-
Kubernetes direnv
Kubernetes connections are normally defined in YAML files at ~/kube/config. This file normally intermingles and accumulates a bunch of server settings and keys, making it hard to add/remove kubernetes clusters. In the past I resorted to building this whole file from fragments at login but recently I discovered direnv which...
-
Lab Environment
If you want to make an apple pie from scratch, you must first create the universe. The Hitchhiker’s Guide to the Galaxy, Douglas Adams Lab environments are vital for the work I’m doing. In most situations fixing problems is “easy” but proving a solution works or that a problem occurs...
-
(Fun With) Packer and Nexus
I have a bunch of VMs that I need to look after in my homelab spread across Hyperv and KMV (libvirt). Management of these VMs has evolved from one-off installs, through to images SCPed between hosts and finally to a fully fledged build system with distribution via Nexus. On hyperv...
-
Lab CA
Lots of stuff we do in the lab needs a self-issued TLS certificate. Here’s how you can generate your own TLS chain of trust for testing(!). This guide is intentionally terse and assumes knowledge of public key cryptography CA Key and Certificate openssl genrsa -out lab_ca.key.pem 4096 openssl req -x509...
-
Debugging asymmetric routing
TLDR; If this applies, reconsider what you are setting out to do and possibly redesign your network too. Long version Recently I had some strange stuff happening on the network: Linux servers with multiple IP addresses - each belonging to virtual NICs on different VLANs Hierarchy of VLANS - some...
-
Podman Quadlet Services
Kubernetes is great but sometimes you just want to run one container on one VM in the simplest way possible. docker --restart always is one way to do this but its pretty clunky: Container managed by docker not systemd Requires installing docker Completely different to Kubernetes Podman and Systemd -...
-
AI Coding - Twitter 3D printing
Can AI do your coding for you in 2025? Best way to answer this is to just try it out: Ready for a fun programming task? Please can you write some python to: Accept a twitter URL Download the tweet Create a 3D model plaque with: rounded corners suitable for...
-
How to reset nexus admin password in Nexus 3 OSS
Nexus users are defined in an H2 database - not to be confused with OrientDB which isn’t used any more. To reset a password, you need to connect to the database and run some SQL. Sonatype have a comprehensive support article on how to do this: https://support.sonatype.com/hc/en-us/articles/213467158-How-to-reset-a-forgotten-admin-password-in-Sonatype-Nexus-Repository-3 But there are...
-
Debian 12 bootable USB
Let’s make a Debian 12 bootable USB. The idea is too boot from the USB and have it fully wipe the disk and bring up a blank server on the network. We would then be able to apply our Standard Operating Environment (SOE) to the new server to fully prepare...
-
noexec /tmp in 2024
TLDR; /tmp is controlled by systemd. Create a /etc/systemd/system/tmp.mount.d/override.conf with content: [Mount] Options=noexec Then enable and reboot: systemctl enable tmp.mount reboot Long Version Want to set noexec on /tmp for security/hardening? You used to be able to do this by editing /etc/fstab but systemd has now taken over this job...
-
no-comment - drop in replacement for staticman
If you run a blog like this, 99.9% of all comments are spam so they need approval before being added. For a few years this site has used staticman but Heroku free dynamos stopped a while ago and staticman hasn’t been updated for years. A new solution for comments Time...
-
Deploy your own Cloudflare Workers
Lets make a Cloudflare Worker with Typescript. Step 1: Setup Workstation Install nodejs, then: npm install -g wrangler wrangler login Step 2: Create a project Create a new project in interactive mode, the template to use for typescript template is listed under resources and pointed to this github directory at...
-
Bun - first impressions
After trying out Deno, the next thing on the list to look at is Bun. Key features: Batteries included - like Deno Drop-in replacement for node.js Much faster then both node.js and Deno due to JavaScriptCore So lets play! Installation Very easy - one curl-bash command Docker image also available...
-
Kubernetes Network Troubleshooting
One of my favourite TV shows is Air Crash Investigation. This is a really insightful show that anyone with interest in engineering should watch. The TLDR of many of the episodes is lots of little problems ending in catastrophy. In my little home network I’ve been having my own very...
-
Home Assistant setup
Ive been playing with Home Assitant for a while now on a variety of platforms: kubernetes - too complicated and pointless (only one node has Zigbee anyway) Docker - too read only (upgrades dont work, plugins dont work) Raspberry Pi - no power points left and too big to share...
-
Deno on AWS Lambda
Sometimes you get to play with cool stuff at work for fun… I decided to try out Deno since Id heard some good things about it and knocked out a small demo project to test on AWS Lambda which has been on my todo list for a while now. Hows...
-
bigdebian kubernetes debugging
Sometimes you need to break out the big guns when it comes to debugging. debian:12 is unfortunately missing a bunch of basic tools to keep the image size and attack surface area small. I spent a good while looking for a ready-to-go container with everything I wanted but ended up...
-
Ansible Passwords
Ansible Vault lets us encrypt values against an external password. The resulting ciphertext can be included directly in the inventory and avoids the need to encrypt the entire file. If the password is kept externally from git so it is impossible to recover from the git repository alone. Lets set...
-
Confluent JSON Schema - Blog series
If youve ever wondered how Confluent JSON Schemas are managed and evolved there is quite a lot of reading and experimenting involved. To make things easier to understand Ive written a series of blog posts explaining how it all works. Since each post builds on the previous one, this index...
-
Which Confluent Schema ID?
kafkacat -u -b localhost:9092 -t azure -J| python3 -c "$(echo 'aW1wb3J0IHN5cwppbXBvcnQganNvbgpmb3IgbSBpbiBzeXMuc3RkaW46CiAgICBqID0ganNvbi5sb2FkcyhtKQogICAgcmkgPSBqWydwYXlsb2FkJ11bMTo1XS5lbmNvZGUoJ3V0Zi04JykKICAgIHNpID0gaW50LmZyb21fYnl0ZXMocmksICJiaWciKQogICAgcHJpbnQoZiJwYXJ0aXRpb246IHtqWydwYXJ0aXRpb24nXX0gb2Zmc2V0OiB7alsnb2Zmc2V0J119IHNjaGVtYSBpZDoge3NpfSIpCgo=' | base64 -d)" Why? Sometimes you just want to see the message partition, offset and schema IDs as messages are produced so that you can can concisely present information. Other approaches are the Confluent Control Center and the kafka*console-consumer*...
-
How to register JSON schemas in Confluent Schema Registry using the REST API
Create the schema By hand By generation (online, from POJO etc) Save the schema somewhere Example: schemas/value.json { "$schema": "http://json-schema.org/draft-07/schema#", "additionalProperties": true, "properties": { "messageCreateTime": { "type": "string" }, "messageType": { "type": "string" }, "sourceApplication": { "type": "string" }, "targetApplication": { "type": "string" }, "tranID": { "type": "string" } },...
-
Confluent schema evolution in development and production
Schema Evolution: The official word TLDR Free-for-all when solo developing Practice your schema evolution when working as part of a team Defined process for schema evolution in production Schema evolution In development In a development environment you have a lot of flexibility in terms of what to do around schema...
-
Confluent JSON Schema Evolution
TLDR Take control of your JSON schema generation in production contexts If your just adding fields no need to worry just add them If field deletion is required, an open content model must be used In-depth Confluent JSON Schema evolution behaves differently to “normal” schema evolution. For the nuances, take...
-
Kubernetes + NVIDIA on K3S
Goal: Setup a Kubernetes node to expose NVIDIA GPU so that GPU loads (AI, Crypto, etc…) can run on Kubernetes: Platform: Debian 12 AMD64/x86_64 NVIDIA RTX 3070 Kubernetes (K3S) What are we trying to do? Expose a “GPU” capability on K8S nodes that have GPUs How do we do it?...
-
Problems with ancient date-time values
Sometimes you get questions that really lead you down rabbit holes: Year Zero My database uses 0000-12-31 as a timestamp and it crashes Google Big Query as it doesnt consider 0000 as a year. So to solve this customer asks if we can replace all 0000-12-31 values with 0001-01-01. Why...
-
Creating a new TypeScript project in 2023
Theres a few steps involved to make a new TypeScript project in 2023. There are lots of guides out there and their all “missing bits”: ES2022, testing, linting, etc - you have to assemble the pieces yourself. Workstation setup nvm Editor: WebStorm Visual Studio Code Project setup To avoid writing...
-
Adding typescript-eslint to a project
Heres how to quickly add typescript-eslint to your typescript project. Of course, this isnt the same thing as configuring eslint for typscript 😂 Step 0 Project already configured with typescript Step 1 Install typescript-eslint: # eg npm install --save-dev @typescript-eslint/parser @typescript-eslint/eslint-plugin eslint typescript Step 2 Use sensible defaults: Disable parseInt,...
-
macOS on AWS
Sometimes your mac colleagues need some instructions on how to do things or test interesting workarounds to Docker bugs MacOS does not run well in VirtualBox and this probably breaks licensing too - so how to test short of borrowing a computer? AWS - heres how!
-
Docker and K3d on macOS with bridged networking
Want to test Kubernetes but dont have a spare PC and want to save money on your cloud bill? Run kubernetes locally with Docker and K3d. Normally theres no bridge networking so you have to port-forward to get data in and out of the cluster. These instructions let you reach...
-
Confluent S3 Sink Connector EOS
Confluents S3 Sink Connector is an easy way to use Kafka Connect to dump data in AWS S3 object store. A useful feature of the connector is its ability to support Exactly Once Semantics (EOS) S3 and EOS EOS is notoriously hard to get right with S3 because S3 objects...
-
Switching to swapfile on linux
Many Linux installs use a swap partition instead of a swap file. There are some good reasons for this such as enabling sequential access for HDDs and hibernate support but a physical partition means if sizes are wrong a live USB and complicated resize procedure will be needed. These days...
-
Shrinking LUKS encrypted LVM2 EXT4 filesystem
Sometimes you need to shrink EXT4 filesystem hosted on LVM + LUKS to free up a bit of space for an additional filesystem. This can be vital in some situations: /boot too small and blocks kernel upgrades… but almost the whole drive is taken by LUKS - I give myself...
-
Nvidia drivers on Debian and Ubuntu
Official Documentation: Debian: https://wiki.debian.org/NvidiaGraphicsDrivers Ubuntu: https://help.ubuntu.com/community/NvidiaDriversInstallation Dont forget to ON the GPU in UEFI/BIOS! Debian enable non-free and contrib for all repos. Eg, update every entry in /etc/apt/sources.list: # old deb http://deb.debian.org/debian bookworm main non-free-firmware # change to deb http://deb.debian.org/debian bookworm main non-free-firmware non-free contrib apt install nvidia-driver firmware-misc-nonfree firmware-misc-nonfree...
-
Growing EXT4 LVM filesystem to use all free space
Growing filesystems is thankfully quite easy and can be done online. Most of the time I just want to use all available free space in a PV, to reclaim space freed by deleting another LV. There are just 3 steps: Take a backup Extend the LV to use all free...
-
Flatpak Firefox + import Firefox profile from Snap
Firefox on Debian Theres two “happy paths” with Firefox on Debian listed on the WIKI: Firefox ESR (Extended Support Release) - older/more stable version. Usually installed by default Flatpak/flathub latest Firefox If your coming from a recent Ubuntu you will need to use a recent Firefox since you cant import...
-
Fix/Setup grub + LUKS (fix grub/bootloader)
Did you just accidentally trash grub or manually install Debian using debootstrap? If so, this is how to get your system booting again by getting it to the stage where grub can be setup so you can rescue the system/finish the install. Boot environment to setup grub (adjust as needed)...
-
Fix Druva backup crash on Linux with Nvidia
If your running Druva InSync on a Linux box with Nvidia hardware, you might experience a crash every time you try to load the app. This manifests as the app starting and immediately exiting. The cause for this is incompatibility between Electron GPU acceleration and the Nvidia driver. Since this...
-
Upgrading to Debian 12 from whole disk Ubuntu + LUKS
Debian 12 is out and its awesome. My personal highlights on a 2017 era Thinkpad: Bundled firmware blobs Working out-of-the-box WIFI “Easy” NVIDIA driver setup Secure boot support 100% free (as in freedom) software… apart from those nasty blobs above Sound, bluetooth, webcam - 100% working No SNAPs If you...
-
Your own Kubernetes environment
How to build a complete Kubernetes environment on a single spare PC or EC2 VM, complete with storage, load balancer(s) and ingress. This is great for testing. For a more production grade setup add some more PCs or VMs. For easy DNS support, add static hostnames on your router for...
-
PostgreSQL Docker Environment
Here’s the quickest way to spin up and connect to a PostgreSQL Docker instance. podman is used as a drop-in replacement for Docker. Create a PostgreSQL server podman run --rm -p 5432:5432 --name postgres -e POSTGRES_PASSWORD=secret postgres:14.4-bullseye Connecting to the server PGPASSWORD=secret psql --host localhost --port 5432 --user postgres
-
MongoDB Docker Environment
Here’s the quickest way to spin up and connect to a MongoDB Docker instance. podman is used as a drop-in replacement for Docker. Create a MongoDB server podman run --rm -p 27017:27017 --name mongo -e MONGO_INITDB_ROOT_USERNAME=root -e MONGO_INITDB_ROOT_PASSWORD=secret mongo:5.0.9 Connecting to the server mongo --username root --password secret
-
MySQL Docker Environment
Sometimes you just want to spin up a MySQL server without having to re-read the instructions. podman is used as a drop-in replacement for Docker in this example. You’re welcome. Create a MySQL server podman run --rm -p 3306:3306 --name mysql -e MYSQL_ROOT_PASSWORD=secret -d mysql:8.0.29-debian Connecting to the server mysql...
-
Tracing Maven transitive dependencies
Sometimes you might get a stray security alert for a maven project, eg my own atlassian plugin: https://bitbucket.org/declarativesystems/puppet_deploy_bitbucket/ was recently flagged on the Atlassian Marketplace for cve-2022-22965. This turned out to be due to a transitive dependency on spring-beans which we can prove by testing a couple of scenarios. The...
-
Headless Raspberry Pi setup
To setup a headless Raspberry Pi with WIFI and SSH access on Raspberry Pi OS follow these steps: Clone or fork https://github.com/declarativesystems/raspberrypi_configs Set a password for pi user Edit userconf.txt: pi:ENCRYPTED_PASSWORD ENCRYPTED_PASSWORD from echo 'mypassword' | openssl passwd -6 -stdin Configure WIFI: Edit wpa_supplicant.conf and change the placeholders to the...
-
Github Actions example
Introduction Lets take Github Actions for a spin by trying it out on a project. I have an existing repository to build container images for various crypto daemons so lets see how we go building it with Actions Review Github Actions is great. The documentation was spot on and everything...
-
K8s External Secrets
Developed by godaddy and given back to the community, External Secrets fill the gap between K8s secrets and secure credential storage. Externals secrets are defined as K8s resources like this: apiVersion: 'kubernetes-client.io/v1' kind: ExternalSecret metadata: name: dockerconfigjson namespace: someorg spec: backendType: secretsManager template: type: kubernetes.io/dockerconfigjson dataFrom: - /someorg/dockerconfig_secret In this...
-
Adding features to K8s
Not as hard as it sounds. K8s has an event stream and/or pageable lists of what the cluster is doing. A pod in a namespace with needed permissions should be able to ask or poll the K8s endpoint to see what needs to be done, eg registering external DNS or...
-
What is a Kubernetes ingress controller
Here’s the deal with K8s - it defines standards and protocols for a whole bunch of stuff but doesn’t necessarily provide an implementation. This is the case with ingress controllers. The K8s spec describes a bunch of HTTP routing behaviours with things like path based routing and default backends which...
-
what is Kubernetes
Kubernetes or K8s for short is the next big thing. Everybody’s doing it but what is it? And why would you want to use it? At its heart K8s is a container scheduling engine. Someone allocates compute and storage capacity to it and the system runs (Docker compatible) containers where...
-
what is upsert
UPSERT does exactly what it says it does: If a record is missing it INSERTs it Otherwise it UPDATEs it This means keeping data current is idempotent - less code is needed so there are less opportunities to make mistakes.