@jax@lemmy.cloudhub.social avatar

jax

@jax@lemmy.cloudhub.social

(They/Them)

This is my main lemmy account.

Admin of lemmy.cloudhub.social

I can also be found elsewhere on the fediverse at @jax

This profile is from a federated server and may be incomplete. Browse more on the original instance.

jax, (edited )
@jax@lemmy.cloudhub.social avatar

Yeah for sure! I like to post about both the positive and negative experiences. I find things like that to be a valuable learning tool.

From a security perspective, it’s important to understand the systems you’ve implemented and test that they are working as expected. I think in that example if I had tested user sign-up sooner I could have caught the configuration issue.

It’s also important to have good observability into your system, both metrics and logs. Metrics to help detect if something weird is happening (increased resource usage could point to ransomware or crypto mining) and logging to track down what happened and see what systems are impacted.

From a technical controls standpoint, it’s good practice to segregate your applications from other systems and control planes like IPMI and switching/routing admin interfaces. It’s also good to try to limit holes in your firewall. In this cluster, I have Cloudflare Tunnels setup so that I don’t have to open ports to access web servers, and I get access to their WAF tooling. You could do something similar with a VPS running WireGuard, CrowdSec, and a reverse proxy.

jax,
@jax@lemmy.cloudhub.social avatar

What’s everyone’s workflows with these systems? Do you catalog both physical and digital documents? Where do you store the documents?

jax,
@jax@lemmy.cloudhub.social avatar

Yeah it very adds some extra complexity and it’s more important for if you are hosting in public clouds anyways IMO.

jax,
@jax@lemmy.cloudhub.social avatar

Ah okay that makes sense, you’re using the internal cluster domain to route to services

jax,
@jax@lemmy.cloudhub.social avatar

That makes sense!

Have you played with anything like Istio to secure in-cluster communications? I think Hashicorp Consul can do something similar to encrypt service to service communications.

jax,
@jax@lemmy.cloudhub.social avatar

Thanks! I find most of the issues occur during upgrades to services, but that is to be expected.

My internet service is usually more of an issue than most services I run. Though some things take longer to get tweaked and running well and that can cause issues.

jax,
@jax@lemmy.cloudhub.social avatar

Oh, dev namespaces are a good idea. Do you have a dev domain then too?

jax,
@jax@lemmy.cloudhub.social avatar

That’s actually super helpful! I haven’t done much custom Helm chart-ing, and was kinda lost where to start. That really helps break the process down, and the tip about skipping state to start is very wise.

jax,
@jax@lemmy.cloudhub.social avatar

I think both of the ones I mentioned have docker-compose files, which I think I can convert with kompose convert? I guess from there I would follow your steps and then start parameterizing it once it’s running properly.

Thanks! I think I’ll start trying out PixelFed tomorrow.

jax,
@jax@lemmy.cloudhub.social avatar

Talos is a great OS! I just wish there was some way to get the IPs from DHCP via Proxmox so I could automate it with terraform.

jax,
@jax@lemmy.cloudhub.social avatar

Nice list! I'm curious, why are you running 2 pi-hole and an adguard instance?

(I also run 2 pi-hole instances for redundancy)

jax,
@jax@lemmy.cloudhub.social avatar

draw.io is one, I've started using LucidChart (personally) and https://d2lang.com at work for process diagrams.

jax,
@jax@lemmy.cloudhub.social avatar

Yeah, that's true, they do have pretty good prices. I like DO though because it's where I started and they have a DC not too far from me, so latency is very low.

jax,
@jax@lemmy.cloudhub.social avatar

That's true! Those do add up over time.

I'd love to go full cloud-native with a kubernetes cluster, but I can't justify the $100+ a month for a reasonable cluster :(

jax,
@jax@lemmy.cloudhub.social avatar

You fit a 3070 in a 5-bay NAS?? That's impressive! I haven't done much with ML, but it is a very interesting field of work. I've seen people do some pretty crazy things with it!

Ansible is nice, but have you heard of Terraform? Or, if you prefer programming/scripting as opposed to HCL/YAML, there is also Pulumi with lets you use terraform via a few different programming languages. (Ansible is nice though, I used to use it all the time in my lab, and it just works)

jax,
@jax@lemmy.cloudhub.social avatar

Awesome! Yeah, my instances are currently running on DO, but it's pretty expensive hosting in the cloud when you have a lab at home. My internet here isn't very good though, that's the main thing stopping me from moving them on-prem.

jax,
@jax@lemmy.cloudhub.social avatar

This sounds a lot like my old cluster config (I stepped away from the lab for a few months and forgot how it works, so started over lmao), but basically it would spin up a talos cluster on proxmox using terraform, and then bootstrap FluxCD and the rest of the software would be setup using that. It was a pretty slick system.

jax,
@jax@lemmy.cloudhub.social avatar

Yeah, I thought the ActivityPub standard was a lot more standard than it actually seems to be. That's probably both a good and bad thing. It would be nice to see some more cohesion though.

jax,
@jax@lemmy.cloudhub.social avatar

As a “replacement” for Reddit (I think that moniker is selling it short, it can be so much more), it makes sense. Reddit and sites like it, depending on the specific community are really just a place to share content from outside sources and discuss that content with a like-minded community.

The other type of subreddit I’ve see are tech support style where someone is asking a question of a group of people who are likely to have a good understanding of the subject matter. I think link-aggregation-style sites are the best interface for these at the moment as well.

jax,
@jax@lemmy.cloudhub.social avatar

Yeah, that sounds like a web sockets issue. I think one part of the nginx.conf file from my docs has proper web sockets handling that you can copy into your config.

jax,
@jax@lemmy.cloudhub.social avatar

Glad it's working for you!

jax,
@jax@lemmy.cloudhub.social avatar

Ahh, I didn't get that far in the docs, but seeing as there are no (that I can tell) post limits, running a blog on Lemmy would work pretty well with a bit of a UI change.

jax,
@jax@lemmy.cloudhub.social avatar

Yeah, I’ll have to do that.

Thanks for the info, that helps clarify things.

jax,
@jax@lemmy.cloudhub.social avatar

Oh yes, right, that is how it works with subscribing to a community.

Though, if I’m on my instance, and select a community from another instance to post in, the post ends up on that community and I have a copy of it (it seems, that’s what I did in this case).

Another comment mentions that if the community went away, I’d still have a copy of the content, which is interesting, though not entirely useful for picking up where the original community left off?

jax,
@jax@lemmy.cloudhub.social avatar

I love my AirPods… I hope you’re right. They do have a way of taking something like that and making it easy and mainstream.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • megavids
  • kavyap
  • DreamBathrooms
  • cisconetworking
  • mdbf
  • InstantRegret
  • magazineikmin
  • Youngstown
  • thenastyranch
  • rosin
  • slotface
  • Durango
  • GTA5RPClips
  • ngwrru68w68
  • JUstTest
  • cubers
  • tacticalgear
  • tester
  • modclub
  • khanakhh
  • everett
  • normalnudes
  • osvaldo12
  • provamag3
  • Leos
  • ethstaker
  • anitta
  • lostlight
  • All magazines
    •