lazyweb

Out of curiosity, why disable USB3 at all?

Seems there's a big outage the moment, at least in FSN. All of my resources there went offline starting 12:24 CET.

Robot and Console are down as well. Nothing yet on their status page.

Edit: Looks like we're back since 12:42 CET.

Jealous until you see my monthly bill.

It's a very good watch, highly recommended.

Went to her exhibit in 2021 in Gropius Bau. Her art has been my phone background ever since. RIP

Socket 370 and Socket A were very easy to break. You needed a flat head screwdriver to pry off the metal bracket which held the cooler in place. Apply a little too much force (or just repeat the process a few times) and watch the plastic nook break off of the socket, rendering the entire mainboard useless. Zip-ties or super glue might save you, if just for a while. But good luck moving/transporting the computer then.

Hosting a personal, low volume mail server works as well as ever. If you know what you're doing.

I've written about it five years ago, still applies: https://schumacher.sh/2021/05/10/running-a-private-mail-serv...

Does not for me. Likely an A/B rollout.

It is a bad idea. There's RCE CVEs on an almost weekly basis.

T-Pot does something similar: https://github.com/telekom-security/tpotce

Oh snap, that's crazy. In a bad way.

> Going forward, customers must order the full server system to obtain the motherboard.

Veritasium - Why It Was Almost Impossible to Make the Blue LED

https://www.youtube.com/watch?v=AF8d72mA41M

I generally agree. But then again, we had Master/Slave IDE connectors, floppy drives, _extremely_ shitty CPU sockets (broke plenty of Sockel A / 370 cooler latches), nothing (including keyboards and mice!) was hot-pluggable ...

Regarding your last point: that's just market segmentation. Plenty of lanes on server CPUs. Remember Linus' rant about Intels refusal to offer ECC for consumer CPUs?

I did the exact opposite. And by that I mean physically moved my homelab into their colo earlier this year. Runs like a charm, costs about 500€ per month total.

Sounds like a lot, but I was almost paying the same before - 220€ for power at home, 110€ for a dedicated Hetzner server, 95€ for a secondary internet connection (as not to interfere with the main uplink used for home office by my partner and me).

Not having to deal with the extra heat, noise and used up space at home anymore has been worth it as well.

I'm hosting my own internal CA using Hashicorp Vault and some ansible + CI. The root CA is valid for 20 years, intermediate CA 10 years, client certs three months.

Initial setup is a handful of commands interacting with Vault's CLI, from there, with CI in place, client certs are renewed automatically. Services are restarted / reloaded as well. Works flawlessly.

I should maybe write a (small) blog explaining how it works.

As predicted by Mass Effect 1: Introducing Omni-gel.

Mort Way

I set up something like this [1] a few years ago at a previous job, mostly just because the security team wanted an interactive dashboard.

[1] https://github.com/debricked/dmarc-visualizer

I am running my own private CA as well, powered by Hashicorp Vault, Ansible and Jenkins.

The Vault initialization and configuration is more or less manual (just a bunch of commands, I have them in my notes). From there I am using an ansible role based on the hasi_vault module [1] which is run by a Jenkins job every night, logging into each target system, renewing certs if needed and reloading services.

Has been working very well for about a year now. Of course, there's a little more technical context needed - my CA needs to be present on all systems interacting with it, and my CI needs to be able to log into each target system (SSH keypair + sudo user). This ties into the rest of my infrastructure, which is managed by Terraform and Ansible.

I might write up a small blog post about this if I find the time.

[1] https://docs.ansible.com/ansible/latest/collections/communit...

Straight out of https://www.imdb.com/title/tt21942866/

Which is a fun watch btw

Has anyone tried mirroring their apt repo yet? Using apt-mirror on Debian stable, I'm seeing errors:

  Processing indexes: [PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPapt-mirror: can't open index packages.mozilla.org/apt//dists/mozilla/main/binary-amd64/Packages in process_index at /usr/bin/apt-mirror line 891.

Config section in /etc/apt/mirror.list:

  deb https://packages.mozilla.org/apt mozilla main
  clean https://packages.mozilla.org

Edit - probably apt-mirror showing its age and adding a second forward slash. I'll look into it soon-ish.

Mildly relevant - the Telmate Terraform provider for Proxmox [1], which now stopped working with latest Proxmox version due to seemingly being abandoned, was initially mostly developed by an engineer employed by a company of the same name. They've since rebranded [2].

I've used that provider for a while, and only recently started looking into the specifics. The repo is effectively owned by a company profiting off of incarcerated persons in the US. Pretty wild.

Mostly writing this since I've spent the last few days migrating my Terraform setup to a different, supported provider [3].

[1] https://github.com/Telmate/terraform-provider-proxmox

[2] https://www.gettingout.com/

[3] https://github.com/bpg/terraform-provider-proxmox

Agreed. I've introduced an internal, selfs-signed CA using Vault, ansible and Jenkins for my personal infrastructure. Issues certs via pipeline job and restarts / reloads affected target services if needed.

I might do a writeup soon on this, it's not even that complicated.

"I still ate some and feel fine" vs. "I've been sitting on the toilet for the last 25 minutes".

I'm using Graphene, but with the default Google captive portal settings. While yes, I am technically leaking my current public IP to Google servers, what does it actually tell them apart from the IP?

It's a generic user agent I believe and there's billions of (simple) HTTP requests hitting that endpoint. If you're using a stock Android (or even worse, like Samsung) it's the Play services and unkillable vendor background apps you should be worried about.

I'd argue it's a lot more conspicuous to network operators if you're using non-standard captive URLs.

Wow, incredible video.

That's what I imagine could be the last few seconds of semi conscious hallucination by some poor Warhammer40K space traveller during a gellar field failure.

Exactly. Depending on the location and "crookedness" of each tooth, the oral surgeon might grind down the inside of the jaw bone for a clean extraction.

Source: I've had three of my four wisdom teeth removed like that just a few weeks ago (mid thirties, local anesthetic). Chewing harder things like bread still hurts a little, otherwise it's fine.

My way of doing private SSL (not necessarily the easiest):

* own CA, to be distributed to all systems via Ansible playbook or Dockerfile directives

* Hashicorp Vault with enabled PKI engine

* Ansible Hashivault module [1]

* Ansible role & playbook to tie it all together

* CI enviroment for automated deployment of SSL certs to target systems

Works flawlessly once set up, including restart/reload of affected services. Might do a writeup on my personal blog at some point.

[1] https://github.com/ansible-collections/community.hashi_vault

As stated, between 20 - 30W.

My router at the moment is a 1U Poweredge R230. Got it for 70€ off of ebay about 3,5 years ago. It's using a Pentium G4600, one stick of 16G DDR4 ECC RAM, and a small cheap 2,5'' SSD. There's an extra PCIe card with 2x 1G Intel RJ45 ports as well, giving me 4x 1G plus IPMI (or whatever Dell calls it).

Fans are throttled to 8% and I'm having Icinga2 watch system temperatures, which are usually between 35 - 45°C. It's barely audible, and currently sitting 1,5m away from my ears. I think idle power consumption is something between 20 - 30W.

It's based on Debian 11, and I'm only using tools available from Debian's repo: dnsmasq, nftables, wireguard, ipsec, haproxy, some policy based routing. Provisioning via ansible.

Rock solid platform. I've recently had to reboot for the 1st time in about 600 days due to physically moving some things around - I know, uptime is not supposed to be a flex.

Might replace the Intel PCIe card with a 1x SFP+ for a DAC connection to my core switch soon-ish since we finally seem to be getting our apartment complex connected to residential fiber.

I guess what I'm saying is - I congratulate the tenacity and expertise that went into OPs blog post, as far as homelab routers go, I'm very happy with my (very easy to set up) HW/SW.