Computer

Here is how to decrypt the root partition at boot time automatically on Ubuntu (and Debian-derivatives). Warning: this is not a good security practice. Anyone who can physically access your computer can find the decryption key and therefore access your data. In the example below, the encrypted partition is /dev/vda3, replace it with your own. Find the key size in bits: cryptsetup luksDump /dev/vda3 | grep 'Key:' Key: 512 bits Create a random key of 512 bits or 64 bytes using dd: ...

I recently started to use OpenObserve to collect logs from my home lab and I wanted to add NetFlow. The documentation is good but unfortunately, running the binary directly from Docker Compose did not work. I had to package it with a trivial bash script. Here is how I fixed it. The Dockerfile to build the container image: FROM debian:12 ADD --chown=root:root --chmod=755 https://github.com/openobserve/goflow2/releases/download/v100.0.1/goflow2-100.0.1-linux-x86_64 /goflow2 ADD --chown=root:root --chmod=755 ./run.sh /run.sh RUN apt-get update && apt-get upgrade -y && rm -vrf -- /var/cache/apt ENTRYPOINT /run.sh EXPOSE 2055/udp EXPOSE 6343/udp The run.sh to start the collector: ...

Just a month after the previous post about GPU prices in Europe, prices have changed quite a bit and it’s a good time to revisit the European GPU market once again. Let’s have a look at the GPU prices in Europe using Amazon.fr and check which one gives the best “bang for the buck” as YouTubers like to say. I will use Hardware Unboxed comparison of the GeForce RTX 5060 Ti 16GB Review & Benchmarks - Not Great, Not Terrible for this post. ...

A year after the first post about GPU prices in Europe, let’s revisit with the European GPU market. Last generations NVIDIA RTX 5000 and AMD RX 9000 are out, let’s have a look at the GPU prices in Europe using Amazon.fr and check which one gives the best “bang for the buck” as YouTubers like to say. I will use Hardware Unboxed comparison of the Radeon RX 9070 XT vs. GeForce RTX 5070 Ti over 55 games for this post. They have used the ASUS TUF Gaming GeForce RTX 5070 Ti OC and the Sapphire Pure Radeon RX 9070 XT for their comparison, so I’ve used the prices for the same models and when possible, I used the same series for other GPU’s. ...

Let’s say you are using GitOps to deploy your applications on Kubernetes. Let’s say you want to be sure you wrote your manifests right. Then kubeconform and kube-score are the tools you are looking for. And you can of course check it on every push or pull/merge request. kubeconform By default, kubeconform will use vanilla Kubernetes schemas but if you use Custom Resource Definitions, kubeconform can support them. Use the -schema-location to indicate where to find the JSON schemas. It accepts templated URLs and it’s handy because there’s a GitHub repository with the most common CRD’s out there: https://github.com/datreeio/CRDs-catalog. ...

Kind of a note to self, a reminder of some NASA programming practices for the JPL code. I’m not a programmer myself but some, if not all, of those rules can be applied to my humble projects. Avoid complex flow constructs, such as goto and recursion. All loops must have fixed bounds. This prevents runaway code. Avoid heap memory allocation. Restrict functions to a single printed page. Use a minimum of two runtime assertions per function. Restrict the scope of data to the smallest possible. Check the return value of all non-void functions, or cast to void to indicate the return value is useless. Use the preprocessor sparingly. Limit pointer use to a single dereference, and do not use function pointers. Compile with all possible warnings active; all warnings should then be addressed before release of the software. Source: ...

I am sure I am not the first to do it, but I have asked ChatGPT to implement a UUID v7 function based on RFC 9562. It did not get it right the first time, but after some back and forth, it gave me this answer: import time, random, uuid def generate_uuid_v7_fast(): ts = int(time.time() * 1000) & ((1 << 48) - 1) upper = (ts << 16) | ((7 << 12) | random.getrandbits(12)) lower = (0b10 << 62) | random.getrandbits(62) return str(uuid.UUID(int=(upper << 64) | lower)) Compared to the reference implementation, it is more than 2 times slower (+117% on my system). However, the reference implementation returns a bytearray while this version returns a string after a call to uuid.UUID(). ...

I had been thinking using Wordpress for a personal blog is kind of wasteful for a long long time. After all, I don’t have dynamic content, it’s really just a bunch of text. I wanted to migrate to a static-file CMS for a long time but I never had the courage to do so. I recently had a few days of downtime, and so finally I did it. I decided to use Hugo as it was the most popular option at the time. ...

It has been a long time since I wanted to control connections from/to Docker containers but I could never find a simple enough solutions. We can control reverse proxy settings (Traefik) using labels but we can’t apply iptables rules with them? Nonsense. If you add to this that every container lives in a namespace, and namespaces can have their iptables rules, you have there an easy solution. So I wrote a Bash script that listen to Docker events. It filters on container starts which have the label firewall.enable=true, so it does not wake up often. ...

In a previous post, I explained how to host a private ChatGPT using Docker and Traefik. I didn’t spend a lot of time on the security aspect of the project. I see many people asking how to expose their large language model on Internet and ask how to secure it. Since most (all?) open-source projects have adopted the OpenAI API, it uses standard HTTP. Therefore you can use all the traditional techniques to secure your large language model with a reverse proxy. ...