Lucas's questions

I am using munin to monitor some servers and now I have delete a server but I want to keep the graphs in my overview to be able to compare the data from the old server to the things that happen on the new server (for example questions like "how many apache accesses did we get in May last year on the main webserver (now delete) and how many do we get now on the current webserver?").

I tried to put

[old.example.com]
update no

into my config but the host old.example.com is not visible in the overview.

I also tried to trick munin into "updating" the host like this

[old.example.com]
address cmd:///usr/bin/true

but that also hides the node from my overview.

Is there any way to keep a node visible where I can not update the graphs any longer because I do not own the server/IP any longer?

Context

I am running my own GitLab instance with an extra server for CI. In case it matters my host for the gitlab runner has CentOS 8 and the gitlab runner is version 14.4.0 and the gitlab instance is running 14.4.1. I am currently using a shell executor on the CI server but want to switch to a docker executor.

Gitlab Runner Config

My /etc/gitlab-runner/config.toml looks like this:

concurrent = 1
check_interval = 0

[session_server]
  session_timeout = 1800

[[runners]]
  name = "the old shell executor"
  url = "https://XXXXXXXXXXXXXXXXXXXXXX/"
  token = "XXXXXXXXXXXXXXXXXXXX"
  executor = "shell"
  [runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]

[[runners]]
  name = "the new docker executor"
  url = "https://XXXXXXXXXXXXXXXXXXXXXX/"
  token = "XXXXXXXXXXXXXXXXXXXX"
  executor = "docker"
  [runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]
  [runners.docker]
    tls_verify = false
    image = "docker.io/centos:7"
    privileged = false
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/var/run/docker.sock:/var/run/docker.sock", "/cache"]
    network_mode = "host"
    shm_size = 0

The shell executor is tagged shell and the docker executor is tagges docker so I can decide where to run my build from the gitlab-ci.yml file.

gitlab-ci.yml

.template:
  before_script:
    - cat /proc/sys/user/max_user_namespaces
  script:
    - $ENGINE login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
    - $ENGINE build -f container/php-71.dockerfile -t "$CI_REGISTRY/$CI_PROJECT_NAMESPACE/$CI_PROJECT_NAME/$TAG:$CI_PIPELINE_ID" .
    - $ENGINE push "$CI_REGISTRY/$CI_PROJECT_NAMESPACE/$CI_PROJECT_NAME/$TAG:$CI_PIPELINE_ID"

build-with-docker-in-shell-executor:
  extends: .template
  variables:
    ENGINE: docker
    TAG: build-with-docker
  tags: [shell]
build-with-docker-in-docker-executor:
  extends: .template
  image: docker:dind
  variables:
    ENGINE: docker
    TAG: build-with-docker-in-docker
  tags: [docker]
build-with-podman-in-docker-executor:
  extends: .template
  image: quay.io/podman/stable
  variables:
    ENGINE: podman
    TAG: build-with-podman-in-docker
  tags: [docker]

My container/php-71.dockerfile is trivial, it uses centos:7 and executes a bunch of yum install commands:

FROM docker.io/centos:7
RUN yum install -y epel-release centos-release-scl
RUN yum install -y rh-php71

The first job fails because my gitlab runner user does not have access to the docker sockt:

Got permission denied while trying to connect to the Docker
daemon socket at unix:///var/run/docker.sock: Post
"http://%2Fvar%2Frun%2Fdocker.sock/v1.24/auth": dial unix
/var/run/docker.sock: connect: permission denied

I think that is ok (or is it nowdays advisable to grant access to docker for non root users?). So this job exists just for reference.

The docker in docker job fails because yum does not have network access it seems:

Step 1/3 : FROM docker.io/centos:7
 ---> eeb6ee3f44bd
Step 2/3 : RUN yum install -y epel-release centos-release-scl
 ---> Running in 8e41cd05bcc1
Loaded plugins: fastestmirror, ovl
Determining fastest mirrors
Could not retrieve mirrorlist http://mirrorlist.centos.org/?release=7&arch=x86_64&repo=os&infra=container error was
12: Timeout on http://mirrorlist.centos.org/?release=7&arch=x86_64&repo=os&infra=container: (28, 'Resolving timed out after 30548 milliseconds')
 One of the configured repositories failed (Unknown),
 and yum doesn't have enough cached data to continue. At this point the only
 safe thing yum can do is fail. There are a few ways to work "fix" this:
     1. Contact the upstream for the repository and get them to fix the problem.
     2. Reconfigure the baseurl/etc. for the repository, to point to a working
        upstream. This is most often useful if you are using a newer
        distribution release than is supported by the repository (and the
        packages for the previous distribution release still work).
     3. Run the command with the repository temporarily disabled
            yum --disablerepo=<repoid> ...
     4. Disable the repository permanently, so yum won't use it by default. Yum
        will then just ignore the repository until you permanently enable it
        again or use --enablerepo for temporary usage:
            yum-config-manager --disable <repoid>
        or
            subscription-manager repos --disable=<repoid>
     5. Configure the failing repository to be skipped, if it is unavailable.
        Note that yum will try to contact the repo. when it runs most commands,
        so will have to try and fail each time (and thus. yum will be be much
        slower). If it is a very temporary problem though, this is often a nice
        compromise:
            yum-config-manager --save --setopt=<repoid>.skip_if_unavailable=true
Cannot find a valid baseurl for repo: base/7/x86_64
The command '/bin/sh -c yum install -y epel-release centos-release-scl' returned a non-zero code: 1

And the podman in docker is the strangest errors of them all, it already fails at the podman login command:

time="2021-11-01T13:34:31Z" level=warning msg="\"/\" is not a shared mount, this could cause issues or missing mounts with rootless containers"
cannot clone: Operation not permitted
Error: cannot re-exec process

Question

I would like to use podman in docker or docker in docker to build my images. What steps can I take to debug and fix this?

I moved a nextcloud installation from one server to another. On the new server I want to use another version of PHP. The problem is that the passwords are hashed with the argon2 algorithm (in the tables oc_users and oc_share in the nextcloud database).

The problem is that the new version does not seem to support argon2 and I get "wrong password" messages when I try to log in with the user+password on the new server that I know to work on the old server.

On the old server I was using PHP 7.2 from the remi repository; on the new server I would like to use PHP 7.2 or 7.3 (do not care) from the centos-sclo-rh repository.

user@home $ ssh old
user@old $ php --version
PHP 7.2.29 (cli) (built: Mar 17 2020 11:36:18) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.2.29, Copyright (c) 1999-2018, by Zend Technologies
user@old $ php -r 'var_dump(PASSWORD_ARGON2I);'
int(2)
user@old $ exit
user@home $ ssh new
user@new $ scl enable rh-php72 -- php --version
PHP 7.2.24 (cli) (built: Nov  4 2019 10:23:08) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.2.24, Copyright (c) 1999-2018, by Zend Technologies
user@new $ scl enable rh-php73 -- php --version
PHP 7.3.11 (cli) (built: Dec 10 2019 16:14:50) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.11, Copyright (c) 1998-2018 Zend Technologies
user@new $ scl enable rh-php72 -- php -r 'var_dump(PASSWORD_ARGON2ID);'

Warning: Use of undefined constant PASSWORD_ARGON2ID - assumed 'PASSWORD_ARGON2ID' (this will throw an Error in a future version of PHP) in Command line code on line 1
string(17) "PASSWORD_ARGON2ID"
user@new $ scl enable rh-php73 -- php -r 'var_dump(PASSWORD_ARGON2ID);'
PHP Warning:  Use of undefined constant PASSWORD_ARGON2ID - assumed 'PASSWORD_ARGON2ID' (this will throw an Error in a future version of PHP) in Command line code on line 1
string(17) "PASSWORD_ARGON2ID"

I also tried to install the sclo-php7{2,3}-php-sodium and libsodium because I found this: https://stackoverflow.com/a/59392421/4102092 but it did not help.

Finally the question: How can I use the PHP packages from the software collection repository and have argon2 support?

I am using exim to deliver mail generated by a web app. The gmx.net, gmx.de and web.de domains are asking me to throttle the amount of mail I send but I have trouble in getting that configured in exim.

The scenario goes like this:

1. my web app generates the emails
2. they are submitted to exim running on localhost via phpmailer
3. exim puts them in the queue right away (I have queue_smtp_domains = web.de : gmx.de : gmx.net in the config)
4. on every queue run (every hour) it tries to deliver the mail
5. after some successful deliveries each of these two domains returns a 421 error code (1.1.1.1 is my IP address in the original log entry which I replaced here). Exim claims that the error occurs strait after connecting to the server:

2019-09-12 14:50:41.157 [19619] 1i8OYb-00056H-01 H=mx01.emig.gmx.net [212.227.17.5]:25: SMTP error from remote mail server after initial connection: 421-gmx.net (mxgmx115) Nemesis ESMTP Service not available\n421-Service unavailable\n421-Reject due to policy restrictions.\n421 For explanation visit http://postmaster.gmx.com/en/error-messages?ip=1.1.1.1&c=irlims

The link they give the advise to reduce the sending rate. That is what I am trying to do.

Every three hours a fixed amount of mail is accepted be the recieving mailserver before the same error message apears again.

I found one question but it looks like the acls will do the rate limiting at step 2 and I don't want that. I want to rate limit at point 4. And only for the two domains in question.

I also found the docs for special retry rules in exim. But I only want to apply a special rule if the domain and the error code match and it seems to me that I can not match the error 421 on connection (only as a reply of a MAIL or DATA or RCPT command can I match it).

How can I configure this kind of throtteling in exim or how else can I get these mails to be accepted at a faster rate?