Recent content in Vegard S. Hagen on Stonegarden
Direct Server Return (DSR) is a networking technique that allows a backend server to learn the original request’s source IP address and respond directly, even behind a load balancer. This results in reduced latency and improved throughput, as well as the ability to filter traffic based on client IP.
The Border Gateway Protocol (BGP) is used for routing information between so-called autonomous systems (AS). A common use case for BGP is for routing traffic between Internet Service Providers (ISPs) — or in large private networks.
Custom OIDC claims allow more granular control as we can give each client application its own scope with custom claims. In this article we’ll use Authelia backed by LLDAP as an Identity Provider (IdP) to implement custom claims for Argo CD and Audiobookshelf .
Authelia is an open-source authentication and authorisation solution, fulfilling an identity and access management (IAM) role, providing multi-factor authentication (MFA) and single sign-on (SSO) for applications via a web portal.
Self-hosting multiple applications often means having to deal with disparate user accounts unless you can integrate them with a common third party. A tried and tested framework for this is the ubiquitous LDAP, or Lightweight Directory Access Protocol , server.
Kubernetes RBAC configuration can seem like a daunting task at first. In this article we will try to demystify some of the mechanism behind the authorisation process in Kubernetes and learn how to generate our own credentials to communicate with the Kubernetes API server.
Traditionally, an ideal Kubernetes workload should be stateless, meaning it should be able to run anywhere and scale freely, though this also severely limits which kinds of applications we can run, i.e. stateful applications.
SREDay London 2024 together with the day-0 TalosCon 1 just finished, and I’m happy I got to attend! I first heard about TalosCon during KubeCon + CloudNativeCon in Paris earlier this year, which also gave me the final push to actually try Talos .
Talos is an immutable operating system designed to only run Kubernetes . The advantage of Talos is an out-of-the-box Kubernetes install, as well as a smaller attack surface, and easier maintenance.
If you plan to run stateful applications in your Kubernetes cluster, you quickly run into the question of where to store this state. A database is often the best solution, though writing to disk is sometimes the only — or at least easier, option.
Taking advantage of hardware acceleration can drastically reduce both CPU and power usage when playing video, enabling seemingly innocuous chips — like the Intel N100 , to render multiple 4K video streams.
In this article we’ll take a look at how to proxy external services through the Kubernetes Gateway API . There are of course more lightweight methods to proxy services, but once you already have the proverbial hammer, why not treat everything like a nail?
In my previous article we took a look at how to bootstrap K3s with Cilium starting from a fresh Debian 12 network installation .
Getting started with Kubernetes might seem like a daunting task at first, but getting a basic ephemeral cluster up and running with tools like minikube , kind , or k3d is quite straightforward if you follow their documentation.
With the LLM era upon us, I’ve been wanting to play around with some of the open source , self-hosted toys available . I’m using an old workstation as a homelab, which conveniently has an old NVIDIA GPU installed. Seeing as I’m running a Kubernetes cluster I want to expose the GPU to the workloads to utilise the existing infrastructure for easy hosting, scheduling, and deployment…
Archived : This is an archived article, see the updated article here . In the Gateway API SIG’s own words,
In the Gateway API SIG’s own words, If you’re familiar with the older Ingress API , you can think of the Gateway API as analogous to a more-expressive next-generation version of that API.
In this article we’ll explore how to use Traefik in Kubernetes combined with Cert-manager as an ACME (Automatic Certificate Management Environment) client to issue certificates through Let’s Encrypt .
For my homelab I’m running an over-engineered one-node Kubernetes “cluster” using Cilium as the Container Network Interface (CNI). Up until recently I used MetalLB for LoadBalancer IP Address Management (LB-IPAM) and L2 announcements for Address Resolution Protocol (ARP) requests over the local network, but Cilium has now replaced this functionality.
In a recent article I wanted one of the images to change dynamically with the theme. I didn’t find any support for this in the Blowfish Hugo theme I’m using, so I had to get creative. I also wanted to reuse an earlier shortcode I experimented with for automatically resizing images.
My first motorcycle was a Moto Guzzi V65 Custom from 1986 which I constantly tinker with. One of the charms with veteran bikes is that you can kinda hold all the inner workings of the bike in your head at once, and it all kinda just works if you don’t mess up too bad.
Hi, and welcome! 👋 I’ve always had a curious min and enjoy exploring new ideas and concepts, this led me to get picked up by Edgeworks (🇳🇴) where I currently work as a DevOps consultant engaged at Statens pensjonskasse .
This is going to be a bit of a follow-up on an earlier article on Cloudflare SSH tunneling where we configured SSH-tunneling through Cloudflare’s WARP-client. In this article we’ll configure Cloudflare’s cloudlared -tunnel and a Zero Trust Application to expose a browser rendered terminal to our server.
I use Argo CD to maintain my Homelab as I find it intuitive. The nice GUI also helps me to quickly inspect problems which might occur when I try something fancy. Another widely used alternative is Flux CD which solves the same problem of GitOps-ing your cluster, but I have little experience with it yet.
Being able to log into your servers from everywhere with an internet connection is convenient as you never know when something may decide to break. However, exposing your ssh-connection to the open web can pose security risks if not done correctly. There’s a plethora of solutions to help with this, e.g. Tailscale , OpenVPN , ngrok , or similar VPN providers. In this article we’ll focus…
https://github.com/docker-mailserver/docker-mailserver-helm/tree/master