chucky_z

SQL!

FreeIPA is a Redhat upstream thing (389 Server or something?) so yea I’d imagine Redhat would probably work with a school district for wicked good pricing.

Oh I mean using the synth stage to write ephemeral code to disk to be applied against “to be imported state.” Disclaimer: this is a terrible idea if you aren’t using state.

I use this today to keep very “wide” modules synced

You can use terraform in a "stateless" manner!

Define everything in like cdk (... I use ruby to generate the tf.json), generate the code, import everything you can without error, and apply the rest.

Performance will be _bad_ but that will completely eliminate state problems.

https://cinc.sh/ a good (FOSS) replacement for chef.

I think this is a really clear winner for something like Litestream, where you can have state far away but sync it locally with periodic syncs if you can live with 'small wait on startup' and 'periodic state updates'.

The thing that sucks for me is that while I fundamentally agree with everything Tim is doing, he has got to get some better PR because I am so tired of this. I am tired of Tim Sweeney and Epic this multi billion dollar company going “boohoo I’m so bullied,” like, shut up and just do the thing without trying to smear anyone and everyone who isn’t yourself.

This was how Etsy used to work and they were really strict about it. It changed about 2 months after they IPOd

> Both Nomad and k8s have ways to do persistent workloads, but they rely heavily on the underlying infrastructure to "move" volumes between throwaway containers

I did this with Nomad by writing a small API to "place" host volumes which Nomad can use for job placement constraints automatically. It works shockingly well for my use-case which I think is somewhat similar to Fly's? A smallish number of containers that require host persistent storage, and don't expect anything to move -- just disappear forever (persistent til' it ain't).

I believe this is considered one of the best videos: https://www.youtube.com/watch?v=_WOKRaM-HI4

Is audit2allow the thing you want?

The 'finicky' is from the default settings meant to work in as many games as possible. (Almost) Every game I tried I found some community-maintained controller profile that had near-perfect settings. I really love Steam's community. :D

Steam Deck has the little "pads" from the Steam Controller, those make playing games with mouse-based controls a joy with a handheld device (with some adjustment period).

They show this in the video! I actually almost wish the initial Steam Controller had these flat pads instead of the concave circles, it looks like it's going to be a straight up improvement.

Wouldn't you still want to actually store transactional data inside of a database? Like, you would use all the workflow stuff to do all the business logic, and the workflow(s) themselves are long-running workers which interact with the database(s).

I'd imagine if anything it makes databases _easier_ to reason with, because you could shard by workflow steps or something.

inbound/outbound tcp connections over time and discovering extremely high connection churn rates on ephemeral ports are both great reasons i've used it.

eBPF can (basically) monitor anything at a low level! check out ebpf_exporter for some other great examples of real-world use.

There’s a straight up conversion tool iirc, and you can do things like include hcl as well I believe. Cdktf is just terraform at the bottom.

Imagemagick is one of the few bits of software where the functionality is worth the risk. Simply find a way to remove any network access and use it. I used to run it in a docker container with (almost) all capabilities dropped but with a directory mapped into it to run.

I think Nix is most poised.

If you don’t have a way to do immutable infrastructure, Ansible is still extremely alive.

Engineers who can put together and maintain this hardware don't exist on the job market.

I’ve been looking at building an auto remediation system for server alerts, is Node-RED a decent system for this? It will probably start with just triggering some kind of ssh command to run a script.

Is there any proof we’re actually headed to hyperinflation with USD? Wouldn’t that collapse the entire global economy in a few months?

From what I can tell is this just Jack shilling for BTC?

This is correct.

We run a Raft cluster of 5 voting members with 13,000 physical Nomad nodes mixed across OS's with a bunch of random workloads using docker, exec, raw_exec, java, and some in-house drivers. I'll clarify that (and I can't... because I can't edit my post anymore :( ).

If you have a mixed Windows/Linux environment I cannot suggest Nomad strongly enough. It truly shines in this environment. Especially if you're dealing with legacy stuff.

Even better if you're running Mac + BSD as well, it just runs everywhere.

I am currently running over 13000 nodes with a 5 server cluster. These are large boxes (90gb memory, 64 cores) but cpu usage is under 20% and memory usage is under 30%.

Yep! If you’re on MacOS check out Lima, it’s a project by Akihiro Suda who is one of the main contributors to nerdctl (and the original author iirc)

I’ve found running Terraform via Ansible to be a pretty good experience.

There are a number of extremely poorly moderated Mastodon instances with a large amount of hateful and hurtful content. I’d imagine they’re automatically blocking a lot of these sites.

Source: I used and helped maintain one of the “don’t federate with these instances” list.

haha i've used garr as an avatar for a super long time now!

> Interesting, so JWT proxy (or any other auth mechanism that is viable over HTTPS) -> ghostunnel machine w/ public VIP -> Target machine ? Or ghostunnel directly running on the Target machine which holds the public VIP? Or does the JWT proxy take the public IP and the ghostunnel machine keep the private VIP?

jwt proxy takes in the iap jwt, they give you the audience and it's just parsed, this lives in the same pod as ghostunnel. ghostunnel goes through a NAT to a public dest, where ghostunnel is _also_ running. it has extremely strict TLS requirements (Forced valid CN to be sent/accepted, strict DNS, along with a single purpose CA, cert, and key).

It's like

IAP =inside-gcp=> (JWT proxy -> ghostunnel) =public=> (ghostunnel -> thing)

There's a more modern way to do this, but this works really well and gives absolutely fantastic introspection, is super easy to use it as a public proxy, and allows you to only use minimal APIs in GCP (IAP + GKE, you don't need GKE but you also don't wanna manage all the things it does for you with annotations. :D)

I run IAP. It's TCP-over-HTTPS but it works remarkably well, connects to all kinds of things, and for users it really is just "login with google, proceed as normal."

I use a JWT proxy + ghostunnel within GKE with a VIP so it's not quite their reference setup but it's extremely "just works" outside GKE being weird and eating its own routes.

BTW, side-note but try out ghostunnel over stunnel! I've really enjoyed using it and it's been fantastic to debug and work with.

Huh. I've been running Consul since 0.7 or so, and the only time any of this happened was my own fault.

Most of the problems I've had with Vault have been around it's Terraform provider which they've improved enough that it's not an issue anymore.

I think the only thing about Raft that folks don't realize is how disk hungry it gets, if you want fast write performance you gotta make dang sure all those fsyncs can keep up. Our largest Consul cluster today runs on storage-heavy boxes as it does ~500Mb/s of writes pretty much 24/7.

I use Consul w/ Vault today instead of the internal storage for Vault just cause Consul has really nice monitoring around some stuff that Vault doesn't (path-based stuff for the most part), I think the internal storage is a really good option for 90% of use-cases.