Snippets of Nifty

I’ve long struggled with finding an organizational, note taking, and task management system that works for me. I feel like I’ve tried dang near everything out there, but nothing really “sticks”. In this blog post, I focus mostly on technological solutions. While not a hard requirement in my mind, the convenience of not having to keep a physical thing on my person. Plus, my handwriting is atrocious!

A further problem I have is the divide between work and personal. I have different requirements for each (although my requirements for a work organizational system are more stringent); my job encourages us to not use most cloud-hosted/third-party options without prior approval. It also seems like a lot of options that would otherwise work well for work are iOS/Mac exclusive; I don’t have a company-provided Apple device.

Continue reading 

Intro

We all get spam. Most of it is devoured by our mail providers’ spam catcher, and we never see it. Every now and then, one slips through the cracks. In this case, I received an email earlier this week with a subject of “Re: Notification your test results COVID-19 [ note-7893 ]”. Classic, making me think it’s in reply to one of my email…that I sent about their test results?

Continue reading 

Quick note on configuring a single Docker container that needs to expose multiple ports using Traefik. For this example, I’m using Ubooquity as it uses a separate port for admin that I wanted to just route on the same domain.

version: "3.7"
services:
  ubooquity:
    image: linuxserver/ubooquity
    container_name: ubooquity
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Chicago
      - MAXMEM=1024 # MB
    labels:
      - traefik.http.routers.ubooquity.rule=Host(`ubooquity.example.com`)
      - traefik.http.routers.ubooquity.service=ubooquity
      - traefik.http.services.ubooquity.loadbalancer.server.port=2202
      - traefik.http.services.ubooquity.loadbalancer.server.scheme=http
      - traefik.http.routers.ubooquity.tls=true
      - traefik.http.routers.ubooquity.tls.certresolver=default
      - traefik.http.routers.ubooquity.tls.domains[0].main=example.com
      - traefik.http.routers.ubooquity.tls.domains[0].sans=*.example.com

      - traefik.http.routers.ubooquity-admin.rule=Host(`ubooquity.example.com`) && (PathPrefix(`/admin/`) || PathPrefix(`/admin-res/`))
      #- traefik.http.routers.ubooquity-admin.middlewares=admin-stripprefix
      #- traefik.http.middlewares.admin-stripprefix.stripprefix.prefixes=/admin
      - traefik.http.routers.ubooquity-admin.service=ubooquity-admin
      - traefik.http.services.ubooquity-admin.loadbalancer.server.port=2203
      - traefik.http.services.ubooquity-admin.loadbalancer.server.scheme=http
      - traefik.http.routers.ubooquity-admin.tls=true
      - traefik.http.routers.ubooquity-admin.tls.certresolver=default
      - traefik.http.routers.ubooquity-admin.tls.domains[0].main=example.com
      - traefik.http.routers.ubooquity-admin.tls.domains[0].sans=*.example.com
    networks:
      - lbclients
    ports:
      - 2202/tcp
      - 2203/tcp
    volumes:
      - ./data/config:/config
      - /mnt/Media/Ebooks:/books
    restart: unless-stopped

networks:
  lbclients:
    external: false
    name: loadbalancer

Note the commented out middleware lines. Before I changed the reverse proxy config to not use ubooquity, I needed the middlewares to strip out the path prefixes.

Continue reading 

I’ve talked about my bizarre double-reverse-proxy approach before. Today I ran into an issue getting a real letsencrypt cert on a backend host. I just wanted to share the config – this goes on the frontend nginx host. Assuming you’re using the certbot-nginx plugin, no special config is needed on the backend.

rewrite ^(/.well-known/acme-challenge/.*) $1 break;
location ^~ /.well-known/acme-challenge {
                proxy_pass http://backend-host;
        }

This will get around the sane default http -> https redirects you’ve probbaly set up. Full config:

Continue reading 

I recently acquired a new server to upgrade my aging HP Gen6 boxes. Since I was consolidating down from 2 to 1 host (but going up to 32 logical threads and 384GB memory), I figured the “HA” portion of VMware/vSphere/vCenter (I’ve entirely forgotten to mind my spheres & centers!) was less necessary. I could have switch to Proxmox, but where’s the challenge in that!? Instead, I switched to plain Ubuntu 20.04 LTS with KVM/libvirt on top, along with ZFS for the disk images. This’ll be my notes and lessons learned during the migration.

Continue reading 

As it stands now, my setup for web-accessible Docker-hosted sites is a bit convoluted. Traffic from the gateway flows into a bastion host in my DMZ. This is a tiny box running Nginx acting as a reverse proxy. There’s a hole in the firewall poked in from this bastion host to the Docker host running on my internal network. Traefik runs in Docker and provides SSL termination among other things.

Continue reading 

When LetsEncrypt announced the availability of wildcard certs, I knew I wanted in. In my homelab, in order to get SSL up and running, I’d been running Caddy, since it automagically gets a cert by doing DNS validation. However, that’s an extra step that can complicate things. With a wildcard cert, I can even put SSL places I couldn’t previously - such as my router and my FreeNAS box.

How To Do

Obtaining a wildcard cert

Due to popular demand, I’ll provide some basic steps to get your wildcart cert. I’m assuming you’re running Ubuntu or Debian, but you can probably adapt these directions as needed.

Continue reading 

These instructions work for me on Ubuntu 16.04.3. YMMV.

First, install Caddy by running curl https://getcaddy.com | bash -s personal hook.service,http.realip,tls.dns.cloudflare. If you don’t trust them (and you shouldn’t!), wget the script first and inspect it before running.

Next, add a user for Caddy: useradd -r -s /usr/sbin/nologin caddy. Then, add a place to store config: mkdir /etc/caddy && chown caddy:caddy /etc/caddy. Finally, give Caddy a logfile: touch /var/log/caddy.log && chown caddy:caddy /var/log/caddy.log

Continue reading 

I have a cluster of 3 hosts running Proxmox as a virtualization platform. They provide a total of 28 vCPUs, 72GB of memory, and ~10TB usable storage. I went with Proxmox because I have a mix of CPU types in these boxes (1x Intel C2750, 1x Xeon E5649, 1x FX-8350), and KVM supports migration between Intel and AMD procs. Pretty much ever since setting this cluster up, I noticed that the hosts would disconnect from each other according to the web interface, but the hosts and any VMs on them would remain accessible otherwise. It looked a little something like this:

Continue reading 

Intro

I maintain a web server for this blog and a few other things (my portfolio, for example). I had a pretty decent setup going, whereby nginx would serve all incoming requests. Sites like my portfolio (which is a Jekyll static site) are served straight-up by nginx, whereas sites like this blog (which runs on Ghost) are proxy-passed to the correct process. I even had a pretty nice reusable snippet for setting up SSL using Let’s Encrypt certs. Everything worked. But knowing me, I can’t leave well enough alone :) I switched to a new VPS provider to save a bit of money. Turns out, they also support Docker! So, I thought - may as well throw these sites in their own containers, for security and ease-of-hosting. Well…it’s not as straightforward as it may seem, especially for somebody who had never used Docker before…

Continue reading 