deploy: f9fea44ff71c0724fb7e43e652cad7218cb93e7d

blog/appgate-sdp-on-arch-linux/index.html

@@ -63,4 +63,4 @@ Let&rsquo;s try to run it.</p><div class=highlight><pre tabindex=0 style=color:#
 </span></span></code></pre></div><p>This is a breaking change in Python3.8.</p><p>So what is calling <code>platform.linux_distribution</code>?</p><p>Let&rsquo;s search for it:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-shell data-lang=shell><span style=display:flex><span>$ sudo grep -r <span style=color:#e6db74>&#39;linux_distribution&#39;</span> /opt/appgate/linux/
 </span></span><span style=display:flex><span>/opt/appgate/linux/nm.py:    <span style=color:#66d9ef>if</span> platform.linux_distribution<span style=color:#f92672>()[</span>0<span style=color:#f92672>]</span> !<span style=color:#f92672>=</span> <span style=color:#e6db74>&#39;Fedora&#39;</span>:
 </span></span></code></pre></div><p>Aha! So this is in the local AppGate source code. This should be an easy fix. Let&rsquo;s just replace this line with:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-python data-lang=python><span style=display:flex><span><span style=color:#66d9ef>if</span> <span style=color:#66d9ef>True</span>: <span style=color:#75715e># Since we are not using Fedora :)</span>
-</span></span></code></pre></div><h1 id=wrapping-up>Wrapping up<a href=#wrapping-up class=post-heading__anchor aria-hidden=true>#</a></h1><p>It turns out there are <a href=https://docs.python.org/3.7/library/platform.html#platform.linux_distribution class=link--external target=_blank rel=noreferrer>breaking changes</a> in Python3.8.</p><p>The docs say <code>Deprecated since version 3.5, will be removed in version 3.8: See alternative like the distro package.</code></p><p>I suppose this highlights one of the caveats of relying upon the system&rsquo;s python, rather than having an isolated, dedicated environment for all dependencies.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.84fad1d1396df61912fa589a19522118b5b3eb0806f4f7161f1034dc0672a3270863d0b236a15e1797d3a78930568729f80f15d66d73f2dc11044a5152de00b2.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>
+</span></span></code></pre></div><h1 id=wrapping-up>Wrapping up<a href=#wrapping-up class=post-heading__anchor aria-hidden=true>#</a></h1><p>It turns out there are <a href=https://docs.python.org/3.7/library/platform.html#platform.linux_distribution class=link--external target=_blank rel=noreferrer>breaking changes</a> in Python3.8.</p><p>The docs say <code>Deprecated since version 3.5, will be removed in version 3.8: See alternative like the distro package.</code></p><p>I suppose this highlights one of the caveats of relying upon the system&rsquo;s python, rather than having an isolated, dedicated environment for all dependencies.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.f34cf124e04ca80600f3e7ebc1ff557ddda55b46ffc9152c7d213762ac19bc2ffa6e41fb59ff4e828f599b992faf554caac138e54ac6973b41ae72672112d3eb.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>

blog/index.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Blog on davegallant.ca</title><link>/blog/</link><description>Recent content in Blog on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><atom:link href="/blog/index.xml" rel="self" type="application/rss+xml"/><item><title>Setting up Gitea Actions with Tailscale</title><link>/blog/setting-up-gitea-actions-with-tailscale/</link><pubDate>Sun, 10 Dec 2023 17:22:11 -0500</pubDate><guid>/blog/setting-up-gitea-actions-with-tailscale/</guid><description>&lt;p>In this post I&amp;rsquo;ll go through the process of setting up Gitea Actions and &lt;a
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Blog on davegallant.ca</title><link>/blog/</link><description>Recent content in Blog on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><atom:link href="/blog/index.xml" rel="self" type="application/rss+xml"/><item><title>AWS EBS CSI driver with terraform</title><link>/blog/aws-ebs-csi-driver-terraform/</link><pubDate>Sun, 07 Apr 2024 15:20:23 -0400</pubDate><guid>/blog/aws-ebs-csi-driver-terraform/</guid><description>&lt;p>I recently configured the Amazon EBS CSI driver and found the setup with terraform to be more effort than expected. I wanted to avoid third-party modules and keep it as simple as possible, while remaining least privilege.&lt;/p></description></item><item><title>Setting up Gitea Actions with Tailscale</title><link>/blog/setting-up-gitea-actions-with-tailscale/</link><pubDate>Sun, 10 Dec 2023 17:22:11 -0500</pubDate><guid>/blog/setting-up-gitea-actions-with-tailscale/</guid><description>&lt;p>In this post I&amp;rsquo;ll go through the process of setting up Gitea Actions and &lt;a
 href="https://tailscale.com/"
 class="link--external" target="_blank" rel="noreferrer"
 >Tailscale&lt;/a>, unlocking a simple and secure way to automate workflows.&lt;/p></description></item><item><title>Using AKS and SOCKS to connect to a private Azure DB</title><link>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</link><pubDate>Mon, 22 May 2023 16:31:29 -0400</pubDate><guid>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</guid><description>&lt;p>I ran into a roadblock recently where I wanted to conveniently connect to a managed postgres database within Azure that was not running on public subnets. And by conveniently, I mean that I&amp;rsquo;d rather not have to spin up an ephemeral virtual machine running in the same network and proxy the connection, and I&amp;rsquo;d like to use a local client (preferably with a GUI). After several web searches, it became evident that Azure does not readily provide much tooling to support this.&lt;/p></description></item><item><title>Watching YouTube in private</title><link>/blog/watching-youtube-in-private/</link><pubDate>Sat, 10 Dec 2022 21:46:55 -0500</pubDate><guid>/blog/watching-youtube-in-private/</guid><description>&lt;p>I recently stumbled upon &lt;a

blog/replacing-docker-with-podman-on-macos/index.html

@@ -47,4 +47,4 @@
 </span></span><span style=display:flex><span>0
 </span></span><span style=display:flex><span>podman start -a davegallant.github.io_hello_world_1
 </span></span><span style=display:flex><span>Hello world
-</span></span></code></pre></div><p>This should more or less provide the same results you would come to expect with docker. The README does clearly state that podman-compose is under development.</p><h3 id=summary>Summary<a href=#summary class=post-heading__anchor aria-hidden=true>#</a></h3><p>Installing Podman on macOS was not seamless, but it was manageable well within 30 minutes. I would recommend giving Podman a try to anyone who is unhappy with experiencing forced docker updates, or who is interested in using a more modern technology for running containers.</p><p>One caveat to mention is that there isn&rsquo;t an official graphical user interface for Podman, but there is an <a href=https://github.com/containers/podman/issues/11494 class=link--external target=_blank rel=noreferrer>open issue</a> considering one. If you rely heavily on Docker Desktop&rsquo;s UI, you may not be as interested in using podman yet.</p><blockquote><p>Update: After further usage, bind mounts do not seem to work out of the box when the client and host are on different machines. A rather involved solution using <a href=https://en.wikipedia.org/wiki/SSHFS class=link--external target=_blank rel=noreferrer>sshfs</a> was shared <a href=https://github.com/containers/podman/issues/8016#issuecomment-920015800 class=link--external target=_blank rel=noreferrer>here</a>.</p></blockquote><p>I had been experimenting with Podman on Linux before writing this, but after listening to this <a href=https://kubernetespodcast.com/episode/164-podman/ class=link--external target=_blank rel=noreferrer>podcast episode</a>, I was inspired to give Podman a try on macOS.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.84fad1d1396df61912fa589a19522118b5b3eb0806f4f7161f1034dc0672a3270863d0b236a15e1797d3a78930568729f80f15d66d73f2dc11044a5152de00b2.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>
+</span></span></code></pre></div><p>This should more or less provide the same results you would come to expect with docker. The README does clearly state that podman-compose is under development.</p><h3 id=summary>Summary<a href=#summary class=post-heading__anchor aria-hidden=true>#</a></h3><p>Installing Podman on macOS was not seamless, but it was manageable well within 30 minutes. I would recommend giving Podman a try to anyone who is unhappy with experiencing forced docker updates, or who is interested in using a more modern technology for running containers.</p><p>One caveat to mention is that there isn&rsquo;t an official graphical user interface for Podman, but there is an <a href=https://github.com/containers/podman/issues/11494 class=link--external target=_blank rel=noreferrer>open issue</a> considering one. If you rely heavily on Docker Desktop&rsquo;s UI, you may not be as interested in using podman yet.</p><blockquote><p>Update: After further usage, bind mounts do not seem to work out of the box when the client and host are on different machines. A rather involved solution using <a href=https://en.wikipedia.org/wiki/SSHFS class=link--external target=_blank rel=noreferrer>sshfs</a> was shared <a href=https://github.com/containers/podman/issues/8016#issuecomment-920015800 class=link--external target=_blank rel=noreferrer>here</a>.</p></blockquote><p>I had been experimenting with Podman on Linux before writing this, but after listening to this <a href=https://kubernetespodcast.com/episode/164-podman/ class=link--external target=_blank rel=noreferrer>podcast episode</a>, I was inspired to give Podman a try on macOS.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.f34cf124e04ca80600f3e7ebc1ff557ddda55b46ffc9152c7d213762ac19bc2ffa6e41fb59ff4e828f599b992faf554caac138e54ac6973b41ae72672112d3eb.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>

blog/running-k3s-in-lxc-on-proxmox/index.html

@@ -48,4 +48,4 @@ As of 2021/11, it is still defaulting to the 1.19 channel, so I overrode it to 1
 </span></span><span style=display:flex><span><span style=color:#960050;background-color:#1e0010>
 </span></span></span><span style=display:flex><span><span style=color:#960050;background-color:#1e0010></span>NAME                                                           REFERENCE                             TARGETS   MINPODS   MAXPODS   REPLICAS   AGE
 </span></span><span style=display:flex><span>horizontalpodautoscaler.autoscaling/tekton-pipelines-webhook   Deployment/tekton-pipelines-webhook   9%/100%   1         5         1          12h
-</span></span></code></pre></div><p>I made sure to install Tailscale in the container so that I can easily access K3s from anywhere.</p><p>If I&rsquo;m feeling adventurous, I might experiment with <a href=https://rancher.com/docs/k3s/latest/en/advanced/#running-k3s-with-rootless-mode-experimental class=link--external target=_blank rel=noreferrer>K3s rootless</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.84fad1d1396df61912fa589a19522118b5b3eb0806f4f7161f1034dc0672a3270863d0b236a15e1797d3a78930568729f80f15d66d73f2dc11044a5152de00b2.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>
+</span></span></code></pre></div><p>I made sure to install Tailscale in the container so that I can easily access K3s from anywhere.</p><p>If I&rsquo;m feeling adventurous, I might experiment with <a href=https://rancher.com/docs/k3s/latest/en/advanced/#running-k3s-with-rootless-mode-experimental class=link--external target=_blank rel=noreferrer>K3s rootless</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.f34cf124e04ca80600f3e7ebc1ff557ddda55b46ffc9152c7d213762ac19bc2ffa6e41fb59ff4e828f599b992faf554caac138e54ac6973b41ae72672112d3eb.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>

blog/setting-up-gitea-actions-with-tailscale/index.html

@@ -88,4 +88,4 @@
 </span></span><span style=display:flex><span>          <span style=color:#f92672>from</span>: <span style=color:#ae81ff>RFD Notify</span>
 </span></span><span style=display:flex><span>          <span style=color:#f92672>body</span>: |<span style=color:#e6db74>
 </span></span></span><span style=display:flex><span><span style=color:#e6db74>            ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}</span>            
-</span></span></code></pre></div><p>And voilà:</p><p><img src=gitea-workflow.png alt=image></p><p>You may be wondering how the gitea runner is allowed to connect to the other hosts using ansible? Well, the nodes are in the same tailnet and have <a href=https://tailscale.com/tailscale-ssh class=link--external target=_blank rel=noreferrer>tailscale ssh</a> enabled.</p><h2 id=areas-for-improvement>Areas for improvement<a href=#areas-for-improvement class=post-heading__anchor aria-hidden=true>#</a></h2><p>One enhancement that I would like to see is the ability to send notifications on workflow failures. Currently, this <a href=https://github.com/go-gitea/gitea/issues/23725 class=link--external target=_blank rel=noreferrer>doesn&rsquo;t seem possible</a> without adding logic to each workflow.</p><h2 id=conclusion>Conclusion<a href=#conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>Gitea Actions are fast and the resource footprint is minimal. My gitea instance is currently using around 250mb of memory and a small fraction of a single cpu core (and the runner is using a similar amount of resources). This is impressive since many alternatives tend to require substantially more resources. It likely helps that the codebase is largely written in go.</p><p>By combining gitea with the networking marvel that is tailscale, running workflows becomes simple and fun. Whether you are working on a team or working alone, this setup ensures that your workflows are securely accessible from anywhere with an internet connection.</p><p>Check out my gitea instance exposed via Funnel <a href=https://gitea.snake-cloud.ts.net class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.84fad1d1396df61912fa589a19522118b5b3eb0806f4f7161f1034dc0672a3270863d0b236a15e1797d3a78930568729f80f15d66d73f2dc11044a5152de00b2.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>
+</span></span></code></pre></div><p>And voilà:</p><p><img src=gitea-workflow.png alt=image></p><p>You may be wondering how the gitea runner is allowed to connect to the other hosts using ansible? Well, the nodes are in the same tailnet and have <a href=https://tailscale.com/tailscale-ssh class=link--external target=_blank rel=noreferrer>tailscale ssh</a> enabled.</p><h2 id=areas-for-improvement>Areas for improvement<a href=#areas-for-improvement class=post-heading__anchor aria-hidden=true>#</a></h2><p>One enhancement that I would like to see is the ability to send notifications on workflow failures. Currently, this <a href=https://github.com/go-gitea/gitea/issues/23725 class=link--external target=_blank rel=noreferrer>doesn&rsquo;t seem possible</a> without adding logic to each workflow.</p><h2 id=conclusion>Conclusion<a href=#conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>Gitea Actions are fast and the resource footprint is minimal. My gitea instance is currently using around 250mb of memory and a small fraction of a single cpu core (and the runner is using a similar amount of resources). This is impressive since many alternatives tend to require substantially more resources. It likely helps that the codebase is largely written in go.</p><p>By combining gitea with the networking marvel that is tailscale, running workflows becomes simple and fun. Whether you are working on a team or working alone, this setup ensures that your workflows are securely accessible from anywhere with an internet connection.</p><p>Check out my gitea instance exposed via Funnel <a href=https://gitea.snake-cloud.ts.net class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.f34cf124e04ca80600f3e7ebc1ff557ddda55b46ffc9152c7d213762ac19bc2ffa6e41fb59ff4e828f599b992faf554caac138e54ac6973b41ae72672112d3eb.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>

blog/using-aks-and-socks-to-connect-to-a-private-azure-db/index.html

@@ -15,4 +15,4 @@ If this sounds more appealing, install <a href=https://github.com/antitree/krew-
 </span></span><span style=display:flex><span>using: image=serjs/go-socks5-proxy
 </span></span><span style=display:flex><span>Creating SOCKS5 Proxy (Pod)...
 </span></span><span style=display:flex><span>pod/davegallant-proxy created
-</span></span></code></pre></div><p>With the above proxy connection open, it is possible to access both the DNS and private IPs accessible within the k8s cluster. In this case, I am able to access the private database, since there is network connectivity between the k8s cluster and the database.</p><h2 id=caveats-and-conclusion>Caveats and Conclusion<a href=#caveats-and-conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>The above outlined solution makes some assumptions:</p><ul><li>there is a k8s cluster</li><li>the k8s cluster has network connectivity to the desired private database</li></ul><p>If these stars align, than this solution might work as a stopgap for accessing a private Azure DB (and I&rsquo;m assuming this could work similarly on AWS).</p><p>It would be nice if Azure provided tooling similar to cloud-sql-proxy, so that using private databases would be more of a convenient experience.</p><p>One other thing to note is that some clients (such as <a href=https://dbeaver.io/ class=link--external target=_blank rel=noreferrer>dbeaver</a>) <a href=https://github.com/dbeaver/dbeaver/issues/872 class=link--external target=_blank rel=noreferrer>do not provide DNS resolution over SOCKS</a>. So in this case, you won&rsquo;t be able to use DNS as if you were inside the cluster, but instead have to rely on knowing private ip addresses.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.84fad1d1396df61912fa589a19522118b5b3eb0806f4f7161f1034dc0672a3270863d0b236a15e1797d3a78930568729f80f15d66d73f2dc11044a5152de00b2.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>
+</span></span></code></pre></div><p>With the above proxy connection open, it is possible to access both the DNS and private IPs accessible within the k8s cluster. In this case, I am able to access the private database, since there is network connectivity between the k8s cluster and the database.</p><h2 id=caveats-and-conclusion>Caveats and Conclusion<a href=#caveats-and-conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>The above outlined solution makes some assumptions:</p><ul><li>there is a k8s cluster</li><li>the k8s cluster has network connectivity to the desired private database</li></ul><p>If these stars align, than this solution might work as a stopgap for accessing a private Azure DB (and I&rsquo;m assuming this could work similarly on AWS).</p><p>It would be nice if Azure provided tooling similar to cloud-sql-proxy, so that using private databases would be more of a convenient experience.</p><p>One other thing to note is that some clients (such as <a href=https://dbeaver.io/ class=link--external target=_blank rel=noreferrer>dbeaver</a>) <a href=https://github.com/dbeaver/dbeaver/issues/872 class=link--external target=_blank rel=noreferrer>do not provide DNS resolution over SOCKS</a>. So in this case, you won&rsquo;t be able to use DNS as if you were inside the cluster, but instead have to rely on knowing private ip addresses.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.f34cf124e04ca80600f3e7ebc1ff557ddda55b46ffc9152c7d213762ac19bc2ffa6e41fb59ff4e828f599b992faf554caac138e54ac6973b41ae72672112d3eb.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>

blog/watching-youtube-in-private/index.html

@@ -46,4 +46,4 @@
 </span></span><span style=display:flex><span>
 </span></span><span style=display:flex><span><span style=color:#f92672>volumes</span>:
 </span></span><span style=display:flex><span>  <span style=color:#f92672>postgresdata</span>:
-</span></span></code></pre></div><p>After invidious was up and running, I installed <a href=https://tailscale.com/ class=link--external target=_blank rel=noreferrer>Tailscale</a> on it to leverage its MagicDNS, and I&rsquo;m now able to access this instance from anywhere at <a href=http://invidious:3000/feed/subscriptions class=link--external target=_blank rel=noreferrer>http://invidious:3000/feed/subscriptions</a>.</p><h3 id=redirecting-youtube-links>Redirecting YouTube links<a href=#redirecting-youtube-links class=post-heading__anchor aria-hidden=true>#</a></h3><p>I figured it would be nice to redirect existing YouTube links that others send me, so that I could seamlessly watch the videos using invidious.</p><p>I went looking for a way to redirect paths at the browser level. I found the lightweight proxy <a href=https://requestly.io/ class=link--external target=_blank rel=noreferrer>requestly</a>, which can be used to modify http requests in my browser. I created the following rules:</p><p><img src=requestly-rules.png alt=requestly></p><p>Now the link <a href="https://www.youtube.com/watch?v=-lz30by8-sU" class=link--external target=_blank rel=noreferrer>https://www.youtube.com/watch?v=-lz30by8-sU</a> will redirect to <a href="http://invidious:3000/watch?v=-lz30by8-sU" class=link--external target=_blank rel=noreferrer>http://invidious:3000/watch?v=-lz30by8-sU</a></p><p>I&rsquo;m still looking for ways to improve this invidious setup. There doesn&rsquo;t appear to be a way to stream in 4K yet.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.84fad1d1396df61912fa589a19522118b5b3eb0806f4f7161f1034dc0672a3270863d0b236a15e1797d3a78930568729f80f15d66d73f2dc11044a5152de00b2.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>
+</span></span></code></pre></div><p>After invidious was up and running, I installed <a href=https://tailscale.com/ class=link--external target=_blank rel=noreferrer>Tailscale</a> on it to leverage its MagicDNS, and I&rsquo;m now able to access this instance from anywhere at <a href=http://invidious:3000/feed/subscriptions class=link--external target=_blank rel=noreferrer>http://invidious:3000/feed/subscriptions</a>.</p><h3 id=redirecting-youtube-links>Redirecting YouTube links<a href=#redirecting-youtube-links class=post-heading__anchor aria-hidden=true>#</a></h3><p>I figured it would be nice to redirect existing YouTube links that others send me, so that I could seamlessly watch the videos using invidious.</p><p>I went looking for a way to redirect paths at the browser level. I found the lightweight proxy <a href=https://requestly.io/ class=link--external target=_blank rel=noreferrer>requestly</a>, which can be used to modify http requests in my browser. I created the following rules:</p><p><img src=requestly-rules.png alt=requestly></p><p>Now the link <a href="https://www.youtube.com/watch?v=-lz30by8-sU" class=link--external target=_blank rel=noreferrer>https://www.youtube.com/watch?v=-lz30by8-sU</a> will redirect to <a href="http://invidious:3000/watch?v=-lz30by8-sU" class=link--external target=_blank rel=noreferrer>http://invidious:3000/watch?v=-lz30by8-sU</a></p><p>I&rsquo;m still looking for ways to improve this invidious setup. There doesn&rsquo;t appear to be a way to stream in 4K yet.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.f34cf124e04ca80600f3e7ebc1ff557ddda55b46ffc9152c7d213762ac19bc2ffa6e41fb59ff4e828f599b992faf554caac138e54ac6973b41ae72672112d3eb.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>

blog/why-i-threw-out-my-dotfiles/index.html

@@ -114,4 +114,4 @@
 </span></span><span style=display:flex><span>  };
 </span></span><span style=display:flex><span>}
 </span></span></code></pre></div><p>Save the file and run:</p><pre tabindex=0><code>home-manager switch
-</code></pre><p>You should see another wave of <code>/nix/store/*</code> paths. The new configuration should now be active.</p><p>If you run <code>zsh</code>, you should see that you have <a href=https://starship.rs/ class=link--external target=_blank rel=noreferrer>starship</a> and access to several other utils such as <code>rg</code>, <code>fd</code>, and <code>exa</code>.</p><p>This basic configuration above is also defining your <code>~/.config/git/config</code> and <code>.zshrc</code>. If you already have either of these files, home-manager will complain about them already existing.</p><p>If you run <code>cat ~/.zshrc</code>, you will see the way these configuration files are generated.</p><p>You can extend this configuration for programs such as (neo)vim, emacs, alacritty, ssh, etc. To see other programs, take a look at <a href=https://github.com/nix-community/home-manager/tree/master/modules/programs class=link--external target=_blank rel=noreferrer>home-manager/modules/programs</a>.</p><h2 id=gateway-to-nix>Gateway To Nix<a href=#gateway-to-nix class=post-heading__anchor aria-hidden=true>#</a></h2><p>In ways, home-manager can be seen as a gateway to the nix ecosystem. If you have enjoyed the way you can declare user configuration with home-manager, you may be interested in expanding your configuration to include other system dependencies and configuration. For example, in Linux you can define your entire system&rsquo;s configuration (including the kernel, kernel modules, networking, filesystems, etc) in nix. For macOS, there is <a href=https://github.com/LnL7/nix-darwin class=link--external target=_blank rel=noreferrer>nix-darwin</a> that includes nix modules for configuring launchd, dock, and other preferences and services. You may also want to check out <a href=https://nixos.wiki/wiki/Flakes class=link--external target=_blank rel=noreferrer>Nix Flakes</a>: a more recent feature that allows you declare dependencies, and have them automatically pinned and hashed in <code>flake.lock</code>, similar to that of many modern package managers.</p><h2 id=wrapping-up>Wrapping up<a href=#wrapping-up class=post-heading__anchor aria-hidden=true>#</a></h2><p>The title of this post is slightly misleading, since it&rsquo;s possible to retain some of your dotfiles and have them intermingle with home-manager by including them alongside nix. The idea of defining user configuration using nix can provide a clean way to maintain your configuration, and allow it to be portable across platforms. Is it worth the effort to migrate away from shell scripts and dotfiles? I&rsquo;d say so.</p><p>You can find my nix config <a href=https://github.com/davegallant/nix-config class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.84fad1d1396df61912fa589a19522118b5b3eb0806f4f7161f1034dc0672a3270863d0b236a15e1797d3a78930568729f80f15d66d73f2dc11044a5152de00b2.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>
+</code></pre><p>You should see another wave of <code>/nix/store/*</code> paths. The new configuration should now be active.</p><p>If you run <code>zsh</code>, you should see that you have <a href=https://starship.rs/ class=link--external target=_blank rel=noreferrer>starship</a> and access to several other utils such as <code>rg</code>, <code>fd</code>, and <code>exa</code>.</p><p>This basic configuration above is also defining your <code>~/.config/git/config</code> and <code>.zshrc</code>. If you already have either of these files, home-manager will complain about them already existing.</p><p>If you run <code>cat ~/.zshrc</code>, you will see the way these configuration files are generated.</p><p>You can extend this configuration for programs such as (neo)vim, emacs, alacritty, ssh, etc. To see other programs, take a look at <a href=https://github.com/nix-community/home-manager/tree/master/modules/programs class=link--external target=_blank rel=noreferrer>home-manager/modules/programs</a>.</p><h2 id=gateway-to-nix>Gateway To Nix<a href=#gateway-to-nix class=post-heading__anchor aria-hidden=true>#</a></h2><p>In ways, home-manager can be seen as a gateway to the nix ecosystem. If you have enjoyed the way you can declare user configuration with home-manager, you may be interested in expanding your configuration to include other system dependencies and configuration. For example, in Linux you can define your entire system&rsquo;s configuration (including the kernel, kernel modules, networking, filesystems, etc) in nix. For macOS, there is <a href=https://github.com/LnL7/nix-darwin class=link--external target=_blank rel=noreferrer>nix-darwin</a> that includes nix modules for configuring launchd, dock, and other preferences and services. You may also want to check out <a href=https://nixos.wiki/wiki/Flakes class=link--external target=_blank rel=noreferrer>Nix Flakes</a>: a more recent feature that allows you declare dependencies, and have them automatically pinned and hashed in <code>flake.lock</code>, similar to that of many modern package managers.</p><h2 id=wrapping-up>Wrapping up<a href=#wrapping-up class=post-heading__anchor aria-hidden=true>#</a></h2><p>The title of this post is slightly misleading, since it&rsquo;s possible to retain some of your dotfiles and have them intermingle with home-manager by including them alongside nix. The idea of defining user configuration using nix can provide a clean way to maintain your configuration, and allow it to be portable across platforms. Is it worth the effort to migrate away from shell scripts and dotfiles? I&rsquo;d say so.</p><p>You can find my nix config <a href=https://github.com/davegallant/nix-config class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.f34cf124e04ca80600f3e7ebc1ff557ddda55b46ffc9152c7d213762ac19bc2ffa6e41fb59ff4e828f599b992faf554caac138e54ac6973b41ae72672112d3eb.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html>

index.xml

@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>davegallant.ca</title><link>/</link><description>Recent content on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><atom:link href="/index.xml" rel="self" type="application/rss+xml"/><item><title>Setting up Gitea Actions with Tailscale</title><link>/blog/setting-up-gitea-actions-with-tailscale/</link><pubDate>Sun, 10 Dec 2023 17:22:11 -0500</pubDate><guid>/blog/setting-up-gitea-actions-with-tailscale/</guid><description>&lt;p>In this post I&amp;rsquo;ll go through the process of setting up Gitea Actions and &lt;a
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>davegallant.ca</title><link>/</link><description>Recent content on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><atom:link href="/index.xml" rel="self" type="application/rss+xml"/><item><title>AWS EBS CSI driver with terraform</title><link>/blog/aws-ebs-csi-driver-terraform/</link><pubDate>Sun, 07 Apr 2024 15:20:23 -0400</pubDate><guid>/blog/aws-ebs-csi-driver-terraform/</guid><description>&lt;p>I recently configured the Amazon EBS CSI driver and found the setup with terraform to be more effort than expected. I wanted to avoid third-party modules and keep it as simple as possible, while remaining least privilege.&lt;/p></description></item><item><title>Setting up Gitea Actions with Tailscale</title><link>/blog/setting-up-gitea-actions-with-tailscale/</link><pubDate>Sun, 10 Dec 2023 17:22:11 -0500</pubDate><guid>/blog/setting-up-gitea-actions-with-tailscale/</guid><description>&lt;p>In this post I&amp;rsquo;ll go through the process of setting up Gitea Actions and &lt;a
 href="https://tailscale.com/"
 class="link--external" target="_blank" rel="noreferrer"
 >Tailscale&lt;/a>, unlocking a simple and secure way to automate workflows.&lt;/p></description></item><item><title>Using AKS and SOCKS to connect to a private Azure DB</title><link>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</link><pubDate>Mon, 22 May 2023 16:31:29 -0400</pubDate><guid>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</guid><description>&lt;p>I ran into a roadblock recently where I wanted to conveniently connect to a managed postgres database within Azure that was not running on public subnets. And by conveniently, I mean that I&amp;rsquo;d rather not have to spin up an ephemeral virtual machine running in the same network and proxy the connection, and I&amp;rsquo;d like to use a local client (preferably with a GUI). After several web searches, it became evident that Azure does not readily provide much tooling to support this.&lt;/p></description></item><item><title>Watching YouTube in private</title><link>/blog/watching-youtube-in-private/</link><pubDate>Sat, 10 Dec 2022 21:46:55 -0500</pubDate><guid>/blog/watching-youtube-in-private/</guid><description>&lt;p>I recently stumbled upon &lt;a

sitemap.xml

@@ -1 +1 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><sitemap><loc>/en/sitemap.xml</loc><lastmod>2024-04-06T23:25:57-04:00</lastmod></sitemap><sitemap><loc>/de/sitemap.xml</loc></sitemap></sitemapindex>
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><sitemap><loc>/en/sitemap.xml</loc><lastmod>2024-04-07T16:10:44-04:00</lastmod></sitemap><sitemap><loc>/de/sitemap.xml</loc></sitemap></sitemapindex>

tags/aws-ebs-csi-driver/index.xml

@@ -0,0 +1 @@
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>aws-ebs-csi-driver on davegallant.ca</title><link>/tags/aws-ebs-csi-driver/</link><description>Recent content in aws-ebs-csi-driver on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><lastBuildDate>Sun, 07 Apr 2024 15:20:23 -0400</lastBuildDate><atom:link href="/tags/aws-ebs-csi-driver/index.xml" rel="self" type="application/rss+xml"/><item><title>AWS EBS CSI driver with terraform</title><link>/blog/aws-ebs-csi-driver-terraform/</link><pubDate>Sun, 07 Apr 2024 15:20:23 -0400</pubDate><guid>/blog/aws-ebs-csi-driver-terraform/</guid><description>&lt;p>I recently configured the Amazon EBS CSI driver and found the setup with terraform to be more effort than expected. I wanted to avoid third-party modules and keep it as simple as possible, while remaining least privilege.&lt;/p></description></item></channel></rss>

tags/aws-ebs-csi-driver/page/1/index.html

@@ -0,0 +1,2 @@
+<!doctype html><html lang=en><head><title>/tags/aws-ebs-csi-driver/</title>
+<link rel=canonical href=/tags/aws-ebs-csi-driver/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=/tags/aws-ebs-csi-driver/"></head></html>

tags/aws/index.xml

@@ -1,2 +1,2 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>aws on davegallant.ca</title><link>/tags/aws/</link><description>Recent content in aws on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><lastBuildDate>Mon, 22 May 2023 16:31:29 -0400</lastBuildDate><atom:link href="/tags/aws/index.xml" rel="self" type="application/rss+xml"/><item><title>Using AKS and SOCKS to connect to a private Azure DB</title><link>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</link><pubDate>Mon, 22 May 2023 16:31:29 -0400</pubDate><guid>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</guid><description>&lt;p>I ran into a roadblock recently where I wanted to conveniently connect to a managed postgres database within Azure that was not running on public subnets. And by conveniently, I mean that I&amp;rsquo;d rather not have to spin up an ephemeral virtual machine running in the same network and proxy the connection, and I&amp;rsquo;d like to use a local client (preferably with a GUI). After several web searches, it became evident that Azure does not readily provide much tooling to support this.&lt;/p></description></item><item><title>Automatically rotating AWS access keys</title><link>/blog/automatically-rotating-aws-keys/</link><pubDate>Fri, 17 Sep 2021 12:48:33 -0400</pubDate><guid>/blog/automatically-rotating-aws-keys/</guid><description>Rotating credentials is a security best practice. This morning, I read a question about automatically rotating AWS Access Keys without having to go through the hassle of navigating the AWS console. There are some existing solutions already, but I decided to write a script since it was incredibly simple. The script could be packed up as a systemd/launchd service to continually rotate access keys in the background.
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>aws on davegallant.ca</title><link>/tags/aws/</link><description>Recent content in aws on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><lastBuildDate>Sun, 07 Apr 2024 15:20:23 -0400</lastBuildDate><atom:link href="/tags/aws/index.xml" rel="self" type="application/rss+xml"/><item><title>AWS EBS CSI driver with terraform</title><link>/blog/aws-ebs-csi-driver-terraform/</link><pubDate>Sun, 07 Apr 2024 15:20:23 -0400</pubDate><guid>/blog/aws-ebs-csi-driver-terraform/</guid><description>&lt;p>I recently configured the Amazon EBS CSI driver and found the setup with terraform to be more effort than expected. I wanted to avoid third-party modules and keep it as simple as possible, while remaining least privilege.&lt;/p></description></item><item><title>Using AKS and SOCKS to connect to a private Azure DB</title><link>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</link><pubDate>Mon, 22 May 2023 16:31:29 -0400</pubDate><guid>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</guid><description>&lt;p>I ran into a roadblock recently where I wanted to conveniently connect to a managed postgres database within Azure that was not running on public subnets. And by conveniently, I mean that I&amp;rsquo;d rather not have to spin up an ephemeral virtual machine running in the same network and proxy the connection, and I&amp;rsquo;d like to use a local client (preferably with a GUI). After several web searches, it became evident that Azure does not readily provide much tooling to support this.&lt;/p></description></item><item><title>Automatically rotating AWS access keys</title><link>/blog/automatically-rotating-aws-keys/</link><pubDate>Fri, 17 Sep 2021 12:48:33 -0400</pubDate><guid>/blog/automatically-rotating-aws-keys/</guid><description>Rotating credentials is a security best practice. This morning, I read a question about automatically rotating AWS Access Keys without having to go through the hassle of navigating the AWS console. There are some existing solutions already, but I decided to write a script since it was incredibly simple. The script could be packed up as a systemd/launchd service to continually rotate access keys in the background.
 In the longer term, migrating my local workflows to aws-vault seems like a more secure solution.</description></item></channel></rss>

tags/ebs/index.xml

@@ -0,0 +1 @@
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>ebs on davegallant.ca</title><link>/tags/ebs/</link><description>Recent content in ebs on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><lastBuildDate>Sun, 07 Apr 2024 15:20:23 -0400</lastBuildDate><atom:link href="/tags/ebs/index.xml" rel="self" type="application/rss+xml"/><item><title>AWS EBS CSI driver with terraform</title><link>/blog/aws-ebs-csi-driver-terraform/</link><pubDate>Sun, 07 Apr 2024 15:20:23 -0400</pubDate><guid>/blog/aws-ebs-csi-driver-terraform/</guid><description>&lt;p>I recently configured the Amazon EBS CSI driver and found the setup with terraform to be more effort than expected. I wanted to avoid third-party modules and keep it as simple as possible, while remaining least privilege.&lt;/p></description></item></channel></rss>

tags/ebs/page/1/index.html

@@ -0,0 +1,2 @@
+<!doctype html><html lang=en><head><title>/tags/ebs/</title>
+<link rel=canonical href=/tags/ebs/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=/tags/ebs/"></head></html>

tags/eks/index.xml

@@ -1 +1 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>eks on davegallant.ca</title><link>/tags/eks/</link><description>Recent content in eks on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><lastBuildDate>Mon, 22 May 2023 16:31:29 -0400</lastBuildDate><atom:link href="/tags/eks/index.xml" rel="self" type="application/rss+xml"/><item><title>Using AKS and SOCKS to connect to a private Azure DB</title><link>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</link><pubDate>Mon, 22 May 2023 16:31:29 -0400</pubDate><guid>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</guid><description>&lt;p>I ran into a roadblock recently where I wanted to conveniently connect to a managed postgres database within Azure that was not running on public subnets. And by conveniently, I mean that I&amp;rsquo;d rather not have to spin up an ephemeral virtual machine running in the same network and proxy the connection, and I&amp;rsquo;d like to use a local client (preferably with a GUI). After several web searches, it became evident that Azure does not readily provide much tooling to support this.&lt;/p></description></item></channel></rss>
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>eks on davegallant.ca</title><link>/tags/eks/</link><description>Recent content in eks on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><lastBuildDate>Sun, 07 Apr 2024 15:20:23 -0400</lastBuildDate><atom:link href="/tags/eks/index.xml" rel="self" type="application/rss+xml"/><item><title>AWS EBS CSI driver with terraform</title><link>/blog/aws-ebs-csi-driver-terraform/</link><pubDate>Sun, 07 Apr 2024 15:20:23 -0400</pubDate><guid>/blog/aws-ebs-csi-driver-terraform/</guid><description>&lt;p>I recently configured the Amazon EBS CSI driver and found the setup with terraform to be more effort than expected. I wanted to avoid third-party modules and keep it as simple as possible, while remaining least privilege.&lt;/p></description></item><item><title>Using AKS and SOCKS to connect to a private Azure DB</title><link>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</link><pubDate>Mon, 22 May 2023 16:31:29 -0400</pubDate><guid>/blog/using-aks-and-socks-to-connect-to-a-private-azure-db/</guid><description>&lt;p>I ran into a roadblock recently where I wanted to conveniently connect to a managed postgres database within Azure that was not running on public subnets. And by conveniently, I mean that I&amp;rsquo;d rather not have to spin up an ephemeral virtual machine running in the same network and proxy the connection, and I&amp;rsquo;d like to use a local client (preferably with a GUI). After several web searches, it became evident that Azure does not readily provide much tooling to support this.&lt;/p></description></item></channel></rss>

tags/oidc/index.xml

@@ -0,0 +1 @@
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>oidc on davegallant.ca</title><link>/tags/oidc/</link><description>Recent content in oidc on davegallant.ca</description><generator>Hugo -- gohugo.io</generator><language>en</language><copyright>Dave Gallant</copyright><lastBuildDate>Sun, 07 Apr 2024 15:20:23 -0400</lastBuildDate><atom:link href="/tags/oidc/index.xml" rel="self" type="application/rss+xml"/><item><title>AWS EBS CSI driver with terraform</title><link>/blog/aws-ebs-csi-driver-terraform/</link><pubDate>Sun, 07 Apr 2024 15:20:23 -0400</pubDate><guid>/blog/aws-ebs-csi-driver-terraform/</guid><description>&lt;p>I recently configured the Amazon EBS CSI driver and found the setup with terraform to be more effort than expected. I wanted to avoid third-party modules and keep it as simple as possible, while remaining least privilege.&lt;/p></description></item></channel></rss>

tags/oidc/page/1/index.html

@@ -0,0 +1,2 @@
+<!doctype html><html lang=en><head><title>/tags/oidc/</title>
+<link rel=canonical href=/tags/oidc/><meta name=robots content="noindex"><meta charset=utf-8><meta http-equiv=refresh content="0; url=/tags/oidc/"></head></html>