Blog on Wael Nasreddine

Configure Tailscale DNS on Qubes OS

Thu, 14 Nov 2024 00:00:00 +0000

This post goes over configuring Tailscale DNS to support DNS resolution from other AppVMs using the Tailscale VM.

This guide assumes you already have Tailscale configured in a TemplateVM and a sys-tailscale AppVM is running Tailscaled for other AppVMs to use. If you don't have Tailscale already configured, then please head over to taradiddles' excellent guide over on the Qubes forum.

We need to do the following on the TemplateVM to get it all configured:

Why I Use NixOS

Sun, 24 Mar 2019 00:00:00 +0000

This post highlights my reasoning behind switching to NixOS.

This was originally posted as a Reddit comment.

Linux/Unix History Link to heading

Please head over to read all about my Linux/Unix History. In a Gist: I have about 20 years experience in using and managing Linux and Unix machines ranging from various Linux distributions, as well as *BSD and by extension Darwin (a.k.a Mac).

Why did I switch to NixOS? Link to heading

Last year -- 2018 -- I was still working as a co-founder of a small Ad-related startup. I used to have crazy long days (averaging about 12-16 hours), and I used to do about ten different things (in parallel). The reliability of my machine to say the least is of utmost importance as my day (and thus my productivity) depends on it. One day early May of last year, I wanted to install a new Vim plugin (can't remember the exact plugin) and I inadvertently ran :PlugUpdate which updated all of my Vim plugins to the latest version and this has broken my entire Go setup. Not only I could no longer get auto-completion as I was typing, but I was also greeted with a multi-line error every time I open a Go file, attempted to edit something or save it. I had to disable most of my plugins just to get by. By the end of that day, I was very much late on my tasks and extremely frustrated, I decided to take the weekend off and look for a solution!

Announcing the new Golang infrastructure: buildGoModule

Sun, 17 Mar 2019 00:00:00 +0000

Important

This guide was written on March 17^th 2019 and thus is out of date! Please refer to Go section in the nixpkgs manual for a more up-to-date instructions!

I recently introduced a new function in Nixpkgs named buildGoModule. The new function allows you to package Go application (or modules) with ease, provided the modules have added support for Go modules upstream.

Go, starting at version 1.11, has shipped with an internal solution for vendoring dependencies named: Go Modules. This feature provides a pseudo-lockfile-based implementation for vendoring dependencies, with one guarentee: Reproducible build. This means that all the dependencies are guarenteed to be the same.

💀 How I Accidentally DDoSed My Own Kubernetes Cluster

Mon, 01 Jan 0001 00:00:00 +0000

Introduction Link to heading

For the past few weeks, my production Kubernetes cluster has been fighting a ghost. Every few days (or sometimes hours), the entire Control Plane would commit suicide. Critical components like the scheduler and controller manager would crash simultaneously, claiming they had "lost leadership."

Usually, this happens when the network fails. But my network was fine. The nodes were up. The CPUs were idling.

🔒Locking Down Mastodon: Cilium Network Policies & Audit Mode

Mon, 01 Jan 0001 00:00:00 +0000

The Goal: Defense in Depth Link to heading

Running Mastodon on my bare metal cluster exposes it to the wider internet for federation. If the Mastodon container were ever compromised (RCE, supply chain attack, etc.), I need to ensure the attacker cannot use it as a jumpbox to scan my internal home lab network or access sensitive data stores (Postgres/Redis) indiscriminately.

The objective was to implement a Zero Trust model using Cilium Network Policies (CNP):

🚨Alerting on Kyverno Policy Validation Failures with Loki

Mon, 01 Jan 0001 00:00:00 +0000

Context Link to heading

We needed to create an alert for Kyverno policy violations across our clusters. The goal was to catch when a resource fails validation (e.g., policy="require-requests-limits") and surface relevant metadata like the resource name, kind, and target namespace directly in the alert.

The Data Link to heading

Kyverno logs validation failures to stderr in JSON format. Below is a trimmed example of the relevant fields we extract:

Arista - Add SSH key to a user

Mon, 01 Jan 0001 00:00:00 +0000

Metric	Value
Total Files (NARs)	60,784
Original Compressed Size	161.06 GB
Post-Deduplication Size	125.46 GB
Net Space Saved	35.60 GB (22.1%)
Unique Chunks Stored	3,934,658
Deduplication Hit Rate	47.72%

Blog on Wael Nasreddine

Configure Tailscale DNS on Qubes OS

Why I Use NixOS

Linux/Unix History Link to heading

Why did I switch to NixOS? Link to heading

Announcing the new Golang infrastructure: buildGoModule

💀 How I Accidentally DDoSed My Own Kubernetes Cluster

Introduction Link to heading

🔒Locking Down Mastodon: Cilium Network Policies & Audit Mode

The Goal: Defense in Depth Link to heading

🚨Alerting on Kyverno Policy Validation Failures with Loki

Context Link to heading

The Data Link to heading

Arista - Add SSH key to a user

Arista - Add SSH key to a user Link to heading

Problem Link to heading

Solution Link to heading

Template Link to heading

Example Link to heading

Related Link to heading

Arista - Check Fan Speed

Arista - Check Fan Speed Link to heading

Problem Link to heading

Solution Link to heading

Example Link to heading

Related Link to heading

Arista - Configure Terminal

Arista - Configure Terminal Link to heading

Problem Link to heading

Solution Link to heading

Related Link to heading

Arista - Control Fan Speed

Arista - Control Fan Speed Link to heading

Problem Link to heading

Solution Link to heading

Arista - Create a new user

Arista - Create a new user Link to heading

Problem Link to heading

Solution Link to heading

Template Link to heading

Examples Link to heading

Example with a password Link to heading

Example without a password Link to heading

Related Link to heading

Arista - Custom Fan Speed Controller

Arista - Custom Fan Speed Controller Link to heading

Problem Link to heading

Solution Link to heading

Arista - Download Firmware - DCS-7050T

Problem Link to heading

Solution Link to heading

Related Link to heading

Arista - Set the admin password

Arista - Set the admin password Link to heading

Proble Link to heading

Solution Link to heading

Related Link to heading

Arista - Update The Firmware

Arista - Update The Firmware Link to heading

Problem Link to heading

Solution Link to heading

Related Link to heading

Automation

CDC: Why Decompression is Worth the Complexity

Cilium Network Policies

Cloudflare Tunnel - Troubleshooting - Cannot determine default origin certificate path

Cloudflare Tunnel - Troubleshooting - Cannot determine default origin certificate path Link to heading

Problem Link to heading

Analysis Link to heading

Cloudflare Tunnel for Kubernetes

Cloudflare Tunnel for Kubernetes Link to heading

Problem Link to heading

Content-Defined Chunking (CDC) Results for NAR Storage

Summary Statistics Link to heading

Database Insights Link to heading

Disaster Recovery: Talos etcd Corruption & Kyverno CNI Deadlock

Incident Summary: Talos Control Plane & CNI Deadlock Link to heading

Overview Link to heading

enable_audit.sh

FortiGate - Export certificate with private key