What happened to hydra.nixos.org?

[waffle8946]

@arcayr

yeah it’s only been mentioned in a couple of places but never as an “announcement”. ultimately in a perfect world nobody would need to know, but evidently we are very much not in one. where would be the most appropriate? discourse? matrix? github somewhere? all three? perhaps in the issue template itself?

Matrix is not an announcement-friendly platform. Mentioning in the issue template would be ideal (a small one sentence disclaimer), and well it’s already effectively mentioned here on discourse but only after we as end-users ran into it.

@arcayr

better alternative would be wiring discourse, hydra, etc. into keycloak, similar to arch linux, but that’s then another thing have to worry about.

Arch is awful for that, please no. Anyway auth should not be necessary, creating two accounts to report an issue would be absurd

[arcayr]

@waffle8946

Mentioning in the issue template would be ideal (a small one sentence disclaimer)

would need a way to report it’s a problem too, for those that run into such an issue. i guess an issue on the infra repo (i don’t know if that’s appropriate currently)?

@waffle8946

Arch is awful for that, please no. Anyway auth should not be necessary, creating two accounts to report an issue would be absurd

to clarify i specifically meant in the context of that versus using discourse as an idp, which we currently don’t do and so wouldn’t be doing this either. fwiw you can use github as an upstream for keycloak so it’d all flow in normally, but wouldn’t be hooked into the auth mechanisms of a bulletin board and would be using something actually fit for purpose.

not really relevant to the thread, but arch being awful because they have a centralised accounts management platform using software designed for it is a position i never really expected to see, though they have e.g., the self-hosted gitlab which plugs into it so they rely on it a bit more than we would.

[bitbloxhub]

I personally would prefer Authentik over Keycloak, but I do think that the general idea of having a real IdP for signing into NixOS-related infra (even supporting signin with github) is a good idea.

@arcayr

quick note that iocaine’s primary objective is to poison llm bots’ results and searches, not block them. anubis’s is to make it computationally expensive enough that it naturally throttles requests, not block them. whether either of these objectives are “worth it” is entirely down to one’s interpretation of “llm scrapers vs the server: the showdown”. if you want to see how much it’s doing (a lot), you can see the grafana grafs.

My idea with my PR is that using the current iocaine detection (to avoid PoW for legit users, unlike Anubis, and catches enough bots) with a static page that’s good for humans to understand (the poison may discourage scrapers though) will keep hydra load down the same amount while avoiding this kind of “hydra got hacked!!” thread.

[hexa]

@bitbloxhub

I personally would prefer Authentik over Keycloak, but I do think that the general idea of having a real IdP for signing into NixOS-related infra (even supporting signin with github) is a good idea.

It’s on the list, see Setup an SSO service for admin interfaces · Issue #375 · NixOS/infra · GitHub. I’m personally leaning towards Authentik.