Meeting started at 2026-06-03 17:00:20 UTC

The Meeting name is 'fedora-server'

!hello

!group members server-wg

Emmanuel Seyman: Emmanuel Seyman (eseyman) - he / him / his

Members of server-wg: Alexander Bokovoy, Adam Williamson, Paul Maconi, eseyman, jwhimpel, Kevin Fenzi, korora (@korora:fedora.im, @korora1981:matrix.org), mowest, ngompa (@conan_kudo:matrix.org, @ngompa:fedora.im, @pharaoh_atem:opensuse.org, @ngompa:kde.org, @ngompa:almalinux.im), Peter Boy, Stephen Gallagher

Welcome to our weekly Server WG meeting.

Hello, Peter

I'll post the agenda in 2-3 minutes.

As usual, let's wait a moment for everybody to show up.

Hi Emmanuel!°

Hello, I'm here but reduced capacity 😄

Mostly listening

I guess we must hurry to coordinate our Flock contribs.

Brett: You are topic 2

Hm, I guess, we are going to miss our quorum today. But maybe, we should just start in style of an open discussion and see, how it goes.

Anything to add?

No, I'm good

OK.

https://docs.fedoraproject.org/en-US/server-working-group/wg-minutes-2026/

meetings overview:

Regarding the action, see the list in our

Current status is:

.

eseyman writes an Ansible playbook that applies the official post-installation tasks.

2.

Conan Kudo will fix Kiwi to set the right partition type of Linux LVM for the system partition on KVM guest and arm image.

3.

MatH will compose the existing ideas and proposals into a TOC proposal, perhaps already for next meeting

4.

pboy will implement the Fedocal workarount for providing meeting location address

5.

pboy will put together the originally planned way of Ansible support for pre-installed software in home server spin-off in the server matrix room.

No announcements from me, otherwise.

FTR, step 1 is still ongoing

Yeah, its more a reminder of the list, which is mostly burried in our wg docs. :-)

OK, let's start.

Brett wrote a contribution, mostly about home server spin-off, but may be relevant not only for that.

https://codeberg.org/brettweir/fedora-home-server-guide/src/branch/main/docs/management.md

Probably 5 mins to read??

Yeah I suppose so hehe

I've used Ansible for so long that I have difficulty putting myself in the shoes of someone starting out

Yes, that's not easy, indeed.

Regarding ssh key: In our Server doc we disable password ssh,too, but with the exception of ant least one user (or two) so you have a fall back solution, just in case something goes wrong with the keys.

Or when you have to use a machine, where you don't have the keys.

!hi

MatH: Mat H (theprogram)

Welcome MatH

I'm accustomed to password auth being fully disabled since a lot of cloud providers require it

Hello, I'm in Poznan now, had to talk to people

That's on Polen, isn't?

Brett: Yeah, and I'm use to always have a fallback solution, just in case. :-)

Not a bad plan

And restrict is to one or two users seems save enough for me

But with a home server, you will always have terminal access, so maybe you don't need a fallback for ssh. That's a big difference to prof. Server in a remote data center.

I think it is fine to have some password access for a home use case, as long as the user picks a good password

Start open and people friendly, add strict access rules later

Oh, yeah, you have physical machine access still

In any case, we should shortly explain, why we recommend differently, if we do.

But yeah I'm not sure how far to go with hardening the server. I think I typically err on excessively paranoid and trying to avoid that

I would say not to go to far, but introduce those concepts in the second half, advnced section

Where you can go crazy on hardening.

A properly configured firewall, ssh keys and a root password is adequate for a home use case

One thing I'm definitely doing differently from usual is keeping the homelab on the same subnet so avahi works. My own home lab, the cluster has its own subnet 🤣

I've not used avahi, have to read up on that

MatH: I think so, yes. Mostly your home server is behind a provider's router including firewall

The "homeserver.local" domain afaik

Yes, but the router does a lot of securing your home lab network.

So you may be a bit relaxed.

Yes, I run a router firewall and a fedora firewall

Allthough, ssh will be your way to your home server from out of home, just in case you need it.

Need to add some firewall discussion to these docs too

I was thinking Tailscale, but I know others just open a port and it's fine. Or maybe use your router's OpenVPN?

can /will cockpit work from outside?

Headscale, tailscale is propriatarty freeware

Cockpit works from outside via port forwarding

If you forward the port, but we'd want to lock that down more

Can add 2FA for cockpit login

Im an 'open the port' kind of guy

I dont think we can rely on openvpn compatibility on all routers

Yeah probably not

definately a good option

The question is, how often you need ssh access to your server from outside? E.G. being at Flock and urgently need something?

(Your forgot your slides. :-). )

!hi

Jocelyn Gould (UTC-4): Jocelyn Gould (korora) - she / her / hers

Sorry I'm late

hello, Jocelyn

As a regular traveller, if I could get my partner to help me set up a homelab at ... home ... than I could administrate it via SSH from whereever I am

Should I also do that? 🤣

!hi

Brett: Brett Weir (brettweir) - he / him / his

No denying you were here now!

And if your laptop was stolen and you don't have a machine with the keys. You'll curse the keys. (I did it in February anyway)

Honestly the cockpit approach is probably great here. We don't need to open an SSH port since cockpit has a terminal

Can focus on locking down cockpit for remote access. Can still use SSH at home

There is some talk about passkey support for Cockpit but its a bit involved

That would be great!

I routinely useb rsync for file transfers... that needs either the rsync daemon or ssh

issue here https://github.com/cockpit-project/cockpit/issues/20389

I guess we have to come to an agreed minimal standard, rather than what we individually use. And then make docs for that stuff we each love

Cockpit seems like a good baseline target because it is so uniquely Fedora

I was actioned to briefly summarize my idea of ​​using Ansible. In short: We deliver a complete playbook around roles with variables. The configuration by the user is limited to entering specific values ​​for the variables. Ideally using a small configuration editor that we should develop for Cockpit.

Yes i like that

I think, that's compatible with Bretts text so far.

That works for me

It's a great idea, but the scripting it is not in my ballpark

Yeah, I'm definitely leaning into just all ansible all the time (which admittedly is also very Fedora lol)

What would be the timeline on that Peter?

That's a good question. I suppose, we have to start w/o Cockbit at first.

I#

I'm evaluating Cockpit support for small specific tasks. There is a special section in thje docs about that.

I don't think it needs to be a blocker. Can edit ansible configs in vim just fine lol

Would be a good addition though

Yes, as a start anyway.

The first task is to define the variable and get the scripting right.

We have to keep in mind the intended difference to commercial NAS and fully web based solution. We want to be open, extendible (and a bit of empowering to digital sov...)

Ansible is quie good for that.

OK, I think, we can go on?

Commercial NSA is a minefield, really not a safe solution at all. A basic server, with a NAS solution is infinately better

RE the included software, I do not have that list yet. I am erring towards what Peter said last week - keep it minimal

Yeah I don't like locked down devices, though that's why I'm here

Yes, i think we shoud start with minimal. But what is minimal?

I was too quick! Having software interpreted as protocols rather than 'apps' is one interpretation of minimal

Another interpretation is to only include things in Fedora's repos

Which cuts out a lot of what was suggested to us by people currently running their own home labs

Yes, but at some point the stuff has to run, i.e. protocol or as an app. :-)

Yes, we should stay with Fedora rpm, at least at first.

Perhaps Brett, Jocelyn and myself cap put aside an hour to kick that around in the next day or two?

Simply run through the list we have and tick or cross each item

Perhaps Brett, Jocelyn and myself can put aside an hour to kick that around in the next day or two?

Well, maybe wi should limit us to 5-8 apps/protocols at first? We have to do all the Ansible tasks for each.

I am not skilled in Ansible, but CStrauf has offered to teach me - we started, so I dont understand how much effort that is

proposed !action Brett, Jocelyn and MatH will put together a proposal from the current ideas and proposals.

proposed !action Brett, Jocelyn and MatH will put together a proposal for the initial small set of apps from the current ideas and proposals.

And Emmanuel, do not mean to forget about you!

Emmanuel ?? You too? or are you busy with Ansible post install?

That's sounds good, I need more time to muck about with things. I've comparing web servers too, it'll be good to discuss more

We will see , I will loop him in if he has any opinion

OK.

I'm quite busy with Perl packaging right now. If you can move forward without my help, I say go for it

OK, let's proceed to the next topic.

The floor is open! For everything, for any question, what youj always wanted to ask but couldn't

How did you start tandem biking?

Why am I

Or... room for others question...

My wife couldn't no longer bike by herself because of hipp issiues. So we came to a Tandem. :-)

The alternative to electric, power on!

Yeah, the new tandem is electric. But it is too risky for my wile to use a single bike. Just in case she has to stop very quickly.

That would be quite a sight, a tandem at speed, I've not seen that before, they look super fun, one day when I settle down...

It is fun !!!!

I've seen a quad tandem, non-electric at speed.... it's... impressi

I've seen a quad tandem, non-electric at speed.... it's... impressive

You have a lot móre power, and the speed ....

OK, I think we need to free up the room, just in case.

Bye bye!! see you next week

Good chatting with you all!