- Arch-devops - lists.archlinux.org

[arch-devops] Curious about Arch repository policy
by Sudarshan Kakoty 27 Mar '18

27 Mar '18

Hello; I was reading "Arch Wiki" and felt curious about that difference between extra and community repo. Some packages, such as "meson" is in the "extra" repo, whereas "ninja" is in "community" repo. The interesting fact is that - "ninja" is an implicit dependency to "meson". So why that is (ninja) in the community repo? Also, some critical GNOME specific packages are part of the community repo. Even, some compilers, like Haskell is also part of the community repo. What is the exact difference between extra and community repository? I wonder, Is it really important to have that split?

2 1

[arch-devops] Host-based Firewalls (Task #61)
by Phillip Smith 08 Mar '18

08 Mar '18

Hi all, I've spent a couple of hours looking in to task #61 ("Set up firewall"). It should be pretty straight-forward. I've reviewed each of the Hetzner hosts for the ports they are listening on vs what should be publicly accessible. I have a diff against the current ansible roles if someone would like to review and give me their thoughts? Cheers, ~p

2 5

[arch-devops] LDAP role
by Giancarlo Razzolini 06 Mar '18

06 Mar '18

Hi Guys, Now that the wiki was migrated, I'm starting to work on the LDAP role. But, since this will certainly be a complex role and it will involve a lot of other roles/applications, I want to discuss with you some of the approaches we can take. First of all, we need to choose on the Directory Service application that we are going to use: 1) OpenLDAP [0]: It's the established open source directory server and the basis for many others. We have it on [core]. It does support having more than one server, either in master-slave or multi-master (I'll talk more about topology below). Pros: Being the "de facto" implementation and well know. It's relatively easy to setup and has multiple options for topology. Cons: It doesn't have any GUI tool for management and needs external projects (like phpldapadmin) to do so. Adding users sometimes requires messing with LDIF's and others. 2) 389-ds (formerly fedora ds) [1]: It's the second contender here. I have personally used it extensively in the past, so I might be biased towards it. It does not have an official package, but there is one on the AUR [2]. Pros: It is very easy to setup and comes up the console tool for management which is a java GUI. Also has a great multi-master replication support. Cons: We don't package it currently and it's somewhat more intensive on resource usage than OpenLDAP. 3) FreeIPA [3]: It is basically a bundle of a lot of software that is complimentary to a DS but not always required, like DNS, NTP server, Kerberos and PKI. It's DS part is provided by 389-ds. Pros: Easier to setup than OpenLDAP, has a nice web management tool and comes with a lot of pre-configured stuff. Cons: It is complex and has a lot of stuff that's not required for our use case. Also does not have an official package, and doesn't have a server package on the AUR either. 4) Samba 4 [4]: Since Samba 4, you can create one DS quite easily, there's even a wizard for it. It uses OpenLDAP, bind and some other bundled stuff behind the scenes, just like FreeIPA does. Pros: It is quite easy to setup and we have it packaged. Cons: It is more meant for AD integration and I think we can assume there won't be any possibility of that happening in the near future. There are some other options, but they are either outdated or do not provide everything we need. Having discussed DS software options, I want to discuss regarding the topology. The idea is to eventually bring all the applications and systems authenticating to this DS. In order for us to do that, more than one will be required to handle the load. We have the master-slave relationship or the multi-master one. There are arguments pro and con to both, but I like the description that the OpenLDAP documentation gives [5]. I would say for us to set a master and each machine having its own slave server running. TLS should be used everywhere, but I don't think we need to set TLS client authentication, at least, not for now (see below). We have to define if we are going to use the plain internet for this or some private network. I'm bringing this up right now, because we need to decide if we are going to allow anonymous connections to the DS (I'm against it) to query for users or not. Basically if we are going to allow anyone to query it or not. If not, then we need to use SASL or other mechanism for authenticating the clients, which compounds on the complexity. There's also the possibility of limiting the fields that anonymous clients can query, as well as the number of queries/responses. This would be similar to the AUR TOS case, but for everything, so it should be discussed upfront. I'm eager to hear your replies and whatever we decide here we should bring to adp for further enhancements. I don't want to turn this into a bikeshed discussion, though. So, keep your ideas within the limits of what was presented. Regards, Giancarlo Razzolini [0] https://www.openldap.org/ [1] http://directory.fedoraproject.org/ [2] https://aur.archlinux.org/packages/389-ds-base/ [3] https://www.freeipa.org/page/Main_Page [4] https://www.samba.org/ [5] http://www.openldap.org/doc/admin24/replication.html#N-Way%20Multi-Master%2…

4 6

[arch-devops] Arch Linux Wiki move
by Giancarlo Razzolini 05 Mar '18

05 Mar '18

Hi All, I am about to move the wiki to apollo. I'm estimating that it will be down for one to two hours. Please, let me know if any of you notice something not working on it. I have tested the role extensively, but you never know. Regards, Giancarlo Razzolini

4 3

[arch-devops] Archweb staging env
by Jelle van der Waa 14 Feb '18

14 Feb '18

Hi all, I've just finished setting up a basic Archweb staging env on nymeria which now runs the upgrade_djano branch (django 1.11.x). [1] It's still missing reporead/mirror related services, and grazz wants to rename the domain to www-dev.archlinux.org, but it's a start. The playbook for nymeria is not in master yet, but in wip/archweb-staging. As it can't be merged without some changes, since it skips one step which is obsolete in the new django version. [2] [1] https://archweb-dev.archlinux.org/ [2] https://git.archlinux.org/infrastructure.git/log/?h=wip/archweb-staging -- Jelle van der Waa

1 0

[arch-devops] New devops member - Phillip Smith (fukawi2)
by Florian Pritz 01 Feb '18

01 Feb '18

Hi, We have a new member joining the sysadmin/devops team by recommendation of Allan. I've already rolled out root and git access. Welcome Phillip, let's break stuff! (slightly) ;) Florian

4 6

[arch-devops] Secondary backup ideas
by Florian Pritz 12 Jan '18

12 Jan '18

Hi, Bartłomiej pointed out that we somehow stopped using the mailing list for discussion so here we go. Currently we only create backups on vostok using borg. A possibly quite big problem with this is that if an attacker gains access to a server, they also have sufficient access to remove all backups of that server. We could restrict that in borg, but then borg wouldn't be able to clean up old backups regularly and our repos would grow forever. A better solution is to create backups of the backups in a way that the front end servers can not delete any of these secondary backups. Possible solutions include: - Creation of a second layer of backups (backups of the backups) on vostok. This roughly doubles our space requirement and we are currently at 44% usage so this won't work well/for long. Unless we can use file system level snapshots or similar for this to reduce the required space, it's out. - Put the secondary backups on a different, possibly new, machine using borg. The backup would be created on vostok from the existing backup data. - Put them on AWS glacier. Roughly 4€/month and TB; suggested by Tyler from Arch Linux 32 Using glacier would require that we export tarballs (supported by borg) and then upload them. However, since the backups are encrypted and vostok is not supposed to be able to read them, the tarballs need to be created on and uploaded from the servers themselves. This may become a cpu/bandwidth/traffic concern if done often. Tyler is currently investigating this for Arch Linux 32's backups AFAIK. Does anyone have other ideas what we could do here to ensure that we have backups of the backups? The most important requirements are that no matter which server an attacker manages to get access to, they cannot read any user data from other servers and that they cannot remove all backups from that server alone. Florian

4 8

[arch-devops] Status of the Arch Twitter Account
by D E 09 Sep '17

09 Sep '17

Good morning, All! As per [the brief discussion on r/archlinux](https://www.reddit.com/r/archlinux/comments/6ykr93/is_the_arch…, could you please tell me the status of the Arch Twitter account? I don't know about anyone else, but I've grown fond of it over the past year. Regards, --A

2 1

[arch-devops] Migrating mail server on Sunday
by Florian Pritz 03 Sep '17

03 Sep '17

Hi, I will migrate our mail server from nymeria to orion on Sunday (tomorrow, September 3rd) starting around 12:00 UTC. The domains will stay the same, user names will stay the same expect for one user. The server may be unavailable for some time during the migration. User passwords are not migrated so you will have to set the password again on orion using `passwd`. If you have already set a password previously but forgot it, I can remove the password for you. Mailing lists will continue to work normally if the @lists.archlinux.org addresses are used. @archlinux.org addresses will work again after the move. If you have any questions or notice any problems, please contact me via mail or on IRC. Florian

1 1

[arch-devops] Caching problem with http://www.archlinux.org/check_network_status.txt
by Daniel Aleksandersen 21 Jul '17

21 Jul '17

Hi, Just wanted to report a Arch Linux infrastrucutre problem, and hope this was the right spot. The NetworkManager test probe page, located at http://www.archlinux.org /check_network_status.txt, should be made cache-aware. Currently, users are testing the connection to their web accelerator or intermediary proxy cache and not their internet connection as expected. Please add a `Cache-Control: max-age=0, must-revalidate` HTTP response header to this page to resolve this problem. I wrote a blog post earlier this week about the problem, but had some problem finding the appropriate place to report this to Arch. https://ctrl.blog/entry/network-connection-http-checks -- Daniel

3 2