2026 Ardennen
Fietsen in de Ardennen met Ans om te oefenen voor Duchenne Heroes.
Miek Gieben
Recent content on Miek Gieben
Latest posts
Uncloud Server Setup
I’m thinking about “upgrading” my server from Ubuntu to Fedora and thereby also making
 Uncloud a part of my routine, but …… This can be done, but doing a container style
setup, does mean I need some extra infra, like a container registry, also my DNS server needs to set source IP
addresses for notifies unsure if that will still work. 
 And Caddy…
2026 Limburg Challenge
Oefenen tijdens de Limburg Challenge .
Uncloud Unpush
Unpush is an experimental attempt to write automatic CI/CD in Uncloud, it
either works via web hooks or polls a repository for changes. When seen it redeploys a service via its
 compose.yaml file from the repository. 
 Now of course this works for GitHub, but we have GitLab and it reimplements a bunch of code from uncloud ,
which can all be removed if you just use the uc -tool.…
DENIC Post-mortem Critique
This is the final report from DENIC on the
outage they experienced on the 5th of May 2026. 
 I appreciate the openness, but I’ve reviewed (and written :/) many post-mortems and this one could be a lot
better. Using one of the readily available post-mortem templates would have helped. 
 The main issues: 
 
 No timeline. 
 Lack of technical details. 
 50% of the…
Uncloud Tips
Uncloud’s docs are great, but a few things are buried a bit. Hence a simple list
of things that can improve your interactions with Uncloud. 
 SSH ProxyJump 
 Sometimes you can not directly connect to a cluster, you first have to SSH into a host that is directly
connected to a cluster. If this is the case use a SSH proxy jump (see ssh(1)). This allows you to, e.g. use…
Uncloud Prometheus, part II
Had some fun playing with my fork of Uncloud . And making metrics
work. 
 
 Metrics are now part of Uncloud proper - uncloudplus can now drop it. 
 
 In prometheus we use dns_sd_configs to pick up new things automatically: 
 - job_name : uncloud 
 dns_sd_configs :
 - names : [ 'm.internal' ]
 type : A 
 port : 51090 
 - job_name : caddy 
…
Uncloud TLS
Caddy in a distributed setup (i.e. running on more than one machine) is a nightmare together with Let’s
Encrypt ACME challenges… What happens is that Caddy A starts a challenge, which ends up at Caddy B and this
can ping-pong for days before any certificates are given - and then only to a single instance, so the
other instance will try for even longer. Of course the more…
Uncloud Image Pruning
Currently uc doesn’t have a prune subcommand to prune images, and even if it had it would still be a
manual operation. It would be better to automate this. This post shows how. 
 First create an image with this Dockerfile: 
 FROM --platform=$BUILDPLATFORM alpine:latest 
 RUN apk add curl 
 
 RUN <<EOF 
 echo \
 ' #/bin/bash 
 
 if ! [[ -S…
Uncloud Prometheus
Prometheus metrics are being worked on by
 me , and will hopefully soon be merged in Uncloud . 
 The uncloudd metrics endpoint is exposed into the cluster network, so this makes it possible for a
Prometheus service running inside the cluster to scrape it. For this it just needs to be able to access the API
to get all machines in the cluster. This can be done by mounting the uncloud…
Uncloud L4
Natively Uncloud doesn’t do L4 forwarding. This is an open
issue as we are figuring out how to actually do this. But
it turns out you can already do this with the current code - well almost. 
 Buckle up, because there is quite some stuff you may need: 
 1. A patched Uncloud, see this PR for that. 
 
 A custom Caddy build, with the L4 plugin. 
 A DNS server, I use…
Uncloud Private Registries
While pushing this PR , the answer was that this was already
working ! But kind of unintuitive, but smart as it re-uses whatever docker setup you got (i.e. credentials
helpers). 
 So to get this working you: 
 % docker login registry.science.ru.nl
 Username: bla
 Password:
 ...
 And then use uc deploy -f .../compose.yml just like you did before. Now it should pull…
Testscript highlighting in Neovim
This is a good article on how to use testscript in Go(lang). It
also goes as far as adding a syntax
file . But I’m 100% into Neovim,
so this needs to be tree-sitter grammar on my system. 
 Well… this was a journey and I needed claude.ai for a lot of stuff to pull it off.
I also wanted to insert Go syntax highlighting for Go blocks, like in this file. 
 This is…
Uncloud
I’m playing with Uncloud to see if it is something we can use at $WORK. Pretty
impressed with it already, as I’ve written something worse pgo , that was
(obviously) not good enough. Uncloud does: implement a subset of the Docker(-compose) API, uses gRPC and
wireguard to create mini network; just brilliant. Haven’t seen prometheus metrics yet, although Caddy is…
Forgejo Go Benchstat
For the longest time I wanted to see the performance impact of my changes. This desire goes back years, back
to the early days of CoreDNS . And now I finally have it. 
 It does require running your own forgejo-runner on your own hardware to have any meaningful data. Without
further adu: 
 # On https://codeberg.org/miekg/dns/actions you can see the run and copy and paste a new.txt…
Create a Pull Request from Git in Forgejo
Recently I’ve started to move all my project to Codeberg . This is working great,
but one of the things I really missed where the git-push options from GitLab where you can create a PR just by
pushing a branch upstream. 
 Thanks to my whining about this on Mastodon I got this
reply about an
 create-pr-action . 
 Well, putting this all together, I right now have this…
2025 Fotos 0xf7.8 feest
De fotos van het 0x7f.8 feest op 1 november 2025 in Groenewoud met al onze vrienden.
Groesbeek's Gruwelijkste 2025
Op zondag 21 September Groesbeek’s Gruwelijkste (11e editie, de laatste ) gereden. De 75 km.
PAM unixsock
Ever felt the need to do something with PAM, like implementing 2FA in SSH? You are left with a few
bad choices, among others you’ll need to write something (complex) in C. I rather not do that, so
I’ve created pam-unixsock . 
 This is tiny , the most trouble I had with concatenating strings with a space in between,
because, you know, C. Anyway tiny . It doesn’t do…
Format Go HTML templates
Because I was fed up with the lack of options (none), I write a tool that
can format Go HTML templates: you can find it here . Includes
screenshots! 
 Formatting Go text templates is pure madness, but the above code works well on HTML templates. If
have find issues or need more functionality open a PR against the repo. 
 Have this in neovim: 
 au FileType gohtmltmpl command…
Matchup in Neovim for Go templates
After dealing with Go templates (also HTML templates) for more
than a year and keep loosing track of where each block {{end}}s I finally did something about
it . 
 But that didn’t work that good. So I’ve switch to the
 match-up plugin, which is better than the built-in
 matchit that I was using previously. With Neovim I’m using this setup: 
 Plug…
Kong Go CLI manual pages
I’m using Kong the CLI argument parser to create manual pages
from the arguments and help described in the Kong structure that tells your CLI how to parse its command
line. 
 With a lot of use from the reflect package (this was before I discovered kong actually has an API
you can use), I’m creating manual pages from the kong CLI definition, while having great fun…
Kong Go CLI
I’m a fan of Kong the CLI argument parser , I use it to
automatically create manual pages, (bash) completion and do a lot of validation inside it. (This guy
also has other really interesting packages, and he’s a huge fan of Go’s struct tags). 
 I wanted to do validation inside Kong as well, for this Kong has
 validation , which is just a
method ( Validate()…
eBPF from Go - IV - Code generation
Played more with TinyGo, but it always generates code for (minimal) reflection - i.e. the reflect 
package, because it requires that for its map implementation. I could skip or not generate that,
but then that would mean using a map would be … weird? Anyhow it looked that even TinyGo does too
much for eBPF. So plan D: generate eBPF code (and Go code) using Go. Cilium has done a…
eBPF from Go - III - Reducing the SSA
Again some progress. I’m mostly focussing on removing code from the SSA representation
( -internal-dumpssa ), so that I can work with a clean slate. As BPF is so limited almost none of
the features from Go make sense, although in some far fetched future it would be super cool to have
channels and goroutines to something in BPF - but not today. First need to get to “Hello…
Groesbeek's Gruwelijkste 2024
Op zondag 15 September Groesbeek’s Gruwelijkste (10e editie) gereden. De 75 km.
eBPF from Go - II
Following up from the previous blog post… I’ve got a JSON file with the string ‘bpf’ in the
correct place. Let’s see what tinygo thinks of that: 
 % ./build/tinygo build -o miekg/main.bpf -target bpf ./miekg/main.go
No available targets are compatible with triple "bpf-unknown-unknown"
 
 clang indeed does not list bpf as a valid target, so this…
eBPF from Go; First Steps
So I had this itch that I wanted to make a Go program compile to eBPF and be able to load that
program in the Linux kernel by use of bpftool . 
 As I say in github.com/miekg/ebpf 
 
 eBPF in C? What am I, a farmer? 
 
 After much reading about eBPF and thinking about how that would work from Go, I figured that would
involve writing a Go compiler. 
 So I could: 
…
eBPF in Go
What if I could program eBPF in pure Go? I want to use eBPF and lots of current tooling exist, but
I like Go. I don’t want to use clang to create the ELF binary that then gets loaded into the Linux
kernel. I want to use Go to create that ELF file. The heavy lifting of loading and
inspecting can be done via bpftool (although I’m aware that Go programs exist that do this),…
De Haan 2024
Vakantie in het Belgische De Haan samen met Toni.
Rügen 2024
Twee weken vakantie in het Duitse Rügen.
Charlie 2024
12e verjaardag van Charlie.
Center Parcs 2024
Met Inbal en Yaniv naar Center Parcs in Zandvoort.
Printing from Android
Quick note to self. 
 Printing from Android requires IPP. If your printing does not support this protocol out of the box
you will not be able to directly print from Android devices. 
 CUPS can then be used to translate between IPP and JetDirect (in my case). Install and configure
CUPS and then on Android configure the printer. The later means connecting to a printer by…
Config Management, part III: Rolling Back
The second part . 
 In the previous part we looked how a micro language would look like, now I want to focus on what it
means to roll back to a previous version. First take a look at an instruction that have no obvious
reverse: CHMOD 
 When rolling back CHMOD you want to revert to the previous permissions. This would work
automatically if there was an older CHMOD that would…
Config Management, part II: Microcode Language
The first part . 
 This cfg mgmt system uses a micro language to perform the changes on the target
system. This language is limited in its scope and has the following “instructions”: 
 
 
 
 INSTRUCTION 
 ARITY 
 ARGUMENTS 
 REMARK 
 
 
 
 
 REM 
 1 
 TEXT 
 a comment 
 
 
 MKDIR 
 2 
 MODE PATH…
OSC52: My Cut & Paste Journey
In the olden days with X11, you could just do x11-forwarding in SSH and remote cut and paste would
work. Now with Wayland, this is all broken and supposedly “there are better ways of doing it”. One
of those is
 OSC52 
support in terminals, but not in VTE based ones, like
 Tilix , which is was my default terminal.
(See…
Config Management

 this project needs a name and a domain. 
 
 After many years of playing with YAML in k8s, I’ve returned to using CFEngine (at work). The last
config management software before that was Puppet. An issue I see with all modern config management
tooling is the lack of monitoring and the impossibility to cleanly roll back. In k8s it works
better, but that’s only…
Graaf
Graaf is a Go program that translates
simple dashboards written in YAML to Grafana JSON. It has an extensive manual
page that explains its usage.
This is also known as Grafana as code, but then for real. 
 The following is a dashboard with 4 panels that I use for my own monitoring. 
 title : Overview i 
 uid : dashboard-overview 
 panels :
 - timeseries :
 title…
Gallery Shortcode
I’m using the following shortcode (saved as gallery.html ) in Hugo to generate a gallery containing
both video and photos. Comments in the code. 
 May it be helpful for you. It comes (of course) with no support. The cover photo handling is done by
my Hugo theme (terminal) btw. 
 <!--
 All img/*.{webm,ogv} video files are taken and simularly the caption file is used
…
Lego 2023
Lego Stad Brickmegen.
ASCII art in motd
I wanted a nicer login experience (see image above) when logging into my server. 
 For this I used the following sites, tools and steps. 
 
 https://www.svgrepo.com/ 
 https://asciiart.club/ 
 Little Go program from below 
 
 Steps: 
 
 Search a nice SVG image at “svgrepo” and save it; 
 Upload it to “asciiart”, and generate an ASCII…