- Arch-devops - lists.archlinux.org

[arch-devops] GitLab 2FA Login Problems
by Томас 27 Mar '22

27 Mar '22

Hello, I'm looking for who I can contact for help with GitLab 2FA login problems. I set up my GitLab account today, literally a couple hours ago (username "70m4c"), but the file that held the 2FA info became corrupted. I am able to log into the SSO just fine, but cannot complete the final step to get into GitLab due to not being able to generate the appropriate 2FA codes. I also lost the 2FA recovery codes as they were in the same file. I did however upload my public keys to GitLab and can prove my identity that way. I can also access a resource from the same IP address that was used to set up the account if need be. I have access to my email and the original emails that were sent when I signed up as well. If anyone can help me reset the GitLab 2FA, I would appreciate that very much. Thank you.

2 1

[arch-devops] gluebuddy deployed
by Jelle van der Waa 20 Jan '22

20 Jan '22

Hi all, I've deployed gluebuddy.archlinux.org and it just successfully ran gluebuddy apply. So all Gitlab user permission settings are now applied from gluebuddy automated and predictable. If there are issues / wrong permissions please reach out to Levente or me. Happy crab! Jelle

1 0

[arch-devops] Meeting tomorrow 19:30 CET
by Jelle van der Waa 08 Dec '21

08 Dec '21

Hi all, I'd like to have another DevOps meeting with as topics: * Gitlab status / ToS * Mailman 3 progress * CDN status * Gluebuddy * DBScripts debug packages deployment More information is available in the pad [1] [1] https://md.archlinux.org/2H6y_4lFTOyOmw61VrEMnA

1 1

[arch-devops] Gluebuddy progress
by Jelle van der Waa 03 Dec '21

03 Dec '21

Hi all, Yesterday anthraxx and I hacked together on getting gluebuddy ready for production. Gluebuddy is a tool to automatically put Arch Linux Staff in the correct Gitlab organization/teams and can later be expanded to enforce more repository settings. The open pull request was updated to not remove our archceo Arch Linux group owner and handles our three devops onboarding/offboarding tasks of adding users to the Staff team, Infrastructure Team and Arch Linux group. [1] There are a few open questions: We match on extern_id which is the username in Gitlab and not the keycloak id, is that correct and is that an issue? For keycloak access we now use the admin account, we should rather use an openid client which has “realm-management roles” such as “query-groups, query-users, view-users” The gitlab personal token used for changing For deploying it to a live server we need: Setup a new VPS for running gluebuddy Create a systemd/service with timer so gluebuddy runs every X minutes Find a way to distribute gluebuddy, an option is to use Gitlab release where we upload a signed locally build gluebuddy (retrieve and veriy this in the ansible role). As packaging doesn’t make much sense here. Create an ansible role for gluebuddy [1] https://gitlab.archlinux.org/archlinux/gluebuddy/-/merge_requests/2 Greetings, Jelle van der Waa

1 0

[arch-devops] Wanting to give access to kevr to aur-dev
by Sven-Hendrik Haase 20 Nov '21

20 Nov '21

Hello, as some of you might know, kevr has been hard at work rewriting the AUR in Python and FastAPI. He now wants to deploy this and has been asking for infra access to the aur-dev test server. We evaluated different ways of giving him partial access that involves just mysql and logs access but as it turns out, loki and grafana make this very annoying and burdensome right now, requiring us to host a second loki and grafana just for this. As such, I suggest the practical solution of giving him a user on aur-dev in order for us to move on with this. He wouldn't have access to the real production AUR, just the test box. What this effectively entails is me giving him a user in the docker group which should give him all the access he might need. Any objections to this? Cheers, Sven

3 3

[arch-devops] Artifact signing
by Kristian Klausen 14 Nov '21

14 Nov '21

Hi all, shibumi has been writing a few blog posts[1][2][3] on `cosign` recentely and its "Keyless Signatures"[4] feature. This motivated me to look into it for artifact signing from our CI[5], in particular for arch-boxes (our VM images). After discussing it on IRC (-devops), I'm sending this mail to get some inputs. I have opened a MR with a few solutions sketched[6] (with great help from @shibumi). [1] https://shibumi.dev/posts/first-look-into-cosign/ [2] https://shibumi.dev/posts/what-are-ephemeral-certificates/ [3] https://shibumi.dev/posts/keyless-signatures-with-github-actions/ [4] https://github.com/sigstore/cosign/blob/main/KEYLESS.md [5] https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/280 [6] https://gitlab.archlinux.org/archlinux/infrastructure/-/merge_requests/508 Best regards, Kristian Klausen

1 0

[arch-devops] Alertmanger alerts now shown in Grafana
by Jelle van der Waa 16 Oct '21

16 Oct '21

Hi All, With the new Grafana, it now integrates alertmanager alerts, so they can be viewed and can be silenced as well. You can see them in Grafana here. [1] [1] https://monitoring.archlinux.org/alerting/list Greetings, Jelle van der Waa

1 0

[arch-devops] Arch DevOps Meeting Tomorrow
by Jelle van der Waa 06 Oct '21

06 Oct '21

Hi All, Tomorrow is another DevOps meeting, topics include * AUR deployment Greetings, Jelle van der Waa

1 0

[arch-devops] forum@archlinux.org moved to GitLab Service Desk
by Kristian Klausen 24 Sep '21

24 Sep '21

Hi all (cc'ing arch-devops for traceability) Per fukawi2 request[1], forum(a)archlinux.org is now redirected to a GitLab Service Desk[2]. [1] https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/394 [2] https://gitlab.archlinux.org/archlinux/service-desks/forum Best regards Kristian Klausen

1 0

[arch-devops] DevOps meeting Thursday 2021-08-26 19:30 CEST
by Jelle van der Waa 31 Aug '21

31 Aug '21

Hi All, This Thursday is another DevOps meetings, the only topic so far is opening up our Gitlab. Greetings, Jelle van der Waa

1 2