [21:22:35] wiki as well [21:22:57] soon:tm: [21:23:09] Sorry. I have to run now. So documenting my findings on https://progress.opensuse.org/projects/opensuse-admin-wiki/wiki/GDPR will be ok? [21:23:23] yup [21:23:40] deneb_alpha: I guess we need some sort of contract with legal - we can only act based on the information provided. [21:23:43] I will update it with stuff from synapse as soon as I can [21:23:57] that's btw one of the reasons why I push for updating our infrastructure zoo so often: this way we get hurt sometimes by small migration issues. But if we don't do that, we get hurt by big migration issues ... [21:24:10] Ok. A nice evening to all of you. [21:24:16] pjessen, I think _we_ will get it. [21:24:18] lethliel: yes, documenting there is ok. Have a nice night [21:24:25] deneb_alpha: I'm not too sure about that. Let's assume we don't know the username, but the user exists in the wiki and later gets a mail via the "watched pages" feature - after we told him we don't have stored his mail address [21:25:07] cboltz: I think the connect platform has the alias, email, and real name info, but I don't know how to search for it. [21:25:10] so just saying "$person didn't provide the username" might fire back [21:25:11] lethliel: cya [21:25:23] cboltz: ...and this user might get reached by other people because they grabbed his IRC nick from connect.o.o... That's why I'm saying we need to do this for each and every little service [21:25:39] cboltz, from what I know usually the person requesting is providing the info for being identified. what we should do is to have a clear vision of all our process but we can't do magics [21:25:50] kl_eisbaer, +1 [21:25:58] cboltz: good point - which is why I suggested a contract. From many years in the big bad corporate world - CYA. [21:26:22] pjessen: agree. [21:26:40] pjessen +1 [21:26:44] So "someone" needs to bring this up to SUSE legal. Any volunteers? :-) [21:26:56] kl_eisbaer, already done [21:27:02] perfect, thanks! [21:27:42] for the list of people is it fine the one in the heroes team wiki page? [21:28:00] I'm sure it's woefully outdated [21:28:35] in theory all the people with admin access should sign this "agreement" or how we can call it [21:29:33] we could consider this like a pre-work for the foundation ;) with an openSUSE legal entity we should have this too [21:30:04] deneb_alpha: might look very different though. (I also work with GDPR in real life). [21:30:20] deneb_alpha: otherwise agree [21:30:20] pjessen, yep, unfortunately I know what you mean ;) [21:30:34] deneb_alpha: we could use the list of people in Freeipa [21:30:47] as these are the ones who somehow "access" data [21:31:12] ...which would result in: our forum and wiki admins need to be listed there as well IMHO [21:31:20] kl_eisbaer, good starting point :) [21:33:22] before we run out of topics, I have another one :) [21:33:57] I hope it's freeipa related too :P [21:33:57] earlier this year I volunteered kl_eisbaer an me to work on the opensuse MX servers - it turned out during the carveout activities we did not have much time for this - so is there someone who likes to help with that? [21:33:57] jdsn: oh no, those have to be added three weeks in advance [21:34:21] jdsn: I'll volunteer for that, sure. [21:34:28] :) [21:34:39] pjessen: mx{1,2}.infra.opensuse.org are waiting for some love ;-) [21:34:50] mx stuff isn't for me, I only do mailman deployments for people apparently :P [21:35:02] kl_eisbaer: cool, that is an itch I love to scratch [21:35:26] pjessen: thanks [21:35:45] but I guess it might be also a good idea to draft some pictures in our wiki again to paint the whole "mail delivery picture" .... I will take that item, if nobody objects [21:36:12] it would be cool [21:36:45] kl_eisbaer, kudos for picking this task. not an easy drawing I suppose [21:37:12] pjessen: if you focus on the new mx, I can draft the picture and identify some small issues, I currently see in our setup. (for example, why are machines (like baloo) with external interfaces sent their messages through the relay instead of sending them out directly?) [21:37:13] deneb_alpha: kl_eisbaer will delegate it to the children, I'm sure. [21:37:32] pjessen: if you need help or some data from our suse mx servers for the migration, just ping me [21:37:33] * lcp15 will be taking care of beautifying anything if required ;) [21:37:39] :) [21:37:41] pjessen: psst: they are sleeping. Now they get nightmares ;-) [21:38:01] jdsn: since you don't have objections to freeipa access anymore, how will actually getting access be handled [21:38:04] kl_eisbaer: jdsn: thanks - I'll be in touch. [21:38:32] kl_eisbaer: drawing the _current_ setup is probably scary (from the bits I know) - therefore I'd recommend to only draw the new setup ;-) [21:38:34] lcp15: I thought you discussed that with kl_eisbaer alrady and only waited for our ok [21:38:35] pjessen: FYI: I copied a lot of stuff on the two mx already from the suse mx setup. If you want to have a look :-) [21:38:50] jdsn: I don't remember tbh [21:39:02] or I misunderstood it [21:39:29] if kl_eisbaer can handle giving me access to it, then ignore me :P [21:39:34] lcp15: as jdsn gave his ok, you will simply get root on the current freeipa machine ;-) [21:39:35] kl_eisbaer: I guess you never got to some migration plan or similar? [21:39:42] lcp15: I guess kl_eisbaer or cboltz will give you access [21:39:45] kl_eisbaer: alright, perfect [21:39:53] pjessen: for Email? Not really. [21:40:09] kl_eisbaer: that's fine - just so I know where to start [21:40:16] Especially as the new mx.opensuse.org machines should only forward external Emails to the internal servers. [21:40:27] ...or to the alias Emails from our community members [21:40:59] both new mx are in Salt already, so anyone should be able to login there [21:42:13] bmwiedemann: ah, since you are planning to set up openidc in id.o.o I assume, what is your estimate on how soon can we get metadata for a few apps [21:42:39] we need it for hyperkitty and synapse at the very least [21:43:14] and discourse I think??? [21:44:04] lcp15: ssh root@freeipa.i.o.o should work for you [21:44:13] excellent [21:44:18] well, migration time [21:44:32] lcp15: you got admin rights in freeipa now (WebUI) and should be able to login on the machine and do the usual sudo su - [21:44:33] after I update the centos machine to centos8.2 [21:47:02] ok - any urgent topics left for today? [21:47:15] looking at the time, I assume we won't have the time to address the old tickets, so maybe let's move that to next month [21:47:52] seems to become a tradition ;-) [21:48:14] we should keep good habits :) [21:48:22] thanks a lot folks for the time spent on the GDPR topic and sorry if took too long :) [21:48:25] I go over those tickets every couple of months regardless of the meetings [21:48:27] hey: one of two more years does not really count, or? :-D [21:48:46] everyone, I feel it's been a very productive meeting. tnx. [21:48:48] (me knows nothing) how about a separate meeting only for tickets? (running) [21:49:03] * cboltz catches robin_listas [21:49:17] cboltz: strangle or torture? [21:49:20] at this point we might need to call a 2 day conference to address them all [21:49:31] one meeting is just not cutting it [21:49:42] robin_listas: this is called oSC - I will ask Doug for a new "entry game for everyone: ticket wrangling" :-) [21:49:52] :) [21:50:23] pjessen: https://laughingsquid.com/cat-5-o-nine-tails-ethernet-cable-whip/ ;-) [21:50:23] maybe we ought to dedicate the next meeting to some ticket maintenance ? [21:50:30] access to oSC will only be granted after successfully closing a ticket. First come, oldest tickets served [21:50:42] I did trouble ticketing for a job, long ago. I know what it entails. But I simply have no knowledge about here and this to be of help. [21:50:45] btw: for my new server I had to email t-online to whitelist the IP, so it would be good to only have 1 outgoing mailserver IP [21:51:17] bmwiedemann1: there are ways - thanks for the hint [21:51:18] kl_eisbaer: I literally need to write a big web app for one of the tickets, not gonna happen [21:51:32] goodnight everyone [21:51:54] alright, the meeting is over, we can all go home now [21:51:55] good night. And thanks for the productive meeting! [21:51:56] kl_eisbaer: do the tickets I closed when I got access to progress.o.o still count? That should give me access for at least the next century ;-) [21:51:57] n8 [21:51:58]