Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
mathstodon.xyz is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Mastodon instance for maths people. We have LaTeX rendering in the web interface!

Administered by:

Server stats:

2.7K
active users

mathstodon.xyz: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#puppet

6 posts6 participants0 posts today
Public
Overlook InfraTech

Have you been looking at #OpenVox and wondered what you could do to help out? What if I told you about an opportunity to help us, and also hundreds of other #OSS projects that you probably rely on? The #OSUOSL is our primary package host and helped us get off the ground right from the start. They are in critical need of funding and without your help, they may cease to exist. See this blog post for more information and go talk to your boss today! #OSS #Puppet @puppet osuosl.org/blog/osl-future/

osuosl.orgHosted Projects | OSU Open Source LabA nonprofit organization working for the advancement of open source technologies.
Public
Edd

Having rebuilt and recommissioned my #HomeLab CA recently (which runs Smallstep's `step-ca`, as both a regular CA, and a CA for generating SSH certs for all my servers and clients). I decided to write a quick blog post on how I'd automated SSH cert issuance with #Puppet - something I glossed over in the post I wrote the first time I set this up - and what steps were needed on the various appliances I can't control with Puppet.

I dedicated a few hours on Sunday to writing it up, and at the end of that it was all ready to go slightly quicker than I expected...

...Then I decided as one last add-in for the post to try and make it work with my QNAP for completion. A machine I SSH to maaaaaaybe one a year.

Two days of swearing later, I have gotten it working (maybe. I'm still very unsure if it'll persist through a firmware update). This stupid plan to throw in one more minor service has cost me more time than the rest of the blog post combined, which feels very stupid, but I guess that's the way it goes sometimes.

Blog post will be up later this week, once I've proof read it with a clear head, and then I'm not touching certificates again for a while*.

*Or that was the plan, but I've just ordered a Raspberry Pi Pico 2, to play around with #PicoHSM, which might well end up as the key storage for another Intermediate CA somewhere in the lab.

Public
Edd

Had one of those days of problem chains today. I've rebuilt #homelab internal CA over the past two weeks, and today I wanted to do the simple task of making my #truenas scale server get it's web certificate from it over acme.

Well problem one, truenas doesn't do acme via anything other than dns challenges, which I haven't setup internal dns for yet. So (given my Truenas was still running 24.04) I decided to upgrade it to 24.10 to see if that added any functionality. The upgrade was smooth, but it once again broke my #clevis automatic unlock of my storage pool.

So then I decided to fix my unlock script to cleanly handle updates (and fixed it so that pool passwords could contain " while I was at it, because why not)

Then having fixed that, I decided I should update my blog post (i.am.eddmil.es/posts/clevis-ta) about it from last year with the new more robust script.

I then realised when I'd updated all my firewall rules last month, I'd broken ssh access from my #forgejo runner to my webserver used for auto deploy website updates, so I had to fix the #puppet that controls the firewall rules.

Finally that was all working, so I updated my truenas to 25.04, in the vain hope that would have better acme support (it doesn't, but at least it validated my clevis script updates, and was the only thing today that just worked as intended)!

Finally I hacked something hideous together using github.com/danb35/deploy-freen and acme.sh to get a certificate from my acme server and deploy it (which I could have done at the start and skipped the whole day fixing other problems)

Taking 6 hours to deploy an SSL cert wasn't quite what I had planned for my Easter Sunday, but at least I achieved it in the end. Onwards to see what chaos I can cause tomorrow...

I Am Edd Miles · Clevis and Tang with Truenas Scale
More from Edd
SearchLive feeds
About