Recent content in Home on apalrd's adventures
Today I’m taking a look at my MONO Gateway - but with my own software twist. You may know I am not a fan of the OpenWRT project for end users (mostly due to their very poor and inconsistent documentation), and usually recommend OPNsense, but this time I want to build something DECLARATIVE! So I’m of course going back to just plain Debian. I’m using systemd-networkd for this, so…
Today I am taking a look at the weird world of multicast, where packets get delivered more than once, and we route using a backwards routing table. But, once you understand how it works, a whole world of content distribution possibilities open up to you! Inspired by an old video by @TallPaulTech, I’m using live TV distribution as an example of how multicast works, and how it can potentially…
In this project, I explore using my new Autonomous System Number (ASN) to start my own content delivery network. It doesn’t really host much, just my own internal services, but it should show all of the challenges of running stuff ‘at scale’ (i.e. beyond one single node and datacenter). Starting my own Content Delivery Network In the first video, I introduce my CDN and how I will…
Today I’m finally starting to put my AS Number to use, rolling out my Content Delivery Network! Currently it’s actually not delivering anything useful, just some neat statistics, but it’s helping me learn how CDNs work and share that with all of you. Here’s a neat visualizer which helps show how users end up at the CDN, when directed via DNS (geo-dns) and BGP (anycast). AI…
Today I’m tackling an issue that gets a lot of network engineers really hung up - in the old days, pushing DHCP data into DNS seemed like a good idea, but now it’s just garbage all around. What are some solutions you can use instead? Today I have three solutions - mDNS (multicast DNS), pushing DNS configs as part of automation (Ansible example), and pushing DNS from the host itself…
Today, in the next eposide on my Personal AS series, I have added a third POP / fourth router, and that means I need to configure the POP all over again. That’s a lot of work, so I automated it with Ansible! Also follow along to see my first use of Netbox for automation Contents Video Ansible - Inventory Ansible - Software Setup Ansible - Network Config Ansible - Routing Config Video Ansible…
In this project, I get my own Autonomous System Number (ASN) and start using it to explore the world of BGP routing on the internet, with my own /40 in the default-free zone! Starting my own AS for Fun (No profit) In the first video, I introduce my CDN and how I will direct viewers - using BGP-based-anycast, or DNS-based distribution? I also play with my first experiment, measuring the latency…
Today I’m taking a look at the Plumspace Smart SFP - a dual core ARM Cortex A53 stuffed inside a 1310nm SFP optical transceiver, which can deal with packet flows at line rate*. Quite a neat little thing, with plenty of use cases. Plumspace Smart SFPs: Link Contents Video Bridging Bridging - Ntopng Routing Routing - NAT44 Routing - NAT46 (CLAT) Wireguard OpenSSL Bench Video Bridging Kernel…
Today I’m setting up a GPON network in my homelab. GPON is the ITU’s Gigabit-class Passive Optical Network technology, one of the most commonly deployed fiber to the home technologies. While it’s being replaced by its faster descendant XGS-PON, it’s still capable of 2.44Gbps down / 1.22Gbps up across 128 clients, all using only passive optical components between the headend…
Today I’m bringing my shared bookmarks to the Fediverse: @bookmarks@mark.apalrd.net It’s a list of things that I like, basically. I hope to post links to lesser-known content creators or content that I really enjoy. The hope is that if you enjoy my content, that you might enjoy the things that I enjoy as well. Hopefully this brings you things that The Algorithm normally might not. So,…
Today I’m diving into Netbox, a tool designed to help you keep track of your network infrastructure. Netbox is a database of relationships, showing you what is connected where, all of your equipment, IP addresses and prefixes, etc. We’ve got a LOT to install today! So hold on tight and follow along. Probably also want to do an apt update && apt full-upgrade -y before we start just to…
Today I’m taking a deep dive into the Thread protocol! Based on IEEE 802.15.4, Thread is a mesh networking protocol designed to balance the needs of small, battery powered Internet-of-Things devices with the ability to communicate directly on The Internet. By leveraging IPv6 and 6LoWPAN, Thread is able to finally bring these automation networks into the land of the Internet Protocol, where…
Today I’m trying to understand if Wireguard really is over-hyped, if OpenVPN is really worth all the hassle to get the user-side features like client authentication and two factor, and if IPSec has any place in the modern VPN landscape. Specifically, looking at traditional ‘road warrior’ or client access VPNs, where all of your users are dialing in to your enterprise network, not…
One of the challenges of running Home Assistant in a virtualized environment is the access to hardware radios. Home Assistant ultimately needs to bridge a ton of home automation networks, and most of these require some sort of USB / Serial dongle. You could have all of your dongles in your server closet and pass them through to the VM/container, but then you can’t migrate it across hosts.…
Inspired by Jeff Geerling’s complete list of sponsor disclosures, I thought I’d work on my own page. This lists every company I’ve worked with in some form, alphabetically, and if any of these agreements were sponsored financially. All links to Amazon and Ebay on my channel are affiliate links. If I am a part of any other affiliate programs, I’ll note it below. Aiffro…
Today I’m diving in to the world of network access control! Being able to authenticate network devies plugged in to your switches is a great way to improve network security without resorting to unplugging or disabling every unused port on yout equipment. Now every switch port is universal, and will enable on demand based on what is plugged in. While I couldn’t go through the complete…
Today I’m setting up a simple nginx proxy, so I can store updates used by my many Linux systems. Most of them run a derivative of Debian, so this guide focuses mostly on caching apt repositories (Debian, Ubuntu, Proxmox, and more), but the same approach should work with any distro. Install nginx I’m using a Debian 12 (Bookworm) unprivilaged LXC container, but this is basic nginx which…
Today I’m diving into Mutual TLS to securely expose my homelab services! TLS is already ubiquitous in the modern era, providing strong symmetric encryption, perfect forward secrecy, and a public chain of trust to authenticate the server. But, it also has a lesser known ability to authenticate the client. By creating our own certificate authority to issue certs to clients, we can securely…
In this episode, I’m playing with Single Root I/O Virtualization (SR-IOV) in Proxmox Virtual Environment (PVE). I’ve heard ruomors that it will be anything from a minor to major improvement in IO performance for my VMs, so I wanted to do some testing on my own system to be sure. Please don’t take my results as final, I’m not comfortable saying that I’ve removed all of…
In this post (and video) I’m going to setup Netconsole, so you can capture kernel panics and logs on headless systems. I know some of you are doing wild things with graphics drivers and passthrough, so hopefully this helps you debug them. Enable Now This option enables the module immediately, so you can use it before you do dangerous things. You Simply rebooting clears the setting, so you…
Since I like to image systems I’m testing, here’s the process I use to capture the boot drive of a bare metal system in Proxmox Backup Server. I start by booting into a Debian Live image (the small one without a GUI). Next, I install Proxmox Backup Client from apt packages: #Run as root sudo bash #Add repo wget https://enterprise.proxmox.com/debian/proxmox-release-bookworm.gpg -O…
So, while I was on vacation, my Proxmox Backup Server boot drive failed! No problem, I take backups of the server itself …. onto the backup server. So in this video, I’m going to start from a clean PBS install, mount my intact backup pool, and then restore the PBS configs out of the backup. Video Restoring the Datastore First, we need to mount the data disks. In my case, they are a…
In this video, I’m setting up Authelia. It’s a very lightweight authentication service, which can be used to provide authentication to services which don’t natively support any form of authentication. I think this is a great choice for small scale homelab environments, as it’s simple to run and administer. Contents Video Authelia Configuration User File TLS Certificate…
This video started as the answer to a simple question - how can I self-host a service for my friends and family, behind cgnat, without requiring them to install any apps (like tunnels)? This video turned into a bunch of different ways to proxy IPv4 to IPv6, so you can receive IPv6 traffic natively and bring in legacy traffic from a VPS which does have public IPv4. While I’m giving you a lot…
So today I’m taking a look at the Kwumsy H3 ‘Stream Dock’ No, not THAT Stream Deck, not a dock for the Steam Deck, there’s already enough name confusion. Basically, it tries to be a lower cost touchscreen alternative to the real Stream Deck, making use of the same addon format for wide addon support, and also somehow a USB-C laptop dock with Ethernet, USB 3, HDMI, and…
Today I’m trying to reduce the power consumption of my Proxmox Backup Server. The HP Microserver is great for what I need, but it’s kinda loud and I’m working on optimizing my power bill. The homelab is the largest single consumer of electricity aside from the air conditioning in the summer, so it’s something I’m looking at heavily. Anyway, I thought I could do this…
I did a full teardown of this unit, see the video below. This page also has the ’extra info’ (pci, cpu, ..) for you. Video Click on the thumbnail to view the video on Youtube Hardware Info All of this was taken via an Debian 12 system (Bookworm / kernel 6.1), so your kernel may be configured slightly differently lscpu Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Address sizes:…
You’ve probably heard all about creating multiple VLANs, for things like your IoT network, guest wifi, and more. But do you know what a VLAN actually is, and what the difference is between a VLAN and a Subnet? Today I’m going to cover the numbering of subnets in your network, and how to set up new subnet and VLAN interfaces in OPNsense. Come along on this adventure! Contents Video…
This is a snippet of my Personal Server Migration, but I thought it would be more useful as a stand-alone tutorial. One of the challenges in dealing with unprivilaged LXC containers is that the UIDs/GIDs are mapped to 100000 in the host. This is a security feature, so the root user in the container doesn’t have root access if they are able to escape their container, but it’s also kinda…
Do you have security cameras at your house? Would you like to locally host all of your recording and analytics, to make sure nobody else has access to your video feeds and recordings? Would you also like to integrate with Home Assistant, the greatest open automation platform in the world? Then Frigate NVR is for you! In this video, I’m going to go in depth to setup Frigate in an LXC…
I’ve been using Mikrotik RouterOS for awhile now, both using their hardware and their virtual image (Cloud Hosted Router). It’s a great product for routing and firewalling, while it’s not a NGFW it’s an absolutely amazing router and their L2/L3 switches are also a great value for the price. So anyway, I often setup images of the latest CHR in Proxmox VE for testing things.…
Come along as I 3D print my own teleprompter! Hopefully improving my production quality, I guess you guys will be the judge of that. And the zip file for the parts (STL, 3MF, and FreeCAD originals) (CC-BY-SA)
Is RISC-V the future of computing? I sure hope so. So I tracked down one of the cheapest Linux-capable SBCs that supports this architecture, the Milk-V Duo. For a retail price of $9, this little guy offers a RV64 Linux environment complete with busybox, Ethernet, and a wide assortment of IO rivaling some microcontrollers. Today I’m going to steup the board and start learning about RISC-V…
When you’re troubleshooting network issues, it’s often extremely helpful to view and analyze packet captures. The de-facto tool for this is the open-source Wireshark, which has an extensive protocol decoding capability. So, as a Proxmox user, it would be nice to be able to analyze VM networking issues using Wireshark. Unfortunately for us, Wireshark is a graphical application and…
So Linux has adopted Persistent Device Naming, which is a really great thing for most systems. Unlike the old days where we just had eth0 and eth1 and eth2 etc (which at least has no spaces unlike Local Area Connection 6 that another OS uses), whose order depended on driver initialization in the kernel. Most people just had eth0 and were happy, and most people will still just have one Ethernet…
Today I’m taking my 10 servers and hopefully working that list down to just 7! JUST SEVEN! So, driven by my desire to consolidate my critical services into one box so I can lab away with the rest of the boxes, I am taking the time to shut down some of the most critical servers in the house and re-home them, then disassemble the parts for the next project. Come along with me on this…
A Discord member of mine came to me with an interesting problem - enbling the VLAN-aware bridge in Proxmox would cause all network traffic on the physical card to stop, entirely. Definitely a frustrating issue, especially since the kernel logs made no sense. The Problem Here’s what he sent from dmesg: [ 32.732509] mlx5_core 0000:19:00.1: mlx5e_vport_context_update_vlans:179:(pid 13470):…
Contents Video Installation Configure HTTPS Self-Signed Configure HTTPS Let’s Encrypt Video Installation I’m using an LXC container in Proxmox running Debian 12. You’re free to use any other Debian 12 system, and the instructions should still work. It’s not particularly resource intensive, but you can monitor it to see if you need to increase the RAM/CPU allocations. I also…
As promised in a previous video about my Proxmox Backup Server, I have a Quantum LTO-5 tape drive that I’m going to try and use to implement a proper 3-tier backup strategy with offsite tapes. I’m currently using Linode’s object storage for backing up my personal data (~200G), and not backing up the video files outside of the two existing copies (on the storage server and the PBS…
I’ve been using Linode’s object hosting for my website for ~2 years now, and it’s time for a change. I’m not unhappy with Linode, but object hosting isn’t for me any more and I’d like to move up to a virtual private server. Object hosting is a fantastic way to get started with a static website for a low cost, but I want better backend analytics and more control…
A common challenge in web design and network architecture is grouping multiple web services in a single host, or behind a single IP address. This is especially true with IPv4 due to the scarcity of addresses. The solution to this is a reverse proxy or load balancer. Essentially, this takes connections from clients and dispatches them to the correct server based on the domain name or URL in the…
Imagine if we could establish a level of trust that in our network, we can verify with certainty that a computer really is who it says it is. By bringing mutual authentication and trust into networking, we can better make security decisions on when connections should be allowed. This can enable our services to talk to each other securely over the global internet, and reduce the dependence on a a…
As an engineer, I LOVE looking at DATA! So today, I’m setting up my Proxmox system to push data to InfluxDB, where I can view it using Grafana. With this setup, I can keep track of how many resources all of my homelab services are using, which really helps when trying to size VMs, hosts, containers, etc. Contents Video Install InfluxDB 2.0 Install Grafana Example Dashboard Using TLS Video…
TRUST. It’s what certificates are all about. How do we know that we can trust a server? We verify that the server has a certificate, and that the certificate is signed by someone we trust. That can be a well-known third party like Let’s Encrypt, or our own certificate authority. In this video, I’m going to cover the basics of setting up a root private key and signing certificates…
Do you have so many self-hosted services running in your homelab that it’s hard to keep track of them all? Do you hate typing the IP/port for each one? You could use DNS, but a nice dashboard would make it easier too! Today I’m setting that up with Dashy, a beautiful and easy to edit homelab dashboard tool. It’s not the lightest weight tool in the world, but the look is worth it…
Do you have a need to extend your home network around your property? Maybe you want reliable internet in the shed you turned into a work-from-home office, or your garage or workshop? Today I’m going to explain what you need to run fiber optic newtorking around your home and property on a budget, for high bandwidth and low latency networking. Fiber doesn’t have any issues with lightning…
I’ve used a lot of different small form factor machines over the years, from the Raspberry Pi to used ebay thin clients. All of them are good at some things. But when Icewhale sent over their x86-based Zimaboard for me to take a look at, I’ve been impressed with the flexibility it has for me to test new software and hardware in a relatively cheap way. It’s not spectacular at any…
I’ve gone from “no backups” to “raid is a backup” to “two zfs pools in one box”, and decided it’s finally time for a proper backup solution. So, I settled on Proxmox Backup Server! And today, I rebuild my HP Microserver Gen8 with 4x10T refurbished SAS drives, a new SAS controller card, and more! With this backup solution, I’m feeling a lot…
I have a rack-mounted KVM now, and it’s great, but I’m working on building out a new Proxmox cluster which might not have a graphics output at all on some of the nodes. So, I need a new remote access solution for them. The new nodes I’m planning on building will all be based on used consumer hardware, so I’m limited by what would be available on normal mATX boards. This…
Since I use a lot of repurposed computers as servers, I don’t have many with IPMI / remote access built in. Usually I can configure them remotely through SSH or their web UI, but sometimes things go wrong and it’s nice to have remote console access. Enter, PiKVM, a project to build a networked KVM switch with a Raspberry Pi. Unfortunately, I have a more than one server, and building a…