Feed for https://chown.me
A while ago, I had the need to synchronize certificates across machines. I was able to answer it using a perhaps uncommon trick which I thought might be worth sharing. Let's say you have one domain for which you want multiple machines answering requests. Of course, you choose to provide that service over TLS (doesn't matter whether it's http or another layer 7 protocol). As usual, the first step…
Intro In this article, I'll explain how, and why I acquired an Autonomous System Number and some IPv6 addresses. Getting some IPv6 cravings again In late 2020, I read https://blog.dave.tf/post/new-kubernetes/ . In this post, the author said if they were to build something new, they would focus on "IPv6 only, mostly". This post got me to thinking about having some IPv6 connectivity again. Before I…
Last year, I wrote about my infrastructure as of 2019. Here's the update for 2020! I would advise that you first (re)read last year's article, since this one will be more like a diff . Goal for this infrastructure Goals stayed the same. Machines My machines are still hosted in the same 3 different places. The first is Exoscale , the second is Vultr and the third is... my flat. My choice for OS…
How can you block one IP simultaneously on multiple machines? The goal As described in My infrastructure as of 2019 , my machines are located in three different sites and are loosely coupled. Nonetheless, I wanted to set things up so that if an IP address is acting maliciously toward one machine, all my machines block that IP at once so the meanie won't get to try one machine after another. This…
This article announces a new version of this blog. Available right now! In my previous article , I said that "seeing how easy writing a static site generator was made me want to write one for my blog," and that's what I did! I initially wrote a very long article to tell the whole story, but then I decided I didn't want to have such a long article here. Here's a short version. Basically, I used a…
Some context first I bought my DSLR at the end of 2014. I wanted to host the resulting pictures somewhere. I never liked Flickr much, so I went with 500px. I liked the website and the UI/UX was pretty nice. The community was pretty cool. Having skilled photographers around is really valuable, as you can learn and find inspiration. But it might also hurt (it definitely did, sometimes) to see…
I've wanted to write about my infrastructure for a while, but I kept thinking, "I'll wait until after I've done $next_thing_on_my_todo." Of course this cycle never ends, so I decided to write about its state at the end of 2019. Maybe I'll write an update on it in a couple of moons; who knows? Goal for this infrastructure The goal for my infrastructure is to run the services I need. While a lot of…
Social media Blogging... I created this blog a few years ago because I wanted to talk about the stuff I was experimenting with, and in my opinion it was cool to have a blog. I still have the same opinion, but now I'm using the blog more like a portfolio. I like it because I take a lot of care with it and I like to build high quality stuff. However, it takes me. So. Much. Time. I have to be really…
This article is best enjoyed with basic knowledge of OpenBSD autoinstall and Ansible My router runs OpenBSD -current A few months ago, I needed software that had just hit the ports tree. I didn't want to wait for the next release, so I upgraded my router to use -current. Since then, I've continued running -current, which means upgrading to a newer snapshot every so often. Running -current is…
I frequent the #openbsd IRC channel in order to help people. A question commonly asked is how to automatically lock your machine when putting it to sleep with zzz(1). I answered this question in a previous article (which was actually written four years ago; time flies!) but it was written in French, so here's a new one, also covering additional related topics. Locking the machine when it is put to…
Five years ago I wrote about using a yubikey on OpenBSD. The only problem with doing this is that there's no validation server available on OpenBSD, so you need to use a different OTP slot for each machine. (You don't want to risk a replay attack if someone succeeds in capturing an OTP on one machine, right?) Yubikey has two OTP slots per device, so you would need a yubikey for every two machines…
Note: this is also available in audio format: 3:49 (1.6MB mp3) (1.3MB ogg) A few months ago, I stumbled across A reading list for new engineering managers . I'm not sure that I want to become a manager, but even so, knowing how management tasks should be approached is valuable. Knowing how things work from the other side helps me to understand the bigger picture, so I try to do that with most…
What is the best way to improve the quality of your actions? According to the author of the book The Checklist Manifesto , it's with checklists. A few months ago, a friend wrote a blog article about how her memory began to fail her. Another friend commented that she wrote a checklist to avoid forgetting anything before a commit, after having read The Checklist Manifesto . Another passion of mine…
After two mostly boring flights, I was in Nantes on Sunday. I didn't do much because I wanted to get some rest after an exhausting week and tried to get my body into this new timezone. After a long night of sleep, I went to the hackroom. It was already well crowded for the first morning. On Friday the week before, I asked my boss at 5 pm if I had to take days off. He said "no" as a way to support…
In June this blog will be five years old. Since I created it , it has had the same design. A few weeks ago I looked for a new theme. I found pelican-blue which I liked. For my first theme, I took it from someone and shortly after someone took it from me. This time I wanted something more unique. I took pelican-blue and hammered the CSS so people would notice I love the color red . At home, my…
Why OpenVPN? For my dayjob we access the servers we manage through OpenVPN. Of course it's not the only security measure, it's yet another layer and it helps to cut a part of the IBN . All of our servers are registered in LDAP and from this system we create some routes that the OpenVPN server pushes to the OpenVPN clients. What did I need? Follow the pushed routes, not always and not for all the…
A few years ago I bought a camera (a Canon 100D) and since that I take pictures from time to time. I go through all the pics I take and I pick the best then I enhance them a bit with rawtherapee and finally I post them on 500px . This process is a bit relou so I don't often do it. Of course I don't always have my camera with me, but I do have my phone most of the time. I take a lot of pictures…
Finding something to install on it 6 weeks ago, I ordered two pine64 units. I didn't (and still don't) have much plan for them, but I wanted to play with some cheap boards. I finally received them this week. Initially I wanted to install some Linux stuff on it, I didn't have much requirement so I thought I would just look what seems to be easy and/or the best supported systemd flavour. I headed…
I also wrote a shorter and less personal report on undeadly , feel free to read it rather than this one if you don't want to know about other things than the hackathon. August was a busy month events-wise. I had the visit of coworkers who work in France, because this year's Debconf took place here, in Montreal. After a week of fun activities, I went to debconf with them. With my badge , people…
2FA Of course by 2FA I mean two-factor authentication . I've been using that for a long time for ssh with my yubikey on OpenBSD but I've never enabled 2FA on the online services I use. The main reason for not doing it before was that I thought that my phone had to play a central role (which in fact is not much the case). While it's the most critical device I have, my phone is the device I trust…
Getting an account Since end of March I have had an OpenBSD account which means that I can do some commits on my own, the login I use is danj . I was then invited to p2k16 which took place in Nantes, about 100kms from where I live (Rennes). Planning I read most of hackathons report (if not all) on undeadly, and people often says that they had plans. So I thought I was going to do the same. Finally…