lazyweb

It is a bad idea. There's RCE CVEs on an almost weekly basis.

T-Pot does something similar: https://github.com/telekom-security/tpotce

Oh snap, that's crazy. In a bad way.

Going forward, customers must order the full server system to obtain the motherboard.

Veritasium - Why It Was Almost Impossible to Make the Blue LED

https://www.youtube.com/watch?v=AF8d72mA41M

I generally agree. But then again, we had Master/Slave IDE connectors, floppy drives, _extremely_ shitty CPU sockets (broke plenty of Sockel A / 370 cooler latches), nothing (including keyboards and mice!) was hot-pluggable ...

Regarding your last point: that's just market segmentation. Plenty of lanes on server CPUs. Remember Linus' rant about Intels refusal to offer ECC for consumer CPUs?

I did the exact opposite. And by that I mean physically moved my homelab into their colo earlier this year. Runs like a charm, costs about 500€ per month total.

Sounds like a lot, but I was almost paying the same before - 220€ for power at home, 110€ for a dedicated Hetzner server, 95€ for a secondary internet connection (as not to interfere with the main uplink used for home office by my partner and me).

Not having to deal with the extra heat, noise and used up space at home anymore has been worth it as well.

I'm hosting my own internal CA using Hashicorp Vault and some ansible + CI. The root CA is valid for 20 years, intermediate CA 10 years, client certs three months.

Initial setup is a handful of commands interacting with Vault's CLI, from there, with CI in place, client certs are renewed automatically. Services are restarted / reloaded as well. Works flawlessly.

I should maybe write a (small) blog explaining how it works.

As predicted by Mass Effect 1: Introducing Omni-gel.

Mort Way

I set up something like this [1] a few years ago at a previous job, mostly just because the security team wanted an interactive dashboard.

[1] https://github.com/debricked/dmarc-visualizer

I am running my own private CA as well, powered by Hashicorp Vault, Ansible and Jenkins.

The Vault initialization and configuration is more or less manual (just a bunch of commands, I have them in my notes). From there I am using an ansible role based on the hasi_vault module [1] which is run by a Jenkins job every night, logging into each target system, renewing certs if needed and reloading services.

Has been working very well for about a year now. Of course, there's a little more technical context needed - my CA needs to be present on all systems interacting with it, and my CI needs to be able to log into each target system (SSH keypair + sudo user). This ties into the rest of my infrastructure, which is managed by Terraform and Ansible.

I might write up a small blog post about this if I find the time.

[1] https://docs.ansible.com/ansible/latest/collections/communit...

Straight out of https://www.imdb.com/title/tt21942866/

Which is a fun watch btw

Has anyone tried mirroring their apt repo yet? Using apt-mirror on Debian stable, I'm seeing errors:

  Processing indexes: [PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPapt-mirror: can't open index packages.mozilla.org/apt//dists/mozilla/main/binary-amd64/Packages in process_index at /usr/bin/apt-mirror line 891.

  deb https://packages.mozilla.org/apt mozilla main
  clean https://packages.mozilla.org

Mildly relevant - the Telmate Terraform provider for Proxmox [1], which now stopped working with latest Proxmox version due to seemingly being abandoned, was initially mostly developed by an engineer employed by a company of the same name. They've since rebranded [2].

I've used that provider for a while, and only recently started looking into the specifics. The repo is effectively owned by a company profiting off of incarcerated persons in the US. Pretty wild.

Mostly writing this since I've spent the last few days migrating my Terraform setup to a different, supported provider [3].

[1] https://github.com/Telmate/terraform-provider-proxmox

[2] https://www.gettingout.com/

[3] https://github.com/bpg/terraform-provider-proxmox

Agreed. I've introduced an internal, selfs-signed CA using Vault, ansible and Jenkins for my personal infrastructure. Issues certs via pipeline job and restarts / reloads affected target services if needed.

I might do a writeup soon on this, it's not even that complicated.

"I still ate some and feel fine" vs. "I've been sitting on the toilet for the last 25 minutes".

I'm using Graphene, but with the default Google captive portal settings. While yes, I am technically leaking my current public IP to Google servers, what does it actually tell them apart from the IP?

It's a generic user agent I believe and there's billions of (simple) HTTP requests hitting that endpoint. If you're using a stock Android (or even worse, like Samsung) it's the Play services and unkillable vendor background apps you should be worried about.

I'd argue it's a lot more conspicuous to network operators if you're using non-standard captive URLs.

Wow, incredible video.

That's what I imagine could be the last few seconds of semi conscious hallucination by some poor Warhammer40K space traveller during a gellar field failure.

Exactly. Depending on the location and "crookedness" of each tooth, the oral surgeon might grind down the inside of the jaw bone for a clean extraction.

Source: I've had three of my four wisdom teeth removed like that just a few weeks ago (mid thirties, local anesthetic). Chewing harder things like bread still hurts a little, otherwise it's fine.

My way of doing private SSL (not necessarily the easiest):

* own CA, to be distributed to all systems via Ansible playbook or Dockerfile directives

* Hashicorp Vault with enabled PKI engine

* Ansible Hashivault module [1]

* Ansible role & playbook to tie it all together

* CI enviroment for automated deployment of SSL certs to target systems

Works flawlessly once set up, including restart/reload of affected services. Might do a writeup on my personal blog at some point.

[1] https://github.com/ansible-collections/community.hashi_vault

As stated, between 20 - 30W.

My router at the moment is a 1U Poweredge R230. Got it for 70€ off of ebay about 3,5 years ago. It's using a Pentium G4600, one stick of 16G DDR4 ECC RAM, and a small cheap 2,5'' SSD. There's an extra PCIe card with 2x 1G Intel RJ45 ports as well, giving me 4x 1G plus IPMI (or whatever Dell calls it).

Fans are throttled to 8% and I'm having Icinga2 watch system temperatures, which are usually between 35 - 45°C. It's barely audible, and currently sitting 1,5m away from my ears. I think idle power consumption is something between 20 - 30W.

It's based on Debian 11, and I'm only using tools available from Debian's repo: dnsmasq, nftables, wireguard, ipsec, haproxy, some policy based routing. Provisioning via ansible.

Rock solid platform. I've recently had to reboot for the 1st time in about 600 days due to physically moving some things around - I know, uptime is not supposed to be a flex.

Might replace the Intel PCIe card with a 1x SFP+ for a DAC connection to my core switch soon-ish since we finally seem to be getting our apartment complex connected to residential fiber.

I guess what I'm saying is - I congratulate the tenacity and expertise that went into OPs blog post, as far as homelab routers go, I'm very happy with my (very easy to set up) HW/SW.

Staggered spinup is still a feature on virtually all modern hardware/RAID disk controllers.

Why not stay with Ubuntu, and upgrade to 22.04 LTS? Is the current setup giving you trouble?

Any kind of (standard) Xeon HW setup should be well supported by either OS.

Can't help but be mildly amused by the article and many of the comments. Here in Germany the standard "Kündigungsfrist" is often three months to the end of the current month at many tech (and other) places.

For example, if I wanted to quit my current job (which I'm currently contemplating), I'd have to make sure to do it in april, otherwise I'll be stuck for another month.

It does go both ways, a company can't just fire you without reasonable cause, such as gross misconduct. But in most cases people stop trying after handing in their resignation - which I can't blame them for - and as a manager I'd like to release them earlier.

His blog is quite the rabbit hole, with blog post about the creation of de_dust and de_dust2. Highly recommended.

That's a very big AND.

HARD agree. Had a lot of fun going against 12 bots with 2-3 (human) friends, for hours.

Similar experience for me. Four 2TB 980pro in RAID-Z2. Since introducing the drives in August 2021 I've had to replace them five times. I think none of the original SSDs are left. Only between 5 - 25TB written on average. Usually individual uncorrectable errors caught by ZFS, but one drive just straight up died. I keep a cold spare these days. On the bright side, if the cycle continues, I'll never run out of warranty from Samsung or the vendor.

There is a show called Alone [1] in which 10 participants compete for 500.000 dollars by trying to survive the northern canadian arctic winter as long as possible, up to three or four months. Virtually all footage is filmed by the participants themselves. It's quite engrossing.

[1] https://www.imdb.com/title/tt4803766/