Recent content in Blog on Yet Another SysAdmin Website
Introduction Not many Virtual Private Server (VPS) providers consider FreeBSD a first-class citizen, and few encourage you to encrypt your hard drive from inside the VPS. Though encrypting a VPS hard drive does not protect against everything and requires one to access the web KVM of the provider to type in a password on each reboot, I still find it reassuring. You need a little know-how to be able…
Introduction I have blogged about my pf firewall configurations a few times, but never my Linux ones. There is nothing especially unusual about it, but it does differ somewhat from the common nftables examples. Configuration This is the configuration for my Gentoo laptop. It has two Wireguard interfaces and references two egress interfaces, one for Ethernet and one for WiFi: #!/sbin/nft -f flush…
Introduction For almost a decade, I have been operating my own mesh overlay network using a combination of point to point OpenVPN tunnels with OSPF on top. It was well automated with Ansible and served me well all these years. I decided it was time I tried to move this to Wireguard instead and spent a bit of time making it all work. This article does not explain everything I did, but will present…
Introduction I recently had my phone die on me and had to get a new one. One of the first apps I install is Syncthing , in order to restore my photos and app data. Syncthing on Android has had quite the history, and for a time it was the norm to use Syncthing-Fork. A few months ago, this fork went through an ownership change, and I stopped updating this app until things settled. On a new device, I…
Introduction Though it is less common nowadays, SSL certificate provisioning can still be full of surprises when dealing with old school setups in client environments. Some colleagues did not know how to easily check if a certificate and private key match in a clean one liner, and their LLM research came up with “interesting” suggestions with at least 6 pipes and too many checksum…
Introduction I find most of the popular dependency update automation tools like Dependabot or Renovate cumbersome to integrate, first and foremost because they cannot be run locally easily. Secondly, they cover everything and the kitchen sink and you cannot easily pick some languages or ecosystems to support. But if I could somehow ignore that, sadly they are clunky even in a forge setting as soon…
Introduction I have been using Forgejo Actions to run CI tasks for about a year. I have been mostly content with them because they are well integrated with Forgejo itself, but I always thoroughly disliked relying on a stack of nodejs Actions that do way too much and that need to be updated way too often. With all the supply chain attacks that make the headlines on hacker news, I started…
Introduction I participated in Advent of Code 2025 in Haskell. It was a fun experience as always! Why write about this now? Because I finished the last puzzle last Saturday! I did all the puzzles each day on time last December except for day 10: part 2 was harder than all the rest combined! Life happened around Christmas, and I took the usual long break away from the puzzles before finishing.…
Introduction One of my readers contacted me with an interesting question regarding Wireguard on FreeBSD: how to run Wireguard inside a jail instead of on the host. I only ever ran Wireguard on the host since that’s where I centralize all my routing and firewalling but was curious to explore the question. Requirements Nowadays Wireguard is easier to configure than ever on FreeBSD! But running…
Introduction Last week I needed to script the download of a specific asset from a release of a private GitHub repository. It turns out that there is no direct way to do this as you first need to resolve the asset name into an ID. Here is a little script that does just that without any big dependency like the gh CLI. The script #!/usr/bin/env bash set -euCo pipefail github_pat = 'XXXXXX' owner =…
Introduction Today’s AWS outage is a good time to remind sysadmins that AWS DynamoDB is no longer required to handle state file locking when storing state files on AWS S3. Since last year, the S3 state backend has supported state locking via S3 object locks. This locking method is simpler, faster and removes a dependency on an AWS service that we no longer need. DynamoDB was the default…
Introduction I have been using a Forgejo action (compatible with GitHub actions) for testing my OpenTofu/Terraform modules on AWS. I planned to blog this earlier, but since it worked without quirks I completely forgot to publish it. Usage example The action relies on having an AWS IAM access key provisioned in your CI’s secrets. An astute reader will notice I am naming the secret…
Introduction I last blogged about how to run simple QEMU virtual machines in 2021 in this article . I often use these commands to spawn virtual machines that I only access via SSH, but it was never for their GUI! Now the need arose and the necessary bits were harder to piece together than I expected. Installation I updated the VNC and drive sections for modern QEMU flags compared to the last…
Introduction I gave Raku several tries over the last 15 years. I was initially a bit disappointed when it was first released as Perl6 as it was very slow to start and a resource hog. I was disappointed again sometime in the late 2010s I tried the freshly renamed Raku. Still very slow to start up and consumming too much memory for what I was attempting, but much better. I tried again this summer…
Introduction I participated in advent of code 2024 in Haskell: it was a fun experience as always! Why writing about this now? Because I just finished the last puzzle! I did the first 12 puzzles each day last December but then life happened and I could no longer complete one puzzle per day. I only finished the first 19 puzzles by Christmas then took the usual long break. I picked up this challenge…
Introduction Managing secrets in AWS is a common task. It is therefore surprising that the default aws_secretsmanager_secret_version usage does not properly enforce a secret value. At first glance, it appears to enforce secret versions properly because updating the secret’s value results in an updated AWS secret version accordingly. Furthermore, if the secret is deleted then…