deploy: c200552255

blog/amazon-ebs-csi-driver-terraform/index.html

@@ -78,4 +78,4 @@ UPDATE: This approach can also be used for the aws-efs-csi-driver
 </span></span><span style=display:flex><span>  policy_arn <span style=color:#f92672>=</span> <span style=color:#e6db74>&#34;arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy&#34;</span>
 </span></span><span style=display:flex><span>  role       <span style=color:#f92672>=</span> <span style=color:#66d9ef>aws_iam_role</span>.<span style=color:#66d9ef>ebs_csi_driver</span>.<span style=color:#66d9ef>name</span>
 </span></span><span style=display:flex><span>}
-</span></span></code></pre></div><p>The above configuration follows the docs, binding an IAM role to the service account <code>kube-system/ebs-csi-controller-sa</code> using an OpenID connect provider.</p><p>After applying the changes above, I deployed <a href=https://docs.aws.amazon.com/eks/latest/userguide/ebs-sample-app.html class=link--external target=_blank rel=noreferrer>the sample application</a> and noticed that the persistent volume claims were bound to EBS volumes.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.a226ea30f40816418a749a0d9130f932662d1889217df28356abd6083cca6dce9309431e34de2c94807585018160e7dbf1e655e4054a5fc25fc177bd61ff8e14.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>
+</span></span></code></pre></div><p>The above configuration follows the docs, binding an IAM role to the service account <code>kube-system/ebs-csi-controller-sa</code> using an OpenID connect provider.</p><p>After applying the changes above, I deployed <a href=https://docs.aws.amazon.com/eks/latest/userguide/ebs-sample-app.html class=link--external target=_blank rel=noreferrer>the sample application</a> and noticed that the persistent volume claims were bound to EBS volumes.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>

blog/appgate-sdp-on-arch-linux/index.html

@@ -63,4 +63,4 @@ Let&rsquo;s try to run it.</p><div class=highlight><pre tabindex=0 style=color:#
 </span></span></code></pre></div><p>This is a breaking change in Python3.8.</p><p>So what is calling <code>platform.linux_distribution</code>?</p><p>Let&rsquo;s search for it:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-shell data-lang=shell><span style=display:flex><span>$ sudo grep -r <span style=color:#e6db74>&#39;linux_distribution&#39;</span> /opt/appgate/linux/
 </span></span><span style=display:flex><span>/opt/appgate/linux/nm.py:    <span style=color:#66d9ef>if</span> platform.linux_distribution<span style=color:#f92672>()[</span>0<span style=color:#f92672>]</span> !<span style=color:#f92672>=</span> <span style=color:#e6db74>&#39;Fedora&#39;</span>:
 </span></span></code></pre></div><p>Aha! So this is in the local AppGate source code. This should be an easy fix. Let&rsquo;s just replace this line with:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-python data-lang=python><span style=display:flex><span><span style=color:#66d9ef>if</span> <span style=color:#66d9ef>True</span>: <span style=color:#75715e># Since we are not using Fedora :)</span>
-</span></span></code></pre></div><h1 id=wrapping-up>Wrapping up<a href=#wrapping-up class=post-heading__anchor aria-hidden=true>#</a></h1><p>It turns out there are <a href=https://docs.python.org/3.7/library/platform.html#platform.linux_distribution class=link--external target=_blank rel=noreferrer>breaking changes</a> in Python3.8.</p><p>The docs say <code>Deprecated since version 3.5, will be removed in version 3.8: See alternative like the distro package.</code></p><p>I suppose this highlights one of the caveats of relying upon the system&rsquo;s python, rather than having an isolated, dedicated environment for all dependencies.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.a226ea30f40816418a749a0d9130f932662d1889217df28356abd6083cca6dce9309431e34de2c94807585018160e7dbf1e655e4054a5fc25fc177bd61ff8e14.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>
+</span></span></code></pre></div><h1 id=wrapping-up>Wrapping up<a href=#wrapping-up class=post-heading__anchor aria-hidden=true>#</a></h1><p>It turns out there are <a href=https://docs.python.org/3.7/library/platform.html#platform.linux_distribution class=link--external target=_blank rel=noreferrer>breaking changes</a> in Python3.8.</p><p>The docs say <code>Deprecated since version 3.5, will be removed in version 3.8: See alternative like the distro package.</code></p><p>I suppose this highlights one of the caveats of relying upon the system&rsquo;s python, rather than having an isolated, dedicated environment for all dependencies.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>

blog/replacing-docker-with-podman-on-macos/index.html

@@ -47,4 +47,4 @@
 </span></span><span style=display:flex><span>0
 </span></span><span style=display:flex><span>podman start -a davegallant.github.io_hello_world_1
 </span></span><span style=display:flex><span>Hello world
-</span></span></code></pre></div><p>This should more or less provide the same results you would come to expect with docker. The README does clearly state that podman-compose is under development.</p><h3 id=summary>Summary<a href=#summary class=post-heading__anchor aria-hidden=true>#</a></h3><p>Installing Podman on macOS was not seamless, but it was manageable well within 30 minutes. I would recommend giving Podman a try to anyone who is unhappy with experiencing forced docker updates, or who is interested in using a more modern technology for running containers.</p><p>One caveat to mention is that there isn&rsquo;t an official graphical user interface for Podman, but there is an <a href=https://github.com/containers/podman/issues/11494 class=link--external target=_blank rel=noreferrer>open issue</a> considering one. If you rely heavily on Docker Desktop&rsquo;s UI, you may not be as interested in using podman yet.</p><blockquote><p>Update: After further usage, bind mounts do not seem to work out of the box when the client and host are on different machines. A rather involved solution using <a href=https://en.wikipedia.org/wiki/SSHFS class=link--external target=_blank rel=noreferrer>sshfs</a> was shared <a href=https://github.com/containers/podman/issues/8016#issuecomment-920015800 class=link--external target=_blank rel=noreferrer>here</a>.</p></blockquote><p>I had been experimenting with Podman on Linux before writing this, but after listening to this <a href=https://kubernetespodcast.com/episode/164-podman/ class=link--external target=_blank rel=noreferrer>podcast episode</a>, I was inspired to give Podman a try on macOS.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.a226ea30f40816418a749a0d9130f932662d1889217df28356abd6083cca6dce9309431e34de2c94807585018160e7dbf1e655e4054a5fc25fc177bd61ff8e14.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>
+</span></span></code></pre></div><p>This should more or less provide the same results you would come to expect with docker. The README does clearly state that podman-compose is under development.</p><h3 id=summary>Summary<a href=#summary class=post-heading__anchor aria-hidden=true>#</a></h3><p>Installing Podman on macOS was not seamless, but it was manageable well within 30 minutes. I would recommend giving Podman a try to anyone who is unhappy with experiencing forced docker updates, or who is interested in using a more modern technology for running containers.</p><p>One caveat to mention is that there isn&rsquo;t an official graphical user interface for Podman, but there is an <a href=https://github.com/containers/podman/issues/11494 class=link--external target=_blank rel=noreferrer>open issue</a> considering one. If you rely heavily on Docker Desktop&rsquo;s UI, you may not be as interested in using podman yet.</p><blockquote><p>Update: After further usage, bind mounts do not seem to work out of the box when the client and host are on different machines. A rather involved solution using <a href=https://en.wikipedia.org/wiki/SSHFS class=link--external target=_blank rel=noreferrer>sshfs</a> was shared <a href=https://github.com/containers/podman/issues/8016#issuecomment-920015800 class=link--external target=_blank rel=noreferrer>here</a>.</p></blockquote><p>I had been experimenting with Podman on Linux before writing this, but after listening to this <a href=https://kubernetespodcast.com/episode/164-podman/ class=link--external target=_blank rel=noreferrer>podcast episode</a>, I was inspired to give Podman a try on macOS.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>

blog/running-k3s-in-lxc-on-proxmox/index.html

@@ -48,4 +48,4 @@ As of 2021/11, it is still defaulting to the 1.19 channel, so I overrode it to 1
 </span></span><span style=display:flex><span><span style=color:#960050;background-color:#1e0010>
 </span></span></span><span style=display:flex><span><span style=color:#960050;background-color:#1e0010></span>NAME                                                           REFERENCE                             TARGETS   MINPODS   MAXPODS   REPLICAS   AGE
 </span></span><span style=display:flex><span>horizontalpodautoscaler.autoscaling/tekton-pipelines-webhook   Deployment/tekton-pipelines-webhook   9%/100%   1         5         1          12h
-</span></span></code></pre></div><p>I made sure to install Tailscale in the container so that I can easily access K3s from anywhere.</p><p>If I&rsquo;m feeling adventurous, I might experiment with <a href=https://rancher.com/docs/k3s/latest/en/advanced/#running-k3s-with-rootless-mode-experimental class=link--external target=_blank rel=noreferrer>K3s rootless</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.a226ea30f40816418a749a0d9130f932662d1889217df28356abd6083cca6dce9309431e34de2c94807585018160e7dbf1e655e4054a5fc25fc177bd61ff8e14.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>
+</span></span></code></pre></div><p>I made sure to install Tailscale in the container so that I can easily access K3s from anywhere.</p><p>If I&rsquo;m feeling adventurous, I might experiment with <a href=https://rancher.com/docs/k3s/latest/en/advanced/#running-k3s-with-rootless-mode-experimental class=link--external target=_blank rel=noreferrer>K3s rootless</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>

blog/setting-up-gitea-actions-with-tailscale/index.html

@@ -88,4 +88,4 @@
 </span></span><span style=display:flex><span>          <span style=color:#f92672>from</span>: <span style=color:#ae81ff>RFD Notify</span>
 </span></span><span style=display:flex><span>          <span style=color:#f92672>body</span>: |<span style=color:#e6db74>
 </span></span></span><span style=display:flex><span><span style=color:#e6db74>            ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}</span>            
-</span></span></code></pre></div><p>And voilà:</p><p><img src=gitea-workflow.png alt=image></p><p>You may be wondering how the gitea runner is allowed to connect to the other hosts using ansible? Well, the nodes are in the same tailnet and have <a href=https://tailscale.com/tailscale-ssh class=link--external target=_blank rel=noreferrer>tailscale ssh</a> enabled.</p><h2 id=areas-for-improvement>Areas for improvement<a href=#areas-for-improvement class=post-heading__anchor aria-hidden=true>#</a></h2><p>One enhancement that I would like to see is the ability to send notifications on workflow failures. Currently, this <a href=https://github.com/go-gitea/gitea/issues/23725 class=link--external target=_blank rel=noreferrer>doesn&rsquo;t seem possible</a> without adding logic to each workflow.</p><h2 id=conclusion>Conclusion<a href=#conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>Gitea Actions are fast and the resource footprint is minimal. My gitea instance is currently using around 250mb of memory and a small fraction of a single cpu core (and the runner is using a similar amount of resources). This is impressive since many alternatives tend to require substantially more resources. It likely helps that the codebase is largely written in go.</p><p>By combining gitea with the networking marvel that is tailscale, running workflows becomes simple and fun. Whether you are working on a team or working alone, this setup ensures that your workflows are securely accessible from anywhere with an internet connection.</p><p>Check out my gitea instance exposed via Funnel <a href=https://gitea.snake-cloud.ts.net class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.a226ea30f40816418a749a0d9130f932662d1889217df28356abd6083cca6dce9309431e34de2c94807585018160e7dbf1e655e4054a5fc25fc177bd61ff8e14.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>
+</span></span></code></pre></div><p>And voilà:</p><p><img src=gitea-workflow.png alt=image></p><p>You may be wondering how the gitea runner is allowed to connect to the other hosts using ansible? Well, the nodes are in the same tailnet and have <a href=https://tailscale.com/tailscale-ssh class=link--external target=_blank rel=noreferrer>tailscale ssh</a> enabled.</p><h2 id=areas-for-improvement>Areas for improvement<a href=#areas-for-improvement class=post-heading__anchor aria-hidden=true>#</a></h2><p>One enhancement that I would like to see is the ability to send notifications on workflow failures. Currently, this <a href=https://github.com/go-gitea/gitea/issues/23725 class=link--external target=_blank rel=noreferrer>doesn&rsquo;t seem possible</a> without adding logic to each workflow.</p><h2 id=conclusion>Conclusion<a href=#conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>Gitea Actions are fast and the resource footprint is minimal. My gitea instance is currently using around 250mb of memory and a small fraction of a single cpu core (and the runner is using a similar amount of resources). This is impressive since many alternatives tend to require substantially more resources. It likely helps that the codebase is largely written in go.</p><p>By combining gitea with the networking marvel that is tailscale, running workflows becomes simple and fun. Whether you are working on a team or working alone, this setup ensures that your workflows are securely accessible from anywhere with an internet connection.</p><p>Check out my gitea instance exposed via Funnel <a href=https://gitea.snake-cloud.ts.net class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>

blog/using-aks-and-socks-to-connect-to-a-private-azure-db/index.html

@@ -15,4 +15,4 @@ If this sounds more appealing, install <a href=https://github.com/antitree/krew-
 </span></span><span style=display:flex><span>using: image=serjs/go-socks5-proxy
 </span></span><span style=display:flex><span>Creating SOCKS5 Proxy (Pod)...
 </span></span><span style=display:flex><span>pod/davegallant-proxy created
-</span></span></code></pre></div><p>With the above proxy connection open, it is possible to access both the DNS and private IPs accessible within the k8s cluster. In this case, I am able to access the private database, since there is network connectivity between the k8s cluster and the database.</p><h2 id=caveats-and-conclusion>Caveats and Conclusion<a href=#caveats-and-conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>The above outlined solution makes some assumptions:</p><ul><li>there is a k8s cluster</li><li>the k8s cluster has network connectivity to the desired private database</li></ul><p>If these stars align, than this solution might work as a stopgap for accessing a private Azure DB (and I&rsquo;m assuming this could work similarly on AWS).</p><p>It would be nice if Azure provided tooling similar to cloud-sql-proxy, so that using private databases would be more of a convenient experience.</p><p><del>One other thing to note is that some clients (such as <a href=https://dbeaver.io/ class=link--external target=_blank rel=noreferrer>dbeaver</a>) <a href=https://github.com/dbeaver/dbeaver/issues/872 class=link--external target=_blank rel=noreferrer>do not provide DNS resolution over SOCKS</a>. So in this case, you won&rsquo;t be able to use DNS as if you were inside the cluster, but instead have to rely on knowing private ip addresses.</del></p><blockquote><p><strong>2025-01-16:</strong>: DNS over SOCKS now works with the latest dbeaver client.</p></blockquote></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.a226ea30f40816418a749a0d9130f932662d1889217df28356abd6083cca6dce9309431e34de2c94807585018160e7dbf1e655e4054a5fc25fc177bd61ff8e14.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>
+</span></span></code></pre></div><p>With the above proxy connection open, it is possible to access both the DNS and private IPs accessible within the k8s cluster. In this case, I am able to access the private database, since there is network connectivity between the k8s cluster and the database.</p><h2 id=caveats-and-conclusion>Caveats and Conclusion<a href=#caveats-and-conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>The above outlined solution makes some assumptions:</p><ul><li>there is a k8s cluster</li><li>the k8s cluster has network connectivity to the desired private database</li></ul><p>If these stars align, than this solution might work as a stopgap for accessing a private Azure DB (and I&rsquo;m assuming this could work similarly on AWS).</p><p>It would be nice if Azure provided tooling similar to cloud-sql-proxy, so that using private databases would be more of a convenient experience.</p><p><del>One other thing to note is that some clients (such as <a href=https://dbeaver.io/ class=link--external target=_blank rel=noreferrer>dbeaver</a>) <a href=https://github.com/dbeaver/dbeaver/issues/872 class=link--external target=_blank rel=noreferrer>do not provide DNS resolution over SOCKS</a>. So in this case, you won&rsquo;t be able to use DNS as if you were inside the cluster, but instead have to rely on knowing private ip addresses.</del></p><blockquote><p><strong>2025-01-16:</strong>: DNS over SOCKS now works with the latest dbeaver client.</p></blockquote></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>

blog/watching-youtube-in-private/index.html

@@ -67,4 +67,4 @@
 </span></span><span style=display:flex><span>        }
 </span></span><span style=display:flex><span>    ]
 </span></span><span style=display:flex><span>}
-</span></span></code></pre></div><p>Now the link <a href="https://www.youtube.com/watch?v=-lz30by8-sU" class=link--external target=_blank rel=noreferrer>https://www.youtube.com/watch?v=-lz30by8-sU</a> will redirect to <a href="http://invidious:3000/watch?v=-lz30by8-sU" class=link--external target=_blank rel=noreferrer>http://invidious:3000/watch?v=-lz30by8-sU</a></p><p>I&rsquo;m still looking for ways to improve this invidious setup. There doesn&rsquo;t appear to be a way to stream in 4K yet.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.a226ea30f40816418a749a0d9130f932662d1889217df28356abd6083cca6dce9309431e34de2c94807585018160e7dbf1e655e4054a5fc25fc177bd61ff8e14.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>
+</span></span></code></pre></div><p>Now the link <a href="https://www.youtube.com/watch?v=-lz30by8-sU" class=link--external target=_blank rel=noreferrer>https://www.youtube.com/watch?v=-lz30by8-sU</a> will redirect to <a href="http://invidious:3000/watch?v=-lz30by8-sU" class=link--external target=_blank rel=noreferrer>http://invidious:3000/watch?v=-lz30by8-sU</a></p><p>I&rsquo;m still looking for ways to improve this invidious setup. There doesn&rsquo;t appear to be a way to stream in 4K yet.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>

blog/why-i-threw-out-my-dotfiles/index.html

@@ -114,4 +114,4 @@
 </span></span><span style=display:flex><span>  };
 </span></span><span style=display:flex><span>}
 </span></span></code></pre></div><p>Save the file and run:</p><pre tabindex=0><code>home-manager switch
-</code></pre><p>You should see another wave of <code>/nix/store/*</code> paths. The new configuration should now be active.</p><p>If you run <code>zsh</code>, you should see that you have <a href=https://starship.rs/ class=link--external target=_blank rel=noreferrer>starship</a> and access to several other utils such as <code>rg</code>, <code>fd</code>, and <code>exa</code>.</p><p>This basic configuration above is also defining your <code>~/.config/git/config</code> and <code>.zshrc</code>. If you already have either of these files, home-manager will complain about them already existing.</p><p>If you run <code>cat ~/.zshrc</code>, you will see the way these configuration files are generated.</p><p>You can extend this configuration for programs such as (neo)vim, emacs, alacritty, ssh, etc. To see other programs, take a look at <a href=https://github.com/nix-community/home-manager/tree/master/modules/programs class=link--external target=_blank rel=noreferrer>home-manager/modules/programs</a>.</p><h2 id=gateway-to-nix>Gateway To Nix<a href=#gateway-to-nix class=post-heading__anchor aria-hidden=true>#</a></h2><p>In ways, home-manager can be seen as a gateway to the nix ecosystem. If you have enjoyed the way you can declare user configuration with home-manager, you may be interested in expanding your configuration to include other system dependencies and configuration. For example, in Linux you can define your entire system&rsquo;s configuration (including the kernel, kernel modules, networking, filesystems, etc) in nix. For macOS, there is <a href=https://github.com/LnL7/nix-darwin class=link--external target=_blank rel=noreferrer>nix-darwin</a> that includes nix modules for configuring launchd, dock, and other preferences and services. You may also want to check out <a href=https://nixos.wiki/wiki/Flakes class=link--external target=_blank rel=noreferrer>Nix Flakes</a>: a more recent feature that allows you declare dependencies, and have them automatically pinned and hashed in <code>flake.lock</code>, similar to that of many modern package managers.</p><h2 id=wrapping-up>Wrapping up<a href=#wrapping-up class=post-heading__anchor aria-hidden=true>#</a></h2><p>The title of this post is slightly misleading, since it&rsquo;s possible to retain some of your dotfiles and have them intermingle with home-manager by including them alongside nix. The idea of defining user configuration using nix can provide a clean way to maintain your configuration, and allow it to be portable across platforms. Is it worth the effort to migrate away from shell scripts and dotfiles? I&rsquo;d say so.</p><p>You can find my nix config <a href=https://github.com/davegallant/nix-config class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.a226ea30f40816418a749a0d9130f932662d1889217df28356abd6083cca6dce9309431e34de2c94807585018160e7dbf1e655e4054a5fc25fc177bd61ff8e14.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>
+</code></pre><p>You should see another wave of <code>/nix/store/*</code> paths. The new configuration should now be active.</p><p>If you run <code>zsh</code>, you should see that you have <a href=https://starship.rs/ class=link--external target=_blank rel=noreferrer>starship</a> and access to several other utils such as <code>rg</code>, <code>fd</code>, and <code>exa</code>.</p><p>This basic configuration above is also defining your <code>~/.config/git/config</code> and <code>.zshrc</code>. If you already have either of these files, home-manager will complain about them already existing.</p><p>If you run <code>cat ~/.zshrc</code>, you will see the way these configuration files are generated.</p><p>You can extend this configuration for programs such as (neo)vim, emacs, alacritty, ssh, etc. To see other programs, take a look at <a href=https://github.com/nix-community/home-manager/tree/master/modules/programs class=link--external target=_blank rel=noreferrer>home-manager/modules/programs</a>.</p><h2 id=gateway-to-nix>Gateway To Nix<a href=#gateway-to-nix class=post-heading__anchor aria-hidden=true>#</a></h2><p>In ways, home-manager can be seen as a gateway to the nix ecosystem. If you have enjoyed the way you can declare user configuration with home-manager, you may be interested in expanding your configuration to include other system dependencies and configuration. For example, in Linux you can define your entire system&rsquo;s configuration (including the kernel, kernel modules, networking, filesystems, etc) in nix. For macOS, there is <a href=https://github.com/LnL7/nix-darwin class=link--external target=_blank rel=noreferrer>nix-darwin</a> that includes nix modules for configuring launchd, dock, and other preferences and services. You may also want to check out <a href=https://nixos.wiki/wiki/Flakes class=link--external target=_blank rel=noreferrer>Nix Flakes</a>: a more recent feature that allows you declare dependencies, and have them automatically pinned and hashed in <code>flake.lock</code>, similar to that of many modern package managers.</p><h2 id=wrapping-up>Wrapping up<a href=#wrapping-up class=post-heading__anchor aria-hidden=true>#</a></h2><p>The title of this post is slightly misleading, since it&rsquo;s possible to retain some of your dotfiles and have them intermingle with home-manager by including them alongside nix. The idea of defining user configuration using nix can provide a clean way to maintain your configuration, and allow it to be portable across platforms. Is it worth the effort to migrate away from shell scripts and dotfiles? I&rsquo;d say so.</p><p>You can find my nix config <a href=https://github.com/davegallant/nix-config class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script></div></body></html>

js/flexsearch.d6270d7508c402a6bbcd4bb19216ce2f2d7cfda08b4056a7dd0a2afedf1ca63bf3857d98a837c741587ec6e83a7aa91e1041f16036aabad04afa4cdbd9e44266.js

@@ -21,7 +21,8 @@ Conclusion# Although I am not sure why passing through a Realtek NIC to an OPNse
 The only app I’ve needed to install has been Tailscale which has enabled me to access the TrueNAS Web UI from anywhere. I’ve setup a few datasets and NFS shares to store various backups and the rest of the periodic backups have routinely been working without a hitch. Since my homelab is becoming more of a vital piece of infrastructure for my daily needs, I wanted to ensure that these datasets had Cloud Sync Tasks setup for offsite backups. These encrypted backups are mostly being stored in places such as Google Drive and other blob storage providers.
 More recently, to reduce cloud costs, I’ve setup some a small node at another physical location and installed both Tailscale and sftpgo on it to facilitate offsite backups. After setting up the infrastructure and adding a Cloud Sync Task in TrueNAS SCALE to replicate these backups offsite to sftpgo, I noticed that Tailscale’s Magic DNS was not working, nor was the Tailscale IPv4 address.
 After reading the Tailscale docs , it became clear that the Userspace box had to be unchecked in the Tailscale app settings. This is because the Tailscale app is running within a docker container on the TrueNAS SCALE VM. After unchecking the Userspace box, I was able to verify that the Backup Credentials created for sftpgo worked when specifying the host as a Tailscale IPv4 address. This was probably good enough since the IP won’t change unless the node is re-registered.
-To get MagicDNS working, I went to Network > Global Configuration and set “Nameserver 1” to 100.100.100.100. After this, I was able to specify the FQDN in the Backup Credentials and the Cloud Sync Tasks started. This method of adding MagicDNS can lead to breakages in DNS when updating the tailscale application in TrueNAS, so I ended up removing this and using the Tailscale IP directly.
+To get MagicDNS working, I went to Network > Global Configuration and set “Nameserver 1” to 100.100.100.100. After this, I was able to specify the FQDN in the Backup Credentials and the Cloud Sync Tasks started.
+This method of adding MagicDNS can lead to issues with DNS when updating the tailscale application in TrueNAS, so I ended using the Tailscale IP directly.
 `}).add({id:2,href:"/blog/opting-out-of-haveibeenpwned/",title:"Opting out of haveibeenpwned",description:`Data breaches are a concern for anyone trying to live a life of relative privacy. Last month, PowerSchool informed its customers that hackers stole data of 62 million students. This may not have impacted you, but unless you have been practicing Extreme Privacy techniques for decades, you likely have been impacted by a data breach in the past.
 `,content:`Data breaches are a concern for anyone trying to live a life of relative privacy. Last month, PowerSchool informed its customers that hackers stole data of 62 million students. This may not have impacted you, but unless you have been practicing Extreme Privacy techniques for decades, you likely have been impacted by a data breach in the past.
 Understanding Data Breaches# Data breaches occur when unauthorized individuals gain access to sensitive information (names, addresses, emails, phone numbers among other details). If the breach is substantial enough, the raw data is likely to make it into the hands of data brokers that will collect, aggregate, and sell the information on the dark web.