• 0 Posts
  • 12 Comments
Joined 2 years ago
Cake day: June 26th, 2023
  • tux7350@lemmy.worldtolinuxmemes@lemmy.world•Almost as annoying as the windows evangelists
    0·
    23 days ago

    I have a coworker that likes to pick fun at my usage of CLI tools. He said it’s confusing “why would I use a terminal when the GUI was made after?”. They vehemently hate anytime they have to work with CLI.

    I watched them use an FTP program to download and change one value in a .conf file. Like they downloaded the file, opened it in notepad++, changed one thing, saved it, reuploaded / overretten the original. I tried to show them how to just use nano and got told their way was “better since you could ensure the file was replaced”. Its okay, I’ve secretly caught them using it a couple times lol

  • tux7350@lemmy.worldtoSelfhosted@lemmy.world•Security of running Headscale on a VPSEnglish
    1·
    1 month ago

    I use headscale on a VPS as an ingress point into my network and I love it. On top of headscale, I use two instances of traefik to make my network. I have one instance of traefik running on the vps which runs a couple of services that I want running 24/7(headscale-ui is nice). It pulls a subdomain certificate for TLS. So any services under say *.vps.example.com get routed to the VPS.

    Then I have a wildcard TCP rule pointing the rest of the network traffic to my home server through headscale. My home server is running another instance of traefik where all my services are running. This pulls another wildcard cert for the rest of the *.example.com subdomains.

    Cool thing about this setup is I can now have my DNS server rewrite *.example.com to my servers LAN IP. Now when my device is home, it works even when WAN is out. But when I’m out and about, it hits the public DNS and goes through my VPS. With traefik I can write a not !ClientIP rule and essentially block the VPS. Now I can host a service at home but also block it from being accessed from the public. But if I need access to the LAN remotely, I can just use a tailsacale client and get into headscale and see everything.

    Its an odd network, but it’s super flexible and works very well for my use case. If you have any questions I’d love to help you set something like this up :D

  • tux7350@lemmy.worldtoSelfhosted@lemmy.world•What's up, selfhosters? It's selfhosting Sunday!English
    1·
    1 month ago

    I followed along the nixos wiki for kubernetes and creating the “master” kublet is super easy when you set easyCerts = true. Problem is, it spits out files to /var/lib/kubernetes/secrets/ that is owned by root. Specifically, the cluster-admin.pem file. If I want to push commands to the cluster using kubectl I have to elevate to a root shell. I could just chmod or chown the file but that seems like a security risk.

    Now I’m not familiar with k8s at all. This is my first go through, so I could be doing something wrong or missing a step. I saw something about the role based security but I haven’t jumped down that rabbit hole yet. Any tips for running kubectl without root?