Fair enough! I toyed with the idea of doing it that way because the systemd component would just reference a single yaml file for each service, which feels portable. That said though, my quadlets as they are are pretty portable too. Thanks for sharing!

Just curious why you chose a kube quadlet instead of the typical podman container quadlets?

That’s because they just terminate TLS at their end. Your DNS record is “poisoned” by the orange cloud and their infrastructure answers for you. They happen to have a trusted root CA so they just present one of their own certificates with a SAN that matches your domain and your browser trusts it. Bingo, TLS termination at CF servers. They have it in cleartext then and just re-encrypt it with your origin server if you enforce TLS, but at that point it’s meaningless.

Good callout! You’re absolutely right, and here I was primarily focused on publicly accessible services. Thanks for the addition.

That’s a super valid question, as it seems sometimes that some of these things are configured in a way that begs the question “why?” As far as contributing to documentation, that’s a moot point. This is already in the man pages, and that’s exactly what I referenced in writing this post, in addition to some empirical testing of course. As far as implementation goes, I think that probably lies at a per distribution level, where not one size fits all. Although I don’t know of it off the top of my head, I’m sure there’s a security centric distro out there that implements more of these sandboxing options by default.

Excellent! There’s certainly a lot to unpack, but being able to twist all these little knobs is part of the beauty of Linux.

Very glad to gear it! Learning new stuff with Linux is the fun part of the journey.

Hey, much appreciated!

What… This isn’t true at all.

The primary thing is rather than “dumb” flood routing, you can choose the path your message takes to its destination; as a repeater operator you can also choose the path it takes to repeat out. Its a slight compensation to people carelessly placing infrastructure nodes with poor configurations in poor places. Not perfect, but better. Adoption is much, much lower though, and the licensing is not copyleft.

Meshcore does address some of the biggest shortfalls of Meshtastic, but I absolutely HATE that they’re positioned to either rugpull, or setup a perpetual “freemium” model. It’s also not interoperable, so if Meshcore is to work, it needs the numbers like Meshtastic has.

Yeah, so far the most prevalent thing around my area has been “it’s a hobby for the sake of being a hobby.” No one does anything terribly useful or important with it. I can tell you that I would certainly never rely on it as a form of emergency communication.

Love me some graylog

LibreNMS, which is a modern fork of observium.

https://roguesecurity.dev/blog/librenms

Yes! Qsl cards are very much still alive and well. Some traditions will never die. The special event stations are fun to get cards from.

Super cool anecdote on the telescope thing, I’ve never heard of that.

I hope you get back on the radio, it’s a great hobby. It’s a nice stress relief outlet for me these days too.

Love to hear things like that! When I first got licensed the solar cycle was utter trash. We’re past the peak now, but band conditions are still pretty good generally. A few watts and a wire will still get you somewhere with CW and some other forward error corrected modes (like FT8). I have a lot of fun with the digital stuff like AREDN, but it’s definitely a different ball game and the old school SSB-based radio still has its place in my heart.

False positive what? I didn’t give any specific examples of alerts, just simply monitoring metrics. Are you referring to the note on the Dnsmasq memory leak?

For any hams here, maybe this blog post will be up your alley. 73!

They misspelled “backdoors.”

The OIDC settings in the Authelia config reference were the most nebulous to me, but they weren’t entirely stumping. The hard part was interpreting whether my errors stemmed from an issue on the client application side or on the Authelia side.

I would imagine you could likely extend the config snippets from my post to work in your situation with a few tweaks. The big lift, the OIDC provider is covered, so I’d be curious to hear what else you have to tweak!