The installation doesn't look too complicated [1], we need to install a new firewall dedicated to admin/internal tools.
The unknown part is on the sso part, but as a quick win, we can try to plug it on the current softwareheritage keycloak's scheme with a dedicated group

I guess it can take about 1 day of work.

[1] https://github.com/hedgedoc/hedgedoc/blob/master/docs/setup/manual-setup.md

Just to be sure (I'm confused even after reading the history document), HedgeDoc is the *community* fork of the HackMD code base (which was named CodiMD), and has no relationship with the original upstream company running hackmd.io. Correct?

In T2827#53716, @vsellier wrote:

The installation doesn't look too complicated [1], we need to install a new firewall dedicated to admin/internal tools.

I guess you meant reverse proxy.

The unknown part is on the sso part, but as a quick win, we can try to plug it on the current softwareheritage keycloak's scheme with a dedicated group

We should definitely connect more tools to keycloak instead of each having their internal authentication. We really need to solve centralized staff user management at some point too.

I guess it can take about 1 day of work.

[1] https://github.com/hedgedoc/hedgedoc/blob/master/docs/setup/manual-setup.md

Yeah, that sounds accurate.

The ongoing maintenance cost doesn't seem too high (the releases are quite sparse), and I don't think we'll get real-time collaborative editing features even with the migration to GitLab, so I guess it makes sense to install an instance of this in-house. I'm just a bit worried about the duplication/overlap with the wikis, but hedgedoc doesn't seem to be able to do short-form internal hyperlinks, so that's probably a non-issue (it would be nice, however, to /reduce/ the number of things we maintain in house once in a while ;p)

In T2827#54141, @olasd wrote:

Just to be sure (I'm confused even after reading the history document), HedgeDoc is the *community* fork of the HackMD code base (which was named CodiMD), and has no relationship with the original upstream company running hackmd.io. Correct?

I believe it's correct.

The ongoing maintenance cost doesn't seem too high (the releases are quite sparse), and I don't think we'll get real-time collaborative editing features even with the migration to GitLab, so I guess it makes sense to install an instance of this in-house. I'm just a bit worried about the duplication/overlap with the wikis, but hedgedoc doesn't seem to be able to do short-form internal hyperlinks, so that's probably a non-issue (it would be nice, however, to /reduce/ the number of things we maintain in house once in a while ;p)

I'd rather kill the wikis in favor of a better (git-based static generator like) doc system (like how we use sphinx currently), but yeah, probably not everybody will agree with that :-)

Inventory updated [1]

[1] https://inventory.internal.softwareheritage.org/virtualization/virtual-machines/91/

correctness first, basic run within vagrant node works (some part is puppetized, the db configuration for one).

A node has been deployed [1]

As it was the first puppetized node in the vlan 442 (admin vlan), some debugging was necessary with @vsellier to make it work (firewall, dns, puppet facts, terraform, etc...)

It's not complete though.

Remains to deal with ssl, open to the public, etc...

It should be ok for the team to play with it though.

[1] http://bardo.internal.admin.swh.network:3000/

I see in the inventory that this VM has 8GB of RAM and 64GB of storage, isn't it a bit overkill?

Also, how is the authentication made?

I see in the inventory that this VM has 8GB of RAM and 64GB of storage, isn't it a bit overkill?

Yes, possibly. That can be "downsized".

Also, how is the authentication made?

That remains part not done yet.
In the main hedgedoc configuration file, config entries related to gitlab, twitter, github, google, ldap, mattermost, dropbox, etc... exist.
So I gather, that's possible with those, like hackmd.

It might also be possible to subscribe oneself to it via email. There is a register form when you click on the sign in link.

Those are still not configured though, i did not have a chance to look into those yet.
Right now, only anonymous edit has been tested.

Instance deployed [1]

What's deployed:

• anonymous edition possible
• email registering possible

What's not done, keycloak authentication [2]

[1] https://hedgedoc.softwareheritage.org

[2] T2951