Recent content on Veerendra's Blog
In Part 1 , I walked through replacing Prometheus + node_exporter + cAdvisor with VictoriaMetrics + FluentBit on my homeserver. This is Part 2 — the actual numbers. All measurements are mean values over a 12-hour window, collected from the containers themselves via cAdvisor (before) and FluentBit docker metrics (after). They’re approximate, but they paint a clear enough picture. FluentBit vs…
I’ve been running the same Prometheus monitoring stack on my homeservers for years. It worked fine — but it was more complex than it needed to be. node_exporter and cAdvisor are two separate containers doing one job: telling me what the machine and its containers are up to. And cAdvisor, it turns out, was the heaviest thing in my entire monitoring stack. I wanted something simpler and…
I use a Shelly Plug M Gen3 to monitor my homeserver’s power consumption with a custom Prometheus exporter . After a router restart, the device disappeared from the network. I tried the official Shelly Cloud app to re-onboard it, but the app demanded location permissions, wanted to upload my WiFi password to Shelly’s cloud, and still failed to add the device. Frustrated, I figured out…
I keep mixing up rate() and increase() in PromQL, so this is a short note for future reference. Both functions are normally used with counters : metrics that only go up, except when the process restarts and the counter resets. The quick difference: rate() answers: how fast is it increasing? increase() answers: how much did it increase? rate() rate() gives the average per-second increase over a…
Introduction As you might know, I manage two home servers for various self-hosted services. I keep everything organized in a GitOps way using ComposeFlux —a tool I built to handle Docker Compose stacks when I got tired of manual updates. (You can read about that journey in GitOps for Homeservers (Part 1) ). Recently, I was catching up with a colleague at the office. We were talking about…
This is Part 1 of a 3-part series: “GitOps for Homeservers” Part 1: My Homeservers, Ansible, and the Pain Points (You are here) Part 2: Searching for the Right Tool — Komodo, Dockhand, and Beyond Part 3: ComposeFlux — A Lightweight GitOps Tool for Docker Compose Also read: How I Manage My Homeservers with GitOps and Docker Compose on Medium. Introduction I have been managing 2…
This is Part 2 of a 3-part series: “GitOps for Homeservers” Part 1: My Homeservers, Ansible, and the Pain Points Part 2: Searching for the Right Tool — Komodo, Dockhand, and Beyond (You are here) Part 3: ComposeFlux — A Lightweight GitOps Tool for Docker Compose Also read: How I Manage My Homeservers with GitOps and Docker Compose on Medium. Introduction In Part 1 , I covered my…
This is Part 3 of a 3-part series: “GitOps for Homeservers” Part 1: My Homeservers, Ansible, and the Pain Points Part 2: Searching for the Right Tool — Komodo, Dockhand, and Beyond Part 3: ComposeFlux — A Lightweight GitOps Tool for Docker Compose (You are here) Introduction In Part 1 , I covered my homeserver setup and the Ansible-based deployment workflow along with its pain points.…
This is a how-to guide inspired by “Quick and Easy SSL Certificates for Your Homelab!” " focus on Traefik reverse proxy server. Although this guide focuses on DuckDNS, a similar configuration can apply to any DNS provider. The trick is by setting private IP for the domain name you own, in my case DuckDNS. Get DuckDNS Sub-Domain Sign-up an account in duckdns.org , choose a sub-domain(As…
Introduction One of the services I always wanted to have on my raspberry pi home server is VPN and BitTorrent, which basically, route all BitTorrent traffic through a VPN container. Then I saw Wolfgang’s “Set Up Your Own Wireguard VPN Server with 2FA in 5 Minutes!” on Youtube, which inspired me to set up my own VPN server. I quickly created an instance on Oracle Cloud and ran the…
Previously in part 1 , we have deployed the qBittorrent with Wireguard VPN on docker swarm. In this part, we will test the deployment, configure qBittorrent and finish the blog with the kill switch configuration Testing Below are the tests to make sure qBittorrent has access to the Internet through Wireguard VPN ➡️Make sure Wireguard and qBittorrent containers are up and running. ➡️Check you are…
Introduction I have been working on my home server setup on Raspberry Pi 4. I’d like to deploy all of my services/tools in docker containers, and for that, I need a nice and fancy container management tool I want to have on my home server. I had checked multiple sources, and finally picked two; they are Portainer and Yacht. Portainer is a well-known container management tool and Yacht is…
There is a cool feature in docker called userns-remap , discovered while doing my RaspberryPi home server project; 15#issuecomment-1296311979 , I can just enable userns-remap and docker does all remapping of uid and gid inside docker container to a non-root user on the host. https://docs.docker.com/engine/security/userns-remap/ How to enable *It is better to reinstall docker and remove all…
Introduction I have been working on a RaspberryPi home server project for quite some time. The project is a collection of applications to run on RaspberryPi and all applications are deployable with docker-compose files and ansible automation. One of the applications I was configuring is Pi-hole , a network-wide ad-blocker. I decided to use Pi-hole as also DHCP server for my LAN. When I look into…
Introduction Hello my dear fellow humans, hope you are having a great day. Today’s guide is on how to recover from a disaster for Strimzi Kafka with Velero . First of all, what is Strmzi Kafka? https://strimzi.io Strimzi provides a way to run an Apache Kafka cluster on Kubernetes in various deployment configurations. Back in a while, I worked on Strimzi Kafka deployment on Openshift, very…
👉 This writeup is part of “Elasticsearch Deploy Docs” series. Important Elasticsearch Configuration 📄 Official Docs Mainly 3 configuration files elasticsearch.yml - Elasticsearch config jvm.options - Elasticsearch JVM settings config log4j2.properties - Elasticsearch logging config Environment Variables export the ES_PATH_CONF etc/default/elasticsearch (Sourced environment variables…
👉 This writeup is part of “Elasticsearch Deploy Docs” series Install 📄 Office Docs Hardware Requirement 📄 Offical Docs Resource Minimum Recommended Memory 16 GB 64 GB CPU 8 Cores 16 Disk Depends Depends JDK Installation Pick JVM compatibility version with elasticsearch from here Install OpenJDK from here Download and install JDK 11 (Another guide here ) $ apt-get install…
👉 This writeup is part of “Elasticsearch Deploy Docs” series Rolling Upgrade Elasticsearch 📄 Official Docs ⚠️ A rolling upgrade allows an Elasticsearch cluster to be upgraded one node at a time so upgrading does not interrupt service As of now, the current latest version of elasticsearch is v7.7.1 . Below procedure is for rolling upgrade from 7.6.2 => 7.7.1 . 1. Divide the cluster…
👉 This writeup is part of “Elasticsearch Deploy Docs” series Kibana Installation 📄 Office docs ❗ The elasticsearch should be up and running before you start kibana installation procedure Install via apt-get from here As of today the kibana version is 7.6.2 $ wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - $ sudo apt-get install apt-transport-https $…
👉 This writeup is part of “Elasticsearch Deploy Docs” series Elastalert 📄 Official docs 📂 Official project Repo Elastalert is developed by Yelp written in python, queries docs in elasticsearch and send alerts depends on the rules. Since Elastalert is not part of Elasticsearch plugin, we can install it where ever we want to. Installation ❗ Refer elasticsearch-deploy-notes/elastalert…
Introduction Hello guys, today I came up with an interesting write-up, that is how to set up backup and restore with Velero on Kubernetes. A year back I worked on Strimzi Kafka , a deployment solution for deploying production-level Kafka on Kubernetes. Strimzi Kafka uses persistance volume(PV) as a disk which is a managed disk from a cloud provider(e.g. Azure, AWS, etc), but I couldn’t find…
It has been 2 years since I wrote a new post. Due to busy work, moving to a new city, new jobs and getting married, I wasn’t able to keep up with writing blog posts. Finally, I’m back now, I have been thinking of changing blog themes for a long time. I spent some time exploring Jekyll themes and tried to modify them according to my requirements. As you can see here GitHub issue.
Looks like my blog posts are like Sherlock TV Show episodes, posting once in a while…anyways I’m back now. As you might know, GitHub recently launched GitHub Actions where people can automate workflows like build, test, and deploy code from GitHub. I have started reading docs a little bit, I have to admit, setting up workflows on GitHub Actions is not that hard. I can directly start…
Hallo alle zusammen, after a long time I’m writing this blog and I come with an interesting and long post I know what you are thinking, I steal Kelsey Hightower’s Kubernetes The Hard Way tutorial , but hey!, I did some research and try to fit K8s cluster(Multi-Master!) in a laptop with Docker as ‘ CRI ’ and Flannel as ‘ CNI ’. This blog post follows Kelsey…
Welcome back to “Kubernetes-The Hard Way With Docker & Flannel” series part 2. In previous post we have provisioned compute resources, generated certificates and kubeconfig files. In this post, we will install and configure controller nodes 6. Bootstrapping the etcd Cluster etcd is a consistent and highly-available key value storage DB. Kubernetes stores all cluster data in etcd via…
Welcome to the final part of “Kubernetes-The Hard Way With Docker & Flannel” series. In part-1 , we discussed our cluster architecture, provisioned compute resources, generated certificates and kubeconfig. In part-2 , we have bootstrapped controller nodes. In this post, we will bootstrap worker nodes and at the end, perform a smoke test on the cluster 9. Bootstrapping the Kubernetes…
As we all know, enabling HTTPS to endpoints/websites is essential now-a-days. When it comes to Kubernetes, when we expose a service as LoadBalancer , the cloud provider doesn’t provide an HTTPS mechanism for the endpoint by default. If we look at the K8s setup that is deployed on AWS(For example kops ), there is an actual ELB (Elastic Load Balancer) sits in front of K8s service and load…
* A blog post that I’m actively collecting “Linux pseudo files info, cheat sheets and tips” Tips & Tricks How to force a command to return exit code 0 even if the command exited non-zero? How to install dependencies of .deb automatically which failed to install previously? Example Solution: $ dpkg -i r-base-core_3.3.3-1trusty0_amd64.deb || : \ && apt-get --yes --force-yes -o Dpkg::Options:: =…
Wireshark is a great tool for analyzing traffic, whether it could be live traffic on the interface or the .cap file. The tool enables different types of filtering on packets like follow a stream, filter by protocol and IP, etc In order to install the latest version of Wireshark on Linux, one should build and install it from the source. Sometimes, building from a source is difficult because we have…
Long back before I worked on Openshift which is really a great container platform tool from Redhat. But installation is not as simple as Kubernetes(relatively). One of the prerequisites for the cluster deployment is Open vSwitch. Now let’s see how to install Open vSwitch v2.6.1 in RedHat7 step by step Install dependencies $ sudo yum install gcc make python-devel openssl-devel \ kernel-devel…
Ok, getting metrics(CPU, Memory & Network) from Windows OS is completely different from Linux. In Linux, people can easily develop scripts to get system metrics by simply reading /proc pseudo files. In fact, there are so many open source tools to do this in Linux, like tcollector which is my favourite. Now, Let’s look at this Telegraf tool and what it does. I found Telegraf tool is a really…
1. Install Packages Check system is capable of running KVM by running kvm-ok $ apt-get install qemu-kvm qemu-system libvirt-bin bridge-utils virt-manager -y Create KVM/Qemu Hard Disk File $ qemu-img create -f raw <name>.img <Size> ## Example $ qemu-img create -f raw ubuntu14-HD.img 10G Then copy the HD file to /var/lib/libvirt/images/ Launch VM with virt-install virt-install --name spinnaker \…
We think that connecting to a website over HTTPS is secure, which is true(not true sometimes!), but what about DNS queries that you(browser) send? Sure if we use HTTPS, all your ( POST or GET) data is encrypted end-to-end which prevents eavesdropping, MITM attack and have Confidentiality , but again what about DNS queries? I got this question back a while ago, so after a quick Internet search, I…
A Wi-Fi deauthentication attack is a type of denial-of-service attack that targets communication between a user and a Wi-Fi wireless access point. -Wikipedia As you can see, this type of attack is pretty powerful and difficult to detect who is attacking. There are some tools(like “aircrack-ng”) for this attack(You can check the commands here ). So, basically the concept is the attacker broadcasts…
GNU Screen is a terminal multiplexer, a software application that can be used to multiplex several virtual consoles, allowing a user to access multiple separate login sessions inside a single terminal window, or detach and reattach sessions from a terminal. It is useful for dealing with multiple programs from a command line interface, and for separating programs from the session of the Unix shell…
👉 Update on 27-08-2022 Moving to Hugo and other updates! I was very excited to try Jekyll and Github Pages when I heard about it. When I try to install jekyll , I got below error root@veeru:/home/veeru# gem install jekyll bundler Fetching: public_suffix-3.0.1.gem ( 100% ) ERROR: Error installing jekyll: public_suffix requires Ruby version > = 2.1. Fetching: bundler-1.16.1.gem ( 100% )…
“ MAC Address Scrambling “- By the name itself we can understand, instead of using a burned-in address, the machine uses a random MAC address. The machine/device changes MAC addresses regularly to improve security. MAC address is a 48-bit hexadecimal digit which is burned in every electronic device that has the capability of “connectivity” such as mobile devices, smart TV, PC, etc. “Apple” added…
Network Blogs Capturing Wireless LAN Packets on Ubuntu with tcpdump and Kismet Linux Bridging Phishing With a Rogue Wi-Fi Access Point Fast DDoS analyzer with sflow/netflow/mirror support China’s Man-on-the-Side Attack on GitHub SSH testing tool checks the configuration of given server accessible over internet Infinite possibilities with the Scapy Module An Illustrated Guide to the Kaminsky…