Two Hollywood Phonies (@autumn)

φ @fiore@brain.worm.pink

ok infra thread to plan out the new gngr.fail server setup

φ @fiore@brain.worm.pink

its gonna be fedora server . i have decided

φ @fiore@brain.worm.pink

itll be 2 physical servers , one actually running the services and the other for bulk data and backups

φ @fiore@brain.worm.pink

backups will be done thru borg , the backups server will only be exposed to the internal network

φ @fiore@brain.worm.pink

itll all be rootless podman+systemd . the only thing running as root will be the caddy reverse proxy

φ @fiore@brain.worm.pink

every service will have its own user , lingering enabled , and data stored in the home dir

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore all sounds very good actually, why fedora server though? you'll have to upgrade it every 6 months (although there's probably a very nice system upgrade util)

φ @fiore@brain.worm.pink

@autumn yea system upgrades are very comfy in fedora . also since im containerizing everything , the servjces themselves will be fine

also , fedora just has the normal way of handling things as the default . its basically Normal Linux nowadays , and i dont wanna have ti deal with outdated packages (debian) , snaps (ubuntu) , or manual setup of everything (arch)

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore how i did things before was via Debian, and since everything would be containerised then outdated packages aren't really an issue, like unless you need the latest version of like. Htop or smth 😭 and that gives you the benefit of not needing to upgrade for 5 years (or until next release)

not trying to convince you or anything, just something to consider!!

φ @fiore@brain.worm.pink

@autumn im running in debian rn . i do not want to use nvim 0.6 anymore . sorry

Two Hollywood Phonies @autumn@cafe.autumn.town

@fiore hahahaha fair enough

mia (developer mode) @mia@shrimptest.0x0.st

@autumn @fiore i’ve been running tumbleweed for as long as it existed and in my experience it doesn’t really care whether it upgrade weekly, monthly, or every 3 years, or only a few packages at a time. it’s pretty well maintained

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn not using containers with it either, just the usual systemd-managed namespace isolation

φ @fiore@brain.worm.pink

@mia @autumn how much less overhead does that have compared to podman ? is it worth it ?

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn idk about podman. but docker has insane syscall overhead so i/o in docker containers tends to be a lot slower than in a bare lxc container or on a KVM guest

φ @fiore@brain.worm.pink

@mia @autumn oh yea im not touching docker anymore

φ @fiore@brain.worm.pink

@mia @autumn crazy that its sliwer tgan a fuarrrking VM tho

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn it’s been less cognitive overhead for me anyway. i basically run zypper dup every now and then, check which services need to be restarted (zypper ps -s; i have a script that does it automatically too), and that’s it. rarely needs manual intervention

φ @fiore@brain.worm.pink

@mia @autumn i dont even know how i would go on to manually set up namespaces for application ngl , hqve any good resources on it ?

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn for services, systemd can do it for you (systemd.exec manpage iirc). distros should provide reasonably hardened unit files out of the box by now. if you’re just running applications in your shell, there are tools like unshare, bubblewrap and firejail

φ @fiore@brain.worm.pink

@mia @autumn interesting

but like . how do i solve dependency issues with this setup ?

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn just use the package manager

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn (this is an advanced feature only available in distros that actually package recent software releases)

φ @fiore@brain.worm.pink

@mia @autumn but like . i will for mkst things have to compile the binaries , and sometimes ill need to build against different versions of some system library . that sounds like hell

might still try it tho

φ @fiore@brain.worm.pink

@mia @autumn im so containerbrained bwaaaaaa

mia (developer mode) @mia@shrimptest.0x0.st

@fiore @autumn

i will for mkst things have to compile the binaries

not on tumbleweed

and sometimes ill need to build against different versions of some system library

different ABI versions are packaged too if anything actually needs those

also, if something isn’t packaged, you can just make your own package and have it built automatically on opensuse’s infra. much easier to maintain in the long run

φ @fiore@brain.worm.pink

@mia @autumn ig i could do that too with a copr repo on fedora . but at that point id much much rather use a container lol

Two Hollywood Phonies @autumn@cafe.autumn.town

@mia @fiore idk if i would need to worry about overhead though, I've used docker running several services on a raspberry pi and didn't notice any storage slowdown, all of it was CPU limited

even now as i run this instance on a rpi, the limitation is storage speed (which is solved by just using an ssd instead of sd card) and cpu which i can't really do anything about lol

mia (developer mode) @mia@shrimptest.0x0.st

@autumn @fiore yes, the syscall overhead is mostly CPU. it’s spending a lot of time doing bpf shenanigans (you can see it with perf top)

Two Hollywood Phonies @autumn@cafe.autumn.town

@mia @fiore well i mean that everything would run but sometimes i tried doing things that would well exceed the CPU capabilities like a minecraft server, or being boosted by a large account on my single user instance 😭 im sure that docker contributes to that slightly but not enough to where it'd fix any of this. the cpu is just slowww