HN user

psYchotic

67 karma

meet.hn/city/nl-Arnhem

Interests: Programming, DevOps

---

Posts1
Comments32
View on HN

I'm considering moving reverse proxying to Traefik for my self-hosted stuff. Unlike the article's author, I'm running containerized workloads with Docker Compose, and currently using Caddy with the excellent caddy-docker-proxy plugin. What that gets me, currently:

- Reverse proxying, with Docker labels for configuration. New workloads are picked up automatically (but I do need to attach workloads to Caddy's network bridge).

- TLS certificates

- Automatic DNS configuration (using yet another plugin, caddy-dynamicdns), so I don't have to worry too much about losing access to my stuff if my ISP decides to hand me a different IP address (which hasn't happened yet)

There are a few things I'm currently not entirely happy about my setup:

- Any new/restarting workload makes Caddy restart entirely, resulting in loss of access to my stuff (temporarily). Caddy doesn't hand off existing connections to a new instance, unfortunately.

- Using wildcard certs isn't as simple as it could/should be. As I don't want every workload to be advertised to the world through certificate transparency logs, I use wildcard certs, and that means I currently can't use simple Caddy file syntax I otherwise would with a cert per hostname. This is something I know is being worked on in Caddy, but still.

Anyway, I've used Traefik in k8s environments before, and it's been fairly pleasant, so I think I'll give it a go for my personal stuff too!

PS: Don't let this comment discourage you trying Caddy, it's actually really good!

Isn't ArgoCD more of a GitOps tool? The pretty UI is mostly secondary to its main purpose for me, which is to keep the declarative "truth" in source control, and have ArgoCD be the control loop that keeps the cluster in sync with that truth. Accidentally nuked namespace? No worries, ArgoCD's (or whatever alternative, like flux) got your back!

The $5 Plan 3 years ago

You should look at Hetzner [0]. They offer unmetered bandwidth on their dedicated servers with a 1Gbps uplink (I personally run a Tor relay on one averaging a sustained 15+Mbps over the past year), idem for their "Storage Share" offering, and 20TB/month at 1Gbps on their cloud VMs.

I'm not affiliated with them, just a happy customer.

[0] https://www.hetzner.com/

- the password box truncates passwords silently

PayPal does this, which means I lost the ability to use PayPal for a few days because my password manager generated something longer than the 16(!) or so characters PayPal accepts. If you're going to implement a form to set or change a password, you should probably let it accept a length greater than whatever you're going to store and validate it client side (and in the backend for those who have javascript disabled, though you should validate in the backend anyway).

If I'm trying to relate to something a relative stranger is telling me, I'll use one of the later versions unless I want to drop the (often unknown what to do with) bomb that I experienced such-and-such with my dead wife, too. Many people don't know how to handle that.

Asking as someone that wants someone such as yourself, a total stranger, to feel like they can share however much they need if it helps in any way: how _should_ I handle that?

It kinda pains me to hear you basically explain how you have to consider another person's feelings when you are in pain. I can't imagine even having that capability myself, were I walking in your shoes.

If a certificate has been issued for a domain, and that domain doesn't show up in the certificate transparency logs, that's not something I'd cheer for: that issuer could just as well hand out certificates for your domain to others without you ever knowing about it.

Conversely, if a domain shows up in the CT logs, then there have been certificates issued for those domains, even if there exists a wildcard certificate that is valid for that domain. If that happens, check your settings, because there's probably something requesting certificates you're not aware of.

Or, ironically, the podcast of the guy he responded to, adamgordonbell: https://corecursive.com/

It's a podcast I've really been enjoying for a few years now. It used to be a little more technical (as the name, corecursive, kinda implies), but found a niche in interviewing people more about the people than the tech they're knowledgeable about, which is also very pleasant. Anyway, I encourage you to listen to both an early and a recent episode to find out if you like it.

You probably misunderstood: gp won't make mistakes in a medical field because he's not a medical professional, so he won't do anything in the medical field.

The same sometimes applies to designers and developers: if developers don't design, then of course they won't make bad designs.

The gist of it all is: don't ridicule people for mistakes, even if they're in their supposed field of expertise. Just let them know they've made a mistake if you see one.

Start Self Hosting 4 years ago

My hosting stack seems to be similar to yours. In addition to the services themselves, I run a watchtower container to check for new images for me, which then notifies me through yet another selfhosted solution: gotify. I have watchtower setup not to automatically recreate the containers (I've been bitten by postgres updates a few times too many).

Speaking of Wireguard: I've been looking for a web-based management interface to define Wireguard networks with (using the server it runs on as a sort of central "hun"), but haven't yet found anything I really like and/or found simple enough to use. What does your Wireguard setup look like?

Watchtower: https://github.com/containrrr/watchtower Gotify: https://github.com/gotify/server

Can't the same be said about the algorithm to generate the Collatz sequence for any given number? By that definition, I shouldn't be calling that an algorithm.

Log4jscanner 5 years ago

May I suggest you look into grype[0], or some other similar tool? It can be used to scan images for vulnerabilities. You'll probably find a bunch of vulnerabilities that aren't likely to actually affect you, but still, at least you'll know they're in the images you're running. And maybe you'll start using things like docker-slim[1] on your own images to get rid of those vulnerabilities you do find.

[0] https://github.com/anchore/grype

[1] https://github.com/docker-slim/docker-slim

For any Arch user running into this thread, wanting to install this: the project went through a rename (to xh), and a package has been added to the Arch "community" repo.

So all you need to install this now is:

    pacman -Syu xh

This may have been semirecently been added to git, but look into [0]: git add -i It launches a fairly simple interactive text UI that allows you to select files to stage, and it allows one to "patch" into the staging area, which works by showing you a bunch of hunks, asking for each if you want to stage it (or you can even edit a hunk in your $EDITOR).

I'm sure it's not nearly as nice as Magit's UI, but I've been a happy user of this feature for a while.

[0] https://git-scm.com/book/en/v2/Git-Tools-Interactive-Staging

Thanks! I can confirm the brightness of LEDs: I went for the Massdrop ALT (the 60% brother of the CTRL). Although I didn't buy it for the lightshow, it's been a great conversation starter at work.

Back to programming the keyboard: all I've really ended up doing is mapping PrintScreen to Fn+P (remember, fewer keys on my board, so no physical PrintScreen). I've also been playing with what qmk calls a "tap dance" [1]. I use it to have my Control key be left control when just pressed once, but when I double-tap it, it becomes Right Control (which the board also lacks a physical key for, and it's useful in VirtualBox).

I've also been toying with the idea to program the LEDs to display a ripple effect, where everytime you press a key, a ripple of light spreads out. Maybe something like that already exists, but I'd like to try programming it myself, if time permits.

[1] https://docs.qmk.fm/#/feature_tap_dance

Would you mind sharing a few of the things you've programmed on your keyboard? I also spent an insane amount of time looking for just the right keyboard for me, which wasn't that easy, as the availability of mechanical keyboards in Europe isn't great, and importing is expensive. My main criteria were: - need to be able to swap switches easily (if I'm spending a decent amount on a board, I don't want to have to get a whole new one if I don't like the switches) - want to be able to program the keyboard, preferably because the board is supported by qmk[1].

I have now owned such a keyboard for over a year, but I've barely started to get into programming it. I'm starting to wonder if I really needed the feature that much, or if I just lack the imagination to find ways to program my board.

[1] https://qmk.fm