ricardbejarano

I don't overload the CPU and my storage requirements are low. 95% of my used storage is stuff I wouldn't care if it got lost, but just nice to have around. I only have around 2GB of data I don't want to lose.

I do leave the batteries in. Is it dangerous? I read some time ago that it is not dangerous, but the capacity of the battery drops significantly, I don't care about capacity, and safe shutdowns are important to me.

In the past I used an HP DL380 Gen. 7 (which I still own, and wouldn't mind selling as I don't use it), but I had to find a solution for the noise. And power consumption was at around 18EUR for my EUR/kWh.

Cramming down what ran on 12 cores and 48GiB of RAM on a 2-core, 4GiB (I only upgraded the memory 2 months ago) machine was a real challenge.

The ThinkPad cost me 90EUR (IBM refurbished), we bought two of them, the other one burnt. The recent upgrades (8GiB kit + Samsung Evo 1TB) cost me around 150EUR. Overall a really nice value both in compute per EUR spent and in compute per Wh spent. Really happy with it, I just feel it is not very reliable as it is old.

There you go!

Essentially, this setup achieves 5 features I wanted my DNS to have:

- Confidentiality: from my ISP; and from anyone listening to the air for plain-text DNS questions when I'm on public WiFi. Solution: DNS-over-TLS[1]

- Integrity: of the answers I get. Solution: DNS-over-TLS authenticates the server

- Privacy: from web trackers, ads, etc. Solution: domain name blacklist

- Speed: as in, fast resolution times. Solution: caching and cache prefetching[2]

- Observability: my previous DNS was Dnsmasq[3], AFAIK Dnsmasq doesn't log requests, only gives a couple stats[4], etc. Solution: a Prometheus endpoint

CoreDNS ticks all of the above, and a couple others I found interesting to have.

To set it up, I wrote my own (better) CoreDNS Docker image[7] to run on my Kubernetes cluster; mounted my Corefile[8] and my certificates as volumes, and exposed it via a Kubernetes Service.

The Corefile[8] essentially sets up CoreDNS to:

- Log all requests and errors

- Forward DNS questions to Cloudflare's DNS-over-TLS servers

- Cache questions for min(TTL, 24h), prefetching any domains requested more than 5 times over the last 10 minutes before they expire

- If a domain resolves to more than one address, it automatically round-robins between them to distribute load

- Serve Prometheus-style metrics on 9153/TCP, and provide readiness and liveness checks for Kubernetes

- Load the /etc/hosts.blacklist hosts file (which has just short of 1M domains resolved to 0.0.0.0), reloads it every hour, and does not provide reverse lookups for performance reasons

- Listens on 53/UDP for regular plain-text DNS questions (LAN only), and on 853/TCP for DNS-over-TLS questions, which I have NAT'd so that I can use it when I'm outside

The domain blacklist I generate nightly with a Kubernetes CronJob that runs a Bash script[9]. It essentially pulls and deduplicates the domains in the "safe to use" domain blacklists compiled by https://firebog.net/, as well as removing (whitelisting) a couple hosts at the end.

That's pretty much it. The only downside to this set up is that CoreDNS takes just short of 400MiB of memory (I guess it keeps the resolve table on memory, but 400MiB!?) and lately I'm seeing some OOM restarts by Kubernetes, as it surpasses the 500MiB hard memory limit I have on it. A possible solution might be to keep the resolve table on Redis, which might take up less memory space, but I'm still to try that out.

[1] Which I find MUCH superior to DNS-over-HTTPS. The latter is simply a L7 hack to speed up adoption, but the correct technical solution is DoT, and operating systems should already support it by now (AFAIK, the only OS that supports DoT natively is Android 9+).

[2] It was when I discovered CoreDNS' cache prefetching that I convinced myself to switch to CoreDNS.

[3] http://www.thekelleys.org.uk/dnsmasq/doc.html

[4] It gives you very few stats. I also had to write my own Prometheus expoter[5] because Google's[6] had a fatal flaw and no one answered to the issue. In fact, they closed the Issues tab on GitHub a couple months after my request, so fuck you, Google!

[5] https://github.com/ricardbejarano/dnsmasq_exporter

[6] https://github.com/google/dnsmasq_exporter (as you can see the Issues tab is no longer present)

[7] https://github.com/ricardbejarano/coredns, less bloat than the official image, runs as non-root user, auditable build pipeline, compiled from source during build time. These are all nice to have and to comply with my non-root PodSecurityPolicy. I also like to run my own images just so that I know what's under the hood.

[8]

  local:65535 {
    ready
    health
  }

  (global) {
    log
    errors

    cache 86400 {
      prefetch 5 10m 10%
    }
    dnssec
    loadbalance

    prometheus :9153
  }

  (cloudflare) {
    forward . tls://1.1.1.1 tls://1.0.0.1 {
      tls_servername cloudflare-dns.com
    }
  }

  (blacklist) {
    hosts /etc/hosts.blacklist {
      reload 3600s
      no_reverse
      fallthrough
    }
  }

  .:53 {
    import global
    import blacklist
    import cloudflare
  }

  tls://.:853 {
    import global
    import blacklist
    import cloudflare
    tls /etc/tls/fullchain.pem /etc/tls/privkey.pem
  }

[9]

  #!/bin/bash

  HOSTS_FILE="/tmp/hosts.blacklist"
  HOSTS_FILES="$HOSTS_FILE.d"

  mkdir -p "$HOSTS_FILES"
  download() {
    echo "download($1)"
    curl \
      --location --max-redirs 3 \
      --max-time 20 --retry 3 --retry-delay 0 --retry-max-time 60 \
      "$1" > "$(mktemp "$HOSTS_FILES"/XXXXXX)"
  }

  # https://firebog.net/
  ## suspicious domains
  download "https://hosts-file.net/grm.txt"
  download "https://reddestdream.github.io/Projects/MinimalHosts/etc/MinimalHostsBlocker/minimalhosts"
  download "https://raw.githubusercontent.com/StevenBlack/hosts/master/data/KADhosts/hosts"
  download "https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.Spam/hosts"
  download "https://v.firebog.net/hosts/static/w3kbl.txt"
  ## advertising domains
  download "https://adaway.org/hosts.txt"
  download "https://v.firebog.net/hosts/AdguardDNS.txt"
  download "https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt"
  download "https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt"
  download "https://hosts-file.net/ad_servers.txt"
  download "https://v.firebog.net/hosts/Easylist.txt"
  download "https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts;showintro=0"
  download "https://raw.githubusercontent.com/StevenBlack/hosts/master/data/UncheckyAds/hosts"
  download "https://www.squidblacklist.org/downloads/dg-ads.acl"
  ## tracking & telemetry domains
  download "https://v.firebog.net/hosts/Easyprivacy.txt"
  download "https://v.firebog.net/hosts/Prigent-Ads.txt"
  download "https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-blocklist.txt"
  download "https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.2o7Net/hosts"
  download "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt"
  ## malicious domains
  download "https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt"
  download "https://mirror1.malwaredomains.com/files/justdomains"
  download "https://hosts-file.net/exp.txt"
  download "https://hosts-file.net/emd.txt"
  download "https://hosts-file.net/psh.txt"
  download "https://mirror.cedia.org.ec/malwaredomains/immortal_domains.txt"
  download "https://www.malwaredomainlist.com/hostslist/hosts.txt"
  download "https://bitbucket.org/ethanr/dns-blacklists/raw/8575c9f96e5b4a1308f2f12394abd86d0927a4a0/bad_lists/Mandiant_APT1_Report_Appendix_D.txt"
  download "https://v.firebog.net/hosts/Prigent-Malware.txt"
  download "https://v.firebog.net/hosts/Prigent-Phishing.txt"
  download "https://phishing.army/download/phishing_army_blocklist_extended.txt"
  download "https://gitlab.com/quidsup/notrack-blocklists/raw/master/notrack-malware.txt"
  download "https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt"
  download "https://ransomwaretracker.abuse.ch/downloads/CW_C2_DOMBL.txt"
  download "https://ransomwaretracker.abuse.ch/downloads/LY_C2_DOMBL.txt"
  download "https://ransomwaretracker.abuse.ch/downloads/TC_C2_DOMBL.txt"
  download "https://ransomwaretracker.abuse.ch/downloads/TL_C2_DOMBL.txt"
  download "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist"
  download "https://v.firebog.net/hosts/Shalla-mal.txt"
  download "https://raw.githubusercontent.com/StevenBlack/hosts/master/data/add.Risk/hosts"
  download "https://www.squidblacklist.org/downloads/dg-malicious.acl"

  cat "$HOSTS_FILES"/* | \
  sed \
    -e 's/0.0.0.0//g' \
    -e 's/127.0.0.1//g' \
    -e '/255.255.255.255/d' \
    -e '/::/d' \
    -e '/#/d' \
    -e 's/ //g' \
    -e 's/  //g' \
    -e '/^$/d' \
    -e 's/^/0.0.0.0 /g' | \
  awk '!a[$0]++' | \
  sed \
    -e '/gamovideo.com/d' \
    -e '/openload.co/d' > "$HOSTS_FILE"

  rm -rf "$HOSTS_FILES"

I've seen it, never tried it.

The thing is, I don't use Kubernetes for convenience or because I need it, I use to learn it.

I was just fine with Docker Swarm before switching, but I wanted to learn Kubernetes as a valuable skill, and I know no better way of learning something than using it every day.

And the thing about Kubernetes distros is that they usually all apply a new layer of "turning Kubernetes' complexity into a turn-key process", and I don't want that.

If you know the ins and outs of K8s, sure, use any distro you like, but if you want to learn something, better learn the fundamentals first. It's like learning Linux's internals instead of learning how Ubuntu is, one applies to a single distro and the other will apply for every distro ever.

I'm throwing it the hosts blacklist as a file. For performance reasons I turn off reverse lookups and limit reloading to once every hour:

    (blacklist) {
      hosts /etc/hosts.blacklist {
        reload 3600s
        no_reverse
        fallthrough
      }
    }

    .:53 {
      import blacklist

      ... (more config)
    }

I don't :)

Right now I have public (read-only) and private buckets only, and I'm the only who writes into any of them.

Public buckets contain files I didn't even create myself and that friends might find useful (Windows ISO, movies, VirtualBox VMs...). Privates have, well, private data, and can only be accessed using my admin account's credentials.

IIRC MinIO has access control through users, but I'm still very new to MinIO to the point where I discover new features every time I use it.

If I were to give someone else their own buckets I'd probably run a second instance to keep things separate, though. I'm even considering running another one myself to keep private buckets only accessible from my home network... (right now the entire instance is reachable from WAN, regardless of whether they are public or not).

That's essentially it, yes.

FYI: the control plane takes about 150m (milli-cpu) and ~1.5GiB of memory in a host with my specs.

Thanks for the heads up, I'll check it out!

Sure! Here's the source code: https://github.com/ricardbejarano/pyctures

I could set up a demo if you want to.

It's a cheap Flask app that scans a given "library" directory for "album" subdirectories, which contain the pictures you want to display.

It has a big issue with image size (16 images per page, my phone takes 5MB pictures, 80MB per page is HUUUGE). Thumbnailing would be great. I'm open for PRs ;)!

If anyone knows about a better alternative... I set this up when we got back from one vacation for my relatives to easily see the pictures (without social media).

On my home server (refurbished ThinkPad X201 with a Core i5-520M, 8GB of memory, 1TB internal SSD sync'd nightly to an external 1TB HDD) I run a single-node Kubernetes cluster with the following stuff:

* MinIO: for access to my storage over the S3 API, I use it with restic for device backups and to share files with friends and family

* CoreDNS: DNS cache with blacklisted domains (like Pihole), gives DNS-over-TLS to the home network and to my phone when I'm outside

* A backup of my S3-hosted sites, just in case (bejarano.io, blog.bejarano.io, mta-sts.bejarano.io and prefers-color-scheme.bejarano.io)

* https://ideas.bejarano.io, a simple "pick-one-at-random" site for 20,000 startup ideas (https://news.ycombinator.com/item?id=21112345)

* MediaWiki instance for systems administration stuff

* An internal (only accessible from my home network) picture gallery for family pictures

* TeamSpeak server

* Cron jobs: dynamic DNS, updating the domain blacklist nightly, recursively checking my websites for broken links, keeping an eye on any new release of a bunch of software packages I use

* Prometheus stack + a bunch of exporters for all the stuff above

* IPsec/L2TP VPN for remote access to internal services (picture gallery and Prometheus)

* And a bunch of internal Kubernetes stuff for monitoring and such

I still have to figure out log aggregation (probably going to use fluentd), I want to add some web-based automation framework like NodeRED or n8n.io for random stuff. I'd also like to host some password manager but I still have to study that.

I also plan on rewriting wormhol.org into supporting any S3 backend, so that I can bind it's storage with MinIO.

And finally, I'd like to move off single-disk storage and get a decent RAID solution to provide NFS for my cluster, as well as a couple more nodes to add redundancy and more compute.

Edit: formatting.

And have unlimited namespaces, letting you choose the same as another deployment you have or a new one.

Make it have a default deny all NetworkPolicy and you are all set.

I'd love to see this too.

You may enjoy my https://github.com/ricardbejarano/learn-aws GitHub repo.

A private company has the right to choose where its traffic comes from, nothing surprising here.

There are legitimate reasons to block TOR traffic, and even if there where none, they'd still have the right to block anyone of their users.

There are plenty of alternatives, simply remember not to choose one ran by a private company again.

It's got into a point where I just assume Google would do x thing against my privacy if it can.

What I do to keep Chrome but ditch Google's anti-features is lockdown requests to Google domains with Little Snitch by Chrome.

I believe you could do something similar with LuLu by ObjectiveSee if you don't want to pay for Little Snitch.

Their city, their rules.

You don't like the rules? Then leave the city.

I was starting to think I was the only one against these claims.

There's no one pushing Google down its users' throats. Yet people ask Google to behave like they want. Well, surprise! Google is a private entity and they'll do whatever they want. If you don't like it, leave. I left a long time ago but I believe these claims are unfair to Google.

We are being bombarded with "Google's x product is a monopoly". No they are not. There are tons of alternatives to anyone of Google's services. The thing is, they do it better than their alternatives. Free market, my friend.

If x alternative to a Google's service gets better, people will gravitate towards it. But don't ask people to drop the better product in order to give (undeserved) attention to the not-so-great one. Earn it!

People also complain about Google making their services' sites suck on other browsers. Well, their site, their rules. Not so long ago all online services had dedicated clients instead of web apps. Those apps weren't called "monopolies", yet there was no alternative client. Because the root of the monopoly argument lies in the "service", if there are no alternatives to the "service", now we are talking, but there's no monopoly in the "client". If you don't like the "client", drop the service.

When I was 9 my dad did two things I'll never thank him enough for:

1. Buy me a laptop and install Ubuntu on it, instead of Windows, so my first OS was Linux. And I'm talking about 11-years-ago Linux for a 9yo kid.

2. Drill into me the importance of English. For non-English speakers, I believe this is the one true barrier of entry. All docs, forums, videos, etc. are English-first, and by the time they get translated into other languages it's no longer cutting-edge, so if you can't read English you are stuck with the "old" technologies.

Thanks, dad!

My experience with HAProxy is limited to maintaining https://github.com/ricardbejarano/haproxy, a HAProxy Docker image, which has both glibc and musl variants.

I haven't used HAProxy in any environments other than testing, but as far as I can tell both variants behave equally. In fact, haproxy.cfg for both images is the same, they only differ in their build flags.

PSA: if you are building your own HAProxy binaries, 2.0 replaces the confusing linux `TARGET`s (`linux2628` and the like) with a single target "`linux-glibc`", that name may be even more confusing, as that's the target you need to build HAProxy even if you are using musl instead of glibc.

I built something similar for the Amazon SES (Simple Email Service) for my cron jobs and other private applications to use.

https://github.com/ricardbejarano/postino

Yeah but losing a kid's motivation is terrible. Having a kid eager to know what's next means the kid will think about it on the commute home, talk about it with his/her parents, ask some hard questions... He/She will be _curious_.

And curiosity is the greatest of all drives. I've spent more hours than I can count following curiosity with no other prize but knowledge. Instead, we've come to tell kids that they should memorise this thing for the next week, and move on.

For a given concept, with three layers of abstraction, if we start bottom-up, with the downmost layer, the kid doesn't know what that layer's good for. That happens until we get to the topmost layer. The layers have no purpose until we've finished 4 months from now. They don't make sense.

If you teach kids backwards, once the kid knows the topmost layer, he/she will know what the next layer is good for and in what conditions shall it exist. The _next layer_ has a purpose, which the kid can understand and expect.

The Socratic method works this way. You start with the general purpose of the system, and then you break it down question by question.

(teacher)- What is this?

(student)+ This is a car.

- What is a car good for?

+ It moves people.

- How does it move people?

+ Because it moves these wheels.

- How does it move those wheels?

+ Because... I don't know (takes a car replica), it has these bar connected to those wheels, and this other bar connected to that bar.

- What happens when you spin that second bar?

+ The wheels move.

- So to move the car, you move those wheels, and to move those wheels you spin this bar, but you don't manually spin this bar when you are driving, who does so then?

+ I don't know.

Now the kid is ready to understand what an engine is.

If we did it backwards, and started with combustion, the kid would have no idea what combustion is for until we've reached the car.

Man I'd had loved to meet Feynman...

I can agree people learn very differently about abstract things. Throughout my career I've seen truly remarkable students that had a very different way of thinking about problems that gave them a competitive advantage over others.

It's a great book, I'm reading it to reinforce those low-level knowledge gaps that appear when you're self-taught. I discovered here: https://teachyourselfcs.com/, I've bought some other books listed there.

I just want to thank 3b1b, and tell anyone who's trying to get in love with math to go ahead and binge his channel.

I've been terrible at math since they started to get "hard" as a teenager, which then compounded into not liking math before and after getting into college for a CS degree.

The degree inevitably requires some math background at the beginning, so I struggled with that a lot, until I discovered 3b1b.

His series on calculus and linear algebra got me through both subjects in less than a week. From 0 to 7 in the scale of 0 to 10 we use in my university, in just 3-4 days per subject. I regret not discovering it before.

What those two series helped me with was understanding why math is important, and how can one solve everyday problems with math, which is something teachers say when you are young but don't actually tell.

Realising that instantaneously motivated me to put in time and effort, which is key when learning math.

The machine learning series also helped me find the answer to the "why am I learning math if I'm just a tech?" question.

On the side, I'm now reading "Computer Networking: a Top-Down Approach" by Kurose, which made me get to the conclusion that we are teaching things wrong. The educational system that brought me here teaches you on a promise of everything making sense once you understand it all, which makes it really hard to understand the pieces in the first place.

The book takes a different approach in that it shows you the final result, and then breaks it down abstraction by abstraction, which makes you eager to know what's going on behind the next abstraction.

If I were to teach a kid how a mechanical watch works, I wouldn't start by the gears, I'd start by the watch itself, and then break it down piece by piece. Once he knows that there's this abstract system that takes some force in one end, and spits some other force in the other, then the kid will want to know what's behind the abstract system, and he'll be ready to know it.

This way I'll keep the attention of the kid till the end, instead of telling him "you'll understand once we finish" after each lesson.

OP and maintainer of the image here.

I understand your concerns. I would have them too.

To be fair, I tried pushing these changes to the official NGINX image, but they weren't accepted because I'm using a multi-stage build, which are not allowed to official images for a series of reasons. I mostly disagree with those reasons, but I don't own the Docker Hub. Here's the PR: https://github.com/nginxinc/docker-nginx/pull/310

As for traceability, we've had some discussion over at Lobsters about that. I believe you can do it from outside the container, and avoid bloat that will only get used in 1% of the cases.

About reproducibility, my CI process for this image uses GitHub and the Docker Hub, I don't build and push the images myself (which I consider a very big red flag in A LOT of images, even official ones), so it must be reproducible as the Docker Hub must be able to build it.

I've responded to another user about maintenance. TL;DR is: I use it, so I must keep it up-to-date, usually in less than 24h of the release of a new patch. If for whatever reason I stop using it, upgrading is just changing two lines in the Dockerfiles, so it's not tiring. But if for whatever reason I can't maintain it anymore... This is an inherent problem of volunteer maintained open source software.

I might have convinced you, or not. Again, I'd have the same concerns as you do, it's fair.

> Will this git repo still be updated then? Will the user remember to pull latest version and regenerate latest image?

I use this image myself, so I have an incentive to keep it up-to-date and secure.

Usually, I upgrade in less than 24h from the release of a new patch. Based on the system I use to get notified of upgrades such as NGINX's, I could even automate the upgrades to get triggered as soon as the patch is released, but I don't like the idea of commiting without human review.

But I see your point. There's no guarantees. What happens if I get tired (highly doubt so), or, what happens if I die? These problem is inherent with open source software maintained by volunteers.

I tried pushing my changes to the official NGINX image, but they can't be merged because I'm using multi-stage builds, which for some reason are not allowed for official images. Here's the PR: https://github.com/nginxinc/docker-nginx/pull/310 Multi-stage builds is the core of what makes this image great, so I can't renounce to it.

I think we can also agree that, because Docker is very new, we cannot guarantee that it's as secure as other well-tested technologies, but if Docker/Kubernetes were to be secure, it let's admins take security to another level. You could have 2 stacks, with all their components, running on the same metal, but isolated at the network level. Doing this is possible without containers, sure, but it takes less than 5 lines of YAML in Docker Swarm.

Exciting time in the world right now. Exciting time...

Now, yes.

Thanks for asking this, I just finished setting it up.

For anyone reading this:

If:

1. you are on macOS,

2. you used brew to install GnuPG: brew install gnupg,

3. after generating your GPG key pair, these two commands fail...

    $ git commit -S
    $ echo "test" | gpg --clearsign

...try adding this line to your bash profile:

    export GPG_TTY="$(tty)"

I consider Apple to be the only respectable bigtech left, that said, I can't avoid to make the following reasoning:

- Apple is US-based, therefore subject to PRISM (and any other surveillance program we don't know about)

- There's a long record of companies going rogue on users for legal reasons

- Apple makes macOS

- macOS is not fully open-source

This means that there's the possibility of macOS turning it's back on users, and that would make me refuse macOS if I were the target of someone with enough money and time.

On why OpenBSD, it's because of it's excellent track of security vulnerabilities (only 2 in 20+ years). Tails and Qubes are also great, but they haven't been out there for as long as OpenBSD has and I think the BSDs deserve some more love.

Edit: CoreOS has some great security features too, such as a read-only /usr. I also believe ChromeOS has some similar features.

I second this.

Could you elaborate?

Thanks for pointing that out! I can't believe I missed that!