General Enquiries: info@ahmza.com
Ceramics: ceramics@ahmza.com
Design: design@ahmza.com
404
":e:f.tabReplace?e.replace(/\t/g,f.tabReplace):e):e}function E(e){let n=null;const t=function(e){var n=e.className+" ";n+=e.parentNode?e.parentNode.className:"";const t=f.languageDetectRe.exec(n);if(t){var r=y(t[1]);return r||(console.warn(d.replace("{}",t[1])),console.warn("Falling back to no-highlight mode for this block.",e)),r?t[1]:"no-highlight"}return n.split(/\s+/).find(e=>p(e)||y(e))}(e);if(p(t))return;j("before:highlightBlock",{block:e,language:t}),f.useBR?(n=document.createElement("div")).innerHTML=e.innerHTML.replace(/\n/g,"").replace(/
Categories
Welcome 👋
ahmza’s ramblings, A place to share his crazy thoughtsBuilding a Docker Swarm With Pi's 👾 👾 👾 👾
Pis are very capable computers, when banded together they're almost unstoppable
Table of Contents
Intro
The Raspberry Pi from it’s first iteration has been a great hit. -Adopted by many as the computer of choice for projects, and for -very good reason. The Pi is a fully fledged computer that fits in -your pocket and the most recent edition has blown fans away with -the flagship model boasting an ARM64 CPU and 8GB of RAM.
Now one Raspberry Pi 4 8GB is more than powerful enough for most -workloads and in some cases totally unnecessary, so you may even -get away with a single 4GB model. However taking into consideration -their relatively low price and power consumption why not go all out -and build a cluster.
You can never have too many Raspberry Pis, just -not enough Ideas
My excuse to build a Pi cluster is, I would like to migrate the -services currently running on a bare metal server that sucks -a lot of power to a low power solution. What better way to do that -than a Pi cluster.
My Setup
- 4 x Raspberry Pi 4 8GB
- 4 x 32GB SD cards
- 4 x PoE hats
- 1 x 5 port PoE Switch
Point of this post
Hopefully after following this post you will have setup Docker -swarm on a cluster of Pis - stay even if you currently only have -one - and understand how to bend it to your will 🦾.
Why Docker Swarm 🧐
While we can manage each docker node - Raspberry Pi - individually -, Docker swarm enables us to manage all the devices from a single -main node making managing the cluster a lot easier.
Think of Docker swarm as a set of 🤖 hands which will run tasks on -each individual node for us. These tasks can consist of:
- Cluster Management
- Deployment and Scaling across the cluster
- Multi-host networking
- load balancing
- etc…
Well why not Kubernetes
Although Kubernetes is awesome, it adds a bunch of complexity that
-is simply not needed in a home lab environment where we only have
-a small cluster. As well as that, from my experience creating
-docker-compose files is a lot easier than writing manifests.
-Docker swarm can do everything I want it to and requires less
-effort which is great if you’re like me 🥱 😂
Required Stuff
The links below are reccomendations/stuff I used
- Raspberry Pi 4B -(Reccomend 4-8 @ 8GB)
- Raspberry Pi PoE Hats -(If you can find the PoE+ -version get them)
- Cluster Case -(Get any case you want)
- PoE switch -(Get one that has enough ports for the nuber of pis you want)
- RJ45 Ethernet Cable -(Reccomend short cables as it will look neater)
- Micro SD cards -(Get enough cards for the number of Pis, Get the biggest cards you can afford)
This is without a doubt an expensive project, however in my eyes -it’s the cost of another server 😂 and the best part about this -project is you can add to the cluster over time spreding the cost -which is how I managed to purchase all the hardware. A suggestion -would be to buy equipment that allows you room to grow so an 8 port -PoE switch instead of a 4 port if you know you will scale to 8 -nodes
If you build this then you can safely say another server is not -needed. This cluster should be more than capable to serve all your -home needs even if you only have 2 nodes. Put it this way, if you -have 4 8GB nodes then you have a combined total of:
- 32GB of RAM
- 16 physical CPU cores @ 1.5GHz
Money Saving Tips
- Just get 1-2 nodes to start
- cut PoE and use normal power cables
- Use Raspberry Pis with less memmory eg 4GB
- Grab a really cheap case or make one using these
- Use smaller SD Cards try not to go below 32GB (Reccomended 64GB If money saved elsewhere)
BUILD TIME !!
Pull yourself up by your bootstraps were jumping into this one -runnig 💨
Image the SD Cards
So interesting fact the CPUs used in the raspberry pi 4 use an ARM64 -archetecture. When looking for images of Raspbian you will only find -32bit variants which will work however will not make use of all the -hardware which is just a waste. 64bit images exist however are well -hidden, Dont fear 😨 you can download the latest images from the -raspberrypi.org index
To write the cards I use the Raspberry Pi imager
-.
-once you have rpi-imager installed and you have the 64bit raspbian
-image, open sudo rpi-imager and on the “CHOOSE OS” section go to
-the bottom and select use custom image.
We dont need to unzip the file as the tool is clever enough to -handle that for us
Before removing the SD card, mount the boot partition - usually the
-first partition, look for a file called cmdline.txt - and create an
-empty file called ssh sudo touch ssh this basically enables
-SSH on the Pis first boot allowing us to access the Pis in a totally
-headless manner.
Assemble the cluster
So assembly is very dependant on the kit you bought, and more -often than not the stuff needed here comes with instructions or is -self explanitory. So go ahead and assemble the cluster 🛠
There is an order of operations that I reccomend:
- Install PoE hats onto the Pis
- Install the SD Cards into the Pis
- Assemble the case and install Pis
- plug in ethernet cables
**Now allow the Pis to boot for a few minutes so it can resize the
Sort out the Network bits
This is the easy part, there are two methods you can use to set a -static IP address, one is on your DHCP server and the other is on -the device itself. Personally I prefer to set static IPs on the -device itself so I will cover that here.
To find the current ip of your Pis you can go to your DHCP server -and look for the DHCP leases for the Pis.
there are naming conventions for naming primary and secondary -things but this is your cluster so be creative with it, I have my -primary node named
Gooband the secondary nodes namedDoris1-Doris2andDoris3-reference
SSH to the Pi then open and edit the following files
- /etc/hosts
- edit this line with your hostname:
127.0.1.1 goob
- edit this line with your hostname:
- /etc/hostname
- edit this file with your hostname:
goob
- edit this file with your hostname:
- /etc/dhcpcd.conf
- knowing we will be using only static IPs here I delete -everything in the file add the following
interface eth0 -static ip_address=10.10.10.20/24 -static routers=10.10.10.1 -static domain_name_servers=10.10.10.1 -
Now reboot the pi sudo shutdown -r now
Once the Pis are back up log into each one and change the default -passwords you may also want to create a new user for yourself but -thats totally optional.
Provision with Ansible
you want to create an Ansible control node and that is as simple as
-installing a package onto your machine. Ansible is built using python
-which makes it easy to install as we can use the python pip package
-manger. To check you have it installed do pip --version if
-it’s not installed do the following
curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
python get-pip.py --user
once you have pip installed proceed to installing Ansible
pip install ansible
Now that Ansible is installed we can create a runbok that defines the -steps Ansible needs to take on the remote machine to correctly -provision it. This playbook is written in yaml so get ready to make -sure your indents are correct 😬
Creating the playbook -now you can copy what I have and it should work - after changing a -thing or two - which is fine however I encourage you to copy what I -have, read the Docs -and make any changes you feel are necessary.
Check the git repo -for the most up to date yaml file im using.
This script assumes you are using SSH keys, which you should but if -not you can skip the whole “Configure SSH” block, -I RECCOMEND YOU USE SSH KEYS - read this
Create the deploy.yml
---
-- hosts: piCluster
- become: yes
- tasks:
-
- - name: Configure SSH
- block:
-
- - name: Auth local SSH Keys
- ansible.posix.authorized_key:
- user: <pi_user>
- state: present
- key: "{{ item }}"
- with_file:
- - /home/<local_user>/.ssh/id_rsa.pub
- - ./pi_rsa.pub
-
- - name: Copy SSH Pi Intercoms Private Key
- copy:
- src: ./pi_rsa
- dest: /home/<pi_user>/.ssh/id_rsa
- mode: '0600'
- owner: <pi_user>
- group: <pi_user>
-
- - name: Copy SSH Pi Intercoms Public Key
- copy:
- src: ./pi_rsa.pub
- dest: /home/<pi_user>/.ssh/id_rsa.pub
- mode: '0644'
- owner: <pi_user>
- group: <pi_user>
-
-
- - name: Check for any updates and install them
- apt:
- update_cache: true
- upgrade: dist
-
- - name: Install Required build dependencies
- apt:
- update_cache: true
- pkg:
- - python3
- - python3-pip
- - vim
- - curl
-
-
- - name: Check Docker is installed
- shell: "docker --version"
- register: docker_version
-
- - name: Install Docker
- block:
-
- - name: Download Docker script
- command: curl -fsSL https://get.docker.com -o get-docker.sh
-
- - name: Run Docker install script
- command: sudo sh get-docker.sh
-
- - name: Enable docker service
- service:
- name: "{{ item }}"
- enabled: true
- state: started
- loop:
- - docker
- - containerd
-
- - name: Add user to docker group
- user:
- name: <pi_user>
- groups: docker
- append: yes
-
- when: docker_version.stdout.find('Docker version')
-
-
- - name: check Docker compose is installed
- shell: "docker-compose --version"
- register: dc_version
-
- - name: Install docker compose
- command: sudo pip3 -v install docker-compose
- when: dc_version.stdout.find('docker-compose version')
-
-
- - name: wait for network on boot
- command: raspi-config nonint do_boot_wait 0
-
- - name: Reboot
- reboot:
-The steps this playbook takes are as follows:
- Copy your SSH keys to the pi authorized_keys
- Copy same Pi ssh key between the Pis for intercommunication
- Check for and Install updates
- Install any build dependancies
- Check if Docker is Installed
- Download the Docker Script
- Install Docker from script
- Enable the Docker service
- Add user to Docker group
- Check if docker-compose is installed
- Install docker-compose (This will take a while on each pi so be patient, grab a coffee)
- Change raspi config to wait for network before boot
- Reboot
take some time to read through the playbook, read the docs and try to -understand whats going on. Change the usernames to your username.
Make the hosts file in the same directory as the deploy.yml
[piCluster]
-10.10.10.20
-10.10.10.21
-10.10.10.22
-[piCluster]- specifies a group of hosts10.10.10.xx- specifies the Pis IP
create the Pi Intercommunication keys
ssh-keygen
-Enter file in which to save the key (/home/ahmza/.ssh/id_rsa): .pi_rsa
-- save the keys in the same directory the deploy.yml file is
heres the command to run the playbook.
ansible-playbook -i hosts -kK deploy.yml -c paramiko
ansible-playbook- the command to run the playbook-i hosts- specifies the host/inventory file-kK- asks you for password for the SSH connection(-k) and the sudo password(-K)deploy.yml- the Ansible playbook-c paramiko- Use the paramiko connection method, I found this works best with ssh keys
You can do so much with Ansible, for example mount network shares etc, -if you can do it in the cli you can do it in Ansible !!
Now that the Ansible script is done we can go ahead and actually -configure all the Pis into the cluster.
Creating/Joining the swarm
Creating and joining the cluster is easy - It is manual and tedious so -this is something you could impliment into the ansible playbook using -multiple host groups.
Follow these steps to create the swarm:
- ssh to the main Pi, this will be the manager node.
- run
docker swarm init- This will return a command and token. Make sure to copy them
- exit the main Pi
- ssh to one of the worker nodes
- paste and run the copied command
- do the same on the remaining worker nodes
You should now have a correctly configured cluster !!
Optional Step - Portainer
Portainer is a webgui that will allow us to manage the cluster, it will -make deploying and destroying containers across the cluster a breeze. -I do understand that all of what portainer does can simply be accomplished -in the command line, however portainer just makes it less hastle to manage.
Install Portainer
Firstly we want to download the yaml file that will be used to deploy -the portainer contiainer on our cluster.
curl -L https://downloads.portainer.io/portainer-agent-stack.yml -o portainer-agent-stack.yml
Now we can actually deploy portainer to the cluster using the following -command:
docker stack deploy -c portainer-agent-stack.yml portainer
Once the stack is up and running navigate to:
https://raspberry-ip:9443
where raspberry-ip is the IP address of the manager node in the swarm.
Optional Step - Private Registry
If you intend to build any of your own docker images then it may be useful -to create a private repository to host any images that you need to run -across the cluster.
to create this private repository create a file called docker-compose.yml -in a folder called repository or whatever and enter the following.
-version: '3.9'
-services:
- registry:
- image: registry:2
- ports:
- - 5000:5000
- volumes:
- - /home/<pi-user>/docker/registry/data:/var/lib/registry
-Be sure to change pi-user to your pi user
create a file /etc/docker/daemon.json and eter the following
{
- "insecure-registries": ["localhost:5000", "<pi-address>:5000"]
-}
-where pi-address is the ip address of the main swarm node.
restart the docker service with sudo systemctl restart docker
now we need to deploy the registry to the stack like we did with portainer
docker stack deploy -c docker-compose.yml registry
and we should have a private registry setup that we can use to push our -custom docker images to.
Conclusion
Well done, you have successfully setup a docker swarm cluster on a bunch -of Pis and along the way you managed to learn a bit about SSH, Ansible, -docker-compose, yaml and networking on Pis. The next step would be to -setup a few containers but I’ll leave that to you, dont be affraid to -play around and even ruin the cluster, you can always rebuild it so have -fun 😊
HUGO Static Site Generator
HUGO is a static site generator. No idea what that is ? Check out this post to learn more !
The HUGO logo
Table of Contents
Introduction
Hugo is a static site generator, which basically means it’s a tool that -allows us to pre-compile all of our website into static HTML, CSS and -JS. The main benefit of using such methods to crate a site is speed. A -Static site takes a lot less time to load than a site that uses -databases for example.
Disadvantages
Some of the disadvantages I have come across are as follows:
- A lot more backend work
- Harder to manage content
- Editing and creating content can be a pain
This is to no fault of hugo itself but to the unnecessary complexity -in my infrastructure!! Deploying the site in my environment was a -challenge as I had to get the site files from gitlab and build a docker -image that would compile the site as well as create an image to be -deployed in my docker swarm. -I do feel I made this more complicated than it needed to be, however now -that I have it working the workflow is great.
The content is manually managed meaning you have to create edit and -delete posts yourself. HUGO does a great job at making this as pleasant -of an experience as possible but coming from a CMS (Content Management -System) it is a lot more involved.
Because there is no integrated webui or CMS for Hugo, the experience -you get when creating content will vary person to person depending on -the environment you use to create the content. When using a CMS I took -dragging and dropping images for granted where now I have to explicitly -define full paths to images which can get me out of the flow of writing -content, however it’s finding solutions for these challenges that makes -this interesting.
Then Why?
The main reason for switching to a static site generator is speed and -how lightweight the final product is, at the time of writing this the -total size of the content on this site including images is ~5mb which -is considerably smaller than a full CMS and database alone with no -content.
Some advantages of static sites in general:
- Security
- Reliability
- Scalability
- Low Resource Requirement
Although the pursuit of speed brought me to HUGO, here are a few things -that kept me:
- Git
- Markdown
- Simplicity
- Live Preview
As mentioned before my initial reason for switching to a static site -generator was speed and how lightweight the final product is, at the -time of writing this the total size of the content on this site -including images is ~5mb which is considerably smaller than a full CMS -and database alone with no content.
I have recently started to use git a lot more and I’m able to -implement a content versioning system that can follow me everywhere and -on any device very easily. It also means there is always a backup of my -site on gitlab and I don’t need to worry about backing up databases.
Markdown makes life a lot easier, Its quick, easy and doesn’t require -me to right click or use buttons. Markdown is also very transferable, -scroll up to the top of this page and hit the “Suggest Changes” button -and you will see how a markdown file can be interpreted by not only -HUGO but gitlab too and so many other tools.
Regarding themes, HUGO allows you to easily create your own, or just as -easily implement other peoples themes.
Although at the start HUGO seemed difficult to me I managed to learn it -pretty quickly and appreciate the simplicity it brings to the table. I -wouldn’t say my workflow is perfect by any means but I feel HUGO makes -it easy to develop a smooth workflow.
Live Preview allows you to start up a light weight web server locally -and has an auto refresh feature so whenever a change is made the web -page refreshes so you can see changes without manually refreshing.
Conclusion
This post is a quick intro to HUGO and why I choose to use it, However -there is another post on setting up a HUGO site from start to finish.
Posts -
Twitch Layoffs
Mon 20 Mar 2023 The news was broken to all Twitch employees that there was going to be a mass layoff that would nuke 1/5th of Twitch’s workforce, Just over 400 employees. We were not given a date that this would happen we were just told that it would be by the end of the week or early the next week. -Fri 24 Mar 2023 The day started with an announcement that Twitch would layoff 1/5th of its workforce....
Setup a HUGO Site
Introduction Hugo is a static site generator, a tool that allows us to pre-compile our website into static HTML, CSS and JS. The main benefit of using such methods is speed. A Static site takes a lot less time to load than a site that uses databases. -For more information on HUGO read my other post Hugo Static Site Generator Prerequisites Git Installing HUGO Official steps The HUGO binary is what we will use throughout the creation of our project to initially setup our site then create posts etc… This step will vary depending on your operating system and distribution....
Minecraft Server on Docker ⛏ 🐳
Introduction Minecraft is a great game and when it comes to multiplayer, a dedicated server is the way to go (here’s why1). Myself and a few others recently decided to start playing this game again, and I took the opportunity to deploy the server in my lab. -A Minecraft server does not require a ton of resources to run, However from my experience the more resources you can throw at it the better, especially when you start to introduce mods and more than a few players....
Setup WSL 🪟 ❤️ 🐧
Introduction WSL stands for Windows Subsystem for Linux which means we have the Linux kernel inside of windows. This is huge news for developers or people who just want to try Linux. -Prerequisites Enable virtualisation in BIOS Setup Open Powershell in Administrator mode -wsl --install You may be required to restart the device, I Highly recommend you do -Go to the Microsoft store and search for a Linux distribution. I prefer to use the “Ubuntu” distro....
HUGO Static Site Generator
Introduction Hugo is a static site generator, which basically means it’s a tool that allows us to pre-compile all of our website into static HTML, CSS and JS. The main benefit of using such methods to crate a site is speed. A Static site takes a lot less time to load than a site that uses databases for example. -Disadvantages Some of the disadvantages I have come across are as follows:...
Minecraft Server on Docker ⛏ 🐳
Ever wanted to build a Minecraft server in docker !! Start here
Introduction
Minecraft is a great game and when it comes to multiplayer, a dedicated -server is the way to go (here’s why1). Myself and a few others -recently decided to start playing this game again, and I took the -opportunity to deploy the server in my lab.
A Minecraft server does not require a ton of resources to run, However -from my experience the more resources you can throw at it the better, -especially when you start to introduce mods and more than a few players.
I run our server on my main PC within WSL and Docker. This allows me to -leverage the system resources in my PC 🦾 leaving the Pi Cluster -to handle the rest of the stuff in my lab. The only reason I opted to -go this route is that I don’t want our server to be limited by hardware -resources as well as the Minecraft server effecting the overall -performance of the Pis.
Prerequisites
- Docker
- Docker Compose
Requirements2
Minimum (1-5 Players)
- Intel Pentium 4 or AMD Athlon based CPU
- 512 MB RAM
- 2 GB Storage space
Recommended (10-15 Players)
- Intel Core or AMD K8 based CPU
- 3 GB RAM
- 16 GB Storage Space
Optimal (20+ Players)
- Intel i5/i7 or AMD Ryzen 5/7 Based CPU
- 6 GB RAM
- 35 GB Storage Space
Building the Container
Now we have the formalities sorted, we can get to work on creating the -docker container for Minecraft.
Create a directory in which you will keep the Minecraft server files
mkdir minecraft-servercd minecraft-server
Create an environment file to be used by the Docker Container
- The .env file allows us to specify variables which we can use -across the build process.
touch .env- Edit the file in a text editor, i.e. vim
vim .envCONTAINER_NAME=minecraft-server -SERVER_MEM=4096 #change this to your desired value (in MB) -SERVER_JAR=minecraft_server.1.18.2.jar -
Create the docker-compose.yml file
- The docker-compose.yml file specifies the container that we -want to build, outlining the build context (Dockerfile), -setting the variables (from .env), configuring storage volumes -for persistence as well as ports and the container name.
touch docker-compose.yml- Edit the file in a text editor3, I.e. vim
vim docker-compose.ymlversion: "3" - -services: - minecraft-server: - build: - context: . - args: - SERVER_MEM: ${SERVER_MEM} - SERVER_JAR: ${SERVER_JAR} - volumes: - - .server-data:/server - ports: - - 25565:25565 - - 25575:25575 - container_name: ${CONTAINER_NAME} - restart: unless-stopped - -volumes: - server-data: -
Create the Dockerfile file
- The Dockerfile builds the container. We take the 17-jre base -image apply our variables change the working directory to -/server and start the jar file, effectively starting the -Minecraft server.
touch Dockerfile- Edit the file in a text editor, i.e. vim
vim DockerfileFROM eclipse-temurin:17-jre - -ARG SERVER_MEM -ARG SERVER_JAR - -ENV SERVER_MEM=${SERVER_MEM} -ENV SERVER_JAR=${SERVER_JAR} - -WORKDIR /server - -CMD echo "Minecraft Server is starting\n" && java -Xms128M -Xmx${SERVER_MEM}M -jar ${SERVER_JAR} nogui -
Setup the Server files
We’re almost there, just a few steps left !!
The curious among you may have realised when trying to start the -container that it fails with the error below:
Minecraft Server is starting
-
-Error: Unable to access jarfile server.jar
-This is because we have not downloaded the server jar file yet, that is -our next step.
- Navigate to one of the following sites:4
- Vanilla Minecraft Server -- instructions found here5
- Fabric Mod loader server -- instructions found here 6
- Create a folder in the Minecraft-server folder called .server-data
mkdir .server-datacd .server-data
- Download the jar file - This will depend on the option above so read the instructions
- Go back to the root minecraft-server folder
cd ..
- Run the container
docker compose up(use CTRL+C to exit)- Once the server unpacks all the files you will see this:
minecraft-server | Starting net.minecraft.server.Main -minecraft-server | [18:05:50] [ServerMain/INFO]: You need to agree to the EULA in order to run the server. Go to eula.txt for more info. -minecraft-server exited with code 0 -
- Accept the EULA
- Go into the .server-data folder
cd .server-data
- Edit the file named eula.txt in a text editor i.e. vim
vim eula.txt- Simply change
eula=falsetoeula=true
- Simply change
- Go into the .server-data folder
- While in the .server-data folder make any changes you want
- Some files to note in here are
- server.properties - properties like server name, game mode, world type etc…
- ops.json - list of server operators (easier to set ingame)
- whitelist.json - list of players allowed to join the server everyone else rejected access.
- Some files to note in here are
- Run the container
docker compose up -d(the -d means detatched so we can run the server in the background)docker logs minecraft-server --followWill show us the progress of the server startup (to exit out of this do CTRL+C)- If you see something like the following then you’re a winner 🥳
[18:17:01] [Server thread/INFO]: Time elapsed: 25529 ms -[18:17:01] [Server thread/INFO]: Done (34.571s)! For help, type "help" -
Conclusion
Well done you have successfully setup a Minecraft server, now go play !! -There is a lot of cool stuff you can do with a Minecraft server for -example installing mods or creating scripts to manage the server, this -will be covered in the next post so keep an eye out for it !!
Hosting your own dedicated server allows you to modify every aspect of the server as you see fit. I.E you can modify the server-properties, you can implement a whitelist not to mention being able to add any mods you want ↩︎
Requirements Gathered from here https://minecraft.fandom.com/wiki/Server/Requirements/Dedicated#Unix_.28Linux.2C_BSD.2C_macOS.29 - ↩︎
Yaml is very picky 😞 when it comes to formatting so if you encounter any errors double check your formatting !! ↩︎
I have left Forge out as it is a more involved process plus Fabric is better 😜 ↩︎
Right click the green link that says something like minecraft_server.x.xx.x.jar and copy the link address
curl -o server.jar <link you copied here> ↩︎
Select the Minecraft version, Fabric Loader Version and the Installer Version of your choice. I tend to go with the latest.
Copy the curl command under CLI download ↩︎
Posts -
You Need to Learn Linux 🐧
Introduction You need to learn Linux because there is no reason not to. If you are pursuing a career in IT, without a doubt you will come across Linux and having even basic knowledge is very helpful. Many people struggle with the OS simply because it’s fundamentally different compared to the other operating systems, but with a bit of time you can master the basics and unlock it’s true power....
Building a Docker Swarm With Pi's 👾 👾 👾 👾
Intro The Raspberry Pi from it’s first iteration has been a great hit. Adopted by many as the computer of choice for projects, and for very good reason. The Pi is a fully fledged computer that fits in your pocket and the most recent edition has blown fans away with the flagship model boasting an ARM64 CPU and 8GB of RAM. -Now one Raspberry Pi 4 8GB is more than powerful enough for most workloads and in some cases totally unnecessary, so you may even get away with a single 4GB model....
Securing SSH 🤖
Introduction SSH is a widely used protocol to access remote devices. The problem with SSH is at the authentication stage, Brute force attacks are one of the ways an SSH connection can be compromised. A malicious actor will constantly hammer the remote host with different passwords until it can gain access. With further configuration of SSH we can make the service a lot more secure. -Configure SSH Famous last words: Configuring SSH like many things in Linux is as simple as editing a few config files...
Setup an NGINX Reverse Proxy 🥸
Introduction In this post we will go over setting up an NGINX reverse proxy to allow different web services to reach the outside world. We will also cover setting up auto renewing SSL certificates. -Why not just port forward the services, it does the same thing Right? Reverse proxies are a great way to expose web services to the outside world in a more secure and customisable manner. Some of the features that a reverse proxy provides are as follows:...
Welcome 👋
Hello World The mandatory hello world when you start something new. -I’d like to say thank you for visiting my site and I hope that you gain something valuable from it. -A bit about me I’m currently based in the UK in the early stages of my career. And like most people - possibly you - I am very interested in learning new technologies and techniques. -I get bored fairly easily and so I have to keep my self busy by learning new stuff....
Securing SSH 🤖
Ever wanted to make your SSH connections more secure. Read this
Introduction
SSH is a widely used protocol to access remote devices. The problem -with SSH is at the authentication stage, Brute force attacks are one of -the ways an SSH connection can be compromised. A malicious actor will -constantly hammer the remote host with different passwords until it can -gain access. With further configuration of SSH we can make the service -a lot more secure.
Configure SSH
Famous last words: Configuring SSH like many things in Linux is -as simple as editing a few config files
Always be sure to create a backup file it’s very easy to end up -locking yourself out of a device.
I would recommend practising on a machine that is not critical.
Create SSH Keys
SSH keys use public and private key encryption for authentication.
To create a set of keys, on the client do:
ssh-keygen
-You will be asked where you want to save the keys, I recommend the
default location for less hair pulling later.
Enter file in which to save the key (/home/user/.ssh/id_rsa):
-You will be asked to enter a password for the ssh keys, be sure to use -a strong password.
Enter passphrase (empty for no passphrase):
-Once that is done you will see a confirmation screen like the one below
Output
-Your identification has been saved in /home/user/.ssh/id_rsa
-Your public key has been saved in /home/user/.ssh/id_rsa.pub
-The key fingerprint is:
-SHA256:tIurljnWJRBc1RnHUJQ5GtND7p9HWKnjV6zjE9AFR1Y user@host
-The key's randomart image is:
-+---[RSA 3072]----+
-| . .....oX=o.oE|
-| o =oB oo|
-| . . +.+ o.|
-| . . .... o+ |
-| . S .+. +|
-| .... ..o+.|
-| +.o. .=o.|
-| * .. .oo |
-| o.o. .. |
-+----[SHA256]-----+
-Copy SSH Keys
Quick note: user@host is the username on the remeote host -you would like to copy your public key to.
ssh-copy-id user@host
-If asked to confirm the connection to the remote host answer yes, this -happens when a new machine with an unknown identity wants to connect to -the client.
Output
-The authenticity of host 'host(host)' can't be established.
-ECDSA key fingerprint is xx:xx:xx:xx:xx:xx:xx:xx.
-Are you sure you want to continue connecting (yes/no)? yes
-You will then be asked to enter a password for the user on the remote -host
Output
-/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
-/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
-user@host's password:
-If successful you should be able to access the device using the SSH key
To verify this, SSH to the device and it should ask for the Keys’s -password not the users
Enter passphrase for key '/home/user/.ssh/id_rsa':
-Modify SSH Config
create a backup
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
-open the original file in a text editor
sudo vim /etc/ssh/sshd_config
-For a new user this might be daunting. Take your time and you will be -fine 😊
Lines we want to modify
Quick note: you may need to uncomment some lines as well as add a -few
- Protocol 2 - add to line 15
- Port 2222 - modify line 17
- PermitRootLogin no - modify line 36
- Max Auth Tries 5 - modify line 38
- PasswordAuthentication no - modify line 60
- PermitEmptyPasswords no -modify line 61
- AllowUsers ahmza - add line 67
- ClientAliveInterval 180 - modify line 104
# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $
-
-# This is the sshd server system-wide configuration file. See
-# sshd_config(5) for more information.
-
-# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
-
-# The strategy used for options in the default sshd_config shipped with
-# OpenSSH is to specify options with their default value where
-# possible, but leave them commented. Uncommented options override the
-# default value.
-
-Include /etc/ssh/sshd_config.d/*.conf
-
-Protocol 2
-
-Port 2222
-#AddressFamily any
-#ListenAddress 0.0.0.0
-#ListenAddress ::
-
-#HostKey /etc/ssh/ssh_host_rsa_key
-#HostKey /etc/ssh/ssh_host_ecdsa_key
-#HostKey /etc/ssh/ssh_host_ed25519_key
-
-# Ciphers and keying
-#RekeyLimit default none
-
-# Logging
-#SyslogFacility AUTH
-#LogLevel INFO
-
-# Authentication:
-
-#LoginGraceTime 2m
-PermitRootLogin no
-#StrictModes yes
-MaxAuthTries 5
-#MaxSessions 10
-
-#PubkeyAuthentication yes
-
-# Expect .ssh/authorized_keys2 to be disregarded by default in future.
-#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
-
-#AuthorizedPrincipalsFile none
-
-#AuthorizedKeysCommand none
-#AuthorizedKeysCommandUser nobody
-
-# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
-#HostbasedAuthentication no
-# Change to yes if you don't trust ~/.ssh/known_hosts for
-# HostbasedAuthentication
-#IgnoreUserKnownHosts no
-# Don't read the user's ~/.rhosts and ~/.shosts files
-#IgnoreRhosts yes
-
-# To disable tunneled clear text passwords, change to no here!
-PasswordAuthentication no
-PermitEmptyPasswords no
-
-AllowUsers ahmza
-
-# Change to yes to enable challenge-response passwords (beware issues with
-# some PAM modules and threads)
-ChallengeResponseAuthentication no
-
-# Kerberos options
-#KerberosAuthentication no
-#KerberosOrLocalPasswd yes
-#KerberosTicketCleanup yes
-#KerberosGetAFSToken no
-
-# GSSAPI options
-#GSSAPIAuthentication no
-#GSSAPICleanupCredentials yes
-#GSSAPIStrictAcceptorCheck yes
-#GSSAPIKeyExchange no
-
-# Set this to 'yes' to enable PAM authentication, account processing,
-# and session processing. If this is enabled, PAM authentication will
-# be allowed through the ChallengeResponseAuthentication and
-# PasswordAuthentication. Depending on your PAM configuration,
-# PAM authentication via ChallengeResponseAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
-# If you just want the PAM account and session checks to run without
-# PAM authentication, then enable this but set PasswordAuthentication
-# and ChallengeResponseAuthentication to 'no'.
-UsePAM yes
-
-#AllowAgentForwarding yes
-#AllowTcpForwarding yes
-#GatewayPorts no
-X11Forwarding yes
-#X11DisplayOffset 10
-#X11UseLocalhost yes
-#PermitTTY yes
-PrintMotd no
-#PrintLastLog yes
-#TCPKeepAlive yes
-#PermitUserEnvironment no
-#Compression delayed
-ClientAliveInterval 180
-#ClientAliveCountMax 3
-#UseDNS no
-#PidFile /var/run/sshd.pid
-#MaxStartups 10:30:100
-#PermitTunnel no
-#ChrootDirectory none
-#VersionAddendum none
-
-# no default banner path
-#Banner none
-
-# Allow client to pass locale environment variables
-AcceptEnv LANG LC_*
-
-# override default of no subsystems
-Subsystem sftp /usr/lib/openssh/sftp-server
-
-# Example of overriding settings on a per-user basis
-#Match User anoncvs
-# X11Forwarding no
-# AllowTcpForwarding no
-# PermitTTY no
-# ForceCommand cvs server
-Now lets explain what we just did
- Protocol 2 - released in 2006, SSH2 introduced improved -encryption algorithms.
- Port 2222 - The port number can be whatever number you want. -Choose something other than 22 this will help hide your device from malicious actors
- PermitRootLogin no - If the root account were to be compromised -then the attacker has full control of the system so we stop it from being able to log in.
- MaxAuthTries 5 - After 5 failed attempts the remote host blocks -requests from that IP for a period of time.
- PasswordAuthentication no - We have the SSH key installed so we -no longer need to have password authentication.
- PermitEmptyPasswords no - We don’t want to allow empty passwords -to be used as authentication for obvious reasons.
- AllowUsers username - Add the usernames of users you want to be -able to connect to the remote host and other users trying to connect -will be dropped.
- Client Alive Interval 180 - Drop the connection after a certain -period of inactivity
Check were able to connect
restart sshd service
sudo systemctl restart sshd
-Keep the current SSH connection open and create a new session.
If you are able to connect to the remote hosts then you are all set. If -not then you still have the initial connection to the remote host to -roll back the changes and troubleshoot.
Success
Setting up Fail2Ban
Fail2Ban is an intrusion prevention tool. Although we are slowing -bots down with MaxAuthTries the attacker is still able to carry on -brute forcing. Which is what Fail2Ban is for, it actually blocks the -connections from that IP.
Install Fail2Ban
We will install Fail2Ban on the remote host -First upgrade any packages, then install Fail2Ban
sudo apt update && sudo apt upgrade
-sudo apt install fail2ban
-Now we need to enable the service so it starts when the remote host -starts
sudo systemctl enable --now fail2ban
-Configure Fail2Ban
The Fail2Ban config file we want to edit is called jail.local located in /etc/fail2ban/ -open jail.local in your editor of choice
sudo vim /etc/fail2ban/jail.local
-The config for Fail2Ban is a lot shorter than sshd so this should be -quick
[DEFAULT]
- bantime = 8h
- ignoreip = 127.0.0.1 <ip addresses to be ignored>
- ignoreself = true
-
-[sshd]
- enabled = true
- port = 2222
- filter = sshd
- logpath = /var/log/auth.log
- maxretry = 3
- findtime = 10m
-[Default] - Settings in here apply to all jails
- bantime - how long the ban will last
- ignoreip - IP addresses to ignore
- ignoreself - stops from locking itself out
[sshd] - this is the jail for sshd
- enabled - decides weather the jail is active or not
- port - the port number the service
- filter - tells the jail which filter to use from /etc/fail2ban/filter.d
- logpath - where the log you want fail2ban to read is
- maxretry - Times the client can attempt a login before being banned
- findtime - An amount of time which maxretry must occur to trigger a -ban for example in 10 minutes if 3 failed login attempts are made the -ban the IP
Restart Fail2Ban to load the configuration
sudo systemctl restart fail2ban
-Testing Fail2Ban
To test Fail2Ban lets create a test user and set a password for the -user
sudo useradd test
-sudo passwd test
-open the sshd config
sudo vim /etc/ssh/sshd_config
-modify the line PasswordAuthentication to say yes and add the test user to AllowUsers
PasswordAuthentication yes
-AllowUsers user test
-restart the sshd service
sudo systemctl restart sshd
-Attempt to login to the remote host using the test account using an -incorrect password. After 3 failed attempts it should say connection -refused.
ssh test@host -p 2222
-Fail2Ban should do something along the lines of … -
log back in as your normal user, remove the test user and restore the -sshd config.
To remove the user
sudo userdel test
-restore the /etc/ssh/sshd_config file
sudo vim /etc/ssh/sshd_config
-Set PasswordAuthentication back to no and remove test from AllowUsers
PasswordAuthentication no
-AllowUsers user
-Conclusion
well done, you managed to make it through all that !! At least now you -can be reassured that if them pesky brute-force attackers decide to -target your machine they wont have a fun time being in Jail 🤣 sorry -bad joke.
By now you have managed to setup an ssh key for a client and copy it to -a remote host, re-configure the sshd config to lockdown authentication -and last but not least install and configure Fail2Ban to block pesky -attackers.
Setup a HUGO Site
Always wanted to setup a static website. Look no further !! In this post we go over the basics of setting up a HUGO site
The HUGO logo
Introduction
Hugo is a static site generator, a tool that allows us to pre-compile our website into static HTML, CSS and JS. -The main benefit of using such methods is speed. -A Static site takes a lot less time to load than a site that uses databases.
For more information on HUGO read my other post Hugo Static Site Generator
Prerequisites
- Git
Installing HUGO
The HUGO binary is what we will use throughout the creation of our project to initially setup our site then create posts etc… -This step will vary depending on your operating system and distribution. -I will show the steps for MacOS and Arch based Linux distros.
MacOS
- Install homebrew
brew install hugo
-Arch
sudo pacman -S hugo
-Confirm Installation
hugo version
-Create your site
This assumes a few steps for you, i.e the theme used. The settings in this guide will mimic the base config of my site
hugo new site -f yml <your-sitename>
-cd <your-sitename>
-git init
-git submodule add --depth=1 https://github.com/adityatelange/hugo-PaperMod.git themes/PaperMod
-echo "theme: 'PaperMod'" >> config.yml
-Create Content
We will now begin adding new content to our website. Lets create our first post.
Lets start by creating a template for our posts.
vim archetypes/posts.md
-Paste the following base template
---
-title: {{ replace .TranslationBaseName "-" " " | title }}
-date: {{ .Date }}
-author: "<author>"
-draft: true
-weight:
-
-tags: [""]
-description: ""
-canonicalURL: "{{ .Page | absURL }}"
-
-cover:
- image: "<image path/url>" # image path/url
- alt: "<alt text>" # alt text
- caption: "<text>" # display caption under cover
- relative: false # when using page bundles set this to true
-
----
-
-## **Introduction**
-
-## **Conclusion**
-If the posts folder does not exist, create it
mkdir content/posts
-Create and edit a post
hugo new posts/<post-name>.md
-vim content/posts/<post-name>.md
-Start the server
Now that we have created our site, installed a theme and created a post lets start the server.
hugo server -D
-The -D flag tells hugo server to build drafts. (notice how we have a draft: option in our posts template.) -Of course once you have finished a post you set draft to false like so draft: false
You will be shown something like the following:
➜ hugo server -D
-Start building sites …
-hugo v0.109.0+extended darwin/arm64 BuildDate=unknown
-
- | EN
--------------------+-----
- Pages | 10
- Paginator pages | 0
- Non-page files | 0
- Static files | 0
- Processed images | 0
- Aliases | 2
- Sitemaps | 1
- Cleaned | 0
-
-Built in 12 ms
-Watching for changes in /home/ahmza/prj/ahmza/{archetypes,assets,content,data,layouts,static,themes}
-Watching for config changes in /home/ahmza/prj/ahmza/config.yml
-Environment: "development"
-Serving pages from memory
-Running in Fast Render Mode. For full rebuilds on change: hugo server --disableFastRender
-Web Server is available at http://localhost:1313/ (bind address 127.0.0.1)
-Press Ctrl+C to stop
-Notice the second line to the bottom. Web Server… This line gives you a localhost url that you can use in your browser to view your site locally.
Configure Site
Open the config.yml file in a text editor.
vim config.yml
-Important changes you need to make
- baseURL - this is the URL your site will be accessed externally. In my case. https://blog.ahmza.com
- title - is the title of your page.
Here is my config.yml with bits redacted so you can fill them in
baseURL: "<your sites URL>"
-title: <your site title>
-paginate: 5
-theme: PaperMod
-
-enableRobotsTXT: true
-buildDrafts: false
-buildFuture: false
-buildExpired: false
-enableEmoji: true
-
-googleAnalytics: <Google Analytics Tag>
-
-minify:
- disableXML: true
- minifyOutput: true
-
-outputs:
- home:
- - HTML
- - RSS
- - JSON
-
-params:
- env: production # to enable google analytics, opengraph, twitter-cards and schema.
- title: <title>
- description: "<description>"
- keywords: [Blog, Portfolio, PaperMod]
- author: <author>
- images: ["<link or path of image for opengraph, twitter-cards>"] #Change this
- DateFormat: "January 2, 2006"
- defaultTheme: auto # dark, light
- disableThemeToggle: false
-
- ShowReadingTime: true
- ShowShareButtons: false
- ShowPostNavLinks: false
- ShowBreadCrumbs: true
- ShowCodeCopyButtons: true
- ShowWordCount: true
- ShowRssButtonInSectionTermList: true
- UseHugoToc: false
- disableSpecial1stPost: false
- disableScrollToTop: false
- hideFooter: false
- comments: false
- hidemeta: false
- hideSummary: false
- showtoc: true
- tocopen: false
-
- assets:
- # disableHLJS: true # to disable highlight.js
- # disableFingerprinting: true
- favicon: "/img/favicon.png"
- favicon16x16: "/img/favicon.png"
- favicon32x32: "/img/favicon.png"
- apple_touch_icon: "/img/favicon.png"
- safari_pinned_tab: "/img/favicon.png"
-
- label:
- text: "<Home>"
- icon: /img/favicon.png
- iconHeight: 35
-
- # profile-mode
- profileMode:
- enabled: true # needs to be explicitly set
- title: "Welcome \U0001F44B"
- subtitle: "<subtitle>"
- imageUrl: "/img/favicon.png"
- imageWidth: 120
- imageHeight: 120
- imageTitle: "my image"
- buttons:
- - name: posts
- url: posts
- - name: archive
- url: archives
- - name: tags
- url: tags
-
- # home-info mode
- homeInfoParams:
- Title: "Welcome \U0001F44B"
- Content: "subtitle"
-
- socialIcons:
- - name: LinkedIn
- url: "https://linkedin.com/in/"
- - name: gitlab
- url: "https://gitlab.com/"
-
- cover:
- hidden: false # hide everywhere but not in structured data
- hiddenInList: false # hide on list pages and home
- hiddenInSingle: false # hide on single page
-
- editPost:
- URL: "https://gitlab.com/<user>/<repo>/-/blob/main/content"
- Text: "Suggest Changes" # edit text
- appendFilePath: true # to append file path to Edit link
-
- # for search
- # https://fusejs.io/api/options.html
- fuseOpts:
- isCaseSensitive: false
- shouldSort: true
- location: 0
- distance: 1000
- threshold: 0.4
- minMatchCharLength: 0
- keys: ["title", "permalink", "summary", "content"]
-
-menu:
- main:
- - identifier: posts
- name: posts
- url: /posts/
- weight: 1
- - identifier: archive
- name: archive
- url: /archives/
- weight: 10
- - identifier: tags
- name: tags
- url: /tags/
- weight: 20
- - identifier: search
- name: search
- url: /search/
- weight: 30
-# Read: https://github.com/adityatelange/hugo-PaperMod/wiki/FAQs#using-hugos-syntax-highlighter-chroma
-pygmentsUseClasses: true
-markup:
- highlight:
- noClasses: false
- codeFences: true
- guessSyntax: true
- # lineNos: true
-Run the server again
Run the server and check out your hard work. Change settings make posts etc. Have fun !!
hugo server -D
-Publish your site
Once you are happy with your site, you may want to publish it to the internet.
In the next post Publishing your HUGO site -I will cover a basic method of publishing your site as well as a more complicated but automated workflow that I use.
Conclusion
Through this post you have learned to create your own HUGO site as well as create and edit posts. -We also learned about
- archetypes
- Mark posts as drafts (expand on this
- The hugo built in server (still need to add this))
- webp + webm (still need to add this)
- shortcodes (still need to add this)
Setup an NGINX Reverse Proxy 🥸
Learn to setup a quick and easy reverse proxy using NGINX
Introduction
In this post we will go over setting up an NGINX reverse proxy to -allow different web services to reach the outside world. We will -also cover setting up auto renewing SSL certificates.
Why not just port forward the services, it does the same thing Right? -Reverse proxies are a great way to expose web services to the outside -world in a more secure and customisable manner. Some of the features -that a reverse proxy provides are as follows:
- Host multiple services using the same HTTP/HTTPS ports
- Hides the origin server
- HTTPS TLS encryption
- Caching
- Compression
Creating a Reverse Proxy
Prerequisites
- a server to act as the reverse proxy
- a web server
- a registered domain name
- Have A records setup for the Domain name
Install NGINX
I’ll be using the apt package manager as I’m on Ubuntu server, -this may differ for you
Update packages, then install NGINX
sudo apt update
-sudo apt install nginx
-Now we want to enable NGINX so the program will start when -the server boots
sudo systemctl enable --now nginx
-Firewall
Quick Note: now is a good time to port forward ports 80 and 443 -from the router to the reverse proxy
Ubuntu server comes with a firewall (ufw), so be sure to allow access -to NGINX and enable it.
The reverse proxy handles both HTTP and HTTPS so allow “Nginx Full”
sudo ufw allow 'Nginx full'
-If you are using SSH allow it through
sudo ufw allow 'OpenSSH'
-Configure NGINX
Unlink the default NGINX config
sudo unlink /etc/nginx/sites-enabled/default
-Create NGINX Config
Create a config file in /etc/nginx/site-available
Quick Note: use whichever text editor you want, I’m using vim
sudo vim /etc/nginx/sites-available/blog.conf
-server {
- listen 80;
- server_name blog.example.com;
- location / {
- proxy_pass http://ip-of-server:port;
- }
-}
-- server_name is the domain name you want use this can include -sub-domains
- proxy_pass is the IP address of the web server
Enable NGINX Config
To activate a config file we need to link the file from the -sites-available folder to sites-enabled.
Pro Tip: make sure to use full paths when creating symlinks
sudo ln -s /etc/nginx/sites-available/blog.conf /etc/nginx/sites-enabled/blog.conf
-Check the config, this is an important step as it warns you of any errors before -reloading NGINX
sudo nginx -t
-If the output looks simmiler to below then you’re good to go !!
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
-nginx: configuration file /etc/nginx/nginx.conf test is successful
-Now restart the NGINX service
sudo systemctl restart nginx
-you should now have a working reverse proxy !!
Setting up SSL
Prerequisites
- Make sure HTTP and HTTPS are port forwarded to the reverse proxy
- Make sure server_name is set in the config file you created
Installing Certbot
Certbot is a tool that requests an SSL certificate and makes sure it -is renewed when needed. -Install Certbot as well as the python NGINX plug-in
sudo apt install certbot python3-certbot-nginx
-Quick Note: double check firewall rules
Request SSL Certificate
Now all we need to do is request the certificate !!
sudo certbot --nginx -d blog.example.com
-- –nginx specifies we are using NGINX, this will update the config -file we created to allow the use of SSL
- -d is the domain name you want to use
If this is the first time running Certbot you will be asked to enter -an email as well as agree to terms and services.
If the certificate request is successful you will be prompted with
Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-1: No redirect - Make no further changes to the webserver configuration.
-2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
-new sites, or if you're confident your site works on HTTPS. You can undo this
-change by editing your web server's configuration.
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-Select the appropriate number [1-2] then [enter] (press 'c' to cancel):
-If you want all traffic to be SSL encrypted choose option 2 -That’s it we have SSL certificates installed. You will need a new -certificate for each different domain name or subdomain.
Verify Auto Renewal
All we need to do now is make sure that Certbot can automatically renew -certificates.
sudo certbot renew --dry-run
-If you see no errors then you are ready to go.
Conclusion
By following this you have hopefully managed to setup an NGINX -Reverse proxy to handle incoming HTTP/HTTPS requests as well as -configured automatically renewing SSL certificates.
This posts barely scratches the surface of what NGINX can do, I would -highly recommend reading more into this great piece of software !!
My reverse proxy handling non existent traffic
Give it a few months and this blog will …
Setup WSL 🪟 ❤️ 🐧
Table of Contents
Introduction
WSL stands for Windows Subsystem for Linux which means we have the -Linux kernel inside of windows. This is huge news for developers or people -who just want to try Linux.
Prerequisites
- Enable virtualisation in BIOS
Setup
Open Powershell in Administrator mode
wsl --install
-You may be required to restart the device, I Highly recommend you do
Go to the Microsoft store and search for a Linux distribution. I prefer -to use the “Ubuntu” distro.
Once that is installed, go ahead and run the distribution, after it -finishes setting itself up it will ask you for a username and password. -These credentials are separate from the host system so you can make them -whatever you want.
And that’s it you have WSL and a Linux distribution setup, now go and do -something awesome.
Optional
I use the windows terminal app to run the Ubuntu distribution, it makes -customising the environment a lot easier. To download it head over to the -Microsoft store and search for Windows Terminal and download it.
When you login to WSL it will not default to your home directory which gets -very annoying. So to fix that go to Windows Terminal Settings (Be sure to -look around there are some cool features) look for Ubuntu or your -distributions name and change the Starting directory to
\\wsl$\Ubuntu\home\ahmza
-Be sure to change “Ubuntu” to your distributions name
Be sure to change “ahmza” to your username
Conclusion
Well done you have managed to setup WSL and use Linux inside of windows. -No go and enjoy the freedom of Linux !!
Twitch Layoffs
Bleed Purple
Table of Contents
Mon 20 Mar 2023
The news was broken to all Twitch employees that there was going to be a mass layoff that would nuke 1/5th of Twitch’s workforce, -Just over 400 employees. We were not given a date that this would happen we were just told that it would be by the end of the week -or early the next week.
Fri 24 Mar 2023
The day started with an announcement that Twitch would layoff 1/5th of its workforce. The anticipation of this moment through the -whole week left hundreds of us with a sick feeling in our stomachs. They had split the layoffs up between APAC, EMEA, And AMER. -APAC on the chopping block first. We saw people loose access and numbers from our #general slack channel dither. Each Region had -a 5 hour window where people would get dropped in waves. You were lucky to get dropped straight away instead of be part of the last -wave of people and have hopes that you might just be one of the people to survive.
Luckily I was one of the folk that was able to keep their jobs this time. But 1/5th of the workforce has surely affected every person -that works at twitch. We all lost somebody we worked with or reported to and so morale has tanked this past week, and you can see it. -The #general channel is almost a bone yard.
In my team the GSOC we lost our technicians, these amazing folk made our lives - the engineers - much easier as we no longer needed -to worry about emails and phone calls. Now that the Techs have gone this workload has been thrown back at us and it has shaken up -the way we got used to working. Our workflows have been disrupted and thus productivity has dropped massively. But not only when -it comes to work will we miss these people, The two Technicians that I worked with made the shift lively and I already miss our -interactions.
Conclusion
If you’re reading this and you are a recruiter then please talk into account ex-twitch employees effected by this tragic event.
Shout outs to:
Welcome 👋
Hello World
The mandatory hello world when you start something new.
I’d like to say thank you for visiting my site and I hope that you -gain something valuable from it.
A bit about me
I’m currently based in the UK in the early stages of my career. And -like most people - possibly you - I am very interested in learning -new technologies and techniques.
I get bored fairly easily and so I have to keep my self busy by -learning new stuff. The reason this site exists is because I wanted -to learn how web servers work and long the way I learned a lot of -other stuff too.
I feel If you are interested in something then definitely go ahead -and try to learn it I’m sure you will learn a lot more than you -expect. Like a lot of people say
Its about the Journey as much as it is the destination
I have always tinkered and naturally gained an interest for -technology, I don’t limit myself to one part of tech I try to dabble -a bit in everything. I love photography as you operate the camera and -in certain situations have to learn to develop film 😂 but I also get -to incorporate the creative side.
Check out my photography focused site here photos.ahmza.com
If you would like to learn more about me then feel free to contact me -on any of my social media.
You Need to Learn Linux 🐧
Ever wanted to learn Linux ? Well no better time than now to learn
Introduction
You need to learn Linux because there is no reason not to. If you -are pursuing a career in IT, without a doubt you will come across -Linux and having even basic knowledge is very helpful. Many people -struggle with the OS simply because it’s fundamentally different -compared to the other operating systems, but with a bit of time you -can master the basics and unlock it’s true power.
But Why
Linux is everywhere, from data centres to your smart toaster. So -if you are interesting in anything IT related then it’s a great asset -to have.
Linux is great for power users because it allows you to customise all -aspects of your workflow to make it yours. The amount of -customisability is mind blowing and an endless rabbit hole which is -awesome as there is always something you could implement to improve -your workflow.
Another great aspect of the customisability is the crazy number of -options you can choose from to theme and tailor the Linux desktop -experience to your liking. For some great and inspiring examples -checkout r/unixporn -. This -is what drove me to switch to Linux and Arch specifically.
Linux is very Light weight (Depending on Distribution) and much
-faster than competing operating systems simply because more often
-than not the distributions of Linux are not filled with bloatware.
-The most extreme examples of this are distros like Arch or something
-like LFS (Linux From Scratch) where you get a completely bare bones
-installation of Linux and are required to install everything from
-Network Managers, to the Desktop Environment, although this can seem
-pointless at the start as you use more and more distros you will find
-things you like and don’t on each and something like Arch allows you
-to choose every bit of software that is installed and come up with
-something completely custom. Plus then you can say I use Arch BTW
How can you start
Install Linux as your main OS
This is the full send option.
A great Distribution that I recommend is Manjaro with KDE Plasma
-as it offers a heavily customisable desktop environment KDE Plasma
-and Manjaro itself is a great as it’s Arch based but does not require
-you to start from step 0.
MacOS Terminal
MacOS is actually UNIX based and so if you have an apple -Mac/MacBook all you need is the Terminal application. I used this on -my work machine and it’s a great alternative to the full send option. -However I do not recommended this if you don’t own one of these devices -already due to cost 💸
Windows WSL
The Windows Subsystem for Linux is another great option to get started -with Linux, it installs the Linux Kernel in windows and allows you -to play around in a real Linux environment.
Virtual Machines
If there is a specific Distribution of Linux you want to try then -this is a great option. However if you want to simply get to know -Linux then choose the MacOS terminal or WSL methods as they are -a lot lighter on system resources
Conclusion
Why are you still reading go and get stuck in with Linux 💨
As with anything learning Linux is a journey and will take time. -Enjoy the experience of learning it and uncovering it’s hidden powers -because it is well worth it. I have linked some great resources for -other great Linux related content that helped me.
Arch Wiki -(Although specific to Arch -this is a great knowledge base, also useful for Manjaro as it’s Arch based)
Search
ARM -
Minecraft Server on Docker ⛏ 🐳
Introduction Minecraft is a great game and when it comes to multiplayer, a dedicated server is the way to go (here’s why1). Myself and a few others recently decided to start playing this game again, and I took the opportunity to deploy the server in my lab. -A Minecraft server does not require a ton of resources to run, However from my experience the more resources you can throw at it the better, especially when you start to introduce mods and more than a few players....
blog -
Setup a HUGO Site
Introduction Hugo is a static site generator, a tool that allows us to pre-compile our website into static HTML, CSS and JS. The main benefit of using such methods is speed. A Static site takes a lot less time to load than a site that uses databases. -For more information on HUGO read my other post Hugo Static Site Generator Prerequisites Git Installing HUGO Official steps The HUGO binary is what we will use throughout the creation of our project to initially setup our site then create posts etc… This step will vary depending on your operating system and distribution....
HUGO Static Site Generator
Introduction Hugo is a static site generator, which basically means it’s a tool that allows us to pre-compile all of our website into static HTML, CSS and JS. The main benefit of using such methods to crate a site is speed. A Static site takes a lot less time to load than a site that uses databases for example. -Disadvantages Some of the disadvantages I have come across are as follows:...
career -
Twitch Layoffs
Mon 20 Mar 2023 The news was broken to all Twitch employees that there was going to be a mass layoff that would nuke 1/5th of Twitch’s workforce, Just over 400 employees. We were not given a date that this would happen we were just told that it would be by the end of the week or early the next week. -Fri 24 Mar 2023 The day started with an announcement that Twitch would layoff 1/5th of its workforce....
Docker Swarm -
Building a Docker Swarm With Pi's 👾 👾 👾 👾
Intro The Raspberry Pi from it’s first iteration has been a great hit. Adopted by many as the computer of choice for projects, and for very good reason. The Pi is a fully fledged computer that fits in your pocket and the most recent edition has blown fans away with the flagship model boasting an ARM64 CPU and 8GB of RAM. -Now one Raspberry Pi 4 8GB is more than powerful enough for most workloads and in some cases totally unnecessary, so you may even get away with a single 4GB model....
Docker -
Minecraft Server on Docker ⛏ 🐳
Introduction Minecraft is a great game and when it comes to multiplayer, a dedicated server is the way to go (here’s why1). Myself and a few others recently decided to start playing this game again, and I took the opportunity to deploy the server in my lab. -A Minecraft server does not require a ton of resources to run, However from my experience the more resources you can throw at it the better, especially when you start to introduce mods and more than a few players....
Building a Docker Swarm With Pi's 👾 👾 👾 👾
Intro The Raspberry Pi from it’s first iteration has been a great hit. Adopted by many as the computer of choice for projects, and for very good reason. The Pi is a fully fledged computer that fits in your pocket and the most recent edition has blown fans away with the flagship model boasting an ARM64 CPU and 8GB of RAM. -Now one Raspberry Pi 4 8GB is more than powerful enough for most workloads and in some cases totally unnecessary, so you may even get away with a single 4GB model....
Games -
Minecraft Server on Docker ⛏ 🐳
Introduction Minecraft is a great game and when it comes to multiplayer, a dedicated server is the way to go (here’s why1). Myself and a few others recently decided to start playing this game again, and I took the opportunity to deploy the server in my lab. -A Minecraft server does not require a ton of resources to run, However from my experience the more resources you can throw at it the better, especially when you start to introduce mods and more than a few players....
Homelab -
Building a Docker Swarm With Pi's 👾 👾 👾 👾
Intro The Raspberry Pi from it’s first iteration has been a great hit. Adopted by many as the computer of choice for projects, and for very good reason. The Pi is a fully fledged computer that fits in your pocket and the most recent edition has blown fans away with the flagship model boasting an ARM64 CPU and 8GB of RAM. -Now one Raspberry Pi 4 8GB is more than powerful enough for most workloads and in some cases totally unnecessary, so you may even get away with a single 4GB model....
Securing SSH 🤖
Introduction SSH is a widely used protocol to access remote devices. The problem with SSH is at the authentication stage, Brute force attacks are one of the ways an SSH connection can be compromised. A malicious actor will constantly hammer the remote host with different passwords until it can gain access. With further configuration of SSH we can make the service a lot more secure. -Configure SSH Famous last words: Configuring SSH like many things in Linux is as simple as editing a few config files...
Setup an NGINX Reverse Proxy 🥸
Introduction In this post we will go over setting up an NGINX reverse proxy to allow different web services to reach the outside world. We will also cover setting up auto renewing SSL certificates. -Why not just port forward the services, it does the same thing Right? Reverse proxies are a great way to expose web services to the outside world in a more secure and customisable manner. Some of the features that a reverse proxy provides are as follows:...
HUGO -
Setup a HUGO Site
Introduction Hugo is a static site generator, a tool that allows us to pre-compile our website into static HTML, CSS and JS. The main benefit of using such methods is speed. A Static site takes a lot less time to load than a site that uses databases. -For more information on HUGO read my other post Hugo Static Site Generator Prerequisites Git Installing HUGO Official steps The HUGO binary is what we will use throughout the creation of our project to initially setup our site then create posts etc… This step will vary depending on your operating system and distribution....
HUGO Static Site Generator
Introduction Hugo is a static site generator, which basically means it’s a tool that allows us to pre-compile all of our website into static HTML, CSS and JS. The main benefit of using such methods to crate a site is speed. A Static site takes a lot less time to load than a site that uses databases for example. -Disadvantages Some of the disadvantages I have come across are as follows:...
Tags
linux -
Setup WSL 🪟 ❤️ 🐧
Introduction WSL stands for Windows Subsystem for Linux which means we have the Linux kernel inside of windows. This is huge news for developers or people who just want to try Linux. -Prerequisites Enable virtualisation in BIOS Setup Open Powershell in Administrator mode -wsl --install You may be required to restart the device, I Highly recommend you do -Go to the Microsoft store and search for a Linux distribution. I prefer to use the “Ubuntu” distro....
You Need to Learn Linux 🐧
Introduction You need to learn Linux because there is no reason not to. If you are pursuing a career in IT, without a doubt you will come across Linux and having even basic knowledge is very helpful. Many people struggle with the OS simply because it’s fundamentally different compared to the other operating systems, but with a bit of time you can master the basics and unlock it’s true power....
misc -
Welcome 👋
Hello World The mandatory hello world when you start something new. -I’d like to say thank you for visiting my site and I hope that you gain something valuable from it. -A bit about me I’m currently based in the UK in the early stages of my career. And like most people - possibly you - I am very interested in learning new technologies and techniques. -I get bored fairly easily and so I have to keep my self busy by learning new stuff....
Networking -
Setup an NGINX Reverse Proxy 🥸
Introduction In this post we will go over setting up an NGINX reverse proxy to allow different web services to reach the outside world. We will also cover setting up auto renewing SSL certificates. -Why not just port forward the services, it does the same thing Right? Reverse proxies are a great way to expose web services to the outside world in a more secure and customisable manner. Some of the features that a reverse proxy provides are as follows:...
NGINX -
Setup an NGINX Reverse Proxy 🥸
Introduction In this post we will go over setting up an NGINX reverse proxy to allow different web services to reach the outside world. We will also cover setting up auto renewing SSL certificates. -Why not just port forward the services, it does the same thing Right? Reverse proxies are a great way to expose web services to the outside world in a more secure and customisable manner. Some of the features that a reverse proxy provides are as follows:...
Pi4 -
Building a Docker Swarm With Pi's 👾 👾 👾 👾
Intro The Raspberry Pi from it’s first iteration has been a great hit. Adopted by many as the computer of choice for projects, and for very good reason. The Pi is a fully fledged computer that fits in your pocket and the most recent edition has blown fans away with the flagship model boasting an ARM64 CPU and 8GB of RAM. -Now one Raspberry Pi 4 8GB is more than powerful enough for most workloads and in some cases totally unnecessary, so you may even get away with a single 4GB model....
Raspberry Pi -
Building a Docker Swarm With Pi's 👾 👾 👾 👾
Intro The Raspberry Pi from it’s first iteration has been a great hit. Adopted by many as the computer of choice for projects, and for very good reason. The Pi is a fully fledged computer that fits in your pocket and the most recent edition has blown fans away with the flagship model boasting an ARM64 CPU and 8GB of RAM. -Now one Raspberry Pi 4 8GB is more than powerful enough for most workloads and in some cases totally unnecessary, so you may even get away with a single 4GB model....
RemoteAccess -
Securing SSH 🤖
Introduction SSH is a widely used protocol to access remote devices. The problem with SSH is at the authentication stage, Brute force attacks are one of the ways an SSH connection can be compromised. A malicious actor will constantly hammer the remote host with different passwords until it can gain access. With further configuration of SSH we can make the service a lot more secure. -Configure SSH Famous last words: Configuring SSH like many things in Linux is as simple as editing a few config files...
ReverseProxy -
Setup an NGINX Reverse Proxy 🥸
Introduction In this post we will go over setting up an NGINX reverse proxy to allow different web services to reach the outside world. We will also cover setting up auto renewing SSL certificates. -Why not just port forward the services, it does the same thing Right? Reverse proxies are a great way to expose web services to the outside world in a more secure and customisable manner. Some of the features that a reverse proxy provides are as follows:...
SSH -
Securing SSH 🤖
Introduction SSH is a widely used protocol to access remote devices. The problem with SSH is at the authentication stage, Brute force attacks are one of the ways an SSH connection can be compromised. A malicious actor will constantly hammer the remote host with different passwords until it can gain access. With further configuration of SSH we can make the service a lot more secure. -Configure SSH Famous last words: Configuring SSH like many things in Linux is as simple as editing a few config files...
twitch -
Twitch Layoffs
Mon 20 Mar 2023 The news was broken to all Twitch employees that there was going to be a mass layoff that would nuke 1/5th of Twitch’s workforce, Just over 400 employees. We were not given a date that this would happen we were just told that it would be by the end of the week or early the next week. -Fri 24 Mar 2023 The day started with an announcement that Twitch would layoff 1/5th of its workforce....
web development -
Setup a HUGO Site
Introduction Hugo is a static site generator, a tool that allows us to pre-compile our website into static HTML, CSS and JS. The main benefit of using such methods is speed. A Static site takes a lot less time to load than a site that uses databases. -For more information on HUGO read my other post Hugo Static Site Generator Prerequisites Git Installing HUGO Official steps The HUGO binary is what we will use throughout the creation of our project to initially setup our site then create posts etc… This step will vary depending on your operating system and distribution....
HUGO Static Site Generator
Introduction Hugo is a static site generator, which basically means it’s a tool that allows us to pre-compile all of our website into static HTML, CSS and JS. The main benefit of using such methods to crate a site is speed. A Static site takes a lot less time to load than a site that uses databases for example. -Disadvantages Some of the disadvantages I have come across are as follows:...
website -
Setup a HUGO Site
Introduction Hugo is a static site generator, a tool that allows us to pre-compile our website into static HTML, CSS and JS. The main benefit of using such methods is speed. A Static site takes a lot less time to load than a site that uses databases. -For more information on HUGO read my other post Hugo Static Site Generator Prerequisites Git Installing HUGO Official steps The HUGO binary is what we will use throughout the creation of our project to initially setup our site then create posts etc… This step will vary depending on your operating system and distribution....
HUGO Static Site Generator
Introduction Hugo is a static site generator, which basically means it’s a tool that allows us to pre-compile all of our website into static HTML, CSS and JS. The main benefit of using such methods to crate a site is speed. A Static site takes a lot less time to load than a site that uses databases for example. -Disadvantages Some of the disadvantages I have come across are as follows:...
welcome -
Welcome 👋
Hello World The mandatory hello world when you start something new. -I’d like to say thank you for visiting my site and I hope that you gain something valuable from it. -A bit about me I’m currently based in the UK in the early stages of my career. And like most people - possibly you - I am very interested in learning new technologies and techniques. -I get bored fairly easily and so I have to keep my self busy by learning new stuff....
windows -
Setup WSL 🪟 ❤️ 🐧
Introduction WSL stands for Windows Subsystem for Linux which means we have the Linux kernel inside of windows. This is huge news for developers or people who just want to try Linux. -Prerequisites Enable virtualisation in BIOS Setup Open Powershell in Administrator mode -wsl --install You may be required to restart the device, I Highly recommend you do -Go to the Microsoft store and search for a Linux distribution. I prefer to use the “Ubuntu” distro....
wsl -
Setup WSL 🪟 ❤️ 🐧
Introduction WSL stands for Windows Subsystem for Linux which means we have the Linux kernel inside of windows. This is huge news for developers or people who just want to try Linux. -Prerequisites Enable virtualisation in BIOS Setup Open Powershell in Administrator mode -wsl --install You may be required to restart the device, I Highly recommend you do -Go to the Microsoft store and search for a Linux distribution. I prefer to use the “Ubuntu” distro....
Tshirt
You Scanned me :D
well done you successfully scanned my t-shirt.
You Don’t get anything for doing so but here have a pop cat (touch his mouth):
