Recent content on Tobias Schäfer's Blog
Zammad is widely used for ticketing and
case management, including in public services. In those environments,
 identity correctness is a security requirement : wrong-account linking,
unexpected re-activation, or silent identity drift are not “ops problems”,
they are audit and incident triggers. 
 This post documents identity and provisioning behaviors that can lead…
If you organise your music with beets you already
have a well-tagged, neatly structured library on disk. Beets Store turns that
library into a browser-based music player — albums, artists, tracks, playback,
and downloads - without standing up a separate media server. 
 
 A single-page app without a JavaScript framework 
 Every navigation link and search form in the app is…
Finch began with a very pragmatic problem: debugging without logs is painful,
and turning on the right logs is often impossible once you depend on
third-party systems or a production environment you can’t easily change. 
 The original idea was deliberately small
 get a working logging stack up quickly , then make enrolling machines
trivial. 
 
 Since then, Finch has…
Modern software development thrives on collaboration, and issues are its
fundamental communication unit. But as teams and projects grow, it becomes
challenging to see the bigger picture: Are issues being addressed efficiently?
Where do bottlenecks appear? Which categories linger, and why? This is where
thoughtful issue lifecycle analysis comes into play. 
 
 With…
When it comes to software development, having clear insights into your code’s
test coverage is invaluable. Coverage data informs where improvements are
needed and helps maintain high-quality standards. Go offers built-in tools for
generating coverage reports, but these reports can often be difficult to
interpret. 
 
 I created gocover-ui to address this challenge and…
Suspicious outbound connections can indicate malware activity, data
exfiltration, or unauthorized access attempts. By logging these connections
with conntrackd and pushing them to Loki,
you can analyze and visualize outbound traffic patterns, identify anomalies,
and enhance your security posture in Grafana. 
 
 A few steps to get you started 
 Let’s assume you are…
When I’m investigating weird connection patterns - unexplained SYN floods,
flaky peer connections, or a service that suddenly stops answering - the kernel
already knows a lot about what’s happening. conntrack holds the live state for
every tracked connection; conntrackd makes those events visible, searchable,
and enriches them with context so you can act. 
 
 I wrote…
When I started Finch, my primary pain point was simple: debugging without logs is like flying blind. A minimal logging stack made troubleshooting easier, but as my own systems (and yours) have grown, I realized that logs alone aren’t enough . 
 
 Modern applications need: 
 
 Metrics for performance and health. 
 Profiling for deep-dive analysis (CPU, memory, etc.). 
…
One of the recurring challenges I face as a software engineer is debugging issues with little to no logs. Often, bug reports or production issues land on my desk containing only vague error descriptions — and crucially, missing the logs that would make the problem reproducible. 
 This situation becomes even harder when third-party services are involved. In those cases, I can’t simply “turn up”…
If you’re running an encrypted ZFS root filesystem on Debian and want to
enhance boot-time security with hardware-backed two-factor authentication, the
 yubikey-zfs-initramfs extension is a robust solution. It introduces a
YubiKey-based challenge-response mechanism into the initramfs stage, ensuring
only users with both the correct passphrase and physical key can decrypt…
The Raspberry Pi is equipped with a VideoCore (VC) GPU, a low-power
mobile-multimedia processor, which can encode and decode a series of multimedia
codes. Additionally, the VC provides information about the hardware and its
peripheral devices.
These information or metrics are exposed via the Linux kernel and can be
accessed with the command line tool vcgencmd . vcgencmd is part…

 Retrieval-augmented generation (RAG) is a technique that enables large
language models (LLMs) to retrieve and incorporate new information. Typically,
the data to be referenced is converted into LLM embeddings, numerical
representations in the form of a large vector space.
 – From the Wikipedia article Retrieval-augmented generation (RAG) 
 
 The latter part is…
In today’s digital age, the intersection of artificial intelligence (AI) and
privacy is a critical concern. As organizations increasingly rely on
data-driven insights, the need to protect personally identifiable information
(PII) becomes paramount. This post explores how to redact sensitive data with
the OpenFaaS function Maceo .
Maceo utilizes Microsoft Presidio to
analyze…
I learned my first lessons from K3s and
 inlets-pro on my Raspberry Pi 5 devices. And came up with
a new tunnel architecture. 
 
 Two inlets cloud tunnels passing through
any TCP traefik and preserving client IP address with proxy protocol v2.
The first tunnel is used to route ingress traffic to the K3s cluster.
The second tunnel is used to route management traffic into…
Recently, I created a K3s cluster on three Raspberry Pi 5
devices and started using inlets-pro for tunneling
private services to the public. A lot of new things to learn. Finally I ended
up with the below architecture. 
 
 Here’s a short summary of the steps I took to get there. 
 Simple K3s Cluster 
 Setting up the RPIs and K3s was a breeze using Alex…
This is the first post on my new hugo blog which is being hosted on my
Hetzner dedicated server. Amongst others the server is running traefik and
minio as Docker containers. Both services build the backend for the blog. 
 I went to these steps to run the blog. 
 
 Created a bucket on minio to store the blog content. 
 Created a user and a policy to deploy the blog with the…