Dear admins,

We would like to request hosting for a KGB service¹ instance.

 ¹ https://wiki.debian.org/Services/KGB

Below you can find the rationale and the requirements. If a change
would make the idea more suitable for Debian hosting, we are open to
suggestions.

Why is it good for Debian
=========================
The service is used by 30 or 40 #debian-* channels.

Moving to a single, Debian-hosted instance will improve the service by:
 - removing the need to upgrade/reconfigure three instances
 - increasing stability (currently hosted on personal servers with various
   degrees of stability)

Why DSA-managed hosting
=======================
While the service can be run on any random VM, having it under DSA
umbrella has the following benefits:

 * Trusted environment
   There are some passwords in the configuration, which while not
   terribly secret, would be better on a host, controlled by a trusted
   party.
 * .debian.org domain to signify official status

Why not DSA-managed hosting
===========================
There are a couple of possible concerns that we'd mention explicitly:

 * it is an IRC bot
 * it currently also serves a few projects outside of Debian, like 
   OpenWRT and reproducible-builds. We have the policy of adding only 
   projects that are suffucuently aligned with Debian's goals.

Hosting requirements
====================
Separate VM or co-hosted with other Debian services on an existing host.

The expected load is rather low, CPU% is seldom higher than 0.0. Memory
footprint was seen to be 200M after 30 days of running, and the expected
network bandwidth is about 200 MB/month.

A 'kgb.debian.org' domain name + an SSL certificate.

Open incoming TCP ports: 80, 443 and 9418.

A http/https redirects from 'kgb.debian.org' to·
<https://salsa.debian.org/kgb-team/kgb/wikis/home>

In terms of access, we would want to be able to:

 - install/upgrade kgb-bot and kgb-client packages (plus dependencies),
   possibly from backports, unstable or git
   (requesting the install/upgrade from DSA would work too)

 - start/stop/restart/reload/status the kgb-bot service

 - read/modify KGB's configuration:

   + modify files under /etc/kgb-bot/*

   + create/modify/delete files under /etc/kgb-bot/kgb.d/

   These would probably require a new group and custom ACLs, but I guess
   you know better.

   Currently permissions look like:

   drwxr-xr-x root root        /etc/kgb-bot
   -rw-r----- root Debian-kgb  kgb.conf
   drwxr-x--- root Debian-kgb  kgb.conf.d
   -rw-r----- root Debian-kgb  kgb.conf.dpkg-dist
   -rw-r----- root Debian-kgb  3dprinter.conf
   -rw-r----- root Debian-kgb  android-tools.conf
   -rw-r----- root Debian-kgb  apt.conf
   -rw-r----- root Debian-kgb  archlinux-reproducible.conf
   -rw-r----- root Debian-kgb  boinc.conf
   .....

 - read /var/log/kgb-bot.log* (-rw-r--r-- Debian-kgb:root)


Thank you for considering,
	Martina Ferrari
	Gregor Herrmann
	Damyan Ivanov