March 2020 - Arch-devops - lists.archlinux.org

[arch-devops] cloud-images
by Christian Rebischke 02 May '20

02 May '20

Dear devops team, Recently I have pushed cloud-init back to [community][1], one Arch Linux user did some improvements on the cloud-init codebase as well and they are going to officially support arch linux with version 19.3[2]. Therefore I have added support for cloud-images to the arch-boxes project[3]. These images are qcow2 images and are expected to be installed in cloud-environments like Openstack. The only thing what is missing is a way to distribute the images and release them. My current plan has been that I build and sign them locally and then upload them to a web directory (This is the most secure way as possible right now). For this I need answers for a few questions: 1. Can I have a web-directory, where only I have access to? 2. Which key should I use to sign them? A new cloud-image signing key or my personal key? (I think latter should be enough). 3. I expect to build them monthly like the ISOs, how many images do you want to keep? My current assumption is that 1 year of image backup of cloud-images (qcow2) only would cost us around 30-50GB. 4. Do we want to mirror the images? Best greetings Chris [1] https://www.archlinux.org/packages/community/any/cloud-init/ [2] https://git.launchpad.net/cloud-init/commit/?id=5d5a32e039782ce3e1c0843082f… [3] https://github.com/archlinux/arch-boxes/commit/9d9f04f9618367e2af8d92bef2d5…

2 3

[arch-devops] Hetzner billing handover to SPI
by Levente Polyak 13 Apr '20

13 Apr '20

Hey folks, we have been discussing this in a small round and want to transition the hetzner billing directly to SPI. This requires them to access the account once to insert the billing data in the accounting page. All this will be done in a secure manner, however even through we have two-factor in place we may want to change the password afterwards. cheers, Levente

4 5

[arch-devops] Arch Devops meeting tommorow 20:30 UTC
by Jelle van der Waa 11 Mar '20

11 Mar '20

Hi All, Tommorow we have another DevOps meeting at 20:30 UTC or in your own timezone visit: https://time.is/compare/2030_12_Mar_2020_in_UTC The topics/updates to discuss are: * mailman 3 * aur-dev/aur * offsite backups -- Jelle van der Waa

1 1

[arch-devops] Offsite backups now in effect
by Sven-Hendrik Haase 11 Mar '20

11 Mar '20

Hey everyone, During my vacation, I found some time to tackle the offsite backups thing. So let me break it down: - We now have an offsite backup location provided by rsync.net and based in Switzerland. - Access the account data from the vault. - You all should have SSH access already via SSH keys (we have full authorized_keys file access) - All current machines were configured to use this offsite backup. - The offsite backup step runs as a separate backup right after the first one. - The offsite backups were tested and it appears to be working fine on all machines. - Payment-wise everything is managed by SPI directly (no reimbursements required) and I'm currently the rsync.net liaison and point of contact. This should be changed to a generic private mail that we can point to in order to mitigate the bus factor. - We should consider how to do 2FA with rsync.net in a DevOps meeting. - I had to do quite some Ansible gymnastics in order to configure the rsync.net machine as it doesn't have Python and is, in general, a pretty restricted environment so we have a new role next to borg-server called rsync_net. - During all of this I cleaned up a few things surrounding borg and I mostly/fully made it so that we can fairly easily add more different offsite locations. - Giancarlo reviewed my changes. Thanks! I might have forgotten somethings but this is pretty much the most important bit. Enjoy, Sven

1 0