Recent content on Sebastien Wains
As some of you may know, I work for Red Hat as an automation advocate in Belgium and Luxembourg. My work is to assist customers leveraging automation to achieve their business objectives, and Ansible Automation Platform (AAP) can be instrumental in achieving those goals. A request I hear from many customers is the desire for dynamic or programmable “surveys” inside Automation…
This post is an update on my 2023 post that was using Authentik. I’ve moved away from Authentik because I was probably using 1% of the tool. I settled on PocketID because I expect it to be simpler to maintain. Assumptions: you are already exposing a simple website service.example.com through Cloudflare Zero Trust this service is currently publicly accessible with no authentication whatsoever…
I own a Shelly i4 (DC model) that keeps an eye on two doors contacts (also knowns as reed switches), which I augmented with a Shelly Plus Addon that keeps an eye on five DS18B20 temperature sensors. I use Homebridge so I can see the live state of doors and probes through the Homekit app on my phone. The problem is Homekit won’t provide historical graphs. I’d like to know (for example)…
I have a lab environment running Ansible Automation Platform 2.3 (AAP) that I use for my customer demos. At the end of 2022 I stopped the VM for a couple of days. Today I start my AAP VM as usual. Everything seemed to work except when I try to run a simple job template. I get an error “cannot re-exec process to join the existing user namespace” in the job output.
Update Dec 25, 2024: steps updated for Authentik release 2024.12.1 Assumptions: you are already exposing a simple website service.example.com through Cloudflare Zero Trust this service is currently publicly accessible with no authentication whatsoever Authentik is already installed (it’s really just a .env and a docker-compose.yml) and available at https://auth.example.com (behind Cloudflare…
Official documentation of Shaarli only gives a PHP example, but I’m more of a Python kind of guy. This is how to generate a JSON web token (JWT) using some Python or Javascript code. Python Keep in ming this uses PyJWT (pip install PyJWT) and not jwt. Replace SHAARLI_API_SECRET accordingly: #!/usr/bin/python3 import time import jwt now = int(time.time()) payload = { 'iat' : now }…
I recently moved from running a VPS in some cloud to running a VM on my home server and exposing it behind Cloudflare tunnels. Everything was great until I decided to host an instance of Ansible Automation Platform (AAP). I could reach the UI and API (using Insomnia). Somehow when trying to use the Automation Controller Ansible Collection to manage my AAP, I was getting an interesting error…
I work at Red Hat but I happen to run some Ubuntu systems. Ubuntu has netplan for network management. I have to admit I find it easier than the nmcli or nmtui of Network Manager. In 2020, I wrote about how to configure VLAN for libvirt virtual machines. I’ll let you go through the 2020 article. The important thing to keep in mind is how a VM can’t connect to the host in the same VLAN…
If you need to generate configuration files quickly based on templates, you can use envsubst to help you. On Fedora, envsubst is part of the gettext package, which is installed by default. Let’s imagine this template: - name: $name group: core url: 'https://$name.wains.be/' interval: 5m conditions: - '[STATUS] == 200' - '[CERTIFICATE_EXPIRATION] > 48h' Now export a variable: export name=blog…
Tested on k3s 1.22.5. StackRox has been open sourced a couple of days ago! StackRox has been acquired in February 2021 by Red Hat (my employer) and we stick to our promise to Open Source communities so we finally contributed the code back to the community. The project is documented to install on k8s or OpenShift. I wanted to give the StackRox project a try on my own VPS (running this very blog)…
I have a Lenovo t14s and a Dell WD19TB Thunderbolt Dock. The thunderbolt security level is set to user authorized in the BIOS. You need to use boltctl to authorize devices. If you want to authorize the docking you can use: boltctl list # take note of the uuid of your device boltctl authorize XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX Authorizing won’t remember your docking if you unplug and replug it.…
Lenovo Thunderbolt docking stations are terrible Ever since getting my new Thinkpad t14s, my Lenovo ThinkPad Thunderbolt 3 gen 1 docking (Type 40AC) started acting up on the USB side. The USB was flapping constantly (keyboard, mouse, camera and DAC attached to a USB switch plugged into the docking). The keyboard was missing keys, the mouse was lagging every other seconds, etc. As a workaround, I…
Moving from i3wm to bspwm In December 2019, I wrote about my Linux desktop environment running i3wm. In May 2021, I changed role at Red Hat, requiring me to present and share my screen a lot more than when I was a consultant. I started looking at how other tiling window managers were handling things and decided to give bspwm a try. After some tests I made the move in September, because it is…
There are many lightweight or light enough Kubernetes distributions out there: k0s, k3s, Microk8s, OpenShift CodeReady Containers, Microshift, etc. Those lightweight distributions are a very inexpensive way to learn Kubernetes or OpenShift, and is a good approach to eventually embrace Enterprise Kubernetes distributions. In this post I will show how to quickly spin up a virtual machine based on…
TESTED ON FEDORA 34 AND 40. PLEASE REPORT SUCCESS OR FAILURE FOR YOUR FEDORA VERSION IN THE COMMENTS By default on Fedora, when you install the package obs-studio you might not see the “Start virtual camera” button. The reason is that OBS is expecting a v4l2loopback module to be loaded. Installation In order to do so, you will need to enable rpmfusion repositories for your version of…
If you want to expose a service from your LAN to the internet and you can’t open ports, you can use ngrok, or its open source alternative FRP. Server The server will be the middle man between your service and the person visiting. Install FRP server (called frps). I installed my instance on Docker using Ansible and the cloverzrg/frps-docker image: --- - name: frps tunnel server side hosts:…
So I run a Fedora virtual machine on a Libvirt host running in my garage. I use SPICE and virt-viewer from my laptop in the office to connect to the VM. Despite the cabled gigabit link, SPICE performances are not optimal. While I can live with poor full screen video performances in SPICE, I can’t stand crackling audio. The crackling audio was particularly bad when scrolling in a webpage in a…
So you want a smart doorbell? I have wanted one for a long time. My expectations: as open source as possible notifications on phone and other devices notified when at home (obviously) but also when not at home I want a photo of the person, I don’t need to see the face in the notification, I only want to be able to tell if that’s the postman, the UPS guy, a neighbor or someone else (I…
By default on a Fedora system running SELinux in enforcing mode, custom scripts won’t be able to make any connection through curl, wget or else. I changed /etc/apcupsd/onbattery to notify me on my Gotify instance, but it was not working when unplugging the UPS. A quick look in journalctl gives us a pretty good hint: Nov 12 22:04:47 yo.example.org python3[13500]: SELinux is preventing curl…
Motion without object detection is worthless I replaced my old Synology DS213j with a Fedora box. I have talked about this in a previous post. The one thing that held me for a while was Synology’s take on home security, called Surveillance Station. It was holding me from moving to a fully open source alternative, but admittedly Surveillance Station never worked quite well with my outdoor…
Ever since purchasing a Synology NAS, the Linux admin in me have been frustrated with the limitations and sometimes weird implentations of Synology DSM. I decided to go back to a fully open and much more manageable system for the sysadmin that I am. I have a small rack in the garage so I was looking for a small form factor. Mainboard: Gigabyte B450 I AORUS PRO WIFI ITX PSU: Be quiet!
Previous title was “libvirtd with trunk port and VM in VLAN aware bridges”. I use my small home server as a virtualization host running Fedora 32. It has only one network interface enp8s0. I have 3 VLANs: 10 home 20 guest 30 work My NAS sits in VLAN 10 and I wanted to be able to run virtual machines in VLAN 20 and 30 with no tagging done inside the guests VMs.
In BIOS: choose M.I.T. menu (whatever that stands for) Advanced CPU Core Settings SVM (whatever that stands for) Mode to Enabled Save and exit
If you have always passed the --listen option under /etc/sysconfig/libvirtd and you can’t get libvirt to listen on a recent Fedora install, read on. Fedora has changed the way to start libvirt in listen mode. The new way is to not touch /etc/sysconfig/libvirtd at all, and use libvirt socket services: systemctl enable libvirtd-tls.socket; systemctl start libvirtd-tls.socket. You can keep…
For the longest time I have been using this bit of (kinda incorrect) Ansible code to log into IdM: - name: Logging in to IPA and store session cookie uri: url: '{{ ipa_url }}/session/login_password' method: POST force_basic_auth: yes headers: Content-Type: 'application/x-www-form-urlencoded' body: 'user={{ username }}&password={{ password }}' status_code: 200 validate_certs: false register: login…
For readers interested in Ansible, I gave a talk about Ansible and Red Hat Consulting at the Ansible Automates 2020 Event, with my colleagues Anton and Marc. Ansible Automates is a full day event, and it was virtual this year, as most events. Our talk was mostly targeted at a business audience (which might not be the dominant audience of this blog :-)). If you’re looking for more technical…
I’ve been trying to add the new mode for my ultra wide monitor with resolution 3440x1440. I was getting this error: X Error of failed request: BadName (named color or font does not exist) Before my wide screen, I used to configure my VM with QXL drivers. It turns out QXL won’t accept the ultrawide resolution. Solution reconfigure your VM with Virtio graphical drivers execute this…
From Mkdocs to Hugo I moved this blog from Mkdocs to Hugo just yesterday. Mkdocs has a great search engine by default but no RSS. Hugo has RSS built in but no search engine. Some themes provide the search functionality, though. I like simple stuff and decided to go with Etch theme, which unfortunately is one of those themes with no search engine. Hugo doesn’t have search engine I decided to…
For the demonstration purpose, let’s create a container, we can use whoami: docker run --name whoami --net userbridge containous/whoami Create the configuration file for Caddy, for example under /opt/docker/caddy/Caddyfile: { # email to use on Let's Encrypt email youremail@example.org #acme_ca https://acme-staging-v02.api.letsencrypt.org/directory #debug } example.org { file_server }…
/etc/traefik/traefik.yml: [...] providers: file: directory: '/etc/traefik/dynamic/' watch: true [...] /etc/traefik/dynamic/redirect.yml: http: middlewares: redir: redirectRegex: permanent: true regex: 'http://old.wains.be/(.*)' replacement: 'https://new.wains.be/${1}' routers: redir: rule: 'HostRegexp(`old.wains.be`)' entrypoints: - http middlewares: - redir tls: certresolver: 'letsencrypt'…
Context I’ve used a number of todo list applications over the years. I have recently decided to use a simple kanban with three columns (todo/wip/done) as my todo list, and it works wonders. I self-host a Kanboard instance, so I have full control over my boards. I no longer depend on a company that could decide to shut down the service overnight (not looking at you, Microsoft [after…
I sync my data from my Seafile instance back to my NAS. Well, when it works. In the most random fashion, my Synology NAS “Cloud Sync” enjoys to take a break. And up until now, it seemed impossible to get it back to sync. You would expect that restarting the app would trigger a resync, but alas, no, it doesn’t. We’re talking about Synology here, right. The only option was to…
As per their website: Node-RED is a programming tool for wiring together hardware devices, APIs and online services in new and interesting ways. With default install, you can wire up API, mostly. I installed Node-RED on my VPS using their Docker image: https://hub.docker.com/r/nodered/node-red If you want to use Ansible to deploy your Node-RED (in my case behind Traefik v2): - name: node…
I write articles on my personal computer. Mkdocs supports Markdown, which has some great advantages: articles are stored as plain text on disk the content is indexed making it easy to find content with Alfred/Spotlight/grep you can grep, sed, awk the hell out of your articles and bring corrections very quickly can (and should!) be stored in a Git repository This is my current publication workflow:…
swatchdog was originally called swatch. I’ll call it swatch in this article. So, swatch is a very simple process that can monitor a log file live, and take actions if a string is found. It’s an ideal situation if you don’t have the resources to run a full fledged monitoring solution such as Graylog. On Fedora, install the package: sudo dnf install swatch Create a configuration…
I have used Linux as a desktop environment since about 2006, mostly with Gnome or Cinnamon. Around 2016 I got bored of the general direction that most desktop environments (“DE” for short) were taking (what I would call “Apple-ization”) and decided to tailor, hand craft, optimize and automate my Linux DE. By no way the aim was to make it sexy, but rather making it more…
I have ordered a TPLink HS110 Smart Plug to test how it compares to my aging Wemo plugs. They are super straight forward, reliable and they don’t hiss like some Wemos can do. I have created an extension for Ulauncher allowing to manage my plug. It is available at https://ext.ulauncher.io/-/github-sebw-ulauncher-tplink-smartplug
Problem: Authentication fails for AD users on RHEL system in an Freeipa/AD trusted environment. The following errors can be found in the logs: Cannot find KDC for realm "EXAMPLE.COM" in /var/log/sssd/krb5_child.log Backend is marked offline, retry later! in /var/log/sssd/sssd_$domain.log pam_unix(sssd:auth): authentication failure in /var/log/secure Assumptions and context: AD domain: example.org…
Problem So if you press F11 in Firefox, by default it goes 100% full screen. If you want to put Firefox in an i3 workspace shared with other applications and make Firefox “full screen” inside its container, as presented below: Solution In Firefox, in the URL bar type about:config. Then change: full-screen-api.ignore-widgets: true
You can use the DOCKER-USER chain to pass any custom iptables rules you want. In my case, I run a DNS resolver publicly and want to prevent it from being abused in DNS amplification attacks. I use the following: iptables -I DOCKER-USER -p udp --dport 53 -m string --hex-string '|0000FF0001|' --algo bm --from 40 -j DROP iptables -I DOCKER-USER -p tcp --dport 53 -m string --hex-string '|0000FF0001|'…
On Fedora you can install with: dnf install asciinema To start recording: asciinema rec /path/to/mysession.cast End recording: Ctrl-D or exit Play a session: asciinema play /path/to/mysession.cast Learn more at https://asciinema.org/
Orphan volumes List mountpoints that are not in use: for j in $(for i in $(docker volume ls -qf dangling=true) do docker volume inspect $i | grep 'Mountpoint' | awk -F':' '{print $2}' | awk -F''' '{print $2}' done) do du -h --max-depth=1 $j done Now feel free to remove folder that you considered not needed anymore. Orphan images Removing unused images is possible directly from the Docker command:…
Project page Source code Gotify is: a simple server for sending and receiving messages self-hosted free and open source under MIT license a simple API a simple GUI written in Go building docker images at every release It comes with a nice Android application available on the Play Store and F-Droid, that listens for events over a websocket. I have been using it for about 10-12 days now, without…
I once wrote about how to simulate latency on Linux. The article has been useful for myself recently, as I was at a customer who was having all kind of weird issues, probably caused by unreliable network, and slow performing disks. I recreated their environment on my Libvirt lab. You can throttle the I/O of a Libvirt disk, as documented here and here. Example:
For a long time I was getting random 502 errors “Bad Gateway” on my Docker instance running on a small VPS. I run my containers behind a reverse proxy, with Let’s Encrypt. Initially I was using Nginx, then moved on to Traefik, but the problem remained. I was thinking it was related to the number of containers (16 for 2GB of RAM), but that was a network issue according to logs…
Let me introduce you to Hastebin. It is a simple pastebin service that you can self-host. Server The server bits are available at https://github.com/seejohnrun/haste-server. I personally use this Docker container: https://hub.docker.com/r/mkodockx/docker-pastebin Client The awesome part is that you can paste from the command line! You have two choices: using gem or a simple bash alias that…
Everything has already been said and documented about ZSH. I made the switch two days ago and only regret I didn’t switch before. I have checked ZSH and Oh my zsh back and forth for the past two years, but never committing to it. I was thinking it was too much trouble learning something new, for too little benefits. Oh boy I was wrong. First of all, it’s 99% like bash but you get power…
A long long time ago I wrote about screen. While screen has been helping sharing terminals with colleagues or clients for many years, tmux is the alternative that can apparently achieve more. You can refer to https://tmuxcheatsheet.com/ for all the useful tips. My (very) basic usage of tmux is to split the screen when I need to work on anything else than my workstation (on which I run terminator…
IMPORTANT: This blog post covers Traefik version 1. With Traefik, you can easily reverse proxy your containers, and automatically generate a Let’s Encrypt certificate for them. It’s pretty awesome. No more complicated Nginx containers coupled with another Let’s Encrypt companion! In the following setup, the name of the container will be used for the certificate generation. For…
Start broadwayd broadwayd :5 & Start a GTK3 application (for example gtk3-demo) GDK_BACKEND=broadway BROADWAY_DISPLAY=:5 gtk3-demo Application can now be reached from http://hostname:8085.