Recent content on book.rymcg.tech
This is part 5 of a series on nixos-vm-template:
Running code agents in an immutable NixOS VM Bootstrapping a Docker server with immutable NixOS on Proxmox Mutable VMs are cool too Managing VMs with home-manager and sway-home A NixOS NAS in a Proxmox LXC container (this post) Every post in this series so far has been about virtual machines - libvirt on a laptop, KVM on Proxmox, immutable or…
I am moving the older blog.rymcg.tech posts into the book.rymcg.tech site.
The old blog URLs will keep working, and their permalinks will be carried over to the new site structure. The goal is to keep the published paths stable while consolidating the content into one Hugo/Org project.
The DNS transfer is now complete: book.rymcg.tech is live as the new home for all of this content.
If…
In a previous post, I introduced git_extensions.sh – a monolithic bash script providing custom git subcommands (git vendor, git deploy, git deploy-key, git remote-proto). It worked fine. It was also a sprawling monolith of bash, with global variables named things like VENDOR_SSH_PORT and URL parsing done through cascading regex in BASH_REMATCH. The kind of code where adding a feature means holding…
In part 2, we set up NAT bridges where the Proxmox host itself performs IP masquerading for VMs on private networks. This is simple and effective, but it means that every VM on a NAT bridge has a direct path to the internet through the host kernel. There is no way to inspect, filter, or control that egress traffic at the VM level.
In this post, we will create a Virtual Private Cloud (VPC): an…
This guide shows how to record audio playing in Firefox using Audacity, with PipeWire as the audio backend. You’ll create a virtual sink to route Firefox audio into Audacity, and use qpwgraph to set up monitored playback so you can hear what you’re recording through your headset.
Prerequisites PipeWire (with pipewire-pulse) Audacity qpwgraph Create a virtual sink Create a null sink called…
Note: This post documents the manual installation commands. An automated installer is now available: artix-dev.
This guide documents setting up Artix Linux with dinit on a ThinkPad X1 Carbon laptop. Artix is an Arch-based distribution that does not use systemd. This setup includes full disk encryption with LUKS + LVM (including encrypted /boot), a sway Wayland desktop managed by Nix…
When testing system deployments meant for air-gapped networks, you need a way to simulate having no internet access while keeping LAN connectivity intact. Rather than physically unplugging cables or reconfiguring your router, this bash script gives you a quick toggle to block all outbound internet traffic using iptables/ip6tables, while preserving local network access.
This is useful for…
Note: This post documents an older version of this idea written in Bash script form. A newer version has been ported to Babashka.
Git is already a mass of arcane incantations and eldritch commands. So naturally, we’re going to bolt more onto it. Why? Because typing the same 47-character SSH URL for the hundredth time is a rite of passage nobody asked for.
This post introduces a script that…
This is part 4 of a series on nixos-vm-template:
Running code agents in an immutable NixOS VM Bootstrapping a Docker server with immutable NixOS on Proxmox Mutable VMs are cool too Managing VMs with home-manager and sway-home (this post) A NixOS NAS in a Proxmox LXC container The previous posts covered creating and managing VMs with nixos-vm-template. But how do you actually integrate it into…
This is part 3 of a series on nixos-vm-template:
Running code agents in an immutable NixOS VM Bootstrapping a Docker server with immutable NixOS on Proxmox Mutable VMs are cool too (this post) Managing VMs with home-manager and sway-home A NixOS NAS in a Proxmox LXC container The nixos-vm-template project has, so far, been only about immutable VMs: read-only root filesystem, separate /var disk…
If you need to access an HTTP service that requires authentication (Bearer or Basic auth), but you don’t want to put the API token anywhere near your code, you can use this script to create a localhost-only proxy for that service. The proxy accepts unauthenticated requests originating only from 127.0.0.1, and it will inject the API token into your requests, and forward them to the upstream…
Just is a command runner - a modern take on the Makefile. You define recipes in a Justfile and run them with just . It’s become my go-to for project automation: building code, managing VMs, running tests, whatever the project needs.
Just has built-in tab completion for recipe names, which is nice. But it stops there. If a recipe takes arguments, you’re on your own. For a project like…
This is part 2 of a series on nixos-vm-template:
Running code agents in an immutable NixOS VM Bootstrapping a Docker server with immutable NixOS on Proxmox (this post) Mutable VMs are cool too Managing VMs with home-manager and sway-home A NixOS NAS in a Proxmox LXC container In the last post I described running AI code agents inside immutable NixOS VMs using libvirt on a laptop. That setup…
This is part 1 of a series on nixos-vm-template:
Running code agents in an immutable NixOS VM (this post) Bootstrapping a Docker server with immutable NixOS on Proxmox Mutable VMs are cool too Managing VMs with home-manager and sway-home A NixOS NAS in a Proxmox LXC container AI coding agents like Claude Code and Open Code run in your terminal, read and write files, execute commands, and…
WebDAV is an open extension to the HTTP protocol that lets you treat a web server like a remote filesystem. Rclone is an open source WebDAV client that lets you mount remote volumes for read/write access on your local computer.
Provision your WebDAV server You can use any WebDAV server that you have access to. If you need to install one, I recommend copyparty or nextcloud (Use the d.rymcg.tech…
Have you ever SSHed into a remote machine and run a program that tried to automatically open a URL in your web browser using xdg-open?
xdg-open is designed to open URLs in your preferred web browser. On your local machine, that usually works great. Logged in remotely over SSH, without a graphical session, it may try to open the URL in a text-mode browser (e.g., links, w3m), but more than…
To gain remote access to a machine behind a NAT, you have quite a few options. Some of the better ones include:
Open a static port at the router.
Use a VPN.
Both of these top options require some preplanning. Sometimes I want a method that is considerably more temporary or ad-hoc, so heres another option:
Initiate a reverse tunnel to any old SSH host and expose a public port via…
WireGuard is a super fast and simple VPN that makes it easy to set up secure, ad-hoc, private connections using the latest encryption tech. WireGuard’s design makes no distinction between “server” and “client” — every node is simply a peer. You could designate a particular node as a “server”, and build a hub-and-spoke architecture, or you can design a full mesh network where every node can talk to…
Networked Attached Storage (NAS) is a very useful service to provide for your homelab. It can serve many different roles:
Samba share on your LAN for storing all your files NFS remote for mounting as proxmox VM storage local S3 compatible buckets iSCSI block storage and more Proxmox has great ZFS support all by itself, and if you only need to create VMs, you should probably stick with that. If…
In part 1 of the virtual-proxmox series, we installed Proxmox on on a regular Linux desktop computer inside of KVM (Kernel Virtual Machine). In this post, we will do something similar, but this time we will install a virtual Proxmox inside of an existing Proxmox server, and then make a cluster of virtual Proxmoxen, all managed from one dashboard. This endeavour serves no practical production…
This example installation will use the ODroid H3 as the core pfsense router for a home installation.
ODroid H3+ with 6 NICs This configuration includes an addon card for a total of six 2.5Gbps Ethernet network controllers (NICs).
ODroid H3+ parts list Network design The six NICs on the odroid will be used like this:
port 1: WAN - wide area network, ie. the internet. Connect this to…
Thinkpad X13S running Arch Linux ARM The Thinkpad X13s is the first Lenovo Thinkpad with an ARM processor (Qualcomm Snapdragon 8cx Gen 3). This laptop is designed to run Microsoft Windows 11 (ARM), but the processor has initial support from the Linux kernel.
This tutorial will install Arch Linux ARM (“alarm”) on the Thinkpad X13s, however as of March 2023 this is not yet officially supported.…
I remember in the days of MS-DOS you could use a “RAM doubler” to compress your memory storage and get “more” RAM, and then a bit later on there was a joke website where you could “download” more RAM. Well both of these are a reality in Linux (no joke), called Zram
On my test system, the Odroid-m1, without zram - I have 8GB of physical RAM, and no swap:
Let’s make a network router/firewall/DHCP/DNS server for the home LAN, with nftables, dnsmasq, and dnscrypt-proxy, all inside of a Proxmox KVM virtual machine, and a physical four port network interface using PCI passthrough. We’ll use nftables counters on a per-route basis to collect traffic statistics, and export these to a separate prometheus/grafana VM in order to monitor bandwidth…
This post introduces a shell script to create KVM virtual machine templates on Proxmox.
KVM? According to Wikipedia:
Kernel-based Virtual Machine (KVM) is a virtualization module in the Linux kernel that allows the kernel to function as a hypervisor. With KVM you can create virtual machines that are hardware accelerated. Unlike a container, a virtual machine boots its own virtual hardware…
Here is an automated script to install Proxmox containers (LXC) from base templates, configuring their SSH servers with passwords disabled, and optionally installing Docker for nesting containers.
Honestly, LXC is cool, but KVM is compelling. If you’re in a hurry, you might want to skip directly to the next post part 5: KVM
LXC? According to the LXC Introduction page:
LXC is a…
Now that you have installed Proxmox, created a storage pool, and configured the networking, you’ll want to setup notifications in case a hardware error occurs, or in the case of a backup job failing. Let’s setup email notifications, and test that they are working.
Prior to Proxmox 8.1, to do this you had to configure postfix by hand, and setup your outgoing SMTP server and credentials. If you…
In part 1, we installed a fresh Proxmox server, configured SSH, updated repositories, and configured a basic node firewall.
In this post, we will continue setting up our Proxmox server’s network.
Use bridge networking for private networks By default, Proxmox uses bridge networking, which is very simple to setup, assuming you already have a LAN and an existing DHCP server and gateway on it.…
This post will detail how to install proxmox and perform the initial configuration. This is an abbreviated supplement to the main Proxmox install guide
Hardware requirements x86_64 CPU architecture (Intel and/or AMD 64 bit) VT-x (hardware acceleration for virtualization) VT-d or “directed IO”, for PCI passthrough support (optional) Wired ethernet for your LAN/WAN Download Proxmox VE .iso image…
Restic is a modern backup program that can archive your files onto many different cloud and network storage locations, and to help restore your files in case of disaster. This article will show you how to backup one or more user directories to S3 cloud storage, using restic and systemd.
Choose an S3 vendor and create a bucket Restic supports many different storage mechanisms, but this article…
Introduction In Part 1 of this series, you installed a Virtual Proxmox server in a libvirt virtual machine (with the GUI tool virt-manager), and you chose the network selection of type Virtual Network 'default': NAT. This type of network only allows traffic from another (virtual) machine on the same network ('default'), including from your host workstation (libvirt has created a virtual network…
Introduction In Part 1 of this series, you created an Ubuntu VM template, and three KVM virtual machines (all cloned from the same template) on your Virtual Proxmox host, and you joined all three nodes into a single K3s cluster, using the same cluster token.
It is a special point in time when you have not yet installed anything on your cluster. You can use Proxmox to make a snapshot of these…
This is the first post in the proxmox series, read the introduction first. This post describes how to install Proxmox inside of a KVM virtual machine on your development workstation and setup a small K3s cluster.
If you want to install Proxmox on a non-virtual computer instead, you can follow the official guide and then come back here and skip to the middle of this page (Setup SSH keys and…
RClone is an excellent, open-source, file synchronization tool. It supports a lot of different service backends. However, it does not automatically sync when files are saved, like the (proprietary) Dropbox tool can. Instead, the common suggestion is to run rclone in a cron job, but this means that your files will only be synchronized as often as the cron job runs.
We can improve this, with a…
This post directly follows the work done in Part 11, where Drone was setup, and test jobs were made to run on the cluster. Still, some workloads are not well suited to running inside of Kubernetes. Ironically, one of these unsuitable workloads is building container images. Generally speaking, container images are built with docker or podman, or some other container builder tool, but these tools…
Drone is a self-hosted Continuous Integration platform, an equivalent to GitHub Actions, Jenkins, Travis CI, or similar. Drone will automatically run jobs in response to commits to git repositories in Gitea (previously setup in Part 4).
## Same git repo for infrastructure as in prior posts: FLUX_INFRA_DIR=${HOME}/git/flux-infra CLUSTER=k3s.example.com NAMESPACE=drone PVC_SIZE=5Gi…
OpenFaaS is a platform for creating serverless functions and microservices on kubernetes.
## Same git repo for infrastructure as in prior posts: FLUX_INFRA_DIR=${HOME}/git/flux-infra CLUSTER=k3s.example.com Add the flux HelmRepository OpenFaaS is distributed as a helm chart. The easiest way to consume this, is to add the helm repository directly to flux, and let flux handle it. HelmRepository…
This post directly follows part 8 where you installed Wordpress and MariaDB. To avoid disaster, you now need to schedule backups of your database. You will modify the StatefulSet that runs MariaDB, so as to start two additional containers (called sidecars) in the same pod, woolfg/mysql-backup-sidecar that performs a backup of the database to a new volume, and Lobaro/restic-backup-docker to upload…
The blog you’re reading is static, built using hugo. I personally don’t have any use for Wordpress, but it is a ubiquitous application which is useful for demonstrating a simple installation.
You can see from the Wordpress docker-compose quickstart, the installation only requires two containers: MariaDB, and Wordpress itself. MariaDB is stateful, it requires a volume to store data. Wordpress…
In part 3, the Traefik IngressRoute for the whoami service was configured with TLS certificates from Let’s Encrypt. This type of certificate only authenticates the server, not the client, leaving client authentication as a requirement on the application layer. (For example, requiring to submit a username/password via HTTP, before access is granted.) This is enough, and normal, for secure public…
If you can’t access container images, you can’t start containers. Self-hosting your own cluster-local container registry is a must.
Configure the git repository directory you created in part 1 along with other config variables:
FLUX_INFRA_DIR=${HOME}/git/flux-infra CLUSTER=k3s.example.com REGISTRY_ADMIN=admin REGISTRY_IMAGE=registry:2 REGISTRY_PVC_SIZE=20Gi Create namespace [bash]: Run…
Flux is a Continuous Delivery platform for Kubernetes infrastructure. Flux will syncrhonize your git repository containing your YAML manifests, and automatically apply changes to your cluster. Manage your cluster via GitOps!
Install flux operators Configure the git repository directory you created in part 1 along with other config variables:
FLUX_INFRA_DIR=${HOME}/git/flux-infra…
Gitea is a self-hosted git platform, much like GitHub. You will push your local flux-infra git repository to gitea, for backup, and for continuous delivery (CD) via Flux (Flux to be installed in part 5.
Configure the git repository directory you created in part 1 along with other config variables:
FLUX_INFRA_DIR=${HOME}/git/flux-infra CLUSTER=k3s.example.com Install Sealed Secrets…
Traefik is a proxy service that will allow HTTP and TCP services running inside your cluster to be exposed to the public internet. It follows the standard Kubernetes Ingress API. Traefik handles automatic and transparent TLS (HTTPS) with ACME certificates (Let’s Encrypt).
Create Traefik YAML manifests Configure the git repository directory you created in part 1 along with other config…
To start testing with k3s, keep it simple, only create one node. You can add more nodes later. You can deploy it anywhere you like, just follow the documentation. Abbreviated notes are below for generic hosts, and detailed instructions for DigitalOcean droplets.
Install k3s on a generic host If you already have a provisioned Linux server, or Virtual Machine, you can install k3s on it, with a…
This is the first post in the K3s series, read the introduction first.
Prepare your workstation When working with kubernetes, you should resist the urge to directly login into the host server via SSH, unless you have to. Instead, you will create all of the config files on your local laptop, which will be referred to as your workstation, and use kubectl to access the remote cluster API.
You…