Recent content on Lukáš Zapletal
Image Builder supports uploading images to AWS through its build or upload commands. For example: image-builder upload rhel-10.1-ami-x86_64.raw \ --to=aws \ --aws-region=eu-central-1 \ --aws-bucket=my-bucket \ --aws-ami-name my-rhel This works with static credentials (AWS access key ID and secret). The industry is moving away from long-lived secrets toward dynamic credentials: short-lived…
Many companies provide NetBird VPN access configured with a mandatory DNS resolving service to ensure malware protection. While this is a solid IT recommendation for the general workforce, it can be frustrating if you run your own DNS blocker at home (like Pi-hole or AdGuard Home) and want to keep your personal traffic routing through it for better performance or hostname rewrites. If your…
This guide covers deploying a streamlined, self-hosted audio and video archiving setup using Podman Quadlets. The stack integrates UN/BT tools and a web-based file management. All services are running rootful with SELinux in enforcing mode. Some containers are configured with host network for maximum performance of the network stack, this only works in rootful mode. By leveraging Quadlets, we can…
Immich has rapidly become the go-to solution for self-hosters looking to replace Google Photos. It is a high-performance, self-hosted photo and video backup application that boasts mobile apps, smooth timeline scrolling, and robust machine-learning capabilities for facial recognition and object detection. While the official documentation heavily leans on Docker Compose, deploying Immich using…
If you have a Fedora 43 (or older) system with public IP with ssh port opened, you are probably getting a lot of records like these: sshd-session[20884]: refusing RSA key: Invalid key length [preauth] sshd-session[31595]: Invalid user shop from 172.94.9.155 port 37434 sshd-session[57487]: Connection closed by 139.0.12.92 port 62968 These are scripts, bots or AI, trying to get in. As you already…
We live in a world where security is paramount, yet network provisioning is often still done via the ancient PXE protocol, which is by design basically an insecure remote execution. Hardware has moved on since the PXE times, and we now have powerful BMC software with capabilities that are a great fit for a secure, end-to-end network provisioning workflow. This post describes a way to leverage the…
Update 2026: Few changes, added host network mode which is more simple and less confusing. Let’s install AdGuard Home via Podman Quadlets. Volumes: sudo podman volume create adguard-work sudo podman volume create adguard-conf Everything must be done as root since AdGuard needs to bind UDP port. Volume units: cat <<EOF | sudo tee /etc/containers/systemd/adguard-work.volume > /dev/null…
I was experiencing a weird behavior of Google treating my blog - specifically with pages that had an alias. Turned out that Hugo generator, which I use for my blog, use client side redirect for aliases: --- type: 'post' aliases: - /2013/07/hidden-gems-of-xterm.html date: '2013-07-17T00:00:00Z' tags: - linux - fedora title: Hidden gems of xterm --- Generates this alias page: <!DOCTYPE html> <html…
While my primary editor is, and always will be, Vim, I find myself using VS Code more and more for longer editing sessions on larger projects. With its great Go support, decent (though not ideal) refactoring tools, and Copilot, it’s an excellent tool. Recently, I was exploring its Git capabilities and realized there are no default shortcuts for important actions like git commit or git push.…
Modern Linux distributions configure OpenSSH client to refuse connecting to servers without newer ciphers or key exchange algos. Symptoms are: Unable to negotiate with 192.168.200.83 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss The solution is clunky, so I created a small Debian-based container with OpenSSH client installed, it is an “oldstable” version old…
I wrote a small but fast tool called walkalike which calculates how two or more filesystem trees (or OS images) are similar. Usage: walkalike dir1 dirN Processing is optimized for SSDs and index creation is parallelized. Example command: walkalike testdata/a testdata/b Should print: 0.4444444444444 testdata/a testdata/b Similarity coefficient is between 0.0, when two trees are not similar at all,…
I found a much better tool to generate testing X509 TLS certificates than my own script which by the way is not correct. Here is how to generate a MTLS pair for typical web testing: #!/bin/bash -e wget -nc https://raw.githubusercontent.com/redhat-qe-security/certgen/refs/heads/master/certgen/lib.sh source lib.sh x509KeyGen ca x509KeyGen server x509KeyGen client x509SelfSign --notAfter '13 years'…
I use MacOS built-in text replacement feature a ton, however, after I started using Firefox recently I quickly found out that it does not work. The feature is disabled in about:config via setting named widget.macos.automatic.text_replacement , but even if you enable it it only works for textarea and not for widely used input element. And there is no solution so far. Well, there is a workaround by…
Here is how you deploy Invidious via Podman 5.x or higher. All commands are executed as a normal user, if you want to use root then you need to modify some paths. Root-less containers are preferred together with SELinux in enforcing mode for maximum security. Create a new volume for database: podman volume create invidious-db Start a temporary container: podman run --rm -it --name invidious-init…
Update: Updated in 2026 with newer MongoDB version. This article contains instructions how to run Unifi Controller from Ubiquiti via podman from Fedora, CentOS, RHEL, clones or pretty much any Linux distribution as long as it is version 5.x or higher. I tested this on Fedora versions 40-43 running with SELinux in enforcing mode and rootless containers via quadlets. The article assumes this is a…
The extensive AWS CLI is quite painful to install on Fedora or RHEL since the API is moving so fast that is gets outdated quite quickly. Luckily, Amazon provides containers published both on AWS and Docker registries. Configuration is easy: podman run --rm -it -v ~/.aws:/root/.aws amazon/aws-cli configure AWS Access Key ID [****************xwcz]: AWS Secret Access Key [****************CAC1]:…
My main machine for all upstream work was Intel NUC 8th gen running i3-8109U CPU, 32 GB RAM and NVME, SSD and two USB HDDs. Originally, I only used this little machine as a file server and backup server but shortly after I added bunch of other services which ended up with this mess of NVMe/SSD/HDD. Last week when I was testing bootable container installations of Anaconda in a libvirt VM and…
We have a mix of devices at home ranging from Linux workstations, servers, Macbooks, a Mac Mini and a Windows PC. Up until now, I was using Samba for a home “share” folder which was also used to do backups of the Windows PC (family photos and videos). But it was always a pain, smb protocol is somehow slow, unreliable and painful to set up for seamless MacOS integration. In fact, it…
I use libvirt quite a lot during my development and I like to use it both through local UNIX sockets and unauthenticated TCP. With the libvirt version 5.6.0 the project moved to socket activation and many tutorials on the internet are not correct on how to setup libvirt for TCP communication. This post will help. The first thing to realize is that the options which were previously used for this…
About structured logging in Go 1.21 Upcoming version of the Go programming language, which is expected to be released in the fall of 2023, will introduce a new package named slog . It provides a clean and consistent API for structured logging. Let’s take a closer look on how to use this new library. Structured logging utilizes key-value structures for storing messages which can be parsed,…