R2 + Postgres deployment

[wolfv]

Description

Hi all, I am interested in running a tessera instance for the Conda package management ecosystem to have a transparency log over channels & artifacts.

I think our preferred way of deployment would be R2 for storage of static tiles and Postgres as a database (if needed).

Does that sound possible? I saw that there is a AWS backend, but that didn't sound "generic" enough for R2.

[AlCutter]

Hi @wolfv,

Thanks for the interest!

There is currently no Postgres support and we have no plans to implement one due to the limited resources we have available, although we'd possibly be open to accepting a PR if someone were able to both implement it as well as commit to serving as OWNER for it.

I'm afraid I don't know much about R2, but, from a quick search, it looks like it supports S3 APIs, and, importantly, seems to support the conditional operations for PutObject (https://developers.cloudflare.com/r2/api/s3/extensions/#putobject).

Despite the naming, the "AWS" backend is known to work with at least some alternative S3+MySQL combinations (e.g. we've heard that MariaDB + either SeaweedFS or MinIO works), so this might be a route to getting you started.

That said, I'd love to hear a bit more about your use-case, perhaps there are other approaches which could also work - could you share a bit of ballpark estimation for how big you think the log is likely to become, how many leaves you expect to be adding in a given period of time, and what the latency requirements are for getting those leaves added into the tree?

[wolfv]

Thank you for getting back to me! I was under the impression that only DynamoDB + S3 combination would work but if MariaDB + S3 / R2 work, that might be another workaround.

The largest "channel" (ie. repository of packages) in the conda ecosystem is conda-forge which has 2.9 million artifacts that we would like to add to the log.

Per day I would estimate at most 50k new artifacts (more likely to be a good bit lower).

For hosting it could either be us (as in prefix.dev company) or the open source project. I think both are cost conscious (although the open source project even more) and we don't have many devops resources for the open source project.

[AlCutter]

Yes - it's actually deployed on AWS as AuroraDB+S3, DynamoDB was investigated as an early possibility but it turned out not to work well for various reasons including cost.

Another option to think about, particularly if cost is a consideration, might be using the POSIX backend (the same IPng blog post I linked earlier talks about that, too). Happy to talk through some of the trade-offs there if you want.

On the conda logging, one more question - would these 50k entries be "trickled in" over the course of the day (~0.5qps on avg), or might they be batched up & arriving in chunks (alternatively, could they be batched up and logged in chunks - e.g. every 10s, 60s, hourly, etc.) or must they be logged and become visible ~immediately?