• 6 Posts
  • 146 Comments
Joined 2 years ago
cake
Cake day: June 11th, 2023

help-circle


  • You probably have your network locked down much better than me. That should work too.

    For me, it was easier to set up authelia to limit access. I don’t trust the “authorization” portal in foundry so I set up a real authentication proxy.

    As a dev I’ve had experience with the developer culture and norms in different languages, and NodeJS stands out to me for invoking (other NodeJS) dependencies for even the smallest things.

    Left-pad is the best illustration of this dependency culture. This also means vulnerabilities spread across the entire npm landscape instantly, since everything depends on almost everything else.


  • I’m hosting foundryvtt on a k8s cluster. I’m using Authelia+lldap to have only authenticated users passed on to that behemoth of a NodeJS app that is undoubtedly full of vulnerabilities.

    I have Authelia set up to enforce 2FA for any request outside my users’ home networks. Or so I thought, but one of my players kept getting asked to 2FA.

    Turns out I forgot about IPv6. He connects over IPv6 by default.






  • CPU requests were filling up on my setup. Got a dirty cracked used Ideapad with 4C/8T (i5-8265U) and an NVMe SSD to reinforce my Talos Kuberbetes cluster. Cost €65.

    Upgraded it from 4GB soldered + 4GB stick RAM to 20GB RAM total. 16GB DDR4 sticks only cost €20 on the used market nowadays :)

    RAM upgrade done, still need to add it to the cluster.

    Then I’ll install a nice observability stack: VictoriaMetrics, VictoriaLogs, Grafana, and set up alerting finally. Afterwards, I’m thinking of adding Karakeep.









  • Sell the expensive minisforum pc, buy 3 used laptops, use https://github.com/onedr0p/cluster-template

    Done! Full GitOps bare metal Talos kubernetes cluster that runs your workloads so much faster than any VM. Without hypervisor or Ansible or systemd or ssh. Just YAML manifests all the way down. Cert-manager for automatic certificate management. SOPS for local secrets management.

    A few months later, you can have this:

    Volsync for automated encrypted backups that automatically populate your volumes when you completely reset the entire cluster.

    Rook-ceph for shared replicated storage among the nodes.

    Authelia/lldap stack + Anubis botblocker to protect public-facing endpoints.

    I guess I should start a blog.