RSSAmplifier

Blog

Sheogorath's Blog

Depending on the time of the day a friend, a colleague, a wise guy. The beauty of the world is its sense of humor to show humans their way by letting them search their own.

shivering-isles.comRSS feed ↗10 posts

Latest posts

Winning SI-Forge

After losing GitLab as described in the previous article I can now say, that I actually won Forgejo, or rather SI-Forge, as I named it. SI-Forge is a Forgejo instance, where I started to host my source code. The recovery of all source repositories is still ongoing and there are some changes to how I previously used GitLab. Mirroring Repositories The first major change is that I don’t plan to bring…

Losing SI-GitLab

I always said to myself, GitLab is one of the services that will not be pleasant to lose, but fine to lose, since it can be rebuilt. It’s time to put that statement to the test. SI-GitLab was down today, because it ran out of disk space. It’s easy to extend the disk and pay a few cents more per month, but since I had done that a few times in the past few years, I decided “No! Not this time, let’s…

Christmas Projects

You might wonder what kind of self-hosting project you could do this weekend or during the holidays. Here are some ideas particularly for beginners, that scale nicely from taking up your entire holidays to just spend a few hours. Pi-hole / Blocky - A network ad blocker Pi-hole is very famous and provides an all-in-one project you can set up on a Raspberry Pi or a VM that runs on your network and…

Use eIDAS as Keycloak Identity Provider

Today I spend around an hour to implement eIDAS authentication for SI-Auth. This allows to use government-issued IDs for authentication. Main subject here: The German Personalausweis. Main purpose for it is the use for account recovery, but depending on your interest, it might just be useful for general authentication. In order to do that, you can use the skIDentity Provider as a SAML Identity…

Kubernetes - VMs vs Containers

It doesn’t take much to start a discussion with people about the security implications of containers vs VMs. It often comes down to the discussion that Container, given the shared kernel aspect are less secure than VMs. The kernel with all its syscalls provides a much larger attack surface compared to VMs. So in the eyes of various people, switching to container is a step backwards from using VMs.…

Where to start Self-Hosting

Since it comes up from time to time, here are two approaches to self-hosting: Service-oriented self-hosting and device-oriented self-hosting . They usually converge at some point, but at the beginning it makes sense to to start with one or the other. Service-oriented self-hosting Service-oriented self-hosting is self-hosting where the focus is on building a service that provides good quality. This…

Securing Kubernetes access using OIDC and Keycloak

Yesterday I finally implemented proper SSO for my Kubernetes clusters and since I noticed some bad patterns in other tutorials along the way, I decided to write my own. Hoping to make different mistakes. Be aware, that if you can not modify your kube-apiserver configuration or run certain Kubernetes distributions you won’t be able to use this. Those of you running OpenShift or OKD, just run oc…

Fighting phishing for everyone's good

Today I spend a few minutes to report phishing mails and domains that I collected with my various email addresses. Since I think many people will face a similar problem at some point, the question “What do I do with this information?” Before you start make sure : If you don’t feel comfortable opening a phishing email, don’t do it. Always open it in plain text and configure your environment that…

Please use official example and test domains

Every now and then, you want to make an example. Suddenly you end up with the wildest domain names in these examples. A popular misuse of an IP that suddenly became a real address was 1.1.1.1 but there is a solution for this. There are some officially reserved and from IANA registered test and example domains that are safe to be used in books, articles and your documentation. Besides the popular…

Kubernetes native delete protection using Validation Admission Policies

In Kubernetes 1.30 Validation Admission Policies became stable and generally available. Validation Admission Policies are a lightweight, built-in policy engine for the Kubernetes API server, that allows to use the “Common Expression Language” (CEL) to express policies for single objects and warn, log or deny them. To play around with this new feature, I decided to implement a simple feature, that…