15:00:04 #startmeeting Server SIG Weekly Meeting (2015-06-09) 15:00:04 Meeting started Tue Jun 9 15:00:04 2015 UTC. The chair is sgallagh. Information about MeetBot at http://wiki.debian.org/MeetBot. 15:00:04 Useful Commands: #action #agreed #halp #info #idea #link #topic. 15:00:04 #chair sgallagh mizmo nirik stefw adamw simo tuanta mitr danofsatx 15:00:04 Current chairs: adamw danofsatx mitr mizmo nirik sgallagh simo stefw tuanta 15:00:04 #topic roll call 15:00:12 .hello sgallagh 15:00:13 sgallagh: sgallagh 'Stephen Gallagher' 15:00:20 .hello dmossor 15:00:22 danofsatx: dmossor 'Dan Mossor' 15:00:43 Hello 15:00:48 * mitr is only somewhat paying attention 15:01:01 mitr: That's an improvement over most people, I think :-P 15:01:07 o/ 15:01:16 howdy 15:01:30 Greetings! 15:01:39 .hello stefw 15:01:40 stefw: stefw 'Stef Walter' 15:01:44 what, we're supposed to pay attention? 15:01:47 wrong meeting room... 15:01:48 * danofsatx didn't get the memo 15:02:16 .hello simo 15:02:17 simo: simo 'Simo Sorce' 15:02:39 hi 15:03:58 /me waits two more minutes 15:04:06 .hello mizmo (fighting a fire atm tho) 15:04:07 mizmo: Sorry, but you don't exist 15:04:11 .hello duffy 15:04:12 mizmo: duffy 'Máirín Duffy' 15:04:44 * nirik is here 15:05:09 .hello garrett 15:05:10 garrett: garrett 'Garrett LeSage' 15:05:10 * garrett tries 15:05:24 OK, let's get started 15:05:29 #topic Agenda 15:05:46 As noted by email, there are two items of high importance this week that I am aware of 15:05:55 #info Agenda Item: PRD Refresh 15:05:55 #info Agenda Item: Change Proposals 15:06:29 Does anyone have any other high-priority items this week? 15:06:36 I had one... 15:06:44 nirik: Go ahead 15:06:44 the local dns resolver change. 15:06:54 What we want to do with it for server. 15:07:03 #info Agenda Item: Local DNS Resolver 15:07:06 or should we wait until fesco rules on it? 15:07:19 Let's discuss that when we get to it. 15:07:23 k 15:07:42 Any other topics? 15:08:31 OK, hold your peace until Open Floor, then 15:08:35 #topic PRD Refresh 15:08:54 I looked at your changes and they seemed good to me. +1 15:08:59 So, I can see that everyone went over this with a fine-tooth comb, thanks to the enormous email thread around it. 15:09:13 you're welcome. 15:09:23 I put together a few proposed changes, as nirik mentions. 15:09:27 #link https://fedoraproject.org/w/index.php?title=User%3ASgallagh%2FServer_PRD_Draft&diff=current&oldid=415115 15:10:08 sgallagh: my only comment is, what happens if we can't provide the upgrade path you mention when using/moving to "isolation" 15:10:11 Sorry for the delay on putting those out; I was planning to do it yesterday afternoon and got busy. 15:10:19 sgallagh: revert everything ? something else ? 15:10:56 simo: Good question. I wrote that under the assumption that *some* form of migration path should always be possible. 15:11:17 If it's truly impossible, I suggest worrying about that when it happens, rather than trying to predict it, but I'm open to suggestions 15:11:43 it may be very difficult if you move to a containerized world where you have to migrate data to multiple containewrs using persistent storage 15:12:13 sgallagh: ok 15:12:39 sgallagh: can we add that the assesment must be done *before* we start developing it 15:12:40 #info simo raises concerns about the migration requirement added to the role upgrade path requirements 15:13:33 simo: Seems like defining a process rather than the intended outcome (which is the point of this doc) 15:13:57 I wouldn't want to find ourself in apinch, because we had a choice to "adjust" the current role to new upstream requirements, or "go with containerized", and then we find out after having tried containers migration is not possible and we have no more time to fix the "regular" role 15:14:25 simo: I agree that new roles should be designed with future migrations in mind. 15:14:36 I'm just not sure this is the right document to state that. 15:14:54 I am just saying that contigency planning must be done at the start pahse 15:15:04 not after we find issues 15:15:23 #info simo recommends that planning for future migrations should be done at the beginning of role implementation to avoid future surprises 15:16:27 sounds reasonable 15:16:40 simo: Is there anything specific you are worried about? It seems to me that “figure out the right destination” (which we need to know to start the containers anyway) and “cp” would cover 90%, modulo database file format changes which need to be dealt with whether or not containers are involved. 15:16:51 simo: If you want to add that to the PRD, can you suggest a phrasing? 15:17:27 sgallagh: If I had phrasing I would have edited the document myself :-| 15:17:56 * simo not really 100% today, sorry, my english co-processor is in power-saving mode 15:19:10 OK, let's move on. We can massage that later if we really feel strongly about having it in the PRD 15:19:35 Any other thoughts on my changes? Any other portions of the PRD that should be updated? 15:21:09 Anyone still reading these questions? 15:21:18 i am :) 15:21:42 mizmo: Actually, I meant to catch you earlier. Do the Personas feel like they still fit? 15:22:07 (I think "yes", but I'd like your opinion) 15:22:33 what's the url to the personas? 15:22:45 sgallagh, i do think so, i dont see any changes that i think would affect their applicability 15:22:56 andreasn: https://fedoraproject.org/wiki/User:Sgallagh/Server_PRD_Draft#Personas has the short versions and links to the full Persona pages 15:23:01 thanks 15:23:27 mizmo: OK, thanks 15:24:11 OK, then if there are no other comments forthcoming, shall we vote on whether my updated version shall be submitted to the Council as-is? 15:24:31 Proposal: https://fedoraproject.org/wiki/User:Sgallagh/Server_PRD_Draft to be submitted to the Fedora Council for ratification 15:25:37 This is the part where WG members vote. I'll start: +1 15:25:47 +1 15:26:31 +1 15:27:00 +1 15:28:04 mizmo, stefw, mitr? 15:28:43 sgallagh: +1 to the edits 15:29:30 #agreed https://fedoraproject.org/wiki/User:Sgallagh/Server_PRD_Draft to be submitted to the Fedora Council for ratification (+5, 2, -0)\ 15:29:40 #topic Change Proposals 15:29:57 #link https://lists.fedoraproject.org/pipermail/server/2015-June/001911.html 15:30:13 ^^ This has the list of Changes we've discussed. Some of them have resources, others do not. 15:30:58 Let's start with the hard one: File Sharing 15:31:11 well, if we don't have people working on it, it's not likely to appear. ;) 15:31:15 it's a neat idea tho 15:31:22 Yes, and oft-requested. 15:31:36 So I'll ask again: is there anyone out there who wants to own this and drive it? 15:31:54 * nirik has not the time sadly. 15:31:58 I don't have the cycles to do anything here in F23. I'm booked. 15:31:58 * danofsatx can't commit 15:32:09 sgallagh: I do not have the time, and I know it will be a big time sink 15:32:16 this is not going to be a sideline project 15:32:23 No, it is not 15:32:29 no, this is a full-time job. 15:32:45 maybe not fulltime, but 50% for sure 15:32:58 depending on your knowl;edge of the underlying tech 15:33:08 well, for me it would be full time. I don't know what I'm doing ;) 15:33:39 Proposal: File Sharing Server Role is deferred to a future release due to lack of volunteers. 15:34:16 +1 15:34:28 +1 15:35:02 Yeah 15:35:59 if some folks have small amounts of time we could start planning/thinking about it and such prelim work... 15:36:17 Sure, there's definitely some small plumbing that can and should be done in advance. 15:36:30 An API for managing the shares would be fantastic 15:36:48 But let's not confuse the current question about the Change Proposal 15:37:48 right 15:37:55 +1 15:38:11 There's a certain irony to a proposal to skip something due to lack of volunteers failing due to lack of votes... 15:38:21 +1 from me makes 5 15:38:40 ha 15:38:42 #agreed File Sharing Server Role is deferred to a future release due to lack of volunteers. (+5, 2, -0) 15:39:20 OK, so let's cover the three that we're definitely doing and get owners for it settled. 15:39:27 First: Cockpit GUI for the DC Role 15:39:56 I'm mentoring a student on this, so I'll own it, but I'd also appreciate if stefw would be willing to co-own the Change. 15:40:19 how is the mentoring going? 15:40:26 (Or perhaps designate one of his teammates) 15:40:36 are we going to end up doing all/most of the work? 15:40:40 a GSoC student? 15:40:46 nirik: GSoC, yes 15:40:59 stefw: No, he's already working on implementation. 15:41:09 ah great 15:41:12 (Starting from the designs that andreasn created) 15:41:21 well put me down tentatively for the change 15:41:28 will confirm tomorrow 15:41:30 Owning a change proposal is mostly acting as a point of contact and coordinator 15:41:59 #action sgallagh and (tentatively) stefw to act as owners of the "Cockpit GUI for Domain Controller Role" Change Proposal 15:42:24 Next up: Containerized Server Roles 15:42:44 I'll be owner on this; I've gotten the go-ahead from my RHT management to spend time implementing it 15:43:15 My plan is to build a memcached role as a PoC and then (time permitting) look at extending the DB role to a containerized approach as well 15:43:38 * nirik is interested to see what we end up with there... 15:43:41 #action sgallagh to act as owner of the "Containerized Server Roles" Change Proposal 15:44:12 #info First containerized role: memcached 15:44:26 #info Second containerized role: updated Database Server ROle 15:44:30 #undo 15:44:30 Removing item from minutes: INFO by sgallagh at 15:44:26 : Second containerized role: updated Database Server ROle 15:44:33 #info Second containerized role: updated Database Server Role 15:44:52 OK, third up: ABI Break Detection 15:45:23 Dodji Seketeli and his team have stepped up and are going to implement at least the ELF binary compatibility checks 15:45:35 yep. :) excellent. 15:45:38 I'd like someone *other than me* to co-own this and get the proposal filed. 15:46:20 sgallagh: the abi stuff ? 15:46:37 simo: Yes. I want someone to act as a coordinator 15:46:50 I'd prefer not to end up co-owning too many Changes this cycle. 15:47:06 when do you need it ? I am interested and have a little knowledge, but vacation time is looming 15:47:25 #link https://fedoraproject.org/wiki/Releases/23/Schedule 15:47:30 I would be able to be really useful only starting in August 15:47:59 and partially in June 15:48:06 simo: Ideally, at least a basic attempt needs to be available by July 28th 15:48:07 is that sufficient ? 15:48:22 sgallagh: yeah no chance I can help in July, I'll be mostly AWOL 15:48:56 I'm not asking the coordinator to do much of the *work*. That's largely going to be handled by Dodji. 15:49:06 I just want someone to be acting as a wrangler and making sure it stays on track 15:49:30 simo: And in your case, I'm more interested in the next one on the list to discuss ;-) 15:50:30 mitr, danofsatx: Would one of you be willing to be that wrangler? 15:51:04 * danofsatx cant - vacation, possible career change, RHCE test...so on and so on 15:52:00 sgallagh: I can't commit to doing anything substantial, sorry. 15:52:14 OK, I'll see if any of the folks from Base might be willing to adopt this. 15:52:25 I'm pretty sure the work is going to happen anyway. 15:52:32 I could have my name on the Change page and update the bz for Alpha/Beta, but Dodji could do that just as well and better. 15:53:03 #info No coordinator from the Server WG selected for the "ABI Break Detection" Change. Will reach out to Base Design WG for a co-owner. 15:53:49 OK, on to the last two. 15:53:56 (Sorry, looks like we're going to run slightly over today) 15:54:15 "FreeIPA Replica Role" 15:54:31 simo: You were saying that you were working on the plumbing of this. Do you have an ETA on that? 15:54:48 sgallagh: not a firm one yet 15:54:59 If it's soon (June?), then this is achievable for F23. If later than that, let's aim to finish that plumbing and do this role in F24 15:55:01 we were trying to get it in in FreeIPa 4.2 bnut it may slip 15:55:18 it may slip in F24 yes 15:55:36 OK, then let's just push it to F24 right now and avoid trying to kill ourselves landing it. 15:55:39 Agreed? 15:55:52 (But obviously, any groundwork that can be laid is good to have) 15:56:20 ok 15:56:49 #info "FreeIPA Replica Role" Change Proposal will be deferred to Fedora 24 due to upstream uncertainty. 15:56:59 OK, last one: Stable API Documentation 15:57:22 I had a brief conversation with the Fedora Docs team at their most recent meeting 15:57:46 They're interested in working on this, but it sounds like they're also in the middle of shifting to a new framework to host content. 15:57:55 So it's unclear if this will be deliverable this release or not. 15:58:18 I'm on the fence on whether we list it as a Change Proposal or not. 15:59:53 sgallagh: would we have an owner ? 16:00:16 perhaps we list, but be ready to pull it if things don't look good ? 16:00:17 simo: tuanta has said he'd coordinate 16:01:00 does change prop go in for F23 if we've deferred it to F24? 16:01:24 danofsatx: We can file it at any time, but we'll probably not file F24 ones today 16:01:33 roger 16:02:57 Actually, I thought I saw tuanta volunteer somewhere, but now I can't locate it. 16:03:08 And he's not here, so volunteering him would be unkind :) 16:03:42 I'll see if I can find an owner. If I can, it'll get filed. If not, it won't. Agreed? 16:04:18 +1 16:04:55 +1 16:05:00 Sure 16:06:06 #info "Stable API Documentation" will be filed as a Change Proposal if an owner can be found 16:06:13 OK, one more topic today 16:06:21 #info Agenda Item: Local DNS Resolver 16:06:25 #undo 16:06:25 Removing item from minutes: INFO by sgallagh at 16:06:21 : Agenda Item: Local DNS Resolver 16:06:29 #topic Local DNS Resolver 16:06:43 nirik: You have the floor 16:07:03 well, just wonder what we want to do related to this change? 16:07:13 or at least be thinking about it if the change is accepted. 16:07:24 Do we want server installs to default to using it? or not. 16:07:33 The default of having a local resolver, and more importantly DNSSEC validator, is correct IMHO. 16:07:35 I would like it to be default on server 16:07:38 because DNSSEC 16:07:43 * nirik nods. 16:08:05 and on server it is a relatively safe thing, it won;t have all the quirks a laptop that jump over networks hjas 16:08:20 We should make it easy to run site-wide caching/validating servers, but perhaps not necessarily in the general case; e.g. enrolling into IPA (which is already a root of trust) could automatically use IPA’s configured DNS server. 16:08:28 yeah, I worry a bit the logic for the laptop case might be in the way, but if we test a lot and make sure thats fixed... 16:08:28 the most you'll see on a server is VPN related quirks if you use vpns 16:08:40 how would this affect an IPA server? 16:08:54 mitr: I would still use a local caching server 16:09:03 mitr: you can't trust the "local" network anyway 16:09:14 danofsatx: it shouldn't affect it much 16:09:20 ok. Sounds like we are largely ok with enabling it by default... just wanted to bring it up. 16:09:29 we can configure bind to listen on 0.0.0.0 16:09:39 while unbind listens specifically on 127.0.0.1 afaik 16:10:06 it also has a localhost bound control port. 16:10:12 if 0.0.0.0 gets in the way we'll just have to add struff to make it explicitly list on all interfaces but localhost 16:10:16 The one concern raised on the devel@ list that I heard was that it's extra processing on all of the endpoint hosts where in an environment that Server is likely to live, it might be more effective to have this be done on the gateway. 16:10:20 * nirik wonders if cockpit might want to grow unbound control... flushing cache, etc. 16:10:28 stefw: ^^ 16:10:43 sgallagh: you can always turn the service off 16:10:58 right, and we should make sure removing/disabling it works/is easy 16:11:02 it's a deployment decision 16:11:08 simo: Sure, but if it turns out that everyone turns it off, then enabling it by default may be silly :) 16:11:20 sgallagh: would you say that about SELinux too ? 16:11:32 Dammit, I was just writing a contradiction about SElinux when you asked that :-P 16:11:33 because really, it is in the same league 16:11:40 DNSSEC requires you to use a local resolver 16:12:02 * nirik has been using dnssec-triggerd for many years. Ever since it showed up in fedora. It's been pretty stable overall. 16:12:10 Anyway, I'm not really supporting this argument, just making sure it was represented in the discussion 16:12:44 I've wanted to, but back when it was first introduced it had problems when I moved my laptop from home to the office. 16:12:53 Though that's likely been resolved by now 16:13:05 agI have occasional issue on my laptop 16:13:10 so I turned it off in F21 16:13:19 I should put it back on now that I moved to F22 16:13:26 but they weren't huge issues 16:13:28 OK, so in general, it sounds like we're largely in favor of this proposal, though 16:13:29 I'm not educated enough on the change, so I can't offer any opinions. I just know I _hated_ it when I ran into it on Ubuntu systems, and didn't know what I was dealing with. 16:13:34 mostly know bugs most of wqhich should be resolved 16:13:35 Which is useful information to provide to FESCo as well 16:13:57 danofsatx: ubuntu uses it? huh, didn't know. 16:14:17 danofsatx: Well, the goal of this Change is to make it available by default without the end-user needing to configure it (I think) 16:14:18 as of 14.04 they do 16:14:29 So that should be an improvement over the current state of things 16:14:49 danofsatx: I am sure we'll find a lot of internet culture pretty soon on how to disable it 16:14:53 well, right now the configuration is only 'install package' and 'add a single line to NetworkManager config' 16:15:26 can nmcli still insert DNS resolvers where they need to go when assigning a static IP? 16:15:31 ok I am for having it enable by default in the server install 16:15:50 pros outweight cons imo and we need to abide by our First rule 16:15:53 danofsatx: yes. unbound uses the dhcp/nm provided ones (by default) 16:16:06 danofsatx: It works for DHCP ones which adjust dynamically, so I'd assume so 16:16:14 query -> unbound on localhost -> dhcp/nm/whatever forwarders that work 16:16:26 Any opposition? Otherwise I'll do a lazy-consensus approval 16:16:30 ok, that was my issue - I couldn't get the Ubuntu systems to use a defined DNS server. 16:16:37 lazy +1 16:16:37 sounds good. I just wanted to bring it up. ;) 16:17:52 #agreed Fedora Server SIG is broadly in favor of enabling DNSSEC by default on the Fedora Server Edition. (Lazy consensus) 16:19:27 #topic Open Floor 16:19:38 /me sets short fuse, since we're over time 16:20:02 hi! 16:20:13 so I have an idea about a Fedora Home Server that I'd like to pitch 16:20:36 garrett: is it quick ? 16:20:37 :) 16:20:41 * simo hungry :) 16:20:43 it would bring together a lot of server work in one package, with nice defaults, to make it easy to enable people to keep their data private 16:20:54 I wrote it up at https://gist.github.com/garrett/31df7687c0680c2c0756 so you can read it 16:21:09 I've been patient, waiting for almost an hour an a half to mention it (: 16:21:24 take it to list/#fedora-server for discussion? 16:21:32 garrett: it would have been better to mention it at the start when we asked for more topics 16:21:36 garrett: but go ahead 16:21:37 yeah, I tried 16:21:58 I can't type that fast today -- a mosquito bit the joins on my hand ): 16:22:03 (joints) 16:22:10 garrett: would this be a Role or something different ? 16:22:21 I'm not sure 16:22:36 I'm skimming your proposal 16:22:44 anmd it raises a series of questions 16:22:57 it also seem to depend on things like LEt's encrypt that are not quite here yet 16:23:05 I think this is something we *should* discuss 16:23:05 well, it should be here soon 16:23:10 and that's only for external services 16:23:15 but probably should be set in agenda ahead of time 16:23:16 it could be a stage 2 16:23:20 yep, sure 16:23:35 I wanted to get this idea thrown at the people here in this meeting, just to start thinking about it 16:23:58 we can work on it together to refine it 16:24:06 I think there's a number of seperate roles in there... 16:24:18 (which could all be setup on the same machine/server if desired) 16:24:24 garrett: it seem like getting a bunch of roles in containers would make it easy/possible to build it 16:24:34 simo: I told mizmo about it like 45 minutes before this meeting started, so it was done spur of the moment 16:24:35 (: 16:24:42 it's ok 16:24:48 you set the ball rolling 16:24:52 (she told me to jump in this meeting to let everyone know) 16:24:52 I like it. 16:25:03 Essentially what I'm doing at home now.... 16:25:06 ok we are way over time 16:25:11 but on a Core2 Duo. 16:25:14 it wouldn't be super-configurable, but rely on a lot of defaults 16:25:16 I think we should take it into consideration at the next meeting 16:25:29 optimized for basic use 16:25:32 okay, great! 16:25:36 also more discussion on the list would be good... could decide what phases things might be in, etc. 16:25:39 garrett: can you send your page to the fedora-server ml as a proposed topic for next week meeting ? 16:25:46 sure! 16:25:51 thanks 16:29:09 Thanks folks. (Sorry, got a phone call that pulled me away) 16:29:41 #endmeeting