| 25 Mar 2023 |
 m1cr0man | Yeah so that's interesting. We do an offline check to get around an issue where ACME would fail in containers that didn't have networking at startup. THere's an old (closed) issue about it lying around, I could probably find it through the git blame. Other than that, we do invoke lego to check renewal and that (as found during that same ticket) already does some online check. I think this is mostly a no-op for us, we already support it as best we can but we kinda need to keep the offline check to avoid that old bug. | 19:28:56 |
| m1cr0man | https://github.com/NixOS/nixpkgs/issues/85794 fixed via https://github.com/NixOS/nixpkgs/pull/114752 | 19:29:40 |
| m1cr0man | what would be really nice is if I would hurry my ass up and PR some sort of offline-ok check into lego renew so we can remove all our custom logic | 19:30:23 |
| 5 Apr 2023 |
|  Redstone joined the room. | 05:51:14 |
| 6 Apr 2023 |
|  kadawee joined the room. | 01:02:12 |
| 12 Apr 2023 |
|  Yuddite G joined the room. | 09:12:01 |
| 16 Apr 2023 |
| Yuddite G changed their profile picture. | 23:09:28 |
| 26 Apr 2023 |
| Yuddite G changed their display name from Yuddite Pilot to Yuddite Groyper. | 04:49:18 |
| Yuddite G changed their display name from Yuddite Groyper to Yuddite G. | 21:02:56 |
| 6 May 2023 |
|  @cel:pussy.accountants joined the room. | 12:49:32 |
| 17 May 2023 |
| m1cr0man | Thanks for jumping in there emily 🙂 I always feel a pressure to respond to these sort of issues (when someone is eager to open a PR) to make sure the module stays maintainable, it's good to know I'm not the only one looking out! | 22:37:55 |
 hexa | I was talking to someone recently who kinda complained about when acme jobs would be started in bulk after a rebuild, which would cause load spikes on hosts with many certificates 🙈 | 22:41:49 |
| hexa | I fear we have no way to stretch those restarts out across a reasonable time span | 22:42:08 |
| hexa | reading through that ticket, I think that is exactly the same company actually | 22:45:33 |
| hexa | wondering if CPUSchedulingPolicy=idle would do the trick | 22:53:31 |
| 18 May 2023 |
 emily | In reply to @m1cr0man:m1cr0man.com
Thanks for jumping in there emily 🙂 I always feel a pressure to respond to these sort of issues (when someone is eager to open a PR) to make sure the module stays maintainable, it's good to know I'm not the only one looking out! no worries, sorry i'm barely around these days :) | 06:03:37 |
| emily | I was thinking CPUWeight=idle, didn't know about CPUSchedulingPolicy. I wonder what the difference is :/ | 06:04:31 |
| emily | I agree that the module is definitely plenty complex enough already (honestly too much in my opinion, I am quite down on lego at this point with how much it has required in the way of custom-built infrastructure and workarounds) | 06:06:05 |
| m1cr0man | Heh I'm barely around either so don't sweat it... I wish I had time to do more, such as opening PRs to Lego to upstream some features like offline renewal checking and proper handling of domain list changes. If they are resistant to those sort of things I'm not against beginning to migrate the module to another tool but... So many resources out there wrt setting up acme as well as people's configs rely on Lego. It's a bit vendor locked sadly | 08:17:58 |
| emily | yeah I feel like the last migration was painful enough that rewriting the whole thing yet again and probably breaking people's configurations in the process would hurt. | 08:34:38 |
| emily | I am more sympathetic to the Caddy "ACME should be integrated into the applications using the certs because there's a lot you can do more reliably/properly and certificate lifecycle management goes smoother" POV these days than I used to be, my personal plan was/is to switch to Caddy and have it dump out the cert to disk (which iirc it can do now) for non-HTTP things | 08:36:29 |
| emily | Caddy is explicitly advertised as being possible to use as a certificate management service separate from being used as a web server but I feel like migrating the whole module to anything else is hard to advocate for at this point unless lego seriously degrades somehow | 08:43:29 |
| emily | (Caddy itself used to use lego - indeed I think they are the reason lego exists? - and then abandoned it for their own implementation) | 08:44:16 |
| emily | btw I assume another effect of spamming the services on switch is that sometimes serves with tons of certificates will spam LE with (re)issuances all at once? that may be a stronger argument than CPU load for some kind of limited parallelism or randomized timing, because what about hosts with thousands of certificates? | 09:24:32 |
| emily | (e.g.: what if lots of hosts do an automated configuration switch at midnight/some other Schelling point for automatic nixpkgs upgrades and at scale this causes us to direct a bunch of predictable load to LE that the module already goes to pains to spread out during normal operation?) | 09:26:43 |
| hexa | In reply to @emilazy:matrix.org
I was thinking CPUWeight=idle, didn't know about CPUSchedulingPolicy. I wonder what the difference is :/ yeah, that was my concern as well. Too many options, that sound relevant. | 10:56:39 |
| 25 May 2023 |
|  raitobezarius changed their display name from raitobezarius to disko in NixOS 23.11 when. | 13:32:16 |
| raitobezarius changed their display name from disko in NixOS 23.11 when to raitobezarius. | 13:37:24 |
| 27 May 2023 |
|  mjolnirchanged room power levels. | 16:40:04 |
| 4 Jun 2023 |
| m1cr0man | Lol I had a dream last night that someone opened a critical ticket on the Acme module and a core maintainer had to fix it because I was asleep but when I read it, it was intended behaviour/user error and I was annoyed that the module got changed just for it 😂 I woke up and like panic checked my emails and of course there was nothing | 07:51:49 |
