2026-09-27T14:09:19 FYI: on man.i.o.o, systemd was eating 40% of the memory and lots of CPU (nearly 100% after a daemon-reexec). This made the system very laggy, and probably is also the reason for all the monitoring alerts 2026-09-27T14:09:50 I rebooted it (via /proc/sysrq-trigger, normal "reboot" timed out) which seems to have "fixed" the issues 2026-09-27T14:12:15 interesting / thanks 2026-09-27T14:12:33 the only strange thing I noticed are lots of failures for rsyncd@$IP.service (also after the reboot) 2026-09-27T14:13:01 example failure: https://paste.opensuse.org/pastes/14b345660098 2026-09-27T14:17:53 not so easy to map CVE changelog entries to commits, but I believe https://paste.opensuse.org/pastes/78053f1836f3 2026-09-27T14:19:48 if I understand correctly now it's mandatory to set "proxy protocol hosts" 2026-09-27T14:21:03 right, it's documented here: https://download.samba.org/pub/rsync/NEWS => behavior changes "proxy protocol = true with no proxy protocol hosts rejects all connections (fail-closed); the daemon now warns about this at startup." 2026-09-27T14:29:35 indeed, that explains it 2026-09-27T14:29:37 https://git.infra.opensuse.org/infra/salt/pulls/2838 (not tested) 2026-09-27T14:32:29 looks good, but I wonder if we also need to allow ...::10 2026-09-27T14:33:05 do you think we need it, or should I merge and we find out in practise? ;-) 2026-09-27T14:43:55 we have networking on haproxy servers configured to make outbound connections from the node/individual addresses, if you find any attempts from the VIP, it's a bug .. 2026-09-27T14:44:49 ok, then I'll merge as is, and deploy in a few minutes 2026-09-27T14:45:14 cool 2026-09-27T15:05:28 looks good, now new failures since the deployment :-) 2026-09-27T15:07:44 cboltz: I hope you mean "no new" instead of "now new" ? 2026-09-27T15:08:09 indeed, that was a w too much 2026-09-27T15:08:47 ;-)