mb_

joined 1 year ago
[–] mb_@lemm.ee 1 points 3 weeks ago* (last edited 3 weeks ago)

There are a few ways to do it, but you don't use caddy for SSH.

  • host SSH on port 22, forgejo on a different port. Expose both ports to the internet
  • host SSH on a different port, forgejo on port 22. Expose both ports to the internet
  • host SSH on port 22. Forgejo on port 2222. Only 22 exposed to the internet. Change the authorized_keys user of the git user on host to automatically call the internal forgejo SSH app

Last option is how I run my Gitea instance, authorized keys is managed by gitea so you don't really need to do anything high maintenance.

~git/.ssh/authorized_keys:

command="/usr/local/bin/gitea --config=/data/gitea/conf/app.ini serv key-9",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,no-user-rc,restrict ssh-rsa PUBLICKEYHASH

/usr/local/bin/gitea:

ssh -p 2222 -o StrictHostKeyChecking=no git@127.0.0.14 "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@"

127.0.0.14 is the local git docker access where I expose the service, but you couldn't different ports, IPS, etc.

[–] mb_@lemm.ee 2 points 3 months ago

distcc so you can compile on the faster ones and distribute it

[–] mb_@lemm.ee 1 points 6 months ago

I can't remember all the details, but depending on the CPU you are running you may need some extra configuration on opnsense.

There were a few issues, on my servers, running on older Intel Xeon CPUs, but I eventually fixed them adding proper flags to deal with different bugs.

Other than that, running on a VM is really handy.

[–] mb_@lemm.ee 2 points 6 months ago

Hold my beer

https://revolt.chat

Although, I have never used it (=

[–] mb_@lemm.ee 1 points 6 months ago

On nvidia, there are still too many edge cases involving Wayland that are just crippled. Orca slicer doesn't work for me for example, you are completely missing any of the 3d accelerated graphics in there.

On the other hand, the AMD 7x00 series have different kind of bugs, with ring0 errors leading to full resets.

I think once nvidia drivers are squared out (the proprietary ones) it will be smooth sailing.

[–] mb_@lemm.ee 2 points 6 months ago

It is nice that you got it running, but when everything you end up doing is running services in low ports or needing specific IP address in different networks, rootless podman is just a PITA.

In my case I have one pihole running on a docker container and another one that runs directly on a VM.

Someone said before "what's the point of running in a container"... Well, there really isn't any measurable overhead and you have the benefit of having a very portable configuration.

I do think the compromises one has to go through for podman rootless are not worth in this case, for me, not even the rootful worked properly (a few years ago), but this is a nice walkthrough for people wanting to understand more.

[–] mb_@lemm.ee 1 points 7 months ago

I can't say if you are overstating it but, only mention that I went through a similar path. I had it multiple scripts running and it was a neverending thing.

Since I have moved to small step I never had a problem.

The biggest advantage I got is for products like opnsense, you can do automatic renewal of certificates using your internal CA.

Generating new certs is still as simple (actually much easier for me) than relying on openssl or easyrsa scripts.

[–] mb_@lemm.ee 27 points 8 months ago (1 children)
[–] mb_@lemm.ee 2 points 9 months ago

While I don't use TPM myself (I dislike being tied to a specific hardware) the way it protects you is:

Disk is protected through encryption, so you can't remove and inject anything/hack the password.

If boot is protected/signed/authorized only, a random person can't load an external OS and modify the disk either.

All this together would say, even if someone acquires your computer, they can't do anything to it without an account with access, or an exploit that works before a user logs.

In a way, the attack surface can be bigger than if you simply encrypted your disk with a key and password protect that key.

[–] mb_@lemm.ee 1 points 9 months ago (1 children)

Saying Waze and Google in the same phrase is, unfortunately, redundant

[–] mb_@lemm.ee 1 points 10 months ago* (last edited 10 months ago)

You can always compile your own Iosevka and adjust several pieces, I have done that selecting what I consider the best pieces a long time ago.

The compiled font lives in an easy to access internal webserver that I just grab from every computer I use (=

[–] mb_@lemm.ee 1 points 1 year ago

If you replace the lava* with shit, the phrase still makes sense and is accurate

view more: next ›