2020-06-02 #opensuse-admin - heroes meeting [19:59:29] hi here [20:01:04] hi everybody, and welcome to the heroes meeting! [20:01:16] hey all [20:01:30] the topics are listed on https://progress.opensuse.org/issues/66463 - but we can add topics if needed [20:01:48] so - let's do two things in parallel: [20:01:53] a) who's here? and [20:01:59] I [20:02:00] b) does someone from the community have a question? [20:02:33] good evening all [20:02:49] * jdsn is here [20:04:58] since nobody dared to ask a question, let's continue with status reports [20:06:11] so - who has something to report? [20:06:17] from me - not really much of my doing, but the opensuse forums having been running in NBG for a while now. [20:06:52] there are a few issues to be ironed out, but overall we're goog [20:06:56] good [20:07:42] otherwise I'm slowly working off the queue of mirror issues I opened priot to corona [20:08:14] I also promise to take a lessons in typing. Very soon. [20:08:22] and english. [20:08:38] ;-) [20:09:09] funny one from me - I repaired rendering of counter.o.o - someone, probably I, did run the render job as root a year ago when firefighting it, and now it lacked permissions to overwrite these files ;-) [20:10:49] does someone else have status reports? [20:10:58] there are some open issues wrt forums still - database location and getting a news server running. [20:11:11] I kicked download.o.o VM after it crashed on monday [20:12:02] bmwiedemann1: i didn't notice. what happened? [20:12:33] not sure. We didnt find logs, but it was down for ~25m [20:12:50] maybe oom [20:12:52] wow. very unusual. [20:12:55] or kernel crash [20:15:17] hej olav [20:15:40] hejsa [20:15:56] I think we can continue with the next topic - status of www.o.o/openid migration [20:16:17] (I didn't expect the "fun" we had with it when adding that topic - but I'll let bmwiedemann1 report ;-) [20:17:41] So somehow the service provided by MF-IT stopped working yesterday [20:17:57] underlying curl https://130.57.66.6 shows a timeout [20:18:26] Lars said, there was some kernel crash or so, but somehow they did not manage to fix it yet [20:19:01] so I keep working on the ipsilon deployment as stop-gap (not fully production-ready with sqlite) [20:20:22] we tried to switch to it during this day but found that it produced different identity URLs [20:20:28] and I am very close to fix that [20:21:25] :-) [20:23:50] I just need to find out if old URL was https://www.opensuse.org/openid/user/bmwiedemann or with trailing slash (because ipsilon code tries to force the latter) [20:24:47] I'd guess the answer might be in the openqa database [20:25:01] okurz might know ^ [20:26:45] I guess, we can get a temp-fix done tomorrow [20:27:02] sounds good [20:27:17] and I wouldn't be surprised if you are faster than MF-IT can reboot the server in Provo ;-) [20:28:37] let's make it a race. [20:29:44] there are other aspects about openid. E.g. we need to find out if we need a different domain from id.o.o to pass common criteria certification. [20:31:11] * cboltz has no idea about certification paperwork [20:31:18] background: SUSE is in the process of being certified under common criteria and we have to take special care about systems that deal with our login credentials [20:31:20] do you think, it would be an issue for our users, if logins went through some secure-suse.tld domain? [20:32:26] bmwiedemann1: isnt that much how it used to work with mf-it ? [20:32:36] sort of, yes. [20:33:40] bmwiedemann1: it probably would be [20:34:07] generally people seem to be unhappy about the bouncing back and forth between SUSE and openSUSE and the marketing email thing didn't help either [20:34:46] well, I would generally prefer if the accounts were clearly labeled as SUSE [20:35:01] jdsn: also, you have my sympathies for going through CC and STIGs [20:35:55] thanks [20:36:14] used to work for gov subcontractor, so I have some idea of the pain involved [20:36:23] the thing is, the login process must be in a protected environment on SUSE owned machines [20:36:45] the client systems can be outside (opensuse dmz) [20:37:08] jdsn: that's not true if the data is partitioned [20:37:18] e.g. what is SUSE stuff and what is openSUSE stuff is clearly split [20:37:46] bugzilla for example is both [20:37:48] but with Leap, things get merged together from SLE+openSUSE [20:37:58] and we have more of these mixed systems [20:38:02] no they didn't [20:38:18] Leap is not mixed, because we take stuff from SLE without a feedback loop [20:38:50] for the jump thing, there's going to be some kind of cross-instance SR federating thing, so it's already remaining partitioned that way [20:38:57] still not easy to separate. And I think, feedback is WIP [20:39:29] jdsn: bugzilla is something that LCP and I have been thinking about for a while [20:39:59] it is definitely a special case [20:40:36] but its not alone special, we also have the special Jira and special Confluence [20:40:47] jira and confluence are not special [20:40:52] nobody but suse people can access or use them [20:40:53] :) ok [20:41:04] neither of which openSUSE uses, and is planning to (hopefully) [20:41:16] I meant special in way that the tool allows login for employees and non-employees [20:41:33] jdsn: currently non-employees cannot log into jira or confluence, afaik? [20:41:41] at least I can't neither with partner or community accounts [20:41:59] but its a service we (SUSE) offer externally and have to provide a secure login anyway [20:42:14] yes they can - with a special contract [20:43:02] oh boy [20:43:46] any more status reports ? [20:44:11] I just really wanted ask about the status on access for freeipa.i.o.o [20:45:19] lcp: no prob, we just get sidetracked too often [20:45:21] lcp: in general I heard positive reactions about that, but we fist need to remove some "dependencies" before we can open it [20:45:45] sorry, I can not go into more details [20:46:04] I hope it's not the case of boosters machine which hosted 20 things at once ;) [20:46:32] nope [20:47:02] but please don't start the yes-no game now :) [20:47:26] I will restrain myself from asking questions then [20:47:53] thanks :) [20:48:00] :( [20:48:10] just wondering - AFAIK freeipa.i.o.o hosts a) heroes accounts and b) DNS entries. I'm somewhat surprised that we need to go through paperwork for giving lcp access there [20:48:14] or do I miss something? [20:48:19] but ping me, if I don't get it done in 3 weeks [20:48:33] cboltz: that is pretty much all that's on that box [20:48:59] cboltz: its not paperwork, and I can show you "after" I removed it :) [20:49:19] LCP and I are in a position to migrate that to the new EL8 based FreeIPA box (so not being stuck on F24 anymore! 🎉) [20:49:39] jdsn: ok, I'm looking forward to that ;-) [20:50:44] cboltz: I'm sure our VPN wiki mentions that admin machines aren't "normal" [20:50:59] I don't expect legacy fedora 24 machine to be an exception [20:51:35] well, let's start with define "normal" ;-)) [20:51:42] (just joking) [20:53:49] are we done with status reports? [20:54:19] I started doing the error pages, but got a little too ambitious at javascript part [20:54:43] https://progress.opensuse.org/issues/67435 [20:55:55] basically I started messing with cachet api to check for the current status of the service displaying 503 [20:56:06] ideally the error pages should be static, so that haproxy can deliver a single HTML file (possibly loading css, images etc. from static.o.o - but it should still look somewhat readable if static.o.o is down) [20:56:40] they are static, although built with jekyll because it's easier for me [20:56:56] but yeah, they will be static, with additional js, css, images etc [20:57:21] ok, sounds good [20:59:28] I just looked at some old tickets (which actually is our next topic) [21:00:17] pjessen: https://progress.opensuse.org/issues/17676 looks like a forgotten mirror ticket. Can you have a look at it? (the remaining part is stage.o.o access) [21:00:33] 17676 ?? wow. [21:00:52] yes, it's our 3rd-oldest open ticket ;-) [21:00:57] sure, assign it to me. [21:02:26] done [21:05:13] got it [21:06:34] I see somebody changed the css for mirror.o.o ? [21:14:46] okay, i guess I'll have to fix it tomorrow. [21:18:57] given the silence, I think we can close the meeting [21:19:02] thanks everybody for joining! [21:19:27] (and if you have some time left, have a look at our tickets (both old and new) and maybe handle one of them ;-) [21:19:47] okay, good night. [21:19:57] N8 [21:21:42] gn [21:40:26] good evening all :)