Recent content in Welcome to Excipio on Excipio
I love Hugo , and it serves as the basis of both my blogs. It’s quite an incredible static site generator, which gives a ton of flexibility and is very lightweight to run, as on a modern machine, serving static HTML files is pretty much free. But, of course, not everything is perfect. For a while now, I’ve been looking for a way to host a bunch of loose thoughts that I’ve been…
For a while now, I had this growing feeling that something was wrong with my main server. This is where I host most of my public services: a mail server, a bunch of websites behind nginx, PostgreSQL and MariaDB, my git forge, and a few other things. These are all services that I use for myself, which wouldn’t be a problem, but I’ve also started selling some of them to friends, family,…
I was lucky to have been born in the early 90s. I was also lucky that my parents had some disposable income. Even luckier that things like the Raspberry Pi Foundation existed while I was alive and young. 
 I shouldn’t take these things for granted. I lived through the rise of the personal computer, the introduction of internet to the masses, and then high speed internet, then high speed…
The amount of posts and videos that I’ve seen in the past ~12 months which are announcing the end of Free Open Source Software is off the charts. From AI tools being set loose on several project’s issue and pull requests boards, to a veritable flood of security vulnerabilities being discovered by automated tools, not forgetting the burn out that many developers are feeling in these…

 
 


 For a while now, I’ve self-hosted a runner to integrate with Gitea Action . But there was something about it that was leaving me worried: in an age where software supply chain security is becoming more and more important, I felt like I needed to improve the security of the setup. The answer I arrived at, while not perfect (yet), it’s a great improvement over…

 
 
 What’s new 
 
 A revamped CI pipeline; and a package registry as well 
 Tests, so I’m not flying blind 
 Authentication with Dex 
 Rate limiting, written from scratch 
 The REST API aka the doors that lock 
 A CLI for login and operation 
 
 
 What I learned meanwhile 
 
 Type assertions can be weird 
 Pick your…
Sometimes, laziness can be a great motivator. 
 In effect, what I wanted was a zero-trust setup for remote authentication. On one hand, because it’s way more secure; but the real motivator was that I got tired of typing or copy/pasting passwords. 
 For a while now, I’ve been using both a Nitrokey and a Yubikey for authentication and signing on my local machine. This has many…

 
 
 What’s new 
 
 Admission Webhooks, our gatekeeper 
 Network Isolation to keep tenants apart 
 LimitRanges for resource guardrails 
 
 
 Testing our platform 
 
 An ownership trap 
 Deployment of a proper tenant 
 The deployment of a bad tenant 
 
 
 Closing thoughts, and what’s next 
 
 
…
It’s hard to think about a more fundamental part of one’s digital identity than a password manager. In a sense, if you want to be sovereign over your digital presence, the password manager is what allows you to hold the keys to your kingdom. It’s pretty much that one security measure that everyone can agree on; managing all your passwords by yourself is bound to create problems…
I saw this post on my feed , and it caught my eye because I self-host a Mattermost instance. The fact that it has possible critical security issues is a concern for me. So I checked the github issue with the details . 
 Of course, it’s fully LLM generated, but that’s to be expected at this point. So I opened the first issue described there, a CRITICAL VULNERABILITY no less.…

 
 
 The Bad Stuff (and why it’s good!) 
 Guardrails are here 
 The Reconciler Pattern 
 The Good Stuff (and why it’s really good!) 
 What’s Next 
 
 
 


 In part 1 we could see the foundation of this project taking shape - we had a zero-framework HTTP server, with structured logging. Solid foundations are very important, but…

 
 
 The Problem 
 The Philosophy 
 The Implementation 
 What’s next? 
 
 
 


 The Problem 
 While talking with a friend that works in IT, he repeated something that I’ve heard before many times: “It’s really difficult to guarantee consistency of developer experience.” It’s not that we don’t have the…

 While I’m no stranger to building dashboards , there was always something that bothered me when I was using Grafana for displaying the metrics I wanted to look at: it was a web app! Now, while web apps are much maligned, they do serve a purpose. But for the purpose of displaying rather the rather simple information that Prometheus collect (yes, simple: a complex metric is a useless…

 While I’m no stranger to building dashboards , there was always something that bothered me when I was using Grafana for displaying the metrics I wanted to look at: it was a web app! Now, while web apps are much maligned, they do serve a purpose. But for the purpose of displaying rather the rather simple information that Prometheus collect (yes, simple: a complex metric is a useless…
After finishing my previous project , I felt an itch to continue building. One of the things that was noticeable during that process was that my coding skills were not being pushed: while the app I built did teach me about integration of Prometheus inside a Golang application, there wasn’t much else new for me there. So, for my next project, I chose to concentrate on building software. 
…
After finishing my previous project , I felt an itch to continue building. One of the things that was noticeable during that process was that my coding skills were not being pushed: while the app I built did teach me about integration of Prometheus inside a Golang application, there wasn’t much else new for me there. So, for my next project, I chose to concentrate on building software. 
…

 
 
 The Foundation 
 The App 
 The Pipeline 
 

 
 k3s and cilium 
 Setting up the repository 
 Argo CD 
 

 
 Ingress and SSL 
 Automating the CI/CD pipeline 
 
 Pushing to dev 
 Managing staging and prod 
 
 
 

 
 Improving the backend 
 Monitoring and logging 
 
 Prometheus and…

 
 
 Improving the backend 
 Monitoring and logging 
 
 Prometheus and Grafana 
 Loki and alerts 
 
 
 Final thoughts and considerations 
 
 
 


 We’ve now arrived at the last stretch of this journey. As mentioned in the previous post, we will now try and establish some ways to increase the visibility on what’s happening…

 
 
 Ingress and SSL 
 Automating the CI/CD pipeline 
 
 Pushing to dev 
 Managing staging and prod 
 
 
 What’s next 
 
 
 


 After installing and setting up all the different pieces of our CI/CD pipeline, we still need to do a bit of work to make sure that this process is as automated as possible, as is working in tandem to…

 
 
 k3s and cilium 
 Setting up the repository 
 Argo CD 
 What’s next 
 
 
 


 After what I have done in the previous post , the next step is to start building our infrastructure. For that, I will be using a few tools, namely: building a Kubernetes cluster, harnessing the power of k3s and kustomize , both of which greatly simplify the…

 
 
 The Foundation 
 The App 
 The Pipeline 
 What’s next 
 
 
 


 This is going to be a series of posts about a learning journey on what it takes to build a GitOps pipeline, with the added constraint that I’m going to be self-hosting all of the necessary parts to achieve this. On one hand, it’s bound to be a great exercise to…
Perhaps one of the most pressing issues of our days is the (lack of) control we have over our online presence. Being spied on became the default expectation, and the lengths that this has gone to is sometimes hard to believe. Even a few months ago, it was revealed that a novel tracking method had been discovered in Meta’s Android application (Facebook and Instagram), as well as…
In the aftermath of the AWS outage, there’s a lot of talk about how the Internet has been taken hostage by this specific provider, and how the internet is not decentralized anymore. While it doesn’t seem like this is necessarily wrong - after all, the recent outage, and all AWS outages for that matter, seem to take down a sizeable portion of the internet - it’s both misguided and…
There’s a feeling you have when you just uncover a fact so shocking, and yet so obvious, that’s hard to put into words. That’s what I felt when I saw this wonderful statistic: as far as I can tell, the only category of products that had a deflationary rate, averaging -7% a year for the past 20 years, was “Information Technology, Hardware And Services”. I had already…
A sometimes overlooked aspect of infrastructure is how we can use different layers of the OSI model to implement features that are not typically associated with it. One example is to provide access control for applications through the network layer - while this is typically associated with and implemented at the application layer, there are simple ways to leverage level 3 solutions to very quickly…
One of the things that I’ve always tried to implement on all the services I run is self-sufficiency. Now, this isn’t completely achievable, in the sense that I still depend on services and software that other people provide, but it’s still an ideal to strive for. In my particular case, all the services I run are self-hosted with no external dependencies, either from a raspberry…

 excipiō (present infinitive excipere , perfect active excēpī , supine exceptum ); third conjugation iō-variant 
 
 to take out, extract, pull out 
 to except, exempt from, exclude 
 to rescue, release 
 to host, accommodate, welcome 
 
 
 Let me start by establishing some ethos here, which I think might be important: I deleted my Instagram account in 2013; my…