- Arch-devops - lists.archlinux.org

[arch-devops] HTTP/2 on Luna
by Pierre Schmitz 16 May '16

16 May '16

Hi all, I'd like to enable h2 on luna. Are there any objections? I have done this on my server already and it's pretty straight forward. We might need to adjust the ssl_ciphers configuration. ATM I use: ssl_prefer_server_ciphers on; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; Greetings, Pierre -- Pierre Schmitz, https://pierre-schmitz.com

3 3

[arch-devops] #archlinux-devops public now
by Florian Pritz 13 May '16

13 May '16

Hi, Just a quick note that our #archlinux-devops channel is now also public. It has been invite only previously, but since we aim to keep as much as possible of everything we do public we have decided that there is no need to keep the IRC channel private. Feel free to join if you are interested in how we run our infrastructure. PS: Any decisions or results of discussions will still be posted on this mailing list for archival reasons. Florian

1 0

[arch-devops] Changing the monitoring for new servers
by Sven-Hendrik Haase 12 May '16

12 May '16

As you probably have read, we're getting a new bunch of servers quite soon. I want to change our monitoring solution on those new servers as we are currently using munin but it has static graphs only and no notifications built-in. I think notifications would be helpful to have so that we're the first ones to know when a service is down or a server runs out of memory/storage. The alternatives that were mentioned are these: 1) munin for graphs, timed ansible for notifications 2) influxdb for storage, collectd for stats collection, graphite for graphs, timed ansible for notifications 3) zabbix (does everything) 4) cacti (does everything with plugins) 5) prometheus (does everything) My thoughts: 1) Basically the same of what we have now. Static daily/weekly/monthly/graphs only. On top of that, we'd use a systemd-timer unit for ansible I suppose. Munin generally is fairly easy to maintain and set up. 2) Four different programs to but each taking care of a certain task. I'm not sure this counts as complex or KISS. But really I have no idea about this stack as I have not worked with any element in it. 3) No idea about this one but it from a glance it looked rather complex and kind of icky to use. 4) I used this one once. It's a heavyduty PHP-based monitoring software that I probably wouldn't recommend. It was a bitch to set up and use when I tried it some years back. It might have improved. 5) This is the newcomer. Seems to be doing everything we'd need but I haven't checked it out in detail yet. Configuration format seems fairly easy and graphs are pretty. Might be worthwhile. Would be interested in hearing your thoughts. If you have something to add, just add numbered bullet points. If nothing comes of this, we'll probably go back to munin. Sven

4 4

[arch-devops] Moving projects.archlinux.org to luna.archlinux.org
by Sébastien Luttringer 23 Apr '16

23 Apr '16

Hello, Florian suggested to move cgit and archweb to nymeria or luna. In this mail, I will only focus on cgit, better known as projects.archlinux.org. Currently: - the web interface is a cgit on gudrun. - http server is apache and run cgit via cgi-bin - cgit scan /srv/git for repositories - /srv/git is a NFS mountpoint from gerolde - so, the git repositories are on gerolde - users push to repos via ssh directly on gerolde. They will have to update their remotes url. - the total space of git repositories is about 730MiB Currently, my preference would be to move the storage and the web interface on the same host. I see more benefits than moving web interface on luna and git repo on nymeria. We don't eat the space twice and we have all the repo accessible under the projects.al.org dns. Nonetheless, if we move the storage to nymeria, we save the configuration of ssh access to all devs + externals to luna. Not sure if this is relevant if we move to accounts to ldap. Thoughts? Here is a short planning if we go through this option: 1) setup a new cgit on luna (with nginx and uwsgi) 2) copy repos for testing purpose 3) create gitshell access to users 4) plan official migration date 5) reduce dns ttl of projects.al.org 6) wait for it 7) cut write access to gerolde repo 8) final repo sync 9) update dns records and restore ttl 10) take a beer I see there is also dev.archlinux.org on gudrun that I could also move to luna too. Cheers, -- Sébastien "Seblu" Luttringer https://seblu.net | Twitter: @seblu42 GPG: 0x2072D77A

6 13

[arch-devops] nymeria: defect hard disk
by Florian Pritz 11 Apr '16

11 Apr '16

Hi, Just a quick note that nymeria has a defective hard disk. I'll look into getting it replaced so expect some downtime (possibly without prior notice). Florian

1 2

[arch-devops] Accidentally broke /srv/ftp on nymeria
by Florian Pritz 10 Mar '16

10 Mar '16

Hi, I've accidentally removed some files from /srv/ftp on nymeria by running a find -delete command with incorrectly ordered arguments. I'm currently restoring from our backups and mirrors though this might take a while because the transfer speed is really slow for reasons I don't know yet. I have also disabled rsyncd for now to prevent mirrors from deleting files as well. I currently don't expect any data loss, but let's see. Florian

3 4

Re: [arch-devops] [arch-dev-public] Integrity Check x86_64: core, extra, community, multilib 04-03-2016
by Bartłomiej Piotrowski 09 Mar '16

09 Mar '16

On 2016-03-04 16:39, repomaint(a)archlinux.org wrote: > Summary > --------- > Missing PKGBUILDs: 1 > Invalid PKGBUILDs: 1 > Mismatching PKGBUILD names: 0 > Duplicate PKGBUILDs: 0 > Invalid archs: 0 > Missing (make)dependencies: 20 > Repo hierarchy problems: 500 > Circular dependencies: 6 > In db, but not in tree: 4 > In tree, but not in db: 7 Where is this script located? I don't think we care about repo hierarchy problem related to makedependencies, I'd like to know what "invalid" PKGBUILD means. I really doubt anyone pays attention to these e-mails since Andrea left, so decluttering the message would be a good first step to change this. Bartłomiej

3 3

[arch-devops] Upgrade SSL CAs to SHA-2
by Sébastien Luttringer 29 Feb '16

29 Feb '16

Hello, I upgraded the luna intermediate CA and RootCA to the new StartSSL certs with SHA-2 signatures. The *.archlinux.org certs is still using SHA-1 signature (so no green bar) which expire this April. Should we move to Letsencrypt or do we still want to use the star certificate? Cheers, -- Sébastien "Seblu" Luttringer https://seblu.net | Twitter: @seblu42 GPG: 0x2072D77A

2 1

[arch-devops] [RFC] Planning testing of the new dbscripts
by Florian Pritz 24 Feb '16

24 Feb '16

Hi, CC'in arch-dev-public just so everyone gets a heads-up. Please send all discussion to arch-devops. A long long time ago in a galaxy far, far away.... No wait, just a long long time ago. Work on improving dbscripts[1] has resumed and thanks to Gabriel Souza Franco we finally have something[2] that should easily support git packages as well as debug packages, split packages across multiple repos and with different arches. It has lots of new tests, but it could really use a field test and we need to figure out how we want to deploy it once we are satisfied. Please note that the wiki page is not entirely up to date, especially everything other than the migration plan. [1] https://wiki.archlinux.org/index.php/User:Bluewind/dbscripts-rewrite [2] https://github.com/gbsf/dbscripts/commits/master The new dbscripts no longer change the svn repo so the repos subdir is not needed any more. All they require is some form of a tag (like a git tag) to fetch the PKGBUILD. This means we are pretty much free to use whatever we like (including git) as long as we can tag stuff. For the time being we can stick with svn if we like. Using tags obviously requires that the existing repositories are migrated and that devs/TUs use the new scripts that generate them. This migration is required for the new svn layout and if we switch to git. It is probably a good idea to do both at once so people don't have to update twice, but I'll only do that if we plan this thoroughly. Currently we treat also extra/core and community separately, but I think there is no real reason for that apart from that we migrated it like that from gerolde. If possible, I'd like to get rid of this distinction. RFC: As for testing, I'd like some input on my (rather preliminary) migration plan[3] and opinions on whether we want to test it directly on nymeria or somewhere else. [3] https://wiki.archlinux.org/index.php/User:Bluewind/dbscripts-rewrite#Migr= ation_Plan Florian

2 1

[arch-devops] Arch Linux ISO Checksums on archlinux.org
by Christian Rebischke 24 Feb '16

24 Feb '16

Hello, Linux Mint had a security breach [1] and was serving an infected ISO. I think this would be a good moment for thinking about our Arch Linux Download-page on [2]. I recommend to change the checksums. MD5 and SHA1 are both broken.[3][4] What do you think about using SHA256 ( or even better SHA512 ) for this? Maybe we should also sign the ISO with a GPG-Key. I don't mean that we should remove the MD5 checksum but we should add some other checksum and sign the ISO. You can call me paranoid but I don't want too see such a security fail on archlinux.org Best regards, Chris Arch Linux Security Team [1] http://arstechnica.com/security/2016/02/linux-mint-hit-by-malware-infection… [2] https://www.archlinux.org/download/ [3] http://www.mathstat.dal.ca/~selinger/md5collision/ [4] https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html

5 5