18:00:25 #startmeeting Infrastructure (2016-06-09) 18:00:25 Meeting started Thu Jun 9 18:00:25 2016 UTC. The chair is nirik. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:00:25 Useful Commands: #action #agreed #halp #info #idea #link #topic. 18:00:25 The meeting name has been set to 'infrastructure_(2016-06-09)' 18:00:25 #meetingname infrastructure 18:00:25 The meeting name has been set to 'infrastructure' 18:00:25 #topic aloha 18:00:25 #chair smooge relrod nirik abadger1999 lmacken dgilmore threebean pingou puiterwijk pbrobinson 18:00:25 Current chairs: abadger1999 dgilmore lmacken nirik pbrobinson pingou puiterwijk relrod smooge threebean 18:00:26 #topic New folks introductions / Apprentice feedback 18:00:30 morning everyone. 18:00:37 .fas linuxmodder 18:00:37 linuxmodder: linuxmodder 'Corey W Sheldon' 18:00:52 good morning 18:01:07 * lousab is here 18:01:11 * skrzepto is here 18:01:11 hi all 18:01:18 hello :) 18:01:22 .fas athoscribeiro 18:01:22 athos: ribeiro 'Athos Ribeiro' 18:01:32 packing the seats ...good to see 18:01:34 .hello jflory7 18:01:37 jflory7: jflory7 'Justin W. Flory' 18:01:55 any new folks around today that would like to give a short one-line introduction? 18:02:01 ! 18:02:22 athos: feel free to chime in anytime. 18:02:31 sure: 18:02:48 tammy when she gets here too nirik 18:03:30 Hello everyone 18:03:37 My name is Athos, I'm a brazilian software engineer and CS graduate student. I am getting more involved with the project and would like to join the team :) 18:03:47 morning tammy_. Care to give a short introduction of yourself? 18:03:54 athos: welcome. 18:03:57 Hi athos, welcome :) 18:04:36 athos, what is your fasid? 18:04:41 Just became an embassador for LATAM and my 1st package is under review :). I also tried sending PRs for fedora-review and copr once or twice 18:04:42 tammy_, same to you 18:04:45 ribeiro 18:04:51 linuxmodder: ^ 18:05:10 athos: great. Are you more interested in application development type tasks then? 18:06:20 nirik: I am interested both in app development and in infrastructure maintainance... I am currently learning how ansible works and have some experience with chef 18:06:37 Sure @nirik I am Tammy and I work as a helpdesk/junior system administrator I just started the junior sys administration role about six months ago and want to gain more experience in doing so 18:06:54 athos: cool. See me after the meeting in #fedora-admin and I can get you setup in the apprentice group... 18:06:59 nice ..welcome tammy_ what is your fasid 18:07:07 thanks! :) 18:07:21 My fasid is tammyb5 18:07:42 Hi, welcome tammy_! 18:07:51 tammy_: great! Sorry that many of us have been busy this week... I've seen you asking for assistance, but always at times I am busy or not around. :( But we will get you setup... never fear. 18:07:54 I also signed up for the apprentice group 18:08:05 and approved for it :) 18:08:17 No worries totally understand 18:08:36 it's been spam fighting this last few weeks. ;( Pesky spammers 18:08:40 tammy_, on that note do oyu have a ssh key in fas setup yet (noticced no gpg keys mentioned in fas) 18:08:42 ok, any other new folks? 18:09:04 seemed like no other new nicks to me 18:09:25 Wow 18:09:27 ok, on to info and announcements... 18:09:35 #topic announcements and information 18:09:35 #info We are still in Fedora 24 Final freeze - everyone 18:09:35 #info spam attacks ongoing. Many thanks to Patrick for cleaning them up via basset 18:09:35 #info spam attackers have opened over 10,000 accounts which have been cleaned by basset 18:09:35 #info Added ru lang to ask.fedoraproject.org - kevin 18:09:36 #info faf and retrace services added in stg via proxy01.stg - kevin 18:09:38 #info Notification bounces now going to /dev/null - kevin 18:09:42 #info alt.stg.fedoraproject.org setup for websites - kevin 18:09:43 tammy_, worst case find me after meeting we can fix that pesky batcaveo01 issue 18:09:54 anything else anyone would like to note or discuss from those? 18:10:04 tammy_: also happy to help in #fedora-admin after the meeting. 18:10:52 when is alt goign strictly webisites ? 18:11:12 alt.fp.o that is not alt.stg 18:11:16 should be at release day... 18:11:18 nirik: is the ongoing spamming long ongoing? Typical? 18:11:28 which is not next week sadly (we slipped a week) 18:11:29 planned or actual GA was a n/g 18:11:38 .hello sayanchowdhury 18:11:39 sayan: sayanchowdhury 'Sayan Chowdhury' 18:11:45 munjeli: started a few months ago... hasn't really let up much since then. ;( 18:12:10 it's really pretty sad. People doing that for a living. ;( 18:12:30 Ok 18:12:59 brightside its helping us tighten up fas3 18:13:10 we can't really lock things down too much or it would affect legit new contributors. ;( So, we have to mark and clean up... 18:13:18 yep. :) 18:13:27 yah, it's a difficult problem. 18:13:28 Hopefully it will relent after a while. I wonder if it will fade off after the GA, if that's the reason for targeting. 18:13:32 * jflory7 shrugs 18:13:44 puiterwijk, you around later have a few ideas for basset 18:13:56 jflory7: I don't think it's anything really other than we are somewhat open so they can spew their spam and hope search engines will pick it up. 18:14:06 True. 18:14:08 they are also hitting bugzilla some. 18:14:10 * pingou late 18:14:15 pingou: o/ 18:14:16 jflory7, doubtful the attention is not seemingly GA centric from what I've seen 18:14:18 linuxmodder: you can also file tickets. But let me know if you have ideas 18:14:18 and I heard they are hitting kernel.org bugzilla too now. ;( 18:14:41 anyhow. 18:14:49 and mozilla is getting traction from them too 18:15:04 I didn't see any discussion items on the gobby. Did anyone have any? or shall we move on to apprentice open office hours... 18:15:13 Again: if people know people in those communities under attack, feel free to send them my way 18:15:25 patricku, noted 18:15:54 I'd be glad to help more people with setting up Basset or any other cross distro anti spam project 18:16:08 sure. :) 18:16:30 #topic Apprentice office hours 18:16:59 lousab and I are looking at the infrastructure mapping ticket and have questions 18:17:00 any apprentices have questions or issues? or need things to work on ? perhaps we should hit the easyfix tickets and see if there's some that could use new folks working on them 18:17:09 excellent. :) ask away. 18:17:10 munjeli, shoot 18:17:49 I would like to make a map that exposes useful information interactively, does this mean service dependencies, networking? 18:17:56 What is useful to the team? 18:17:58 my connection is getting unstable fyi advance apoligies if i d/c 18:18:19 munjeli: well, IMHO I would start with something pretty basic at first. you can always add to it after. 18:18:20 hi, i start few weeks ago and i need some guidance about what have to do 18:18:22 munjeli, useful information being what in your workflow 18:18:49 ie, just datacenters, what machines are in each... 18:18:52 chakal, you looked at and done stuff on the Join page yet? 18:18:55 welcome btw 18:19:10 yes 18:19:29 linuxmodder: I did this last time as an html page with d3 that showed routes, acls, and showed error conditions like black holes on AWS 18:19:29 chakal: take a look at https://fedoraproject.org/easyfix/ and the fedora-infrastructure section... 18:19:35 nirik: what do you think if we start mapping machines using the code of https://apps.fedoraproject.org/ 18:19:35 i have logged on ssh server and already installed ansible 18:19:38 munjeli, I am busy next week but email still works too if you need a hand ( I was the one who originally handed that off to you) 18:19:38 see if any of those tickets look like something interesting to work on 18:20:04 yes y have fas accound and registered on infrastructure list 18:20:44 lousab: you mean make the map use that same interface? 18:20:49 yes 18:20:53 chakal, ssh key setup and / or easyfix tickets look good for you ? 18:21:01 thats not a bad thought... :) 18:21:26 might get a littel busy but I like the idea 18:21:32 it's simple, (json) and might work nicely for a map 18:21:41 Are there other things am apprentice can do 18:22:08 tammy_, what you have in mind? 18:22:09 Yes, I don't like the layout of the graphing there - I used a sankey diagram last time to show flow, but the graph is not authentic to most infrastructure diagramming. 18:22:15 there is plenty 18:22:25 nirik: exactly and it should be quite simple to start from there 18:22:34 sankey diagram? 18:23:03 munjeli: what if we change a little bit the graphic? 18:23:23 Yes, a sankey diagram is a dataviz that describes flow. But it was also too busy. I think authentically, we use things closer to circuit diagrams to map datacenters 18:23:28 tammy_: well, the main thing is easyfix tickets (proposing solutions/patches), but also if you can hang out in irc or on the list there will often be discussions about apps or things and you can chime in that you would like to help out with those. Also we always need docs cleanup/help, and there's a few things listed on the main apprentice page as "quests" that anyone can work on. 18:23:58 https://fedoraproject.org/wiki/Infrastructure_Apprentice#Longer_term_quests 18:24:04 linuxmodder, I dont know what i have to do on easeyfix 18:24:06 updating CSI variables and docs work 18:24:06 lousab: sure, a good first pass would be a graph diagram 18:24:47 munjeli, seen the infra_hosts file on batcave01? 18:24:51 chakal: it depends on the ticket. Usually its something you can provide a patch for against the ansible repo... 18:24:52 linuxmodder: where is the best place to understand network and service dependencies? the data? 18:25:03 Yah, I have the list of hosts.. 18:25:18 munjeli: nagios has some of that, and ansible has host/vhost dependencies and datacenter info 18:25:25 service dependencies ? as in what each needs or is used for? 18:25:30 Yup, nagios is what I want. 18:25:53 nagios01.phx2 18:26:00 Yeah, understanding what will fail and how. spoffiness, etc 18:26:01 should help ^ 18:26:36 https://admin.fedoraproject.org/nagios/ 18:26:39 What ports are open, how the infrastructure is scoped (private and public subnets) 18:26:42 and https://admin.fedoraproject.org/nagios-external 18:26:56 munjeli, take read at infrastructure.fedoraproject.org/infra/docs for the SOPs on those 18:26:58 anyone should be able to login there. ;) 18:27:29 Even if we build for just seeing the basics, we should be open to extending for monitoring interactively, sec team loves stuff like this. 18:27:38 BTW, nagios also has a map, but not all hosts are in nagios... and the map is... not so great 18:27:44 Gtk 18:27:49 munjeli, indeed we sec folks do :) 18:28:08 well let's start :) 18:28:09 :) 18:28:17 nirik, does that nagios map have a undate script like ambassador map? 18:28:36 where is information on how to repo and code review? 18:28:37 it generates it live from the data it has 18:29:16 looks like something out of the matrix :) 18:29:27 munjeli, repo what ? 18:29:37 the nagios and ansible stuff? 18:29:40 munjeli: well, if this is goign to be like apps, you can look at the ansible roles/apps 18:29:41 The code for this map.. 18:29:52 where should we put it? 18:30:03 batcave01 ? 18:30:17 or somewhere on stg 18:30:18 but where do you git? is github? 18:30:25 I'd say a patch against ansible in the ticket... call it roles/netmap or something? 18:30:33 munjeli, some things you could 18:30:38 I will work on the docs and questions 18:30:40 but we have pagure :) 18:30:44 munjeli: ssh to batcave01, git clone ansible 18:30:50 sweet. 18:31:03 nirik, you know off hand if any SOPs need love like the guides did? 18:31:18 ansible repo is public, but the base location for it is batcave. It's not on pagure or github or anything. 18:31:28 linuxmodder: I am sure they do. 18:31:32 tammy_: sounds good. 18:31:35 munjeli, ssh to MOST if not all hosts drops you in /home/fedora/ 18:32:04 nirik, any reason we couldn't throw the public bits for ansible on pagure? 18:32:05 How does Nagios work interested in that as well 18:32:11 nirik: gtk. 18:32:26 tammy_, its a monitorign appliance kind of like a lookout 18:32:50 I'm pretty committed to an agnostic interface as I want this tooling for my own job and my open source project. 18:32:56 iirc its what status.fedoraproject.org is polled from 18:33:04 OK 18:33:12 linuxmodder: yes, we need to not depend on a remote repo. So, until we have things setup so we can merge changes from both pagure and batcave into the batcave repo, we cannot have it at pagure. 18:33:24 munjeli, pagure is agnostic you can do your own local instance even 18:33:40 status is actually manually updated. 18:33:57 that is still an issue ah didn't realie the sync thing was still issue 18:34:02 there is a pending easyfix ticket to add a host to nagios if anyone wants to take that on. :) 18:34:18 might look at that 18:34:39 well, if our ansible repo was on pagure, and pagure was down, we could redeploy it with ansible... execept we couldn't because there would be no ansible repo to use. ;) chicken and egg. 18:34:47 nirik: i could start from there also 18:35:00 wich number 18:35:06 nirik: there is a RFE to allow mirroring in pagure :) 18:35:21 something which is slowly getting higher in my list :) 18:35:22 pingou: i know. ;) That will be nice when it arrives. 18:35:28 lousab: let me look... 18:35:30 fingers crossed :) 18:35:52 https://fedorahosted.org/fedora-infrastructure/ticket/5337 18:36:03 pingou, that needs a secure db return tho no? 18:36:04 ok 18:36:12 for the rsync'ing part 18:36:26 linuxmodder: I don't follow you, what do you mean? 18:36:30 pingou: once we have that it would be nice to move to a PR model for a lot of the infra stuff too... although not in all cases. 18:36:46 nirik: def 18:36:52 pingou, somewhere or some host that the backend trusts coming back thru bastion 18:37:03 would be nice for freezes and for new folks to submit things. 18:37:10 ^^ 18:37:22 linuxmodder: it would be using ssh just like everyone 18:37:35 pagure will provide you with a public ssh key to put on the receiving side 18:37:36 pingou, ok 18:37:38 and a git hook 18:37:40 et voila :) 18:37:51 chakal: did you see anything in this discussion you wanted to work on? did you look at the easyfix tickets? 18:38:06 se3parate ssh key then the one on pagure already to git clone git@pagure? 18:38:20 chakal: or perhaps docs and CSI changes would be a good way to start? 18:38:22 pingou, ^ 18:39:12 linuxmodder: I don't think the system ssh keys can be used to ssh into anything, am I wrong? 18:39:29 /5/5 18:39:37 pingou, the one you setup for pagure for git over ssh can't be used? 18:39:43 if so why not ? 18:40:24 linuxmodder: pagure knows your public key, how could it push to something w/ a public key? 18:40:31 nirik, i am a litle beat lost 18:40:34 and no pagure does not want to know your private key 18:41:21 no I was thinking setting it pagure pubkey + fas pass or something 18:41:32 using a OAUTH style ssh auth 18:41:44 chakal: BTW, I am kevin... you just emailed me. ;) So, perhaps best would be working on docs/CSI variables? 18:41:50 take a look at: https://fedoraproject.org/wiki/Infrastructure_Apprentice#Longer_term_quests 18:42:06 nirik, ok for me perfect 18:42:09 linuxmodder: I don't think pagure wants to do anything w/ your fas password 18:42:28 well then maybe I'm thinking something weird 18:42:37 and I don't see how this would work to mirror projects outside Fedora (for example on github) 18:42:43 how does it handle git clone git@pagure.io atm then 18:42:48 chakal: Cool. There's usually someone around in #fedora-admin that can answer questions too, so ask if you get stuck or need more info... 18:42:56 and couldn't we do same or similar for the mirroring 18:43:05 linuxmodder: it has your public key, the rest is ssh/gitolite 18:43:36 right but couldn't the mirroring over ssh be done like the tunneling thru bastion is 18:44:07 I'm not sure how that would work 18:44:11 auth to pagure and then to the external repo and vice versa on retrun 18:44:31 I think CSI variables would be a good introduction point for me as well :) if that's ok 18:44:34 use pagure similar to how bastion is for (only with mirroring) 18:44:36 linuxmodder: tunneling through bastion is done on your side, there is nothing to do on bastion itself 18:44:52 anyhow, we could close out now, or if folks would like I could pontificate about some application or setup in infrastructure... I think I was going to talk about mailman3 a few weeks back. Does anyone have interest in that? 18:44:53 that i get 18:44:56 so if that were to work, it wouldn't be something to be done in pagure 18:45:10 athos: great. We do have a lot of hosts to update still I am pretty sure. 18:45:15 ! i do 18:45:53 mm3 has been kicking my ass lately :( 18:46:01 athos / tammy_ / chakal: also, if you see any problems or improvements to the CSI doc that apprentice page points to, that would be great to submit as well. ;) 18:46:36 #topic Learn about - mailman3 18:46:44 ack 18:46:45 ok, I will talk just a bit about mailman3. 18:46:50 i.e broken links or outdated info ( login with fas creds on most wiki pages to edit them( 18:47:31 abompard is our mailman3 guru. He wrote large parts of hyperkitty (the archiver) and works upstream on the admin and core bits as well. :) Hopefully if I say something incorrect he will correct me. 18:48:05 We are now 100% on mailman3 for our lists. All of them run on mailman01.phx2.fedoraproject.org internally. Thats both fedoraproject.org lists and fedorahosted.org lists. 18:48:41 so mailman02 and 03 are decom'd? 18:48:48 mailman3 has a number of parts that fit together. There's a core list handler setup, hyperkitty (the archiver and web poster) and postorius (the admin interface) 18:49:17 we do have a mailman02, but it's not doing anything. It's not easy/possible to load balance mailman3. 18:49:37 emails come in via our smtp-mm hosts (we have 3 of them spread around the world) 18:50:04 from there they go to mailman01. If mailman01 is down, the smtp-mm hosts just queue the incoming emails until they can be processed. 18:50:34 is that what was happening a few weeks back when things were delaye liek crap 18:50:37 the web part of things goes via our proxy network into mailman01. 18:51:35 Great nirik will do 18:51:40 Not sure which thing you mean, but that was likely due to someone on the perl sig changing acls on all their packages, which generated an email for each branch of each package and each acl and was going to the scm-commits list. 18:51:58 That generated a pretty vast backlog of emails and notifications. 18:52:11 likely 18:52:15 which has pretty much nothing to do with mailman :) 18:52:52 yeah. but hopefully that will be fixed in FMN soon. ;) 18:53:13 anyhow, lets see. mailman3 allows you to login via persona, fedora openid or yahoo currently. 18:53:13 * pingou ducks 18:53:41 ho0w many yahoo id folsk do we still have? 18:53:44 if you login via fedora openid, you are username@fedoraproject.org... which may not be the address you subscribe to lists with 18:53:56 seems so '90s to me 18:54:04 but you can add additional emails and manage them from your fedoraproject.org account once you login 18:54:08 I have yahoo 18:54:21 no idea. abompard kept it because yahoo supports openid. ;) 18:54:23 linuxmodder: people using yahoo are probably grateful to your kind words 18:54:47 persona is also going away toward the end of the year... 18:55:41 ok, thats a high level overview. Anyone have any more specific questions on mailman3 (if they are too specific, may defer to abompard :) 18:56:16 mozilla is still supporting openid so why is persona going away? 18:56:17 nirik: any idea how easy/hard it is to add new domains? 18:56:29 nirik: is there a client running on the host that sends stuff out by email? 18:56:30 linuxmodder: lack of resources 18:56:30 linuxmodder: mozilla is dropping persona. 18:56:39 linuxmodder: because persona is totally unrelated to openid. 18:56:41 pingou: I think it's pretty easy. 18:56:53 nvm was thinking oneandedone.mozilla which is openid 18:56:54 munjeli: yeah, thats part of core mailman3. 18:57:01 nirik: cool, at one point we may want to see if we want @lists.pagure.io lists or so :) 18:57:28 pingou: +1 18:57:41 or jsut hooks for existing lists ? 18:59:08 pingou: or... we could setup a new server with that near pagure and tie them more closely... ie, allow it to add/remove them, perhaps some kind of patchwork thing to watch for PRs on list? 18:59:14 but thats all down the road. ;) 18:59:18 #topic Open Floor 18:59:43 anyone have any items for open floor? anything we didn't cover? questions, comments, favorate kind of rice? 18:59:56 yeah, down the road :) 19:00:19 down the road? 19:00:24 Nothing from me! 19:00:31 nirik++ 19:00:45 Thanks for chairing. 19:01:00 linuxmodder: something to be determined later after other things are done. 19:01:41 ok. Thanks for coming everyone. Do continue in #fedora-admin, #fedora-apps and #fedora-noc. ;) 19:01:44 #endmeeting