2017-08-01 #opensuse-admin - Heroes meeting [20:01:32] meeting time! [20:01:39] who is around? [20:01:49] me [20:01:58] good evening everyone [20:02:22] hi everybody! [20:02:40] Hi [20:03:41] cboltz: wanna chair? [20:04:02] well, why not ;-) [20:04:34] first topic - questions from the community [20:04:41] does someone have a question? [20:05:16] do we cover topics from last meeting that were not answered? at the end? or here [20:05:23] sorry, if i ask. just unsure [20:05:37] That's default... [20:05:41] usually at the end, but I don't mind to cover them first [20:06:00] yeah, that's probably better than forgetting them ;-) [20:06:12] okay, good to know [20:06:48] I don't see any question from the community, so - mmaher_home, what's the topic you have in mind? [20:07:15] about the heinlein sponsering, what came out while taking this topic to the board [20:07:32] because we didn't know last time how to proceed / handle it. [20:07:33] right [20:07:49] We'll use the heinlein sponsoring. We accept it. [20:08:16] this is an "old" board decision (old as in "decided before Sarah and I were elected") [20:08:35] we discussed it again, and as Sarah already said, we'll accept it [20:08:55] that sounds good. so after the membership topic this topic can proceed then? [20:09:02] Yes [20:09:39] ok then i'm lookig forward to it. thanks [20:09:47] I'll ask on the board ML about the next steps and keep you updated [20:09:56] Do you have another topic? [20:10:48] cboltz: thank you very much [20:11:02] no thats it [20:11:19] ok, then let's continue with the status reports [20:11:38] I'll start with the wiki [20:12:02] I probably don't need to mention that all wikis are moved and updated ;-) [20:12:46] I spent some evenings to replace the old tags with the new in all wikis (including languages where I can't even read the characters) [20:12:46] and it looks now very modern [20:13:24] en-test.opensuse.org got a new skin - still with some rough edges, but it already looks very good :-) [20:13:47] fixing the login is on my TODO list for later tonight [20:14:14] and Guo will probably need to do some CSS adjustments here and there [20:14:24] how was the overall feedback from the community so far after the move? [20:14:41] for example, does it feel faster? [20:14:49] I believe the font size is a little bit too big... [20:14:57] The rest is fine. :-) [20:15:01] the only serious problem was with the cookie domain which caused some login problems [20:15:16] besides that, I only heard positive feedback [20:16:01] including that it feels faster - even when testing from Provo :-) [20:16:43] cool [20:16:55] I mean - we tested it long enough, so what could have gone wrong? ;-) [20:16:56] there are a few dns stuff on my side todo, but not really urgent [20:19:00] I've seen a few tickets about broken member mail - is this something you could handle? (ideally soon, since people might depend on the @opensuse.org address) [20:20:10] sure [20:20:29] just give me some time, there is a lot on my plate right now, esp regarding updating machines to new leap and sle versions [20:20:30] ok, I'll search for those tickets and assign them to you after the meeting ;-) [20:20:51] any other status reports? [20:21:13] did everything survive the 42.3 release? [20:21:46] well, I need to update most of the infrastructure to 42.3 still [20:22:00] I will do a major part during the maintenance window this thursday [20:22:15] and I will do some not-so-critical machines outside of the maintenance window [20:22:23] so fingers crossed nothing will go wrong :) [20:22:58] Do you change all machines from SLES to Leap? [20:23:31] I try, it's not that straightforward [20:23:47] the heroes-managed machines that are running sle12 have to be changed to leap [20:24:03] the heroes-managed machines that are running sle11 have to be redeployed to a new VM [20:24:34] ok [20:24:35] the non-heroes-managed machines are a bigger discussion, as they involve more admins there and some suse services as well [20:24:52] that's a generalization, does it answer your question? [20:24:57] yes [20:25:39] good [20:26:54] does everybody have VPN access in the meantime? [20:27:19] yes [20:27:26] most of the people yes, but I know that Per doesn't yet [20:27:50] not too surprising, he just came back from vacation [20:28:02] exactly [20:29:37] I just had a look at the open tickets - right now we have 150 open tickets [20:29:38] mmaher_home: you got your vpn working btw? [20:30:49] most of them are not terribly urgent, but nevertheless I'd like to remind everybody to check the open tickets - assign them to the right people, and please get your own tickets done ;-) [20:32:25] tampakrap: still something missing in the vpn conf, but i will figure it out [20:32:59] mirror tickets should be fine atm. i try make them immitiatly so they dont stuck up anymore [20:33:45] Great [20:34:23] for the VPN - my openvpn config is in the admin wiki on progress, no need to re-invent the wheel [20:34:47] that is very nice :) [20:35:37] I will put my dnsmasq config as well so that you can have fully working dns inside the suse network [20:36:30] I believe you can config dnsmasq in the openvpn config, too. [20:36:47] good idea, maybe I should also add my unbound config (overriding a NS entry is slightly ;-) more difficult than overriding other DNS entries) [20:37:22] (just in case more people don't allow openvpn to change resolv.conf) [20:38:07] cool [20:38:46] more status reports about done or planned work? [20:38:53] anything else we need to discuss? [20:40:05] tampakrap: IIRC the question if mysql.infra.o.o does daily backups was never answered. Did you check that in the meantime? [20:45:10] * cboltz wonders if tampakrap is searching for backup cronjobs right now [20:46:47] sorry was afk for a min :) [20:46:52] no it doesn't BUT [20:47:03] this cluster runs on the suse-dmz vlan [20:47:20] so we will need to create a new mysql and a new postgresql cluster for the heroes-managed vlan [20:47:40] meanwhile I could add the daily mysql backups [20:47:52] file a ticket for me please so we don't forget [20:47:57] same for postgresql [20:48:10] but the backups are going to be on the suse-dmz vlan as well [20:48:16] makes sense? [20:49:00] I hope that I/we won't need the backup, so it's fine if they are not directoy accessible for everybody at the moment [20:49:10] the important thing is to _have_ backups ;-) [20:49:29] I'll open tickets as requested [20:49:34] agreed [20:49:59] speaking about backups - would it make sense to setup a backup VM? [20:50:12] my usecase would be rsnapshot backups of the wiki file uploads [20:50:17] we do have one, also at the suse-dmz vlan :) [20:50:24] so yes we need a new one [20:50:57] we need backups via rsyncd/rsnapshot, we need rsyslog server, and we already have the storage backups that I need to verify at some point [20:52:33] I'd vote for rsnapshot over SSH instead of having rsyncd running [20:53:09] there are pros and cons for each method, we can discuss it outside of this meeting [20:53:32] BTW: you know you can run rsnapshot as root (so that it can read all files) and still only give it read-only permissions? [20:53:37] ok [20:53:45] sure [20:54:14] but to run it over ssh means ssh-root login, which is something we want to get rid of [20:54:21] either way, let's not discuss it now, it's a big topic [20:54:42] ok [20:55:20] any news on encrypted pillar (besides "still on the TODO list")? [20:56:09] no and don't wait for me on this [20:56:18] it is easy enough for you even to do it [20:56:31] I would like to focus on the ldap topic at the moment [20:56:47] makes sense [20:57:17] I can't promise if/when I'll have time for it, so if there are any volunteers... ;-) [20:58:34] any other topic? [20:58:48] one last [20:59:00] dns, we need to start thinking of fully taking it over [20:59:09] is this something that the board could start discussing? [21:00:06] I can bring it up on the board ML [21:00:25] do you have a specific timeframe in mind, or simply "as soon as possible"? [21:01:12] the sooner the better [21:01:23] ok [21:01:30] it will solve a lot of technical issues regarding the dns setup we currently have, plus the upcoming relay.o.o [21:01:50] ok [21:02:15] that reminds me of what could be the "very last" topic ;-) [21:02:20] it is not urgent/high priority though, as things work and we can proceed with stuff [21:02:29] so it's not a blocker, but it would be nice to proceed on [21:02:41] ok [21:02:47] www.o.o is still running in Provo [21:03:08] moving the website is technically boring, but it also includes an openID provider [21:03:33] well, you are the expert on moving services from provo now :) [21:03:49] yeah, but I'm not an expert on openID ;-) [21:04:00] why it needs openid? [21:04:02] * tampakrap checks [21:04:15] www.o.o doesn't _need_ openID [21:04:34] it seems a static page [21:04:36] ah sorry, continue [21:04:44] it _provides_ openID which you can use to login at various places inside and outside openSUSE [21:05:10] ah [21:05:20] https://www.opensuse.org/openid/ [21:05:26] and the openid clients care about the openid's provider? [21:05:38] the openid stuff is managed by mf it [21:05:43] I mean, do they care about the openid's provider's IP? [21:06:00] the IP doesn't matter AFAIK [21:06:36] we could create a www2.o.o and move the webpage and the openid provider there [21:06:47] and then create a clone of a website that is an openid client [21:06:53] and see what breaks [21:07:07] it might need a few tricks on the haproxy, but it seems totally doable to me [21:07:11] tampakrap arent the accounts the same we use in bugzilla? [21:07:44] yeah I see your point [21:07:55] right, same account everywhere [21:08:02] we will need to contact MF-IT to open a hole to their API/db to get the accounts [21:08:39] I wonder if we could convince them to move openid to openid.o.o [21:08:45] then we can move a bunch of stuff easier [21:09:51] if openID logins "survive" redirects (so that www.o.o/openid/user still works), I like the idea to have a separate VM for it [21:10:36] for the accounts - can't we simply put an openID provider behind login2.o.o? [21:10:38] I don't even care even if it stays in provo, as long as the main website can be moved [21:10:58] I doubt it, the ichain is managed by mf-it [21:11:04] we don't have access to them [21:11:29] maybe we could by using our ldap mirror, but I can't answer it now [21:11:35] yes, but login2.o.o knows all accounts, so - what's the problem? [21:12:45] I'd say send a mail to the mailing list to have darix and lars involved in the discussion [21:12:58] ok [21:13:15] they know better than me if it is technically and policitally doable [21:14:47] can someone beat the "very last" topic with another topic? [21:15:49] doesn't look so [21:15:58] thanks everybody for joining the meeting! [21:16:15] thank you too for chairing! [21:16:26] thanks everyone [21:16:30] enjoy the evening, and whenever you are bored, feel free to handle one of our 150 tickets ;-) [21:16:54] I would say let them become 200 as long as we have a hot summer [21:17:04] when it gets cold again we can go back to them :P [21:17:30] I vote for melting that number down as long as it's hot *g*