Depending on the time of the day a friend, a colleague, a wise guy. The beauty of the world is its sense of humor to show humans their way by letting them search their own.
After losing GitLab as described in the previous article I can now say, that I actually won Forgejo, or rather SI-Forge, as I named it. SI-Forge is a Forgejo instance, where I started to host my source code. The recovery of all source repositories is still ongoing and there are some changes to how I previously used GitLab. Mirroring Repositories The first major change is that I don’t plan to bring…
I always said to myself, GitLab is one of the services that will not be pleasant to lose, but fine to lose, since it can be rebuilt. It’s time to put that statement to the test. SI-GitLab was down today, because it ran out of disk space. It’s easy to extend the disk and pay a few cents more per month, but since I had done that a few times in the past few years, I decided “No! Not this time, let’s…
You might wonder what kind of self-hosting project you could do this weekend or during the holidays. Here are some ideas particularly for beginners, that scale nicely from taking up your entire holidays to just spend a few hours. Pi-hole / Blocky - A network ad blocker Pi-hole is very famous and provides an all-in-one project you can set up on a Raspberry Pi or a VM that runs on your network and…
Today I spend around an hour to implement eIDAS authentication for SI-Auth. This allows to use government-issued IDs for authentication. Main subject here: The German Personalausweis. Main purpose for it is the use for account recovery, but depending on your interest, it might just be useful for general authentication. In order to do that, you can use the skIDentity Provider as a SAML Identity…
It doesn’t take much to start a discussion with people about the security implications of containers vs VMs. It often comes down to the discussion that Container, given the shared kernel aspect are less secure than VMs. The kernel with all its syscalls provides a much larger attack surface compared to VMs. So in the eyes of various people, switching to container is a step backwards from using VMs.…
Since it comes up from time to time, here are two approaches to self-hosting: Service-oriented self-hosting and device-oriented self-hosting . They usually converge at some point, but at the beginning it makes sense to to start with one or the other. Service-oriented self-hosting Service-oriented self-hosting is self-hosting where the focus is on building a service that provides good quality. This…
Yesterday I finally implemented proper SSO for my Kubernetes clusters and since I noticed some bad patterns in other tutorials along the way, I decided to write my own. Hoping to make different mistakes. Be aware, that if you can not modify your kube-apiserver configuration or run certain Kubernetes distributions you won’t be able to use this. Those of you running OpenShift or OKD, just run oc…
Today I spend a few minutes to report phishing mails and domains that I collected with my various email addresses. Since I think many people will face a similar problem at some point, the question “What do I do with this information?” Before you start make sure : If you don’t feel comfortable opening a phishing email, don’t do it. Always open it in plain text and configure your environment that…
Every now and then, you want to make an example. Suddenly you end up with the wildest domain names in these examples. A popular misuse of an IP that suddenly became a real address was 1.1.1.1 but there is a solution for this. There are some officially reserved and from IANA registered test and example domains that are safe to be used in books, articles and your documentation. Besides the popular…
In Kubernetes 1.30 Validation Admission Policies became stable and generally available. Validation Admission Policies are a lightweight, built-in policy engine for the Kubernetes API server, that allows to use the “Common Expression Language” (CEL) to express policies for single objects and warn, log or deny them. To play around with this new feature, I decided to implement a simple feature, that…