2018-07-03T01:52:22  *** Son_Goku has joined #opensuse-admin
2018-07-03T03:24:38  *** ldevulder_ has joined #opensuse-admin
2018-07-03T03:27:30  *** ldevulder has quit IRC
2018-07-03T04:50:01  *** mcaj_nb has joined #opensuse-admin
2018-07-03T05:26:42  *** Son_Goku has quit IRC
2018-07-03T05:39:27  *** duncanmv has joined #opensuse-admin
2018-07-03T05:56:49  *** mcaj_nb has quit IRC
2018-07-03T05:58:09  *** mcaj_nb has joined #opensuse-admin
2018-07-03T06:03:45  *** lcp has quit IRC
2018-07-03T06:42:39  *** nicolasbock has joined #opensuse-admin
2018-07-03T06:57:07  *** ldevulder_ is now known as ldevulder
2018-07-03T06:57:12  *** enavarro has joined #opensuse-admin
2018-07-03T07:10:55  *** duncanmv has quit IRC
2018-07-03T07:54:23  *** mcaj has joined #opensuse-admin
2018-07-03T08:07:18  *** lcp has joined #opensuse-admin
2018-07-03T08:12:23  *** ancorgs has joined #opensuse-admin
2018-07-03T08:42:31  *** matthias_bgg has joined #opensuse-admin
2018-07-03T08:53:33  *** sven15 has joined #opensuse-admin
2018-07-03T09:01:46  *** asmorodskyi has joined #opensuse-admin
2018-07-03T09:39:17  *** matthias_bgg has quit IRC
2018-07-03T09:55:40  *** nicolasbock has quit IRC
2018-07-03T09:56:35  <heroes-bot> PROBLEM: PerfData on monitor.infra.opensuse.org - CRITICAL: Found files older than 2880 minutes /var/lib/pnp4nagios/perfdata//proc_Rsyslog_Process.xml was last modified on Thu Jun 21 09:42:54 2018 ; See https://monitor.opensuse.org/icinga/cgi-bin/extinfo.cgi?type=2&host=monitor.infra.opensuse.org&service=PerfData
2018-07-03T10:12:35  *** Son_Goku has joined #opensuse-admin
2018-07-03T10:52:17  *** enavarro has quit IRC
2018-07-03T11:14:24  *** enavarro has joined #opensuse-admin
2018-07-03T11:35:43  *** matthias_bgg has joined #opensuse-admin
2018-07-03T11:42:51  *** cboltz has joined #opensuse-admin
2018-07-03T11:42:52  *** cboltz has joined #opensuse-admin
2018-07-03T11:47:44  *** ancorgs has quit IRC
2018-07-03T11:48:47  *** ancorgs has joined #opensuse-admin
2018-07-03T11:55:05  *** enavarro has quit IRC
2018-07-03T11:57:21  *** enavarro has joined #opensuse-admin
2018-07-03T11:57:59  <enavarro> on ircfreenode: opensuse-buildservice and opensuse-admin
2018-07-03T12:33:54  <lcp> cboltz: what exactly is the point of user wiki pages with connect in place?
2018-07-03T12:34:48  <cboltz> connect will be shut down sooner or later (basically as soon as we have a replacement to manage membership)
2018-07-03T12:35:15  <cboltz> which also means that the wiki user pages will become more useful
2018-07-03T12:38:17  <lcp> Eh, alright
2018-07-03T13:00:12  *** duncanmv has joined #opensuse-admin
2018-07-03T13:03:16  *** Son_Goku has quit IRC
2018-07-03T13:15:43  *** Son_Goku has joined #opensuse-admin
2018-07-03T13:23:08  *** duncanmv has quit IRC
2018-07-03T14:16:42  *** Son_Goku has quit IRC
2018-07-03T14:24:39  *** lcp_ has joined #opensuse-admin
2018-07-03T14:24:57  *** lcp has quit IRC
2018-07-03T14:25:36  *** lcp has joined #opensuse-admin
2018-07-03T14:29:44  *** Son_Goku has joined #opensuse-admin
2018-07-03T14:33:51  *** lcp has quit IRC
2018-07-03T14:35:37  *** lcp has joined #opensuse-admin
2018-07-03T14:36:46  *** lcp has joined #opensuse-admin
2018-07-03T14:39:39  *** lcp has quit IRC
2018-07-03T14:40:01  *** lcp has joined #opensuse-admin
2018-07-03T14:51:51  *** Son_Goku has quit IRC
2018-07-03T15:10:49  *** duncanmv has joined #opensuse-admin
2018-07-03T15:16:33  *** Son_Goku has joined #opensuse-admin
2018-07-03T15:47:57  *** Son_Goku has quit IRC
2018-07-03T15:52:42  *** nicolasbock has joined #opensuse-admin
2018-07-03T15:57:47  *** duncanmv has quit IRC
2018-07-03T16:04:02  *** sven15 has quit IRC
2018-07-03T16:04:48  *** Son_Goku has joined #opensuse-admin
2018-07-03T16:20:42  *** matthias_bgg has quit IRC
2018-07-03T16:36:27  *** dakechi has quit IRC
2018-07-03T16:47:35  *** ancorgs has quit IRC
2018-07-03T16:51:59  *** enavarro has quit IRC
2018-07-03T17:02:18  *** pjessen has quit IRC
2018-07-03T17:56:37  *** pjessen has joined #opensuse-admin
2018-07-03T17:56:48  <tampakrap> hello
2018-07-03T17:56:52  <pjessen> hi
2018-07-03T17:56:56  <tampakrap> 3 minutes to go!
2018-07-03T17:57:14  <pjessen> goo timing ...
2018-07-03T17:57:36  *** Son_Goku has quit IRC
2018-07-03T17:58:23  <pjessen> lets see who else turns up.
2018-07-03T17:58:39  * cboltz hides
2018-07-03T17:59:50  <tampakrap> let's start?
2018-07-03T17:59:58  <pjessen> yup.
2018-07-03T18:00:11  <cboltz> yes
2018-07-03T18:00:23  <tampakrap> cboltz: put your hat on!
2018-07-03T18:00:36  <cboltz> ok, so I'll do a formal
2018-07-03T18:00:40  <cboltz> welcome to the heroes meeting!
2018-07-03T18:00:54  <cboltz> our topics are on https://progress.opensuse.org/issues/36817
2018-07-03T18:01:12  <cboltz> let's start with Q&A from the community - does someone have a question?
2018-07-03T18:01:49  <pjessen> any community members attending?
2018-07-03T18:02:38  <cboltz> looks like nobody has a question ;-)
2018-07-03T18:02:48  <cboltz> so let's continue with status reports
2018-07-03T18:03:18  <cboltz> provo-mirror has some free disk space again - using --delete instead of --delete-after obviously helps
2018-07-03T18:03:59  <tampakrap> I've been experimenting with caasp and cloudfoundry, it seems to work so far but I need to figure out more on how it works
2018-07-03T18:04:19  <tampakrap> the progress is documented here https://trello.com/b/5rcSlDX1/geekops
2018-07-03T18:04:35  <tampakrap> it's also my hackweek project https://hackweek.suse.com/17/projects/microservices-and-serverless-for-the-opensuse-dot-org-infrastructure
2018-07-03T18:04:47  <tampakrap> I intend to spend the last two days on documentation, assuming that it works as expected
2018-07-03T18:04:47  <pjessen> I had to tidy up widehat, get rid of 42.1 stuff. It's still almost full.
2018-07-03T18:06:01  <tampakrap> cboltz: any progress with the sync_update.sh on provo-mirror?
2018-07-03T18:06:05  <pjessen> mirroring - still minor bits that dont work on pontifex.
2018-07-03T18:06:45  <cboltz> you mean why rsync doesn't offer some of the update directories? I didn't have time to check that yet
2018-07-03T18:06:56  <tampakrap> okay
2018-07-03T18:07:15  <tampakrap> pjessen: what doesn't work on pontifex?
2018-07-03T18:07:55  <pjessen> there are some jobs that regularly fail, I've opened at least one ticket.  + hotstuff rsnyc packages
2018-07-03T18:08:36  <pjessen> generally the mirroing works okay.
2018-07-03T18:09:23  <tampakrap> cool
2018-07-03T18:09:48  <tampakrap> cboltz: let's move to the next topic?
2018-07-03T18:10:01  <pjessen> I've decided to basically open tickets for whatever stuff I see. Feel free to take a look :-)
2018-07-03T18:10:09  <cboltz> actually I have another status report:
2018-07-03T18:10:17  <cboltz> I just build a Leap 15 JeOS image locally with a minimal amount of packages (not tested yet, but it's probably close to the final version)
2018-07-03T18:10:40  <pjessen> good stuff
2018-07-03T18:10:41  <cboltz> so we'll have an image to deploy Leap 15 machines soon :-)
2018-07-03T18:11:15  <tampakrap> we have a topic about leap15 later
2018-07-03T18:11:32  <pjessen> old tickets?  I have not had time to review any.
2018-07-03T18:12:18  <cboltz> same for me, but anyway, I'd say let's move the old tickets to the end of the meeting
2018-07-03T18:12:24  <tampakrap> me neither, I focused on kubernetes the past weeks
2018-07-03T18:12:31  <cboltz> which means the next topic is
2018-07-03T18:12:39  <cboltz> why are we redirecting websites to https?
2018-07-03T18:12:46  <pjessen> right. my question.
2018-07-03T18:13:15  <pjessen> I was wondering why we are forcing everyone to https when we could just have both http and https available? e.g. for lists.o.o
2018-07-03T18:13:40  *** lcp has quit IRC
2018-07-03T18:13:51  <tampakrap> is there a reason to not have https everywhere?
2018-07-03T18:14:05  *** lcp has joined #opensuse-admin
2018-07-03T18:14:24  <pjessen> I had a discussion about using older browsers which are okay with https, but not with TLS 1.2
2018-07-03T18:14:53  <pjessen> by forcing https and tls1.2 we are excluding some people. dunno how many.
2018-07-03T18:15:33  <pjessen> tls1.2 is fine, but I think it might be good to offer both http and https. when the content isnt sensitve.
2018-07-03T18:15:58  <cboltz> well, define "sensitive" ;-)
2018-07-03T18:16:14  <pjessen> well, not sensitive = lists.o.o for instance.
2018-07-03T18:16:15  <cboltz> if the NSA catches you reading lots of mails about GPG and disk encryption - is this sensitive or not?
2018-07-03T18:16:37  <tampakrap> since we didn't get any reports about this yet, I would like to change it
2018-07-03T18:16:38  <pjessen> if the NSA is after me, uising http is the least of my worries
2018-07-03T18:17:00  <cboltz> ;-)
2018-07-03T18:17:08  <cboltz> https also ensures that nobody can do a MITM and inject a "rm -rf /" in some example script
2018-07-03T18:17:18  <cboltz> (or, closer to the real world, inject ads)
2018-07-03T18:18:23  <pjessen> for insensitive data, I would like us to leave it to the user to choose.
2018-07-03T18:18:35  <tampakrap> sorry, I *wouldn't like to change it
2018-07-03T18:18:48  <pjessen> yeah, I thought thats what you meant. :-)
2018-07-03T18:19:17  <cboltz> I also think the redirect to https makes sense
2018-07-03T18:19:20  <pjessen> it was mentioned briefly on opensuse@o.o, that's why I added the topic.
2018-07-03T18:19:54  <cboltz> right, I followed that discussion ;-)
2018-07-03T18:20:00  <tampakrap> is there a link?
2018-07-03T18:20:20  <pjessen> not right now. I can dig it out
2018-07-03T18:20:51  <cboltz> tampakrap: let me warn you that it's a typical opensuse@ discussion, so you'll need some time to read all the mails ;-)
2018-07-03T18:21:03  <tampakrap> okay
2018-07-03T18:21:26  <tampakrap> I'll read and let you know if I am convinced, but for now I am not
2018-07-03T18:22:04  <cboltz> another detail that was mentioned in this discussion is that www.o.o, bugzilla and forums (basically the things running in provo) don't support the latest tls
2018-07-03T18:22:15  <cboltz> do you think there's a chance to get this fixed/updated?
2018-07-03T18:22:28  <pjessen> okay. I would say why not suppoert both.
2018-07-03T18:22:40  <tampakrap> we can file the ticket to MF-IT and see what happens
2018-07-03T18:22:58  <pjessen> how long will MF-IT be looking after things?
2018-07-03T18:23:11  <tampakrap> cboltz: file me a ticket to progress.o.o and I'll forward it to them so I don't forget
2018-07-03T18:23:29  <cboltz> ok
2018-07-03T18:23:51  <tampakrap> pjessen: can't answer that, it usually depends on the urgency of the ticket
2018-07-03T18:24:31  <tampakrap> anything else or can we move to the next one?
2018-07-03T18:24:47  <pjessen> lets move on
2018-07-03T18:25:10  <cboltz> ok, next topic is the planned provo downtime on July 13th
2018-07-03T18:25:29  <tampakrap> yes, also mentioned to https://progress.opensuse.org/issues/37543
2018-07-03T18:25:47  <pjessen> link to https discussion - https://lists.opensuse.org/opensuse/2018-06/msg00752.html
2018-07-03T18:26:01  <tampakrap> anybody willing to create a draft for our status.o.o and opensuse-announce@o.o announcements?
2018-07-03T18:26:29  <bmwiedemann> hi there. had to get kids to bed.
2018-07-03T18:26:59  <tampakrap> hello bmwiedemann
2018-07-03T18:27:07  <pjessen> hi bernd
2018-07-03T18:27:25  <bmwiedemann> could we re-use some of the last announcement of the scheduled downtime?
2018-07-03T18:27:31  <tampakrap> sure
2018-07-03T18:27:56  <bmwiedemann> shall we start a page on etherpad.opensuse.org ?
2018-07-03T18:28:11  <tampakrap> sure good idea
2018-07-03T18:28:43  <tampakrap> I would say to send the announcement on opensuse-announce@o.o with a link to the status.o.o incident this week asap
2018-07-03T18:28:59  <tampakrap> then one reminder three days before, and one more reminder the same day
2018-07-03T18:29:08  <tampakrap> sounds good?
2018-07-03T18:29:17  <pjessen> yep, thats how it got to be done
2018-07-03T18:29:25  <cboltz> yes
2018-07-03T18:29:29  <bmwiedemann> https://etherpad.opensuse.org/p/adminoo-downtime20180713
2018-07-03T18:30:07  <cboltz> the downtime is expected to last two hours, so we don't need to setup replacements for most of the services
2018-07-03T18:30:10  <tampakrap> bmwiedemann: would you like to start the draft?
2018-07-03T18:30:18  <cboltz> the only thing that might be worth some effort is www.o.o
2018-07-03T18:30:35  <cboltz> that's a static page, so temporarily moving it to NBG shouldn't be too hard
2018-07-03T18:30:53  <cboltz> (yes, I'm ignoring the openID endpoint ;-)
2018-07-03T18:31:31  <tampakrap> agreed, any volunteers? :)
2018-07-03T18:31:36  <tampakrap> it could be done on static.o.o
2018-07-03T18:31:42  <pjessen> the announcement has to list which services are affected.
2018-07-03T18:33:10  <tampakrap> so somebody already started the draft on etherpad (put your name on the top right corner please)
2018-07-03T18:33:45  <tampakrap> and since nobody volunteered, I'll make sure we get the announcement on status.o.o and on the opensuse-announce ml
2018-07-03T18:33:54  <tampakrap> and I'll work on the www.o.o temp replacement
2018-07-03T18:34:24  <tampakrap> anything else?
2018-07-03T18:34:26  <cboltz> bmwiedemann: seeing your questionmark on the pad - the ticket on progress lists the affected services
2018-07-03T18:34:49  <cboltz> IIRC our public nameservers also run in provo
2018-07-03T18:34:55  <cboltz> will they be affected by the outage?
2018-07-03T18:35:38  *** dddh has quit IRC
2018-07-03T18:35:57  <pjessen> looks like there is also one in houston - nshou1.novell.com. ?
2018-07-03T18:36:35  <bmwiedemann> have a link to the ticket? the tool is not very good at finding these things
2018-07-03T18:36:48  <tampakrap> I will ask about this, but I think MF-IT maintains nameservers not only in provo
2018-07-03T18:36:53  <cboltz> bmwiedemann: https://progress.opensuse.org/issues/37543
2018-07-03T18:37:48  <cboltz> tampakrap: also ask if we can deploy DNS updates during the outage, or if we have to do it in advance
2018-07-03T18:38:13  *** dddh has joined #opensuse-admin
2018-07-03T18:38:13  *** dddh has joined #opensuse-admin
2018-07-03T18:38:24  <cboltz> if we have to switch over www.o.o in advance, it might be a good idea to ProxyPass (or however it's called in haproxy) /openid/ to the server in provo
2018-07-03T18:38:37  <tampakrap> okay
2018-07-03T18:40:02  <cboltz> next topic?
2018-07-03T18:40:41  <cboltz> since nobody objects ;-) let's continue with
2018-07-03T18:40:43  <cboltz> leap 15 status
2018-07-03T18:41:13  <cboltz> I already mentioned that I'm working on the JeOS image
2018-07-03T18:41:19  <tampakrap> yey!! good job!
2018-07-03T18:41:28  <cboltz> I didn't test the latest version yet, but I expect it to work ;-)
2018-07-03T18:41:43  <tampakrap> we have also machines running leap15 already
2018-07-03T18:41:47  <tampakrap> one is gitlab.i.o.o
2018-07-03T18:41:56  <bmwiedemann> cboltz: we got an OpenStack image in OBS, so if you drop cloud-init there, you are close to JeOS
2018-07-03T18:42:16  <tampakrap> the others are the new postgresql cluster machines, mirrordb1 and mirrordb2
2018-07-03T18:42:35  <tampakrap> darix managed to figure out a performance issue we were having, so the cluster is ready for use
2018-07-03T18:42:52  <tampakrap> and we can start moving databases from the old cluster mirrordb[3-4] already
2018-07-03T18:43:03  <tampakrap> I'll probably start working on it after hackweek
2018-07-03T18:43:23  <tampakrap> so something important that is missing is leap15 repos in salt
2018-07-03T18:43:23  <cboltz> tampakrap: did I miss the salt code to setup those machines? ;-)
2018-07-03T18:44:01  <tampakrap> exactly! you need to start with the repos!
2018-07-03T18:44:28  <cboltz> I'd hope that we can basically   cat 42.sls 12_or_42.sls > 15.sls
2018-07-03T18:44:48  <cboltz> (not the best solution, we'll have to clean that up after dropping SLE 11)
2018-07-03T18:44:52  <tampakrap> maybe, I'll leave that to you
2018-07-03T18:45:15  <tampakrap> the good thing is that we don't need sle15 repos, as we don't plan to have any sle15 machines
2018-07-03T18:46:10  <cboltz> regarding Leap 15 repos - I'm quite sure we have them in salt already ;-)
2018-07-03T18:46:31  <cboltz> IIRC we have a leap.sls that says something like download.o.o/..../$version/
2018-07-03T18:46:45  <cboltz> which should work for Leap 15 without changes
2018-07-03T18:46:57  <tampakrap> mind giving it a try?
2018-07-03T18:47:03  <tampakrap> I didn't have time to check it yet
2018-07-03T18:47:16  <cboltz> I will, when testing my shiny new JeOS image ;-)
2018-07-03T18:48:08  <tampakrap> perfect
2018-07-03T18:48:22  <tampakrap> do you have any ETA for that?
2018-07-03T18:49:04  <cboltz> this or next week, depends on which other things get onto my TODO list
2018-07-03T18:49:11  <tampakrap> cool
2018-07-03T18:49:37  <tampakrap> anything else apart from the jeos and the salt code for the repos needed for leap15 before we start migrating VMs?
2018-07-03T18:50:51  <cboltz> in theory, it should just work ;-)
2018-07-03T18:50:59  <pjessen> famous last words
2018-07-03T18:51:14  <tampakrap> now I'm curious
2018-07-03T18:51:15  <cboltz> in practise, I'd prefer to upgrade some of my test VMs before upgrading the production machines ;-)
2018-07-03T18:51:27  <tampakrap> I'll do a salt-call state.apply test=True on mickey
2018-07-03T18:51:49  <tampakrap> mickey had to be upgraded, because there was a conflict between gitlab and sssd packages
2018-07-03T18:51:58  <tampakrap> that was preventing me from updating gitlab
2018-07-03T18:52:05  <tampakrap> mickey (gitlab.i.o.o):~ # salt-call state.apply test=True
2018-07-03T18:52:07  <tampakrap> local:
2018-07-03T18:52:09  <tampakrap>     Data failed to compile:
2018-07-03T18:52:11  <tampakrap> ----------
2018-07-03T18:52:13  <tampakrap>     Pillar failed to render with the following messages:
2018-07-03T18:52:15  <tampakrap> ----------
2018-07-03T18:52:16  <cboltz> you'll probably get an error for osmajorrelease/15 pillar
2018-07-03T18:52:17  <tampakrap>     Specified SLS 'osmajorrelease.15' in environment 'production' is not available on the salt master
2018-07-03T18:52:19  <tampakrap> so, it needs work :)
2018-07-03T18:52:22  <bmwiedemann> is that using salt-master/minion? because salt-ssh has some compat issues with python2 vs 3
2018-07-03T18:53:04  <cboltz> tampakrap: looks as expected ;-) - but fixing that should be easy
2018-07-03T18:53:25  <tampakrap> bmwiedemann: master/minion, we don't use salt-ssh
2018-07-03T18:54:45  <tampakrap> anything else or can we move?
2018-07-03T18:55:14  <cboltz> IMHO we can continue with the next topic
2018-07-03T18:55:19  <cboltz> extra headers on download.o.o
2018-07-03T18:55:40  <tampakrap> yes that's mine
2018-07-03T18:55:53  <pjessen> lets hear it
2018-07-03T18:56:15  <tampakrap> lars forwarded me a mail a couple of weeks ago
2018-07-03T18:56:37  <tampakrap> a guy from microfocus is running some security scans on opensuse.org services
2018-07-03T18:56:48  <tampakrap> and he requested to add some extra headers to download.o.o
2018-07-03T18:57:24  <pjessen> interesting
2018-07-03T18:57:28  <tampakrap> Cache-Control,Content-Security-Policy,Strict-Transport-Security,X-Content-Type-Options
2018-07-03T18:57:41  <tampakrap> I am copy pasting from a csv, I might be pasting wrong content
2018-07-03T18:57:45  <tampakrap> give me a few secs
2018-07-03T18:57:52  <pjessen> cache-control, no prob
2018-07-03T18:58:07  <pjessen> content-security-policy- dunno
2018-07-03T18:58:17  <bmwiedemann> Strict mode might be overkill.
2018-07-03T18:58:19  <pjessen> STS - questionable. Maybe.
2018-07-03T18:59:19  <pjessen> I think STS would be okay, but a bit pointless. Most requests are redirected to http anyway.
2018-07-03T18:59:24  <tampakrap> Lars says that apart from the Content-Security-Policy cookie, the rest seem fine to him
2018-07-03T18:59:25  <bmwiedemann> it would prevent users from browsing the non-https version
2018-07-03T18:59:55  <pjessen> they are already prevented I think. See earlier topic from tonight :-)
2018-07-03T18:59:56  *** lcp has quit IRC
2018-07-03T19:00:17  <tampakrap> download.o.o is the only one afair that runs on http as well
2018-07-03T19:00:42  <pjessen> yes, my mistake, just checked it
2018-07-03T19:00:46  <tampakrap> https://progress.opensuse.org/news/40 Lars wrote this article 8 months ago, still valid
2018-07-03T19:03:19  <pjessen> which precludes HSTS
2018-07-03T19:03:44  <tampakrap> STS I think is already there
2018-07-03T19:04:31  <bmwiedemann> not on download.o.o
2018-07-03T19:05:18  <bmwiedemann> says curl -I
2018-07-03T19:05:26  <pjessen> says my browser too
2018-07-03T19:05:35  <tampakrap> ah maybe the tool doesn't really need it
2018-07-03T19:05:46  <tampakrap> No security headers are set - cache control, content security policy, x content type options are missing.
2018-07-03T19:05:54  <tampakrap> that's the summary from the report
2018-07-03T19:06:21  <pjessen> the only I am familiar with is cache control and hsts. Never heard of the others
2018-07-03T19:07:13  <tampakrap> me neither, I'm googling about x-content-type-options
2018-07-03T19:07:14  <bmwiedemann> the content* stuff might be relevant to HTML/JS stuff which we dont host there
2018-07-03T19:07:40  <tampakrap> https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
2018-07-03T19:08:37  <bmwiedemann> yes. XSS and data-injection are not really relevant there.
2018-07-03T19:08:43  <tampakrap> so I would suggest to enable cache-control and x-content-type-options, announce it and see what happens
2018-07-03T19:08:54  <tampakrap> just to make the colleague's tool happy :)
2018-07-03T19:09:06  <pjessen> what would he like for cache-control ?
2018-07-03T19:10:00  <tampakrap> it is not defined, I'll ask him
2018-07-03T19:10:19  <pjessen> its more of a header for .. wait for it ..... cache control
2018-07-03T19:11:06  <tampakrap> I suppose the tool doesn't care much, as long as it is set
2018-07-03T19:11:06  <bmwiedemann> like telling proxies and browsers which files they can re-use later
2018-07-03T19:11:16  <pjessen> exactly
2018-07-03T19:11:18  <tampakrap> so better to ask if he has a recommended value
2018-07-03T19:11:40  <pjessen> the thing is - its not very security related.
2018-07-03T19:11:53  <pjessen> ask him and see what he says.
2018-07-03T19:12:00  <tampakrap> okay
2018-07-03T19:12:08  <bmwiedemann> it could, if shared proxies could give out private data or such
2018-07-03T19:12:30  <cboltz> given how often the content of download.o.o changes (basically every minute), don't allow too much caching ;-)
2018-07-03T19:12:33  <bmwiedemann> (but that should be avoided with a "Vary" header anyway)
2018-07-03T19:12:43  <pjessen> yep.
2018-07-03T19:12:51  <pjessen> well, every 5 mins?
2018-07-03T19:13:18  <bmwiedemann> can be useful to be able to use the 'back' button without having a forced page reload
2018-07-03T19:13:52  <pjessen> I think it wud be sensible.
2018-07-03T19:14:35  <pjessen> I'll take a closer look at those options. is there an open ticket already?
2018-07-03T19:15:22  <tampakrap> no, can you create one please?
2018-07-03T19:15:27  <pjessen> willdo
2018-07-03T19:15:32  <tampakrap> thanks
2018-07-03T19:15:51  <bmwiedemann> slightly off-topic: I sometimes find that "Short overview" confusing, because it is above what I'm actually interested in
2018-07-03T19:16:22  <tampakrap> so to sum up: cache-control AI for me to ask about expected values, content-security-policy we don't want, x-content-type-options no problem to do
2018-07-03T19:16:24  <tampakrap> correct?
2018-07-03T19:16:49  <pjessen> I dont know what content-sec-policy does yet
2018-07-03T19:17:00  <pjessen> hsts wwe don't want
2018-07-03T19:18:01  <cboltz> pjessen: https://media.ccc.de/v/gpn18-141-http-security-headers might be helpful (if you have an hour to watch it)
2018-07-03T19:18:23  <pjessen> I dont :-)
2018-07-03T19:19:16  <tampakrap> bmwiedemann: which short overview?
2018-07-03T19:21:53  <bmwiedemann> tampakrap: on each download.o.o page, the HTML has the same links in a list
2018-07-03T19:22:12  <bmwiedemann> that is rather similar to directory listings I'm usually looking for
2018-07-03T19:22:43  <tampakrap> ah yes
2018-07-03T19:23:35  <tampakrap> I assume it comes from mirrorbrain
2018-07-03T19:24:08  <pjessen> no, I think itŝ generated by some or other script, based on a template
2018-07-03T19:24:18  <cboltz> tampakrap: I doubt - IIRC it's a simple template for the directory index
2018-07-03T19:24:27  <bmwiedemann> at least it is not on the mirrors.
2018-07-03T19:24:49  <pjessen> yes, the mirrors do their own thing.
2018-07-03T19:25:41  <bmwiedemann> one quick fix could be moving it from header to footer
2018-07-03T19:25:51  <bmwiedemann> or reducing font size / contrast
2018-07-03T19:26:20  <tampakrap> btw, can we close the meeting or is there anything else to discuss?
2018-07-03T19:26:54  <pjessen> im done. ticket opened:  https://progress.opensuse.org/issues/38159
2018-07-03T19:27:40  <cboltz> I'd say it's late enough to skip checking old tickets ;-)
2018-07-03T19:30:06  <pjessen> okay, then I'll say goodbye.  I might not be back for the August meeting. I think I'm travelling.
2018-07-03T19:32:18  <cboltz> found the header and footer - HEADER.html and README.html in /usr/share/apache2/mirrorbrain-icons
2018-07-03T19:32:36  <cboltz> both files are packaged in mirrorbrain-icons, so if you want to change them, please do it in the package ;-)
2018-07-03T19:33:45  <cboltz> that said - I also think we can close the meeting
2018-07-03T19:33:52  <cboltz> thanks everybody!
2018-07-03T19:35:06  *** pjessen has quit IRC
2018-07-03T19:48:44  *** duncanmv has joined #opensuse-admin
2018-07-03T20:00:03  <heroes-bot> PROBLEM: HAProxy on mufasa.infra.opensuse.org - HAPROXY CRITICAL - Active service riesling is DOWN on riesling proxy ! ; See https://monitor.opensuse.org/icinga/cgi-bin/extinfo.cgi?type=2&host=mufasa.infra.opensuse.org&service=HAProxy
2018-07-03T20:04:02  <tampakrap> cboltz: ^^ can I comment out riesling from mufasa to stop getting this every day?
2018-07-03T20:05:14  <cboltz> yes, please
2018-07-03T20:13:09  *** Fraser_Bell has joined #opensuse-admin
2018-07-03T20:13:09  *** Fraser_Bell has joined #opensuse-admin
2018-07-03T20:18:22  *** malcolmlewis has quit IRC
2018-07-03T20:24:45  <tampakrap> commented out
2018-07-03T20:26:06  <cboltz> thanks!
2018-07-03T20:30:50  *** malcolmlewis has joined #opensuse-admin
2018-07-03T20:30:51  *** malcolmlewis has joined #opensuse-admin
2018-07-03T20:35:46  *** malcolmlewis has quit IRC
2018-07-03T20:40:02  <heroes-bot> PROBLEM: HAProxy on elsa.infra.opensuse.org - HAPROXY CRITICAL - Active service caasp-master1 is DOWN on caasp_k8s_dashboard proxy ! Active service caasp-master2 is DOWN on caasp_k8s_dashboard proxy ! Active service caasp-master3 is DOWN on caasp_k8s_dashboard proxy ! Active service dale is DOWN on dale proxy ! Active service obsreview is DOWN on obsreview proxy ! ; See https://monitor.opensuse.org/icinga/cgi-bin/extinfo.cgi?type=2&host=elsa.infra.opensuse.org&service=HAProxy
2018-07-03T20:40:03  <heroes-bot> PROBLEM: HAProxy on anna.infra.opensuse.org - HAPROXY CRITICAL - Active service obsreview is DOWN on obsreview proxy ! Active service caasp-master1 is DOWN on caasp_k8s_dashboard proxy ! Active service caasp-master3 is DOWN on caasp_k8s_dashboard proxy ! Active service caasp-master2 is DOWN on caasp_k8s_dashboard proxy ! Active service dale is DOWN on dale proxy ! ; See https://monitor.opensuse.org/icinga/cgi-bin/extinfo.cgi?type=2&host=anna.infra.opensuse.org&service=HAProxy
2018-07-03T20:40:04  <heroes-bot> RECOVERY: HAProxy on mufasa.infra.opensuse.org - HAPROXY OK -  keyserver-recon (Active: 0/1) keyserver (Active: 1/2) static (Active: 1/1) keyserver-db (Active: 0/1) ; See https://monitor.opensuse.org/icinga/cgi-bin/extinfo.cgi?type=2&host=mufasa.infra.opensuse.org&service=HAProxy
2018-07-03T20:47:10  *** malcolmlewis has joined #opensuse-admin
2018-07-03T20:47:11  *** malcolmlewis has joined #opensuse-admin
2018-07-03T21:00:03  *** Fraser_Bell has quit IRC
2018-07-03T21:06:57  *** malcolmlewis has quit IRC
2018-07-03T21:19:52  *** malcolmlewis has joined #opensuse-admin
2018-07-03T21:19:52  *** malcolmlewis has joined #opensuse-admin
2018-07-03T21:25:33  *** ldevulder has quit IRC
2018-07-03T21:52:10  *** duncanmv has quit IRC
2018-07-03T22:00:01  *** nicolasbock has quit IRC
2018-07-03T22:02:03  *** cboltz has quit IRC
2018-07-03T23:40:17  *** okurz has quit IRC
2018-07-03T23:41:09  *** okurz has joined #opensuse-admin