gchristensen changed the topic of #nixos-borg to: https://www.patreon.com/ofborg https://monitoring.nix.ci/dashboard/db/ofborg?refresh=10s&orgId=1&from=now-1h&to=now "I get to skip reviewing the PHP code and just wait until it is rewritten in something sane, like POSIX shell. || https://logs.nix.samueldr.com/nixos-borg
<gchristensen> the new core server receives thousands of connections an hour from silverlight?
<samueldr> silverlight?
<gchristensen> yeah
<gchristensen> port 4506
<gchristensen> Aug 18 00:07:05 core-1.ewr1.nix.ci kernel: TCP: request_sock_TCP: Possible SYN flooding on port 4506. Sending cookies. Check SNMP counters.
<gchristensen> Aug 18 00:07:06 core-1.ewr1.nix.ci kernel: TCP: request_sock_TCP: Possible SYN flooding on port 4506. Sending cookies. Check SNMP counters.
<samueldr> (or salt stack)
<samueldr> (port 4506) Salt minions connect to the request server as needed to send results to the Salt master, and to securely request files and minion-specific data values (called Salt pillar). Connections to this port are 1:1 between the Salt master and Salt minion (not asynchronous).
<gchristensen> lol sorry
<gchristensen> thousands of connections per second
<samueldr> no worries, I was kinda wondering
<samueldr> wondering too if salt stack makes more sense (being a server)
<gchristensen> unlikely..?
<gchristensen> samueldr: would saltstack be performing thousands of requests a second from thousands of IPs?
<samueldr> I don't know enough about it to be certain, but the feature (pillars) could make it a possibiliy
<gchristensen> :o
<gchristensen> no way
<samueldr> probably not for *thousands* of IPs though
<samueldr> 147.75.194.9 right?
<gchristensen> 147.75.64.189
<gchristensen> not thousadns of IPS :)
<samueldr> oh, misread then :)
<gchristensen> https://gist.github.com/grahamc/16401dd1fc1526083e373ffea7c5239d here are all the IPs who have attempted more than 4,000 times in the last 24hrs
<samueldr> this is highly coincidental if not 100% relevant
<samueldr> (search for 147.75.64.189)
<samueldr> https://www.google.ca/search?q=%22147.75.64.189%22+site:learningnetwork.cisco.com
<samueldr> what are the chances?
<gchristensen> huh
<gchristensen> nice
<gchristensen> they open their connection with ff00 0000 0000 0000 017f
<samueldr> (I have extremely basic knowledge about salt stack)
<samueldr> (and seeing zeromq makes sense here)
<gchristensen> sure enough
<gchristensen> let's start up a 0mq receiver if I can ... :)
<samueldr> (I find this extremely funny how you want to setup a 0mq thing and are already receiving thousand of requests!)
<gchristensen> :D
<samueldr> (and extremely worrying how a master dropped without their minions being fixed?)
<gchristensen> I have no idea what I'm doing
orivej has quit [Ping timeout: 244 seconds]
LnL has quit [Read error: Connection reset by peer]
LnL has joined #nixos-borg
timokau has joined #nixos-borg
orivej has joined #nixos-borg
orivej has quit [Ping timeout: 260 seconds]
jtojnar has quit [Ping timeout: 240 seconds]
jtojnar has joined #nixos-borg
<{^_^}> [ofborg] @Infinisil opened pull request #224 → Move infinisil to trusted_users → https://git.io/fAe1U
<LnL> ^ can ok to deploy or are you doing stuff with rabbitmq?
<gchristensen> go ahead lnl
<gchristensen> I'm postponing several more days to test SSL certificate rotation
<LnL> kk
<{^_^}> [ofborg] @LnL7 merged pull request #224 → Move infinisil to trusted_users → https://git.io/fAe1U
<{^_^}> [ofborg] @LnL7 pushed 2 commits to released: https://git.io/fAe9h
<LnL> hmm, waiting for agent...
<LnL> yeah doesn't seem up
<gchristensen> oh
<gchristensen> I shut it down last night during severe lightning
<infinisil> LnL: gchristensen: Thanks :D
<gchristensen> LnL: should be up
<LnL> yep, it's already running :)
<gchristensen> cool :)
<gchristensen> nixops' send-keys is cool
<LnL> oh neat (assuming it does what you'd expect)
<gchristensen> $ nixops deploy --include ogden
<gchristensen> building all machine configurations...
<gchristensen> ogden.......> copying closure...
<gchristensen> personal> closures copied successfully
<gchristensen> ogden.......> uploading key ‘packet-nixos-config’...
<gchristensen> ogden.......> uploading key ‘buildkite-token’...
<gchristensen> ogden.......> uploading key ‘buildkite-ssh-public-key’...
<gchristensen> ogden.......> uploading key ‘buildkite-ssh-private-key’...
<{^_^}> [ofborg] @LnL7 closed pull request #219 → Add kalbasit to trusted users → https://git.io/fNbRf
<gchristensen> thanks LnL
<infinisil> I have a mac I'm often not using (when I'm home). Could I use it to help with the darwin builds?
<LnL> you could :)
<{^_^}> [ofborg] @markuskowa opened pull request #225 → Add markuskowa to known users → https://git.io/fAeQR
<infinisil> How does it work?
<gchristensen> imo you probably shouldn't run ofborg on a mac you use for anything else :/
<infinisil> Hmm yeah that's probably a good idea
<LnL> yeah, firstly understand that there's no sandboxing and everybody who has access essentially gets access to your local network
<gchristensen> do they have access to your system's files too?
<LnL> it should also have a multi-user install to give at least a bit of isolation
<LnL> anything that's world readable, yes
<infinisil> Wouldn't be a problem for me, I don't use macOS for anything, I would completely wipe it.
<infinisil> Is there nothing one can do against it having access to the network?
<infinisil> (the local one i mean)
<LnL> yeah, I use my machine only for nix-builds so the only sensitive thing on there is the ofborg secret
<infinisil> I guess isolation through the router software would still work
<LnL> no, that's actually the same for linux with sandboxing enabled
<gchristensen> I have my ofborg on a totally separate network
<infinisil> gchristensen: How do you have this separate network set up?
<gchristensen> I'm glad you asked!
<gchristensen> oeu
<gchristensen> oeu
<LnL> man, that's so neat
<gchristensen> it was pretty frustrating to set up but since then its cool
<infinisil> Aha! nixos on your router :O
<infinisil> Neat
<gchristensen> ^ that setup requires a switch which supports VLANs, which I got for free from a friend
<LnL> huh, you have that at home :o
<gchristensen> yeah
<gchristensen> :|
jtojnar has quit [Ping timeout: 244 seconds]
jtojnar has joined #nixos-borg
jtojnar has quit [Read error: Connection reset by peer]
jtojnar has joined #nixos-borg
LnL has quit [Excess Flood]
LnL has joined #nixos-borg
orivej has joined #nixos-borg