Two Hollywood Phonies (@autumn)

φ @fiore@brain.worm.pink

ok infra thread to plan out the new gngr.fail server setup

φ @fiore@brain.worm.pink

its gonna be fedora server . i have decided

φ @fiore@brain.worm.pink

itll be 2 physical servers , one actually running the services and the other for bulk data and backups

φ @fiore@brain.worm.pink

backups will be done thru borg , the backups server will only be exposed to the internal network

φ @fiore@brain.worm.pink

itll all be rootless podman+systemd . the only thing running as root will be the caddy reverse proxy

φ @fiore@brain.worm.pink

every service will have its own user , lingering enabled , and data stored in the home dir

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore all sounds very good actually, why fedora server though? you'll have to upgrade it every 6 months (although there's probably a very nice system upgrade util)

φ @fiore@brain.worm.pink

@autumn yea system upgrades are very comfy in fedora . also since im containerizing everything , the servjces themselves will be fine

also , fedora just has the normal way of handling things as the default . its basically Normal Linux nowadays , and i dont wanna have ti deal with outdated packages (debian) , snaps (ubuntu) , or manual setup of everything (arch)

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore how i did things before was via Debian, and since everything would be containerised then outdated packages aren't really an issue, like unless you need the latest version of like. Htop or smth 😭 and that gives you the benefit of not needing to upgrade for 5 years (or until next release)

not trying to convince you or anything, just something to consider!!

φ @fiore@brain.worm.pink

@autumn im running in debian rn . i do not want to use nvim 0.6 anymore . sorry

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore hahahaha fair enough

mia (developer mode) @mia@shrimptest.0x0.st

@autumn @fiore i’ve been running tumbleweed for as long as it existed and in my experience it doesn’t really care whether it upgrade weekly, monthly, or every 3 years, or only a few packages at a time. it’s pretty well maintained

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn not using containers with it either, just the usual systemd-managed namespace isolation

φ @fiore@brain.worm.pink

@mia @autumn how much less overhead does that have compared to podman ? is it worth it ?

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn idk about podman. but docker has insane syscall overhead so i/o in docker containers tends to be a lot slower than in a bare lxc container or on a KVM guest

φ @fiore@brain.worm.pink

@mia @autumn oh yea im not touching docker anymore

φ @fiore@brain.worm.pink

@mia @autumn crazy that its sliwer tgan a fuarrrking VM tho

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn it’s been less cognitive overhead for me anyway. i basically run zypper dup every now and then, check which services need to be restarted (zypper ps -s; i have a script that does it automatically too), and that’s it. rarely needs manual intervention

φ @fiore@brain.worm.pink

@mia @autumn i dont even know how i would go on to manually set up namespaces for application ngl , hqve any good resources on it ?

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn for services, systemd can do it for you (systemd.exec manpage iirc). distros should provide reasonably hardened unit files out of the box by now. if you’re just running applications in your shell, there are tools like unshare, bubblewrap and firejail

φ @fiore@brain.worm.pink

@mia @autumn interesting

but like . how do i solve dependency issues with this setup ?

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn just use the package manager

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn (this is an advanced feature only available in distros that actually package recent software releases)

φ @fiore@brain.worm.pink

@mia @autumn but like . i will for mkst things have to compile the binaries , and sometimes ill need to build against different versions of some system library . that sounds like hell

might still try it tho

φ @fiore@brain.worm.pink

@mia @autumn im so containerbrained bwaaaaaa

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn

i will for mkst things have to compile the binaries

not on tumbleweed

and sometimes ill need to build against different versions of some system library

different ABI versions are packaged too if anything actually needs those

also, if something isn’t packaged, you can just make your own package and have it built automatically on opensuse’s infra. much easier to maintain in the long run

φ @fiore@brain.worm.pink

@mia @autumn ig i could do that too with a copr repo on fedora . but at that point id much much rather use a container lol

Two Hollywood Phonies @autumn@cafe.autumn.town

@mia @fiore idk if i would need to worry about overhead though, I've used docker running several services on a raspberry pi and didn't notice any storage slowdown, all of it was CPU limited

even now as i run this instance on a rpi, the limitation is storage speed (which is solved by just using an ssd instead of sd card) and cpu which i can't really do anything about lol

mia (developer mode) @mia@shrimptest.0x0.st

@autumn @fiore yes, the syscall overhead is mostly CPU. it’s spending a lot of time doing bpf shenanigans (you can see it with perf top)

Two Hollywood Phonies @autumn@cafe.autumn.town

@mia @fiore well i mean that everything would run but sometimes i tried doing things that would well exceed the CPU capabilities like a minecraft server, or being boosted by a large account on my single user instance 😭 im sure that docker contributes to that slightly but not enough to where it'd fix any of this. the cpu is just slowww

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore if you want to take it one step further, i suggest you look into ansible and other infrastructure as code tools too. really cool software.

φ @fiore@brain.worm.pink

@autumn ive never understood what ansible does lmfao csre to explain ?

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore essentially you're able to write out instructions for a server to do tasks when setting it up, the idea is that you have a clean install and you're able to configure it to whatever you need (edit configs, install packages etc)

the way this differs from a bash script is that it's a lot easier since tasks that don't need to be done are just skipped, and it's all done in a reproducible way so you're able to push the same thing to 2 different servers, or even completely clean reinstall one of then and run the playbook again to restore it. (assuming that the only thing you erased can be made again, e.g configs and not like user files etc.)

φ @fiore@brain.worm.pink

@autumn it feels overkill for what i need tho haha

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore yeah its more intended for stuff like cloud infra but its definitely saved my ass a few times, its the approach of having a home server that you take care of vs having a home server you nuke and restart as soon as there's another issue

φ @fiore@brain.worm.pink

@autumn yea that seems kinda comfy but i thibk ill start raw and maybe integrate it along the way

one rubillion containers @sneexy@booping.synth.download

@fiore @autumn ( nix but not nix therefore is 100x more sane )

Two Hollywood Phonies @autumn@cafe.autumn.town

@sneexy @fiore there are differences between the 2 fundamentally but in broad strokes yeah, writing configs to make your system reproducible