Personal Tech Blog

Restic clean up backups

Tue, 09 Jul 2024 16:51:37 +0000

Efficient backup management is essential to maintain storage space and ensure important data is retained without unnecessary redundancy. Restic provides powerful features to manage backups effectively. One of the common tasks is to clean up older backups that are no longer needed, which can be automated using a scheduled cron job. Below is how I setup a cleanup job.

As backups accumulate over time, they can consume a significant amount of storage. Automating the cleanup of older backups ensures that storage usage is optimized and only essential backups are retained. By scheduling this task, it is possible to maintain a balance between data retention and storage management.

Crontab Restic Cleanup

30 11 * * Sun /usr/bin/restic forget --keep-daily 21 --keep-weekly 9 --keep-monthly 12

Options:
- --keep-daily 21: Retains the last 21 daily backups.
- --keep-weekly 9: Retains the last 9 weekly backups.
- --keep-monthly 12: Retains the last 12 monthly backups.

By using these options, it ensures that a reasonable number of backups are kept over time, while older, less necessary backups are deleted. This approach keeps the backup storage manageable and efficient.

Conclusion

Automating the cleanup of backups with Restic and Crontab is a straightforward process that can significantly improve backup management. By configuring a cron job to regularly clean up older backups, it is possible to maintain a streamlined backup system that conserves storage space without sacrificing the availability of important data.

Nginx Subdirectory Configuration

Tue, 09 Jul 2024 15:23:37 +0000

The following solution involves making modifications to a Dockerfile and adjusting URL settings to ensure the site is served correctly from different paths.

The goal was to configure an Nginx blog from a dockerfile to be testable and runnable from both the root directory and any subdirectory on the site. This flexibility allows for testing different versions of the site or hosting multiple versions simultaneously on different subfolders without interfering with each other.

How to Implement the Configuration

To achieve this, several changes were made to the Dockerfile and the configuration files:

Dockerfile Setup: The Dockerfile was modified to build the site with a specified FULLBASEURL and SUBFOLDER argument. This setup allows for dynamically setting the base URL and the subdirectory where the site should be served. The Dockerfile is divided into two stages: the build stage and the final stage.

Dockerfile:

FROM ruby:3.3-alpine AS builder

ARG FULLBASEURL="https://jmoore53.com"
ARG SUBFOLDER=""
ARG BUILT="Wed 03 Jul 2024 02:01:53 PM EDT"

RUN apk update && apk add \
    git \
    build-base

COPY ./ /app

WORKDIR /app

RUN rm Gemfile.lock

RUN bundle install

RUN sed -i "s|BASEURLHERE|$FULLBASEURL|" _config.yml
RUN sed -i "s|BUILTDATE|$BUILT|" _config.yml
RUN sed -i "s|SUBFOLDERHERE|$SUBFOLDER|" nginx/default.conf

RUN bundle exec jekyll build -d /public

FROM nginx:latest
ARG FULLBASEURL="https://jmoore53.com"
ARG SUBFOLDER=""
RUN if [ ! -d "/usr/share/nginx/html/$SUBFOLDER" ]; then mkdir /usr/share/nginx/html/$SUBFOLDER ; fi
COPY --from=builder /public/ /usr/share/nginx/html/$SUBFOLDER/
COPY --from=builder /app/nginx/default.conf /etc/nginx/conf.d/default.conf
RUN sed -i "s|SUBFOLDERHERE|$SUBFOLDER|" /etc/nginx/conf.d/default.conf
COPY --from=builder /app/nginx/nginx.conf /etc/nginx/nginx.conf
CMD ["nginx", "-g", "daemon off;"]

This Dockerfile first builds the site using Ruby and Jekyll, then copies the built static files to the Nginx container. It also makes sure that URLs and paths in the configuration files are correctly set up based on the provided build arguments.

Running the Blog: The blog can be run with specific arguments to test it from different subdirectories. This is done by passing FULLBASEURL and SUBFOLDER as build arguments when creating the Docker image.
```
# Remove the current blog image
docker image rm jmoore53-blog

# Build Docker Image for testing
docker build -t jmoore53-blog:testa --build-arg FULLBASEURL="http://10.100.0.20:8888/a" --build-arg SUBFOLDER="a" .
```
These commands first remove any existing Docker image for the blog to prevent conflicts. Then, a new Docker image is built with the specified base URL and subfolder. This setup allows for testing the site under different conditions.
Configuration Adjustments: After these changes to the Dockerfile, modifications were made to the config.yml file. The baseurl and url settings were updated, and static hrefs were converted to absolute links. These adjustments ensure that static resources are correctly referenced, regardless of whether the site is served from the root or a subdirectory.

For more details on the specific changes made to the repository, see the link to commit.

Conclusion

By modifying the Dockerfile and adjusting configuration settings, the Nginx blog can now be served from any specified subdirectory on the site. This setup provides flexibility in managing different versions of the site and ensures that all resources are correctly loaded regardless of the path from which the site is accessed.

Kanboard Copy Multiple Links

Sat, 02 Mar 2024 16:00:14 +0000

Using Kanboard a lot I found myself wanting to add multiple links at a time. This made me pull down the kanboard source code and build my own docker image with the feature I needed.

To implement this feature, the “Add External Links” function was updated to support multiline input. This enhancement allows users to paste several URLs at once. A lookup function was also added to fetch and display the titles of these links within the task view, making it easier to identify the nature of each linked resource. This improvement saves time and reduces the need to add links one by one manually.

Process of Applying Fixes/Rebase

Here is the step-by-step process used to apply recent fixes:

Merge New Changes: Update the branch with the latest changes from the Kanboard repository.
```
git pull main
```
Rebuild Docker Image: Build the updated Kanboard Docker image.
```
docker build -t jmoore53/kanboard:latest
```
Restart Kanboard Services: Stop and restart the Kanboard service using Docker Compose to apply the new build.
```
docker compose stop kanboard
docker compose up -d
```

These steps allow the changes to run locally, ensuring the new feature functions as expected.

SSH Key Management for GitHub

Something I ran into along the way was the SSH agent for github. Below is the fix.

Start the SSH Agent: Initiate the SSH agent in the background.
```
eval "$(ssh-agent -s)"
```
Add SSH Private Key: Add the SSH private key to the SSH agent.
```
ssh-add ~/.ssh/id_ed25519
```
Replace id_ed25519 with the specific private key file name if different.

Conclusion

This update simplifies the process of adding multiple external links to Kanboard tasks, enhancing usability and project management efficiency. By automating and streamlining these actions, it is possible to maintain a more organized and accessible task management system.

Custom Kernel Install for Ubuntu

Sat, 02 Mar 2024 15:44:27 +0000

I wanted to test out running the mainline kernel for some eBPF features that weren’t available to me. Below is a post on running the mainline kernel.

A mainline kernel is often needed for specific tasks such as installing eBPF, which requires the latest LLVM version (like llvm-17). Using the latest mainline kernel can help unlock these capabilities, allowing for advanced system tuning and development tasks.

How to Install a Mainline Kernel on Ubuntu

To install a mainline kernel on an Ubuntu system, follow these steps:

Download and install the mainline kernel script:

 wget https://raw.githubusercontent.com/pimlie/ubuntu-mainline-kernel.sh/master/ubuntu-mainline-kernel.sh
 sudo install ubuntu-mainline-kernel.sh /usr/local/bin/

Check for the latest available kernel version and install it:

 sudo ubuntu-mainline-kernel.sh -c
 sudo ubuntu-mainline-kernel.sh -i

Reboot the system to apply the changes:
```
 sudo reboot
```
Verify the installed kernel version:
```
 uname -r
```

GUI Interface for Kernel Updates

For users who prefer a graphical interface, there is an alternative method to update the kernel using a GUI tool. Install the GUI tool by running the following commands:

sudo add-apt-repository ppa:cappelikan/ppa
sudo apt update
sudo apt install mainline

Installing LLVM

LLVM is required for various development tasks, including working with eBPF. The latest version of LLVM can be installed using the following command:

bash -c "$(wget -O - https://apt.llvm.org/llvm.sh)"

This command downloads and executes a script to install the desired version of LLVM directly from the official repositories.

Conclusion

Installing a mainline kernel and LLVM on Ubuntu is straightforward and can provide the latest features and improvements for development and testing environments. Using scripts and tools simplifies the process and ensures the system is up to date with the latest software.

bitmagnet - dht

Thu, 22 Feb 2024 19:32:52 +0000

Setting up a custom indexer using a Distributed Hash Table (DHT) requires careful configuration and deployment. This post outlines the steps taken to install bitmagnet on an Alpine Linux virtual machine (VM), configure OpenVPN for secure tunneling, and use NFS for storage instead of MinIO due to compatibility issues.

Installing DHT on Alpine VM

To begin, a new Alpine VM was set up to run the DHT. Transmission and OpenVPN were also installed on this server. Here is the output of the ip route command after configuring the network:

alpineylinux:~# ip route
0.0.0/1 via 10.35.112.1 dev tun0
default via 192.168.122.1 dev eth0 metric 202
35.112.0/24 dev tun0 proto kernel scope link src 10.35.112.226
100.0.0/24 via 192.168.122.1 dev eth0
0.0.0/1 via 10.35.112.1 dev tun0
17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
20.0.0/16 dev br-94bb901b6c16 proto kernel scope link src 172.20.0.1
23.0.0/16 dev br-716551f713d9 proto kernel scope link src 172.23.0.1 linkdown
96.150.41 via 192.168.122.1 dev eth0
168.122.0/24 dev eth0 proto kernel scope link src 192.168.122.115

Configuring OpenVPN

OpenVPN was configured to provide a secure tunnel interface on the VM. The key configuration file, openvpn.cnf, is shown below:

client
dev tun0
proto udp
remote us-newyorkcity.privacy.network 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server

auth-user-pass /etc/openvpn/creds.conf
compress
verb 1
reneg-sec 0
redirect-gateway def1
route 10.100.0.0 255.255.255.0 net_gateway

<crl-verify>
-----BEGIN X509 CRL-----
-----END X509 CRL-----
</crl-verify>

<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>

disable-occ

The most important line in this configuration is route 10.100.0.0 255.255.255.0 net_gateway, which instructs the VM to route all traffic to the 10.100.0.0 network using the local network gateway.

Docker Configuration for PostgreSQL

To manage data, a Docker container running PostgreSQL was set up with the following docker-compose.yml configuration:

postgres:
    image: postgres:16-alpine
    container_name: bitmagnet-postgres
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    # ports:
    #   - "5432:5432" Expose this port if you'd like to dig around in the database
    restart: unless-stopped
    environment:
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_DB=bitmagnet
      - PGUSER=postgres
    shm_size: 1g
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready
      start_period: 20s
      interval: 10s

NFS was used for storing the data due to issues with using s3fuse directories with Transmission. This setup runs on a VM with 8 GB of storage, 1 GB of RAM, and 1 vCPU. Although using an Alpine container could further reduce resource usage, the VM remains a more straightforward solution due to concerns about routing and VPN connections within Docker containers.

List Packages to be installed with APT with Ansible Task

Wed, 31 Jan 2024 14:54:11 +0000

Managing system updates across multiple servers can be a complex task, especially when dealing with different packages and updates. This blog post shows how to use Ansible to list upgradable packages on systems using APT, and how to parse this information into a formatted output.

How to List Upgradable Packages with Ansible

Here’s an example Ansible task that lists all upgradable packages using APT:

---
- name: List System Upgrades
  become: true
  become_user: root
  become_method: sudo
  shell: apt list --upgradable
  register: output
- debug: msg=""

Potential Solutions for Managing Upgrade Listings

Moving forward this is how I want the output to show, but for now the playbook output is good enough.

[common-among all servers]
package-1
package-2
package-3
package-4

[server-1]
package-custom

[server-2]
package-custom

Conclusion

By creating a formatted list of upgradable packages, this allows me to better manage and apply updates. This method provides a clear overview of what needs to be updated and allows for better planning of system upgrades.

Ansible Testing on Blank Container

Sun, 28 Jan 2024 18:12:26 +0000

Testing Ansible playbooks often requires a controlled environment where configurations and commands can be executed without interference. A blank Docker container provides an isolated environment that can be easily reset or modified, allowing for extensive testing of Ansible configurations. This setup facilitates a streamlined process for testing playbooks, ensuring that they function correctly before being deployed in production.

Setup

A blank Docker container is spun up with SSH access enabled to perform tasks using Ansible. This container is based on Ubuntu 20.04 and includes necessary components such as openssh-server and systemd to simulate a more traditional server environment. The container is configured to run commands via SSH and allows for testing Ansible playbooks in a controlled setting.

Creating the Docker Environment:

The following Dockerfile creates a minimal environment with SSH enabled. This configuration is useful for basic testing scenarios where system services are not required.

FROM ubuntu:20.04

RUN apt update && apt install openssh-server sudo -y

RUN useradd -rm -d /home/ubuntu -s /bin/bash -g root -G sudo -u 1000 test

RUN echo 'test:test' | chpasswd

RUN service ssh start

EXPOSE 22

CMD ["/usr/sbin/sshd","-D"]

This Dockerfile installs the openssh-server and creates a user named “test” with sudo privileges, allowing remote SSH access for Ansible to connect and execute commands.

Dockerfile with Systemd for Testing More Complex Scenarios:

For cases requiring a systemd environment, a more advanced Dockerfile is used. This configuration allows testing services managed by systemd, which is not natively available in Docker containers.

FROM ubuntu:20.04
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    systemd systemd-sysv dbus dbus-user-session
COPY docker-entrypoint.sh /
ENTRYPOINT ["/docker-entrypoint.sh"]

This setup is useful for simulating a real-world environment where services need to be managed by systemd, making it ideal for more comprehensive Ansible playbook testing.

Combining SSH and Systemd in a Docker Container:

To incorporate both SSH and systemd functionalities, a combined Dockerfile is used. This file creates an environment where Ansible can connect via SSH and also control services managed by systemd.

FROM ubuntu:20.04

RUN apt update && apt install -y --no-install-recommends \
    openssh-server sudo \
    systemd systemd-sysv dbus dbus-user-session

RUN useradd -rm -d /home/ubuntu -s /bin/bash -g root -G sudo -u 1000 test

RUN echo 'test:test' | chpasswd
RUN echo 'root:root' | chpasswd
RUN printf '#!/bin/sh\nexit 0' > /usr/sbin/policy-rc.d
RUN printf "systemctl start systemd-logind" >> /etc/profile

RUN service ssh start

EXPOSE 22

CMD ["/bin/bash", "-c", "/sbin/init", "&&", "/usr/sbin/sshd","-D"]

This Dockerfile includes openssh-server for SSH connectivity, adds a test user, and sets up systemd components, allowing the container to function similarly to a standard Ubuntu server. The container starts the SSH service and systemd, providing a robust environment for testing.

Additional Considerations:

Running commands as “root” in Docker containers can pose security concerns. It is essential to investigate and address these risks, particularly in environments where elevated privileges could lead to vulnerabilities.

The lack of a native init system within Docker containers also requires workarounds, such as the use of systemd within the container. A solution involving systemctl commands is necessary for scenarios requiring full control over system services.

Conclusion:

By using Docker containers configured with SSH and systemd, Ansible playbooks can be tested in environments that closely mimic production servers. This method provides a flexible and secure way to ensure configurations are correct and perform as expected, ultimately saving time and reducing errors in deployment.

IPv6 in the Homelab

Tue, 16 Jan 2024 15:52:14 +0000

Capturing and logging IPv6 address attempts is essential for understanding network traffic and ensuring robust security measures. Accurate logging allows for detailed monitoring and helps in identifying potential threats or misconfigurations.

To effectively log IPv6 addresses and integrate logs with monitoring tools, syslog-ng was utilized along with some configurations on the Nginx server.

Initial Setup and Evaluation:

IPv6 tables configuration was evaluated on the Nginx server to ensure proper handling of IPv6 addresses. It was confirmed that logs do occur on containers and that they follow a structure similar to IPv4, which is suitable for the current setup. However, some adjustments were necessary to ensure comprehensive logging.

Nginx Logging Configuration:

The Nginx server was configured to log requests and errors, including those for IPv6 addresses. The following Nginx configuration was added to manage logs:

log_format timed_combined '$remote_addr - $remote_user [$time_local] '
                          '"$host" "$request" $status $body_bytes_sent '
                          '"$http_referer" "$http_user_agent" '
                          '$request_time $upstream_response_time $pipe';

access_log /var/log/nginx/timed_combined.log timed_combined;
access_log /var/log/nginx/access.log;
access_log syslog:server=10.100.0.252:514,tag=nginxSyslogAccess timed_combined;
error_log /var/log/nginx/error.log;
error_log syslog:server=10.100.0.252:514,tag=nginxSyslogError;

This configuration ensures that both access and error logs are captured and sent to the syslog-ng server. The use of log_format named timed_combined captures additional details such as request time and upstream response time, which are valuable for analyzing server performance and client behavior.

Syslog-ng Configuration:

To filter and properly display Nginx logs in the monitoring tools, a syslog-ng filter was configured:

filter f_syslog_nginx { match("nginxSyslogError") or match("nginxSyslogAccess"); };

This filter ensures that only relevant Nginx logs are processed, reducing noise and improving clarity in log analysis tools like Kibana.

Verifying Log Appearance in Kibana:

After configuring syslog-ng and Nginx, the logs were checked to ensure they appeared correctly in Kibana. The following filter was used to confirm the presence of Nginx logs:

syslog_program: "nginxSyslogAccess"

All logs from Nginx, including those with IPv6 addresses, were properly displayed and filtered in Kibana, indicating that the setup was successful.

Through careful configuration of Nginx and syslog-ng, accurate logging for IPv6 addresses was achieved. This setup ensures comprehensive monitoring of network traffic, enhances security measures, and provides valuable data for ongoing analysis and optimization.

Matomo Server

Mon, 04 Dec 2023 18:26:29 +0000

Analytics provide valuable insights into website traffic and user behavior, which are crucial for optimizing online presence and performance. Implementing Matomo, an open-source web analytics platform, enables detailed tracking and analysis.

Setting up a Matomo server involves several steps, including configuring the server, setting up a reverse proxy, and securing the environment.

Server Configuration:

A server was built to host Matomo, and configurations were carefully documented. The .example folder was placed in the /opt directory to serve as a reference for configuration files.

Database Configuration:

Passwords and other sensitive information were managed using a db.env file. The following configuration was applied to the config.php.ini file to connect Matomo with the database:

[database]
host = "db"
username = "matomo"
password = "P@ssword123"
dbname = "matomo"
tables_prefix = "matomo_"
charset = "utf8mb4"

[General]
salt = "salty"
trusted_hosts[] = "analytics.jmoore53.com"
trusted_hosts[] = "hrvmatp1.cell.jmoore53.com:8080"
trusted_hosts[] = "jmoore53.com"
proxy_client_headers[] = HTTP_X_FORWARDED_FOR

This configuration specifies the database connection settings and lists trusted hosts to ensure secure connections to the Matomo server.

Nginx Reverse Proxy Setup:

Nginx was configured as a reverse proxy to handle incoming requests and direct them to the appropriate server. The setup included adding a certificate and configuring DNS for domain resolution. The Nginx configuration file used for the setup is as follows:

server {
    server_name analytics.jmoore53.com;

    location / {
        proxy_pass http://hrvmatp1.cell.jmoore53.com:8080;
        include proxy_params;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_headers_hash_max_size 512;
        proxy_headers_hash_bucket_size 128;
    }

    ...etc
}

This configuration allows Nginx to act as a gatekeeper, forwarding traffic to the Matomo server while maintaining security and performance.

The server setup was completed by adding DNS records and ensuring that all services are correctly configured and running. The Matomo server is now operational, providing comprehensive analytics for the specified domains.

Some sort of kanboard plugin to save the external links as a scraped site to provide a preview

Fri, 01 Dec 2023 04:41:12 +0000

So this one was never finished off, but this is where I got with the Selenium Scraper. The reason was because I now have multiple dead links I wish I had.

Using Python Selenium and Docker

I chose Python Selenium for web scraping due to its robust capabilities in interacting with web pages, combined with Docker to easily manage and run Selenium.

Docker Commands:

First, we need to run the Selenium Docker container:

docker run -d -p 4444:4444 -p 7900:7900 --shm-size="2g" selenium/standalone-firefox:4.16.1-20231219

Port 4444: This is used by the Selenium WebDriver.
Port 7900: This allows you to view what’s happening in real time through a web-based VNC client.

Scraping the Data with Selenium:

Here’s a basic Python script (app.py) using Selenium to access a webpage and fetch its content:

from selenium import webdriver

options = webdriver.FirefoxOptions()
options.page_load_strategy = 'normal'
options.add_argument('--ignore-ssl-errors=yes')
options.add_argument('--ignore-certificate-errors')
# options.add_argument('--headless')  # Uncomment this line to run in headless mode
# options.add_argument('--no-sandbox') # Uncomment this line if needed for sandbox issues

driver = webdriver.Remote(
    command_executor="http://localhost:4444/wd/hub",
    options=options
)

driver.get("https://jmoore53.com")
page_source = driver.page_source
print(page_source)

driver.quit()

Setting Up WebDriver Options:

I configure Firefox options to handle SSL errors and certificate issues, which is important for accessing a variety of websites without interruptions. The script navigates to the desired URL and retrieves the HTML source of the page. It was also important to always ensure to close the WebDriver session with driver.quit() to free up resources. I ran into an issue where if the driver wasn’t closed, the next open would lock.

Integrate this functionality into Kanboard:

Database Interaction: Use Docker and MySQL to interact with Kanboard’s database and fetch the URLs from task_has_external_links.

docker exec -it kanboard-db-1 /bin/mysql -u root -psecret -e 'use kanboard; select url from task_has_external_links;'

Automating the Scrape and Save

My goal going forward was to create a PHP plugin that triggers the Selenium script for each fetched URL, scraping the content and saving it to your database as a blob for easy retrieval and manipulation.

Enhancing the Scraped Data:

To refine the scraped data, you might consider using BeautifulSoup, a Python library for parsing HTML and XML documents, to extract just the relevant body content from the saved HTML.

Personal Tech Blog

Restic clean up backups

Crontab Restic Cleanup

Conclusion

Links

Nginx Subdirectory Configuration

How to Implement the Configuration

Conclusion

Links:

Kanboard Copy Multiple Links

Process of Applying Fixes/Rebase

SSH Key Management for GitHub

Conclusion

Links

Custom Kernel Install for Ubuntu

How to Install a Mainline Kernel on Ubuntu

GUI Interface for Kernel Updates

Installing LLVM

Conclusion

Links

bitmagnet - dht

Installing DHT on Alpine VM

Configuring OpenVPN

Docker Configuration for PostgreSQL

Links

List Packages to be installed with APT with Ansible Task

How to List Upgradable Packages with Ansible

Potential Solutions for Managing Upgrade Listings

Conclusion

Ansible Testing on Blank Container

Setup

Creating the Docker Environment:

Dockerfile with Systemd for Testing More Complex Scenarios:

Combining SSH and Systemd in a Docker Container:

Additional Considerations:

Conclusion:

Links:

IPv6 in the Homelab

Initial Setup and Evaluation:

Nginx Logging Configuration:

Syslog-ng Configuration:

Matomo Server

Server Configuration:

Database Configuration:

Nginx Reverse Proxy Setup:

Links

Some sort of kanboard plugin to save the external links as a scraped site to provide a preview

Using Python Selenium and Docker

Scraping the Data with Selenium:

Setting Up WebDriver Options:

Integrate this functionality into Kanboard:

Automating the Scrape and Save

Enhancing the Scraped Data:

Links