UVOO Tech Wiki - User contributions [en]

Skills urls

2026-09-28T03:25:16Z

Busk: Created page with "https://github.com/github/awesome-copilot/blob/main/agents/oracle-to-postgres-migration-expert.agent.md?plain=1 https://github.com/github/awesome-copilot/blob/main/plugins/or..."

https://github.com/github/awesome-copilot/blob/main/agents/oracle-to-postgres-migration-expert.agent.md?plain=1

https://github.com/github/awesome-copilot/blob/main/plugins/oracle-to-postgres-migration-expert/README.md

2fa ssh

2026-09-16T12:41:41Z

Busk:

# Using 2FA

Require OTP via Google Authenticator App

publickey,keyboard-interactive (and - requires both)

publickey keyboard-interactive (or - requires one or the other)

## Ubuntu 26.04

Prep user

```
adduser myuser --disabled-password
# usermod -aG sudo myuser
visudo # myuser ALL=(ALL:ALL) NOPASSWD: ALL
sudo su - myuser
mkdir .ssh
nano .ssh/authorized_keys # paste public ssh key
```

Update SSHD to require both SSH ID and then OTP

```
#!/usr/bin/env bash
set -e

sudo apt update
sudo apt install -y libpam-google-authenticator

# Run as the login user, NOT root/sudo — generates ~/.google_authenticator
google-authenticator

# Insert BEFORE @include common-auth if you want pubkey+OTP only, no password.
# As a quick check, comment out the password-based auth line so PAM only asks for the OTP:
sudo sed -i 's/^@include common-auth/#&/' /etc/pam.d/sshd
sudo sed -i '1 i\auth required pam_google_authenticator.so' /etc/pam.d/sshd

sudo tee /etc/ssh/sshd_config.d/60-mfa.conf > /dev/null <<'EOF'
KbdInteractiveAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive
EOF

sudo systemctl restart ssh
```

# KeyCloak realm

setup-authd-keycloak.sh

```
#!/usr/bin/env bash
# setup-authd-keycloak.sh
#
# Idempotent Ubuntu 26.04 Server bootstrap for Canonical authd + generic OIDC
# broker (authd-oidc), intended for Keycloak device authorization.
#
# Default SSH policy for OIDC users:
# - SSH password authentication: disabled
# - SSH public-key authentication: disabled for the OIDC suffix
# - PAM keyboard-interactive/authd: required
#
# This ensures OIDC users cannot bypass authd/Keycloak with an SSH key.
#
# IMPORTANT:
# Keycloak OTP/WebAuthn policy is configured in Keycloak, not by this script.
# Configure the Keycloak client/authentication flow to require the desired MFA.

set -Eeuo pipefail
IFS=$'\n\t'

PROGRAM="${0##*/}"

ISSUER=""
CLIENT_ID=""
SSH_SUFFIX=""
ALLOWED_USERS=""
CLIENT_SECRET=""
EXTRA_SCOPES="offline_access"
FORCE_PROVIDER_AUTHENTICATION="true"
HOME_BASE_DIR="/home"
EXTRA_GROUPS=""
SSH_POLICY="authd-only"
BROKER_CHANNEL="0.x/stable"
SKIP_OIDC_CHECK="false"

BROKER_SNAP="authd-oidc"
BROKER_CONF=""
BROKER_DATA_DIR=""
BROKER_DISCOVERY_SRC="/snap/authd-oidc/current/conf/authd/oidc.conf"
BROKER_DISCOVERY_DST="/etc/authd/brokers.d/oidc.conf"
SSHD_DROPIN="/etc/ssh/sshd_config.d/00-authd-oidc.conf"

usage() {
cat <<EOF
Usage:
sudo ./${PROGRAM} \\
--issuer URL \\
--client-id ID \\
--ssh-suffix @DOMAIN \\
--allowed-users USERS

Required:
--issuer URL
OIDC issuer / Keycloak realm URL.
Example: https://auth.example.com/realms/linux

--client-id ID
Keycloak OIDC client ID.
Example: ubuntu-authd

--ssh-suffix @DOMAIN
Username suffix allowed to perform first SSH authentication.
Exactly one suffix is supported by this script.
Example: @example.com

--allowed-users USERS
authd broker allowed_users value.
Examples:
ALL
OWNER
user1@example.com,user2@example.com

Optional:
--client-secret SECRET
OIDC client secret, only when your Keycloak client requires one.
Prefer a public client for device authorization when appropriate.
WARNING: a secret supplied on the command line may be visible in shell
history or process listings.

--extra-scopes SCOPES
Comma-separated additional OIDC scopes.
Default: offline_access

--force-provider-authentication true|false
Require provider/token refresh validation even for authd local-password
authentication.
Default: true

--home-base-dir DIR
Base directory for authd-created home directories.
Default: /home

--extra-groups GROUPS
Optional comma-separated local groups to assign to authd users.
Example: sudo
Default: unset

--ssh-policy POLICY
authd-only Require authd/Keycloak for OIDC users. This is the
recommended default for JIT-provisioned SSH users.
publickey+authd Require BOTH SSH public key AND authd/Keycloak.
The account/key must already be resolvable before SSH
reaches authd, so this is normally unsuitable for the
very first JIT login.
Default: authd-only

--broker-channel CHANNEL
Snap channel used when authd-oidc is first installed.
Existing installations are not automatically switched.
Default: 0.x/stable

--skip-oidc-check
Do not validate the issuer discovery document before changing config.

-h, --help
Show this help.

Example:
sudo ./${PROGRAM} \\
--issuer https://auth.uvoo.io/realms/test \\
--client-id test \\
--ssh-suffix @uvoo.io \\
--allowed-users ALL

More restrictive production example:
sudo ./${PROGRAM} \\
--issuer https://auth.uvoo.io/realms/test \\
--client-id test \\
--ssh-suffix @uvoo.io \\
--allowed-users 'test1@uvoo.io,admin1@uvoo.io'
EOF
}

die() {
printf 'ERROR: %s\n' "$*" >&2
exit 1
}

log() {
printf '==> %s\n' "$*"
}

on_error() {
local rc=$?
printf 'ERROR: command failed at line %s (exit %s)\n' "${BASH_LINENO[0]}" "$rc" >&2
exit "$rc"
}
trap on_error ERR

require_value() {
local opt="$1"
local value="${2-}"
[[ -n "$value" ]] || die "${opt} requires a value"
}

while (($#)); do
case "$1" in
--issuer)
require_value "$1" "${2-}"
ISSUER="$2"
shift 2
;;
--client-id)
require_value "$1" "${2-}"
CLIENT_ID="$2"
shift 2
;;
--ssh-suffix)
require_value "$1" "${2-}"
SSH_SUFFIX="$2"
shift 2
;;
--allowed-users)
require_value "$1" "${2-}"
ALLOWED_USERS="$2"
shift 2
;;
--client-secret)
require_value "$1" "${2-}"
CLIENT_SECRET="$2"
shift 2
;;
--extra-scopes)
require_value "$1" "${2-}"
EXTRA_SCOPES="$2"
shift 2
;;
--force-provider-authentication)
require_value "$1" "${2-}"
FORCE_PROVIDER_AUTHENTICATION="$2"
shift 2
;;
--home-base-dir)
require_value "$1" "${2-}"
HOME_BASE_DIR="$2"
shift 2
;;
--extra-groups)
require_value "$1" "${2-}"
EXTRA_GROUPS="$2"
shift 2
;;
--ssh-policy)
require_value "$1" "${2-}"
SSH_POLICY="$2"
shift 2
;;
--broker-channel)
require_value "$1" "${2-}"
BROKER_CHANNEL="$2"
shift 2
;;
--skip-oidc-check)
SKIP_OIDC_CHECK="true"
shift
;;
-h|--help)
usage
exit 0
;;
*)
die "unknown argument: $1 (use --help)"
;;
esac
done

[[ -n "$ISSUER" ]] || die "--issuer is required"
[[ -n "$CLIENT_ID" ]] || die "--client-id is required"
[[ -n "$SSH_SUFFIX" ]] || die "--ssh-suffix is required"
[[ -n "$ALLOWED_USERS" ]] || die "--allowed-users is required"

[[ "$ISSUER" == https://* ]] || die "--issuer must use https://"
ISSUER="${ISSUER%/}"

[[ "$SSH_SUFFIX" == @* ]] || die "--ssh-suffix must begin with '@'"
[[ "$SSH_SUFFIX" != *","* ]] || die "--ssh-suffix accepts exactly one suffix"
[[ "$SSH_SUFFIX" != *[[:space:]]* ]] || die "--ssh-suffix must not contain whitespace"

case "$FORCE_PROVIDER_AUTHENTICATION" in
true|false) ;;
*) die "--force-provider-authentication must be true or false" ;;
esac

case "$SSH_POLICY" in
authd-only|publickey+authd) ;;
*) die "--ssh-policy must be authd-only or publickey+authd" ;;
esac

for value_name in ISSUER CLIENT_ID SSH_SUFFIX ALLOWED_USERS CLIENT_SECRET EXTRA_SCOPES HOME_BASE_DIR EXTRA_GROUPS; do
value="${!value_name}"
[[ "$value" != *$'\n'* && "$value" != *$'\r'* ]] \
|| die "${value_name} must not contain newlines"
done

if [[ $EUID -ne 0 ]]; then
die "run this script as root, e.g. sudo ./${PROGRAM} ..."
fi

[[ -r /etc/os-release ]] || die "cannot read /etc/os-release"
# shellcheck disable=SC1091
source /etc/os-release
[[ "${ID:-}" == "ubuntu" ]] || die "this script supports Ubuntu only"
[[ "${VERSION_ID:-}" == "26.04" ]] \
|| die "this script is intentionally limited to Ubuntu 26.04; found ${VERSION_ID:-unknown}"

export DEBIAN_FRONTEND=noninteractive

install_packages() {
local required=(
authd
openssh-server
snapd
curl
ca-certificates
python3
cracklib-runtime
wamerican
)
local missing=()
local pkg

for pkg in "${required[@]}"; do
if ! dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -qx 'install ok installed'; then
missing+=("$pkg")
fi
done

if ((${#missing[@]})); then
log "Installing required packages: ${missing[*]}"
apt-get update
apt-get install -y --no-install-recommends "${missing[@]}"
else
log "Required Debian packages already installed"
fi

systemctl enable --now snapd.socket >/dev/null
# authd may be socket/D-Bus activated depending on package version; start it
# without assuming the unit has an [Install] section.
systemctl start authd
systemctl enable --now ssh >/dev/null
}

install_broker() {
if snap list "$BROKER_SNAP" >/dev/null 2>&1; then
log "$BROKER_SNAP is already installed; leaving its current snap channel/revision unchanged"
snap list "$BROKER_SNAP"
else
log "Installing $BROKER_SNAP from channel $BROKER_CHANNEL"
snap install "$BROKER_SNAP" --channel="$BROKER_CHANNEL"
fi

# Resolve the active snap revision explicitly. The service wrapper uses the
# revision-specific SNAP_DATA path (for example /var/snap/authd-oidc/89).
local revision
revision="$(snap list "$BROKER_SNAP" | awk 'NR==2 {print $3}')"
[[ "$revision" =~ ^[0-9]+$ ]] || die "could not determine active $BROKER_SNAP revision"

BROKER_DATA_DIR="/var/snap/${BROKER_SNAP}/${revision}"
BROKER_CONF="${BROKER_DATA_DIR}/broker.conf"

[[ -f "$BROKER_CONF" ]] \
|| die "broker configuration was not created at $BROKER_CONF"
[[ -f "$BROKER_DISCOVERY_SRC" ]] \
|| die "broker discovery file not found at $BROKER_DISCOVERY_SRC"

log "Active broker revision: $revision"
log "Active broker config: $BROKER_CONF"
}

validate_oidc() {
[[ "$SKIP_OIDC_CHECK" == "true" ]] && {
log "Skipping OIDC discovery validation"
return
}

local discovery="${ISSUER}/.well-known/openid-configuration"
local tmp
tmp="$(mktemp)"
trap 'rm -f "$tmp"' RETURN

log "Validating OIDC discovery document: $discovery"
curl --fail --silent --show-error --location \
--connect-timeout 5 --max-time 15 \
"$discovery" -o "$tmp"

python3 - "$tmp" "$ISSUER" <<'PY'
import json
import sys

path, expected_issuer = sys.argv[1], sys.argv[2]
with open(path, encoding="utf-8") as f:
d = json.load(f)

actual_issuer = str(d.get("issuer", "")).rstrip("/")
if actual_issuer != expected_issuer.rstrip("/"):
raise SystemExit(
f"OIDC discovery issuer mismatch: expected {expected_issuer!r}, got {actual_issuer!r}"
)

device_ep = d.get("device_authorization_endpoint")
if not device_ep:
raise SystemExit(
"OIDC provider does not advertise device_authorization_endpoint; "
"authd Device Authentication will not work."
)

print(f"OIDC issuer OK: {actual_issuer}")
print(f"Device authorization endpoint: {device_ep}")
PY

rm -f "$tmp"
trap - RETURN
}

install_if_changed() {
local source="$1"
local destination="$2"
local mode="$3"

if [[ -f "$destination" ]] && cmp -s "$source" "$destination"; then
return 1
fi

install -D -m "$mode" "$source" "$destination"
return 0
}

validate_broker_files_no_placeholders() {
local bad=0
local f

# authd-oidc 0.4.1 rejects any parsed config value containing both '<' and '>'.
# Scan the active main file and all drop-ins before attempting a restart.
if grep -nE '<[^>]+>' "$BROKER_CONF" >/dev/null 2>&1; then
printf 'ERROR: unresolved template placeholder(s) in %s:\n' "$BROKER_CONF" >&2
grep -nE '<[^>]+>' "$BROKER_CONF" >&2 || true
bad=1
fi

if [[ -d "${BROKER_CONF}.d" ]]; then
while IFS= read -r -d '' f; do
if grep -nE '<[^>]+>' "$f" >/dev/null 2>&1; then
printf 'ERROR: unresolved template placeholder(s) in drop-in %s:\n' "$f" >&2
grep -nE '<[^>]+>' "$f" >&2 || true
bad=1
fi
done < <(find "${BROKER_CONF}.d" -maxdepth 1 -type f -print0)
fi

(( bad == 0 )) || die "authd-oidc configuration contains unresolved <...> placeholders"
}

configure_broker_discovery() {
mkdir -p /etc/authd/brokers.d

if install_if_changed "$BROKER_DISCOVERY_SRC" "$BROKER_DISCOVERY_DST" 0644; then
log "Updated authd broker discovery: $BROKER_DISCOVERY_DST"
AUTHD_CHANGED=true
else
log "authd broker discovery already correct"
fi
}

configure_broker() {
local tmp
tmp="$(mktemp)"
trap 'rm -f "$tmp"' RETURN

{
printf '[oidc]\n'
printf 'issuer = %s\n' "$ISSUER"
printf 'client_id = %s\n' "$CLIENT_ID"

if [[ -n "$CLIENT_SECRET" ]]; then
printf 'client_secret = %s\n' "$CLIENT_SECRET"
fi

if [[ -n "$EXTRA_SCOPES" ]]; then
printf 'extra_scopes = %s\n' "$EXTRA_SCOPES"
fi

printf 'force_provider_authentication = %s\n' "$FORCE_PROVIDER_AUTHENTICATION"
printf '\n'
printf '[users]\n'
printf 'ssh_allowed_suffixes_first_auth = %s\n' "$SSH_SUFFIX"
printf 'allowed_users = %s\n' "$ALLOWED_USERS"
printf 'home_base_dir = %s\n' "$HOME_BASE_DIR"

if [[ -n "$EXTRA_GROUPS" ]]; then
printf 'extra_groups = %s\n' "$EXTRA_GROUPS"
fi
} >"$tmp"

# Preserve the snap-provided/generated file the first time we take control.
if [[ -f "$BROKER_CONF" && ! -e "${BROKER_CONF}.pre-${PROGRAM}" ]]; then
cp -a "$BROKER_CONF" "${BROKER_CONF}.pre-${PROGRAM}"
log "Saved original broker config as ${BROKER_CONF}.pre-${PROGRAM}"
fi

if install_if_changed "$tmp" "$BROKER_CONF" 0600; then
log "Updated broker configuration: $BROKER_CONF"
BROKER_CHANGED=true
else
log "Broker configuration already correct"
fi

rm -f "$tmp"
trap - RETURN

validate_broker_files_no_placeholders
}

configure_sshd() {
local tmp
tmp="$(mktemp)"
trap 'rm -f "$tmp"' RETURN

cat >"$tmp" <<EOF
# Managed by ${PROGRAM}
#
# Local/break-glass Unix accounts may still use SSH public keys.
# OIDC users matching ${SSH_SUFFIX} are forced through authd/PAM.

UsePAM yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

Match User *${SSH_SUFFIX}
PasswordAuthentication no
KbdInteractiveAuthentication yes
EOF

case "$SSH_POLICY" in
authd-only)
cat >>"$tmp" <<'EOF'
PubkeyAuthentication no
AuthenticationMethods keyboard-interactive:pam
EOF
;;
publickey+authd)
cat >>"$tmp" <<'EOF'
PubkeyAuthentication yes
AuthenticationMethods publickey,keyboard-interactive:pam
EOF
;;
esac

if install_if_changed "$tmp" "$SSHD_DROPIN" 0644; then
log "Updated SSH configuration: $SSHD_DROPIN"
SSH_CHANGED=true
else
log "SSH configuration already correct"
fi

rm -f "$tmp"
trap - RETURN

log "Validating sshd configuration"
sshd -t
}

restart_if_needed() {
if [[ "$AUTHD_CHANGED" == "true" ]]; then
log "Restarting authd"
systemctl restart authd
fi

if [[ "$BROKER_CHANGED" == "true" || "$AUTHD_CHANGED" == "true" ]]; then
log "Restarting authd-oidc broker"
if ! snap restart authd-oidc >/dev/null; then
printf 'ERROR: authd-oidc failed to restart. Recent broker log:\n' >&2
journalctl -u snap.authd-oidc.authd-oidc.service -b -n 60 --no-pager >&2 || true

if [[ -f "${BROKER_CONF}.pre-${PROGRAM}" ]]; then
printf 'ERROR: restoring previous broker configuration and retrying service start\n' >&2
cp -a "${BROKER_CONF}.pre-${PROGRAM}" "$BROKER_CONF"
systemctl reset-failed snap.authd-oidc.authd-oidc.service || true
snap restart authd-oidc >/dev/null || true
fi
die "authd-oidc broker restart failed; previous config was restored when available"
fi
fi

if [[ "$SSH_CHANGED" == "true" ]]; then
log "Restarting SSH"
systemctl restart ssh
fi
}

show_effective_config() {
local probe_user="authd-probe${SSH_SUFFIX}"

log "Service status"
systemctl is-active --quiet authd && echo "authd: active"
snap services authd-oidc
systemctl is-active --quiet ssh && echo "ssh: active"

log "Effective SSH authentication settings for ${probe_user}"
sshd -T -C "user=${probe_user},host=localhost,addr=127.0.0.1" 2>/dev/null \
| grep -E '^(usepam|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|authenticationmethods) ' \
|| true

log "Installed versions"
dpkg-query -W -f='authd: ${Version}\n' authd 2>/dev/null || true
snap list authd-oidc 2>/dev/null || true

cat <<EOF

Setup complete.

OIDC issuer: ${ISSUER}
OIDC client ID: ${CLIENT_ID}
SSH suffix: ${SSH_SUFFIX}
Allowed users: ${ALLOWED_USERS}
SSH policy: ${SSH_POLICY}

Test from a SECOND terminal while keeping your current administrative
session open:

ssh 'user${SSH_SUFFIX}'@<server>

For Keycloak MFA:
Configure the Keycloak authentication flow/client so Device Authorization
requires OTP/WebAuthn. This script configures the Ubuntu side only.

EOF

if [[ "$SSH_POLICY" == "publickey+authd" ]]; then
cat <<'EOF'
NOTE:
publickey+authd requires the SSH public key to succeed before authd runs.
For a brand-new JIT user, pre-provision the account/key or use centralized
SSH certificates / AuthorizedKeysCommand. Otherwise first login can fail.

EOF
fi
}

AUTHD_CHANGED=false
BROKER_CHANGED=false
SSH_CHANGED=false

install_packages
install_broker
validate_oidc
configure_broker_discovery
configure_broker
configure_sshd
restart_if_needed
show_effective_config
```

2fa ssh

2026-09-16T12:40:49Z

Busk:

# Using 2FA

Require OTP via Google Authenticator App

publickey,keyboard-interactive (and - requires both)

publickey keyboard-interactive (or - requires one or the other)

## Ubuntu 26.04

Prep user

```
adduser myuser --disabled-password
# usermod -aG sudo myuser
visudo # myuser ALL=(ALL:ALL) NOPASSWD: ALL
sudo su - myuser
mkdir .ssh
nano .ssh/authorized_keys # paste public ssh key
```

Update SSHD to require both SSH ID and then OTP

```
#!/usr/bin/env bash
set -e

sudo apt update
sudo apt install -y libpam-google-authenticator

# Run as the login user, NOT root/sudo — generates ~/.google_authenticator
google-authenticator

# Insert BEFORE @include common-auth if you want pubkey+OTP only, no password.
# As a quick check, comment out the password-based auth line so PAM only asks for the OTP:
sudo sed -i 's/^@include common-auth/#&/' /etc/pam.d/sshd
sudo sed -i '1 i\auth required pam_google_authenticator.so' /etc/pam.d/sshd

sudo tee /etc/ssh/sshd_config.d/60-mfa.conf > /dev/null <<'EOF'
KbdInteractiveAuthentication yes
PasswordAuthentication no
AuthenticationMethods publickey,keyboard-interactive
EOF

sudo systemctl restart ssh
```

# KeyCloak realm

```
setup-authd-keycloak.sh
#!/usr/bin/env bash
# setup-authd-keycloak.sh
#
# Idempotent Ubuntu 26.04 Server bootstrap for Canonical authd + generic OIDC
# broker (authd-oidc), intended for Keycloak device authorization.
#
# Default SSH policy for OIDC users:
# - SSH password authentication: disabled
# - SSH public-key authentication: disabled for the OIDC suffix
# - PAM keyboard-interactive/authd: required
#
# This ensures OIDC users cannot bypass authd/Keycloak with an SSH key.
#
# IMPORTANT:
# Keycloak OTP/WebAuthn policy is configured in Keycloak, not by this script.
# Configure the Keycloak client/authentication flow to require the desired MFA.

set -Eeuo pipefail
IFS=$'\n\t'

PROGRAM="${0##*/}"

ISSUER=""
CLIENT_ID=""
SSH_SUFFIX=""
ALLOWED_USERS=""
CLIENT_SECRET=""
EXTRA_SCOPES="offline_access"
FORCE_PROVIDER_AUTHENTICATION="true"
HOME_BASE_DIR="/home"
EXTRA_GROUPS=""
SSH_POLICY="authd-only"
BROKER_CHANNEL="0.x/stable"
SKIP_OIDC_CHECK="false"

BROKER_SNAP="authd-oidc"
BROKER_CONF=""
BROKER_DATA_DIR=""
BROKER_DISCOVERY_SRC="/snap/authd-oidc/current/conf/authd/oidc.conf"
BROKER_DISCOVERY_DST="/etc/authd/brokers.d/oidc.conf"
SSHD_DROPIN="/etc/ssh/sshd_config.d/00-authd-oidc.conf"

usage() {
cat <<EOF
Usage:
sudo ./${PROGRAM} \\
--issuer URL \\
--client-id ID \\
--ssh-suffix @DOMAIN \\
--allowed-users USERS

Required:
--issuer URL
OIDC issuer / Keycloak realm URL.
Example: https://auth.example.com/realms/linux

--client-id ID
Keycloak OIDC client ID.
Example: ubuntu-authd

--ssh-suffix @DOMAIN
Username suffix allowed to perform first SSH authentication.
Exactly one suffix is supported by this script.
Example: @example.com

--allowed-users USERS
authd broker allowed_users value.
Examples:
ALL
OWNER
user1@example.com,user2@example.com

Optional:
--client-secret SECRET
OIDC client secret, only when your Keycloak client requires one.
Prefer a public client for device authorization when appropriate.
WARNING: a secret supplied on the command line may be visible in shell
history or process listings.

--extra-scopes SCOPES
Comma-separated additional OIDC scopes.
Default: offline_access

--force-provider-authentication true|false
Require provider/token refresh validation even for authd local-password
authentication.
Default: true

--home-base-dir DIR
Base directory for authd-created home directories.
Default: /home

--extra-groups GROUPS
Optional comma-separated local groups to assign to authd users.
Example: sudo
Default: unset

--ssh-policy POLICY
authd-only Require authd/Keycloak for OIDC users. This is the
recommended default for JIT-provisioned SSH users.
publickey+authd Require BOTH SSH public key AND authd/Keycloak.
The account/key must already be resolvable before SSH
reaches authd, so this is normally unsuitable for the
very first JIT login.
Default: authd-only

--broker-channel CHANNEL
Snap channel used when authd-oidc is first installed.
Existing installations are not automatically switched.
Default: 0.x/stable

--skip-oidc-check
Do not validate the issuer discovery document before changing config.

-h, --help
Show this help.

Example:
sudo ./${PROGRAM} \\
--issuer https://auth.uvoo.io/realms/test \\
--client-id test \\
--ssh-suffix @uvoo.io \\
--allowed-users ALL

More restrictive production example:
sudo ./${PROGRAM} \\
--issuer https://auth.uvoo.io/realms/test \\
--client-id test \\
--ssh-suffix @uvoo.io \\
--allowed-users 'test1@uvoo.io,admin1@uvoo.io'
EOF
}

die() {
printf 'ERROR: %s\n' "$*" >&2
exit 1
}

log() {
printf '==> %s\n' "$*"
}

on_error() {
local rc=$?
printf 'ERROR: command failed at line %s (exit %s)\n' "${BASH_LINENO[0]}" "$rc" >&2
exit "$rc"
}
trap on_error ERR

require_value() {
local opt="$1"
local value="${2-}"
[[ -n "$value" ]] || die "${opt} requires a value"
}

while (($#)); do
case "$1" in
--issuer)
require_value "$1" "${2-}"
ISSUER="$2"
shift 2
;;
--client-id)
require_value "$1" "${2-}"
CLIENT_ID="$2"
shift 2
;;
--ssh-suffix)
require_value "$1" "${2-}"
SSH_SUFFIX="$2"
shift 2
;;
--allowed-users)
require_value "$1" "${2-}"
ALLOWED_USERS="$2"
shift 2
;;
--client-secret)
require_value "$1" "${2-}"
CLIENT_SECRET="$2"
shift 2
;;
--extra-scopes)
require_value "$1" "${2-}"
EXTRA_SCOPES="$2"
shift 2
;;
--force-provider-authentication)
require_value "$1" "${2-}"
FORCE_PROVIDER_AUTHENTICATION="$2"
shift 2
;;
--home-base-dir)
require_value "$1" "${2-}"
HOME_BASE_DIR="$2"
shift 2
;;
--extra-groups)
require_value "$1" "${2-}"
EXTRA_GROUPS="$2"
shift 2
;;
--ssh-policy)
require_value "$1" "${2-}"
SSH_POLICY="$2"
shift 2
;;
--broker-channel)
require_value "$1" "${2-}"
BROKER_CHANNEL="$2"
shift 2
;;
--skip-oidc-check)
SKIP_OIDC_CHECK="true"
shift
;;
-h|--help)
usage
exit 0
;;
*)
die "unknown argument: $1 (use --help)"
;;
esac
done

[[ -n "$ISSUER" ]] || die "--issuer is required"
[[ -n "$CLIENT_ID" ]] || die "--client-id is required"
[[ -n "$SSH_SUFFIX" ]] || die "--ssh-suffix is required"
[[ -n "$ALLOWED_USERS" ]] || die "--allowed-users is required"

[[ "$ISSUER" == https://* ]] || die "--issuer must use https://"
ISSUER="${ISSUER%/}"

[[ "$SSH_SUFFIX" == @* ]] || die "--ssh-suffix must begin with '@'"
[[ "$SSH_SUFFIX" != *","* ]] || die "--ssh-suffix accepts exactly one suffix"
[[ "$SSH_SUFFIX" != *[[:space:]]* ]] || die "--ssh-suffix must not contain whitespace"

case "$FORCE_PROVIDER_AUTHENTICATION" in
true|false) ;;
*) die "--force-provider-authentication must be true or false" ;;
esac

case "$SSH_POLICY" in
authd-only|publickey+authd) ;;
*) die "--ssh-policy must be authd-only or publickey+authd" ;;
esac

for value_name in ISSUER CLIENT_ID SSH_SUFFIX ALLOWED_USERS CLIENT_SECRET EXTRA_SCOPES HOME_BASE_DIR EXTRA_GROUPS; do
value="${!value_name}"
[[ "$value" != *$'\n'* && "$value" != *$'\r'* ]] \
|| die "${value_name} must not contain newlines"
done

if [[ $EUID -ne 0 ]]; then
die "run this script as root, e.g. sudo ./${PROGRAM} ..."
fi

[[ -r /etc/os-release ]] || die "cannot read /etc/os-release"
# shellcheck disable=SC1091
source /etc/os-release
[[ "${ID:-}" == "ubuntu" ]] || die "this script supports Ubuntu only"
[[ "${VERSION_ID:-}" == "26.04" ]] \
|| die "this script is intentionally limited to Ubuntu 26.04; found ${VERSION_ID:-unknown}"

export DEBIAN_FRONTEND=noninteractive

install_packages() {
local required=(
authd
openssh-server
snapd
curl
ca-certificates
python3
cracklib-runtime
wamerican
)
local missing=()
local pkg

for pkg in "${required[@]}"; do
if ! dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null | grep -qx 'install ok installed'; then
missing+=("$pkg")
fi
done

if ((${#missing[@]})); then
log "Installing required packages: ${missing[*]}"
apt-get update
apt-get install -y --no-install-recommends "${missing[@]}"
else
log "Required Debian packages already installed"
fi

systemctl enable --now snapd.socket >/dev/null
# authd may be socket/D-Bus activated depending on package version; start it
# without assuming the unit has an [Install] section.
systemctl start authd
systemctl enable --now ssh >/dev/null
}

install_broker() {
if snap list "$BROKER_SNAP" >/dev/null 2>&1; then
log "$BROKER_SNAP is already installed; leaving its current snap channel/revision unchanged"
snap list "$BROKER_SNAP"
else
log "Installing $BROKER_SNAP from channel $BROKER_CHANNEL"
snap install "$BROKER_SNAP" --channel="$BROKER_CHANNEL"
fi

# Resolve the active snap revision explicitly. The service wrapper uses the
# revision-specific SNAP_DATA path (for example /var/snap/authd-oidc/89).
local revision
revision="$(snap list "$BROKER_SNAP" | awk 'NR==2 {print $3}')"
[[ "$revision" =~ ^[0-9]+$ ]] || die "could not determine active $BROKER_SNAP revision"

BROKER_DATA_DIR="/var/snap/${BROKER_SNAP}/${revision}"
BROKER_CONF="${BROKER_DATA_DIR}/broker.conf"

[[ -f "$BROKER_CONF" ]] \
|| die "broker configuration was not created at $BROKER_CONF"
[[ -f "$BROKER_DISCOVERY_SRC" ]] \
|| die "broker discovery file not found at $BROKER_DISCOVERY_SRC"

log "Active broker revision: $revision"
log "Active broker config: $BROKER_CONF"
}

validate_oidc() {
[[ "$SKIP_OIDC_CHECK" == "true" ]] && {
log "Skipping OIDC discovery validation"
return
}

local discovery="${ISSUER}/.well-known/openid-configuration"
local tmp
tmp="$(mktemp)"
trap 'rm -f "$tmp"' RETURN

log "Validating OIDC discovery document: $discovery"
curl --fail --silent --show-error --location \
--connect-timeout 5 --max-time 15 \
"$discovery" -o "$tmp"

python3 - "$tmp" "$ISSUER" <<'PY'
import json
import sys

path, expected_issuer = sys.argv[1], sys.argv[2]
with open(path, encoding="utf-8") as f:
d = json.load(f)

actual_issuer = str(d.get("issuer", "")).rstrip("/")
if actual_issuer != expected_issuer.rstrip("/"):
raise SystemExit(
f"OIDC discovery issuer mismatch: expected {expected_issuer!r}, got {actual_issuer!r}"
)

device_ep = d.get("device_authorization_endpoint")
if not device_ep:
raise SystemExit(
"OIDC provider does not advertise device_authorization_endpoint; "
"authd Device Authentication will not work."
)

print(f"OIDC issuer OK: {actual_issuer}")
print(f"Device authorization endpoint: {device_ep}")
PY

rm -f "$tmp"
trap - RETURN
}

install_if_changed() {
local source="$1"
local destination="$2"
local mode="$3"

if [[ -f "$destination" ]] && cmp -s "$source" "$destination"; then
return 1
fi

install -D -m "$mode" "$source" "$destination"
return 0
}

validate_broker_files_no_placeholders() {
local bad=0
local f

# authd-oidc 0.4.1 rejects any parsed config value containing both '<' and '>'.
# Scan the active main file and all drop-ins before attempting a restart.
if grep -nE '<[^>]+>' "$BROKER_CONF" >/dev/null 2>&1; then
printf 'ERROR: unresolved template placeholder(s) in %s:\n' "$BROKER_CONF" >&2
grep -nE '<[^>]+>' "$BROKER_CONF" >&2 || true
bad=1
fi

if [[ -d "${BROKER_CONF}.d" ]]; then
while IFS= read -r -d '' f; do
if grep -nE '<[^>]+>' "$f" >/dev/null 2>&1; then
printf 'ERROR: unresolved template placeholder(s) in drop-in %s:\n' "$f" >&2
grep -nE '<[^>]+>' "$f" >&2 || true
bad=1
fi
done < <(find "${BROKER_CONF}.d" -maxdepth 1 -type f -print0)
fi

(( bad == 0 )) || die "authd-oidc configuration contains unresolved <...> placeholders"
}

configure_broker_discovery() {
mkdir -p /etc/authd/brokers.d

if install_if_changed "$BROKER_DISCOVERY_SRC" "$BROKER_DISCOVERY_DST" 0644; then
log "Updated authd broker discovery: $BROKER_DISCOVERY_DST"
AUTHD_CHANGED=true
else
log "authd broker discovery already correct"
fi
}

configure_broker() {
local tmp
tmp="$(mktemp)"
trap 'rm -f "$tmp"' RETURN

{
printf '[oidc]\n'
printf 'issuer = %s\n' "$ISSUER"
printf 'client_id = %s\n' "$CLIENT_ID"

if [[ -n "$CLIENT_SECRET" ]]; then
printf 'client_secret = %s\n' "$CLIENT_SECRET"
fi

if [[ -n "$EXTRA_SCOPES" ]]; then
printf 'extra_scopes = %s\n' "$EXTRA_SCOPES"
fi

printf 'force_provider_authentication = %s\n' "$FORCE_PROVIDER_AUTHENTICATION"
printf '\n'
printf '[users]\n'
printf 'ssh_allowed_suffixes_first_auth = %s\n' "$SSH_SUFFIX"
printf 'allowed_users = %s\n' "$ALLOWED_USERS"
printf 'home_base_dir = %s\n' "$HOME_BASE_DIR"

if [[ -n "$EXTRA_GROUPS" ]]; then
printf 'extra_groups = %s\n' "$EXTRA_GROUPS"
fi
} >"$tmp"

# Preserve the snap-provided/generated file the first time we take control.
if [[ -f "$BROKER_CONF" && ! -e "${BROKER_CONF}.pre-${PROGRAM}" ]]; then
cp -a "$BROKER_CONF" "${BROKER_CONF}.pre-${PROGRAM}"
log "Saved original broker config as ${BROKER_CONF}.pre-${PROGRAM}"
fi

if install_if_changed "$tmp" "$BROKER_CONF" 0600; then
log "Updated broker configuration: $BROKER_CONF"
BROKER_CHANGED=true
else
log "Broker configuration already correct"
fi

rm -f "$tmp"
trap - RETURN

validate_broker_files_no_placeholders
}

configure_sshd() {
local tmp
tmp="$(mktemp)"
trap 'rm -f "$tmp"' RETURN

cat >"$tmp" <<EOF
# Managed by ${PROGRAM}
#
# Local/break-glass Unix accounts may still use SSH public keys.
# OIDC users matching ${SSH_SUFFIX} are forced through authd/PAM.

UsePAM yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

Match User *${SSH_SUFFIX}
PasswordAuthentication no
KbdInteractiveAuthentication yes
EOF

case "$SSH_POLICY" in
authd-only)
cat >>"$tmp" <<'EOF'
PubkeyAuthentication no
AuthenticationMethods keyboard-interactive:pam
EOF
;;
publickey+authd)
cat >>"$tmp" <<'EOF'
PubkeyAuthentication yes
AuthenticationMethods publickey,keyboard-interactive:pam
EOF
;;
esac

if install_if_changed "$tmp" "$SSHD_DROPIN" 0644; then
log "Updated SSH configuration: $SSHD_DROPIN"
SSH_CHANGED=true
else
log "SSH configuration already correct"
fi

rm -f "$tmp"
trap - RETURN

log "Validating sshd configuration"
sshd -t
}

restart_if_needed() {
if [[ "$AUTHD_CHANGED" == "true" ]]; then
log "Restarting authd"
systemctl restart authd
fi

if [[ "$BROKER_CHANGED" == "true" || "$AUTHD_CHANGED" == "true" ]]; then
log "Restarting authd-oidc broker"
if ! snap restart authd-oidc >/dev/null; then
printf 'ERROR: authd-oidc failed to restart. Recent broker log:\n' >&2
journalctl -u snap.authd-oidc.authd-oidc.service -b -n 60 --no-pager >&2 || true

if [[ -f "${BROKER_CONF}.pre-${PROGRAM}" ]]; then
printf 'ERROR: restoring previous broker configuration and retrying service start\n' >&2
cp -a "${BROKER_CONF}.pre-${PROGRAM}" "$BROKER_CONF"
systemctl reset-failed snap.authd-oidc.authd-oidc.service || true
snap restart authd-oidc >/dev/null || true
fi
die "authd-oidc broker restart failed; previous config was restored when available"
fi
fi

if [[ "$SSH_CHANGED" == "true" ]]; then
log "Restarting SSH"
systemctl restart ssh
fi
}

show_effective_config() {
local probe_user="authd-probe${SSH_SUFFIX}"

log "Service status"
systemctl is-active --quiet authd && echo "authd: active"
snap services authd-oidc
systemctl is-active --quiet ssh && echo "ssh: active"

log "Effective SSH authentication settings for ${probe_user}"
sshd -T -C "user=${probe_user},host=localhost,addr=127.0.0.1" 2>/dev/null \
| grep -E '^(usepam|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|authenticationmethods) ' \
|| true

log "Installed versions"
dpkg-query -W -f='authd: ${Version}\n' authd 2>/dev/null || true
snap list authd-oidc 2>/dev/null || true

cat <<EOF

Setup complete.

OIDC issuer: ${ISSUER}
OIDC client ID: ${CLIENT_ID}
SSH suffix: ${SSH_SUFFIX}
Allowed users: ${ALLOWED_USERS}
SSH policy: ${SSH_POLICY}

Test from a SECOND terminal while keeping your current administrative
session open:

ssh 'user${SSH_SUFFIX}'@<server>

For Keycloak MFA:
Configure the Keycloak authentication flow/client so Device Authorization
requires OTP/WebAuthn. This script configures the Ubuntu side only.

EOF

if [[ "$SSH_POLICY" == "publickey+authd" ]]; then
cat <<'EOF'
NOTE:
publickey+authd requires the SSH public key to succeed before authd runs.
For a brand-new JIT user, pre-provision the account/key or use centralized
SSH certificates / AuthorizedKeysCommand. Otherwise first login can fail.

EOF
fi
}

AUTHD_CHANGED=false
BROKER_CHANGED=false
SSH_CHANGED=false

install_packages
install_broker
validate_oidc
configure_broker_discovery
configure_broker
configure_sshd
restart_if_needed
show_effective_config
```

2fa ssh

2026-09-15T15:16:02Z

Busk:

2fa ssh

2026-09-15T15:15:32Z

Busk:

2fa ssh

2026-09-15T15:14:08Z

Busk: Created page with "# Using 2FA Require OTP via Google Authenticator App publickey,keyboard-interactive (and - requires both) publickey keyboard-interactive (or - requires one or the other) #..."

CKS exam prep

2026-09-15T10:05:03Z

Busk: Created page with "https://tech-insider.org/kubernetes-security-hardening-2026/ https://github.com/mikonoid/CKS-exam-cheat-sheets/blob/main/system_hardering/os_footprint.md"

https://tech-insider.org/kubernetes-security-hardening-2026/

https://github.com/mikonoid/CKS-exam-cheat-sheets/blob/main/system_hardering/os_footprint.md

Windows 11 prep

2026-09-14T19:00:56Z

Busk:

## Windows 11 Prep

## Common Basic Apps

```
winget install -e --id Google.GoogleDrive
winget install SlackTechnologies.Slack --source winget
winget install -e --id Zoom.Zoom --source winget
winget install Google.Chrome --source winget
winget install Bitwarden.Bitwarden --source winget
winget update
winget update --all
```

## SSH
```
ssh-keygen
cat .\.ssh\id_ed25519.pub
```

## AI CLI
```
curl -fsSL https://antigravity.google/cli/install.sh | bash
curl -fsSL https://gh.io/copilot-install | bash
curl -fsSL https://claude.ai/install.sh | bash
curl -fsSL https://chatgpt.com/codex/install.sh | sh
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
```
run codex in powershell once as admin to setup sandbox as it needs elevated privileges.

## Useful Scripts

stay-awake.ps1
```
$shell = New-Object -ComObject WScript.Shell
while ($true) {
$shell.SendKeys("{F15}")
Start-Sleep -Seconds 120
}
# Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
# Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
```

## More winget apps

```
winget install -e --id CrystalDewWorld.CrystalDiskInfo
```

## And even more apps if really wanted

```
https://www.resplendence.com/whysoslow
```

Windows 11 prep

2026-09-14T18:58:57Z

Busk: Created page with "## Windows 11 Prep ## Common Basic Apps ``` winget install -e --id Google.GoogleDrive winget install SlackTechnologies.Slack --source winget winget install -e --id Zoom.Zoom..."

## Windows 11 Prep

## Common Basic Apps

```
winget install -e --id Google.GoogleDrive
winget install SlackTechnologies.Slack --source winget
winget install -e --id Zoom.Zoom --source winget
winget install Google.Chrome --source winget
winget install Bitwarden.Bitwarden --source winget
winget update
winget update --all
```

## SSH
```
ssh-keygen
cat .\.ssh\id_ed25519.pub
```

## AI CLI
```
curl -fsSL https://antigravity.google/cli/install.sh | bash
curl -fsSL https://gh.io/copilot-install | bash
curl -fsSL https://claude.ai/install.sh | bash
curl -fsSL https://chatgpt.com/codex/install.sh | sh
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
```
run codex in powershell once as admin to setup sandbox as it needs elevated privileges.

## Useful Scripts

stay-awake.ps1
```
$shell = New-Object -ComObject WScript.Shell
while ($true) {
$shell.SendKeys("{F15}")
Start-Sleep -Seconds 120
}
# Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
# Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
```

## More winget apps
```
winget install -e --id CrystalDewWorld.CrystalDiskInfo
```

Ai cli install

2026-09-14T17:26:13Z

Busk: Created page with "``` curl -fsSL https://antigravity.google/cli/install.sh | bash curl -fsSL https://gh.io/copilot-install | bash curl -fsSL https://claude.ai/install.sh | bash curl -fsSL https..."

```
curl -fsSL https://antigravity.google/cli/install.sh | bash
curl -fsSL https://gh.io/copilot-install | bash
curl -fsSL https://claude.ai/install.sh | bash
curl -fsSL https://chatgpt.com/codex/install.sh | sh
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

```

for windows codex run once in run with administrator privledges terminal to setup sandbox via escalation then you can run in normal terminal.

Linux Windows USB Drive format

2026-09-07T22:04:35Z

Busk:

```
sudo apt update
sudo apt install exfatprogs
sudo umount /dev/sdc1
sudo wipefs -a /dev/sdc
sudo parted /dev/sdc mklabel gpt
sudo parted -a opt /dev/sdc mkpart primary 0% 100%
sudo partprobe /dev/sdc
sudo mkfs.exfat /dev/sdc1
sudo mkfs.exfat -n usb2Texfat /dev/sdc1
```

```
sudo parted /dev/sda --script mklabel gpt
sudo parted /dev/sda --script mkpart primary 1MiB 100%
sudo parted /dev/sda --script set 1 msftdata on
sudo partprobe /dev/sda
```
nvme
```
sudo parted /dev/sdc --script mklabel gpt
sudo parted /dev/sdc --script mkpart primary 65535s 100%
sudo parted /dev/sdc --script set 1 msftdata on

```

wipe if needed for existing
```
sudo umount /dev/sda*
sudo wipefs -a /dev/sda
```

force in needed
```
sudo wipefs -a -f /dev/sda
```

Linux Windows USB Drive format

2026-09-07T22:02:22Z

Busk:

```
sudo apt update
sudo apt install exfatprogs
sudo umount /dev/sdc1
sudo wipefs -a /dev/sdc
sudo parted /dev/sdc mklabel gpt
sudo parted -a opt /dev/sdc mkpart primary 0% 100%
sudo partprobe /dev/sdc
sudo mkfs.exfat /dev/sdc1
sudo mkfs.exfat -n usb1t /dev/sdc1
```

```
sudo parted /dev/sda --script mklabel gpt
sudo parted /dev/sda --script mkpart primary 1MiB 100%
sudo parted /dev/sda --script set 1 msftdata on
sudo partprobe /dev/sda
```
nvme
```
sudo parted /dev/sdc --script mklabel gpt
sudo parted /dev/sdc --script mkpart primary 65535s 100%
sudo parted /dev/sdc --script set 1 msftdata on

```

wipe if needed for existing
```
sudo umount /dev/sda*
sudo wipefs -a /dev/sda
```

force in needed
```
sudo wipefs -a -f /dev/sda
```

Linux Windows USB Drive format

2026-09-07T22:00:20Z

Busk:

```
sudo apt update
sudo apt install exfatprogs
sudo umount /dev/sdc1
sudo wipefs -a /dev/sdc
sudo parted /dev/sdc mklabel gpt
sudo parted -a opt /dev/sdc mkpart primary 0% 100%
sudo partprobe /dev/sdc
sudo mkfs.exfat /dev/sdc1
```

```
sudo parted /dev/sda --script mklabel gpt
sudo parted /dev/sda --script mkpart primary 1MiB 100%
sudo parted /dev/sda --script set 1 msftdata on
sudo partprobe /dev/sda
```
nvme
```
sudo parted /dev/sdc --script mklabel gpt
sudo parted /dev/sdc --script mkpart primary 65535s 100%
sudo parted /dev/sdc --script set 1 msftdata on

```

wipe if needed for existing
```
sudo umount /dev/sda*
sudo wipefs -a /dev/sda
```

force in needed
```
sudo wipefs -a -f /dev/sda
```

Linux Windows USB Drive format

2026-09-07T21:45:10Z

Busk:

```
sudo parted /dev/sda --script mklabel gpt
sudo parted /dev/sda --script mkpart primary 1MiB 100%
sudo parted /dev/sda --script set 1 msftdata on
sudo partprobe /dev/sda
```
nvme
```
sudo parted /dev/sdc --script mklabel gpt
sudo parted /dev/sdc --script mkpart primary 65535s 100%
sudo parted /dev/sdc --script set 1 msftdata on

```

wipe if needed for existing
```
sudo umount /dev/sda*
sudo wipefs -a /dev/sda
```

force in needed
```
sudo wipefs -a -f /dev/sda
```

Linux Windows USB Drive format

2026-09-05T19:20:38Z

Busk:

Linux Windows USB Drive format

2026-09-05T19:18:23Z

Busk: Created page with "``` sudo parted /dev/sda --script mklabel gpt sudo parted /dev/sda --script mkpart primary 1MiB 100% sudo parted /dev/sda --script set 1 msftdata on sudo partprobe /dev/sda ```"

```
sudo parted /dev/sda --script mklabel gpt
sudo parted /dev/sda --script mkpart primary 1MiB 100%
sudo parted /dev/sda --script set 1 msftdata on
sudo partprobe /dev/sda
```

Kong volcano sdk

2026-08-17T16:28:36Z

Busk:

## What Kong AI Gateway Does Automatically

* Semantic Caching: If a user asks the exact same question tomorrow, Kong serves the cached response instantly without incurring costs or hitting the LLM again.
* Prompt Guardrails: Kong blocks malicious prompt injections or sensitive company data from leaking out to the LLM providers.
* Failover: If OpenAI drops offline mid-execution, Kong can automatically route GPT requests to Azure or Anthropic without breaking your Volcano code.

## Connecting Volcano to Kong AI Gateway
Volcano SDK is designed to work seamlessly with the Kong AI Gateway (via Kong Advanced Gateway Services). By routing your agent's LLM calls through Kong, you get instant access to enterprise-grade security, request auditing, rate-limiting, and semantic caching.
Here is a conceptual example of how to connect the two and build an MCP-native workflow.
------------------------------
## Step 1: Configure the Volcano Client
Instead of hitting the LLM provider (like OpenAI or Anthropic) directly, you point the Volcano client to your Kong AI Gateway endpoint. Kong will manage your API keys, load-balancing, and security controls behind the scenes.

import { Volcano, ModelProvider } from '@kong/volcano-sdk';
// Initialize Volcano to route through your Kong AI Gatewayconst volcano = new Volcano({
baseUrl: "https://your-kong-gateway-domain.com",
apiKey: process.env.KONG_AI_GATEWAY_TOKEN, // Your Kong access token
});

------------------------------
## Step 2: Define an MCP Tool
The Model Context Protocol (MCP) lets you expose external tools and data to your agent. In this example, we define an MCP tool that connects to a internal company database to fetch shipping updates.

import { McpServer } from '@modelcontextprotocol/sdk/server';
const mcpServer = new McpServer({
name: "shipping-tracker",
version: "1.0.0"
});
// Register a tool on the MCP server
mcpServer.tool("get_shipping_status", { orderId: z.string() }, async ({ orderId }) => {
// Logic to fetch real-world data
const status = await fetchInternalDb(orderId);
return { content: [{ type: "text", text: `Order status: ${status}` }] };
});

------------------------------
## Step 3: Run the Multi-Model Workflow
Volcano allows you to chain multiple models together. In this workflow, Claude 3.5 Sonnet acts as the high-reasoning "brain" to understand the customer's request and call the MCP tool. Then, GPT-4o mini handles the cheaper, faster task of drafting a polite email response.

async function handleCustomerInquiry(userPrompt: string) {

// 1. High-reasoning model analyzes prompt and triggers the MCP tool
const agentRunner = await volcano.agents.create({
model: "kong-managed-claude-sonnet", // Configured routing inside Kong
tools: [mcpServer.getTool("get_shipping_status")],
prompt: userPrompt
});

const toolOutput = await agentRunner.execute();

// 2. Chained workflow shifts to a faster, cheaper model for drafting
const finalResponse = await volcano.chat.completion({
model: "kong-managed-gpt4o-mini", // Routed and cached by Kong
messages: [
{ role: "system", content: "You are a polite customer support agent." },
{ role: "assistant", content: `Internal tool data: ${toolOutput}` },
{ role: "user", content: "Draft an email update to the customer based on this." }
]
});

console.log(finalResponse.text);
}
// Example usage
handleCustomerInquiry("Where is my package for order #98765?");

------------------------------
## What Kong AI Gateway Does Automatically

* Semantic Caching: If a user asks the exact same question tomorrow, Kong serves the cached response instantly without incurring costs or hitting the LLM again.
* Prompt Guardrails: Kong blocks malicious prompt injections or sensitive company data from leaking out to the LLM providers.
* Failover: If OpenAI drops offline mid-execution, Kong can automatically route GPT requests to Azure or Anthropic without breaking your Volcano code.

Kong volcano sdk

2026-08-17T16:25:01Z

Busk: Created page with "What Kong AI Gateway Does AutomaticallySemantic Caching: If a user asks the exact same question tomorrow, Kong serves the cached response instantly without incurring costs or..."

What Kong AI Gateway Does AutomaticallySemantic Caching: If a user asks the exact same question tomorrow, Kong serves the cached response instantly without incurring costs or hitting the LLM again.Prompt Guardrails: Kong blocks malicious prompt injections or sensitive company data from leaking out to the LLM providers.Failover: If OpenAI drops offline mid-execution, Kong can automatically route GPT requests to Azure or Anthropic without breaking your Volcano code.Would you like to explore how to set up the semantic caching plugin inside Kong, or do you need help writing a custom MCP server for your specific database?

## Connecting Volcano to Kong AI Gateway
Volcano SDK is designed to work seamlessly with the Kong AI Gateway (via Kong Advanced Gateway Services). By routing your agent's LLM calls through Kong, you get instant access to enterprise-grade security, request auditing, rate-limiting, and semantic caching.
Here is a conceptual example of how to connect the two and build an MCP-native workflow.
------------------------------
## Step 1: Configure the Volcano Client
Instead of hitting the LLM provider (like OpenAI or Anthropic) directly, you point the Volcano client to your Kong AI Gateway endpoint. Kong will manage your API keys, load-balancing, and security controls behind the scenes.

import { Volcano, ModelProvider } from '@kong/volcano-sdk';
// Initialize Volcano to route through your Kong AI Gatewayconst volcano = new Volcano({
baseUrl: "https://your-kong-gateway-domain.com",
apiKey: process.env.KONG_AI_GATEWAY_TOKEN, // Your Kong access token
});

------------------------------
## Step 2: Define an MCP Tool
The Model Context Protocol (MCP) lets you expose external tools and data to your agent. In this example, we define an MCP tool that connects to a internal company database to fetch shipping updates.

import { McpServer } from '@modelcontextprotocol/sdk/server';
const mcpServer = new McpServer({
name: "shipping-tracker",
version: "1.0.0"
});
// Register a tool on the MCP server
mcpServer.tool("get_shipping_status", { orderId: z.string() }, async ({ orderId }) => {
// Logic to fetch real-world data
const status = await fetchInternalDb(orderId);
return { content: [{ type: "text", text: `Order status: ${status}` }] };
});

------------------------------
## Step 3: Run the Multi-Model Workflow
Volcano allows you to chain multiple models together. In this workflow, Claude 3.5 Sonnet acts as the high-reasoning "brain" to understand the customer's request and call the MCP tool. Then, GPT-4o mini handles the cheaper, faster task of drafting a polite email response.

async function handleCustomerInquiry(userPrompt: string) {

// 1. High-reasoning model analyzes prompt and triggers the MCP tool
const agentRunner = await volcano.agents.create({
model: "kong-managed-claude-sonnet", // Configured routing inside Kong
tools: [mcpServer.getTool("get_shipping_status")],
prompt: userPrompt
});

const toolOutput = await agentRunner.execute();

// 2. Chained workflow shifts to a faster, cheaper model for drafting
const finalResponse = await volcano.chat.completion({
model: "kong-managed-gpt4o-mini", // Routed and cached by Kong
messages: [
{ role: "system", content: "You are a polite customer support agent." },
{ role: "assistant", content: `Internal tool data: ${toolOutput}` },
{ role: "user", content: "Draft an email update to the customer based on this." }
]
});

console.log(finalResponse.text);
}
// Example usage
handleCustomerInquiry("Where is my package for order #98765?");

------------------------------
## What Kong AI Gateway Does Automatically

* Semantic Caching: If a user asks the exact same question tomorrow, Kong serves the cached response instantly without incurring costs or hitting the LLM again.
* Prompt Guardrails: Kong blocks malicious prompt injections or sensitive company data from leaking out to the LLM providers.
* Failover: If OpenAI drops offline mid-execution, Kong can automatically route GPT requests to Azure or Anthropic without breaking your Volcano code.

Would you like to explore how to set up the semantic caching plugin inside Kong, or do you need help writing a custom MCP server for your specific database?

Python on windows

2026-08-11T01:05:08Z

Busk: Created page with "``` winget install Python.Python.3.14 pip install pipx pipx ensurepath pipx install ipython ```"

```
winget install Python.Python.3.14

pip install pipx
pipx ensurepath
pipx install ipython
```

Kube-virt - k8s in k8s

2026-08-02T15:11:02Z

Busk: Created page with "One of the most popular and powerful use cases for KubeVirt, often referred to as **Kubernetes-in-Kubernetes** or **Tenant Clusters**. In this architecture, your underlying b..."

One of the most popular and powerful use cases for KubeVirt, often referred to as **Kubernetes-in-Kubernetes** or **Tenant Clusters**.

In this architecture, your underlying bare-metal Kubernetes cluster acts as the **infrastructure management layer** (the control plane for hardware), and KubeVirt provisions VMs that join together to form separate, isolated **tenant Kubernetes clusters**.

---

## Why Do This? (Key Benefits)

* **Multi-Tenancy & Hard Isolation:** Containers share the host kernel. If you need strict security boundaries between teams or environments (e.g., Prod vs. Dev), VMs provide hardware-level virtualization isolation.
* **Infrastructure-as-Code (GitOps):** You can manage the lifecycle of entire target Kubernetes clusters declaratively using standard `kubectl` commands or GitOps pipelines (ArgoCD/Flux).
* **Cluster API (CAPI) Integration:** Using the **Cluster API Provider KubeVirt (CAPK)**, you can declare a target Kubernetes cluster in YAML, and CAPI + KubeVirt will automatically spin up the VMs, run `cloud-init` to install Kubernetes on them, and join them into a fully functional tenant cluster.
* **Testing & Sandbox Environments:** It allows developers to spin up ephemeral, full-featured Kubernetes clusters (with custom kernel modules or CNI configurations) without needing real physical hardware.

---

## How the Architecture Looks

```
┌────────────────────────────────────────────────────────────────────────┐
│ BARE-METAL KUBERNETES CLUSTER │
│ (Management Cluster: Physical Servers + Storage + KubeVirt Operator) │
│ │
│ ┌──────────────────────────────────────────────────────────────────┐ │
│ │ TENANT KUBERNETES CLUSTER │ │
│ │ │ │
│ │ ┌────────────────────┐ ┌────────────────────┐ │ │
│ │ │ KubeVirt VM 1 │ │ KubeVirt VM 2 │ │ │
│ │ │ (Tenant Control) │ │ (Tenant Worker) │ │ │
│ │ │ │ │ │ │ │
│ │ │ ┌────────────────┐ │ Network │ ┌────────────────┐ │ │ │
│ │ │ │ Tenant K8s API │ ◄────────────────►│ Tenant Pods │ │ │ │
│ │ │ └────────────────┘ │ (Overlay/VLAN) │ └────────────────┘ │ │ │
│ │ └────────────────────┘ └────────────────────┘ │ │
│ └──────────────────────────────────────────────────────────────────┘ │
└────────────────────────────────────────────────────────────────────────┘

```

---

## Typical Workflow

1. **Deploy Bare-Metal K8s:** You set up physical servers with a Kubernetes distribution (e.g., Talos, RKE2, OpenShift, or upstream K8s).
2. **Install KubeVirt:** Deploy the KubeVirt operator on the bare-metal cluster.
3. **Use Cluster API (CAPK):** Apply a manifest defining a tenant cluster (e.g., 1 Control Plane VM, 3 Worker VMs).
4. **Bootstrapping via cloud-init:** KubeVirt boots the VMs, and `cloud-init` runs scripts (like `kubeadm join` or `k3s`) to wire the nodes into the new nested cluster.

---

## Things to Consider

* **Nested Virtualization / Overhead:** Ensure hardware-assisted virtualization (`/dev/kvm`) is available on your bare-metal nodes so KubeVirt runs near native speed.
* **Networking:** You’ll need a CNI or plugin like **Multus** or **OVN-Kubernetes** on the bare-metal cluster to assign dedicated IPs or VLANs to the VM nodes so the tenant cluster can route traffic cleanly.

Openssl

2026-08-01T22:06:24Z

Busk:

openssl s_client -connect docker2:993 -servername docker2 </dev/null 2>/dev/null | openssl x509 -noout -subject

https://www.digitalocean.com/community/tutorials/openssl-essentials-working-with-ssl-certificates-private-keys-and-csrs

https://www.openssl.org/docs/manmaster/man5/x509v3_config.html

```
openssl s_client -connect ldaps.example.com:636 -showcerts </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName
```

```
echo -n | openssl s_client -connect google.com:443 2>/dev/null | openssl x509 -noout -text | grep -E 'Subject:|X509v3 Subject Alternative Name:'
openssl s_client -connect www.uvoo.me:443
echo | openssl s_client -showcerts -servername www.uvoo.me -connect www.uvoo.me:443 2>/dev/null | openssl x509 -inform pem -noout -text
```

Quicks like get subject alt names
```
openssl x509 -text -in my.crt.pem
openssl x509 -noout -ext subjectAltName
openssl x509 -noout -dates
```

# self signed cert pem
```
fqdn=${FQDN:-autogenerated-selfsigned-cert}; openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout selfsigned.key -out selfsigned.crt -subj "/CN=$fqdn" -addext "subjectAltName = DNS:$fqdn"

cat selfsigned.crt selfsigned.key >> aaa.pem
```

# Extract Certs from .pfx PKCS#12
```
openssl pkcs12 -passin env:PASSIN -in ${cn}.pfx -nocerts -nodes > ${cn}.key.pem
openssl pkcs12 -passin env:PASSIN -in ${cn}.pfx -clcerts -nokeys > ${cn}.crt.pem
openssl pkcs12 -passin env:PASSIN -in ${cn}.pfx -cacerts -nokeys -chain > ${cn}.ca.crt.pem
```

# validate
https://link.medium.com/9Cif8SlO9ub

# Pem
```
Donwload pem
openssl rsa -in ~/myhost.example.com.pem -out ~/myhost.example.com.pem.key
and replace encrypted private key at bottom in ~/myhost.example.com.pem with ~/myhost.example.com.pem.key
```

# pkcs12
```
echo -n | openssl s_client -showcerts -connect $HOST:$PORTNUMBER -servername $SERVERNAME \
| openssl x509 > /tmp/$SERVERNAME.cert

openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key>
openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <clientcert.cer>
openssl pkcs12 -in <filename.pfx> -cacerts -nokeys -chain | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <cacerts.cer>
```

Expiration dates
```
host=example.com; port=443; echo "Q" | openssl s_client -servername $host -connect $host:$port | openssl x509 -noout -dates
```

Show Certs
```
host=example.com; port=443; echo "Q" | openssl s_client -showcerts -connect $host:$port
```

Get CA cert PEM from URL and use with curl
```
host=example.com; port=443; echo quit | openssl s_client -showcerts -servername server -connect $host:$port > cacert.pem
host=example.com; port=443; curl -vv --cacert cacert.pem https://$host:$port/notifications/health
```
```
openssl pkcs12 -in example.io.pfx -out example.io.pem -nodes
```

# PKS
```
# kb.dev.example.com.pks
host=kb.dev.example.com; openssl pkcs12 -in $host.pfx -out $host.key -nocerts -nodes
host=kb.dev.example.com; openssl pkcs12 -in $host.pfx -out $host.crt -clcerts -nokeys
```

```
openssl pkcs12 -in <filename.pfx> -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > <clientcert.key>
openssl pkcs12 -in <filename.pfx> -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <clientcert.cer>
openssl pkcs12 -in <filename.pfx> -cacerts -nokeys -chain | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > <cacerts.cer>
```

cipher scans
```
echo quit | openssl s_client -connect www.uvoo.io:443 -msg -debug 2>/dev/null | grep "Cipher :"
```

Self signed https certs
```
View & Download in Firefox
PEM (cert)PEM (chain)
export API_HOST=example.com
echo quit | openssl s_client -showcerts -servername "${API_HOST}" -connect "${API_HOST}":443 > cacert.pem
curl --cacert cacert.pem --location --silent https://${API_HOST}
```

https://www.redhat.com/sysadmin/6-openssl-commands

# Extract cert and key
```
openssl pkcs12 -in domain.pfx -clcerts -nokeys -out domain.crt
openssl pkcs12 -in domain.pfx -nocerts -nodes -out domain.key
```

# Update your Apache configuration file with:

```
<VirtualHost 192.168.0.1:443>
...
SSLEngine on
SSLCertificateFile /path/to/domain.crt
SSLCertificateKeyFile /path/to/domain.key
...
</VirtualHost>
```

```
echo quit | openssl s_client -connect log.example.com:6514
echo "Q" | openssl s_client -servername google.com -connect google.com:443 | openssl x509 -noout -dates
host=example.com; port=443; echo "Q" | openssl s_client -servername $host -connect $host:$port | openssl x509 -noout -dates
```

```
echo quit | openssl s_client -showcerts -servername server -connect google.com:443 > cacert.pem
true | openssl s_client -connect google.com:443 2>/dev/null | openssl x509
rm -f cert.pem && echo -n | openssl s_client -connect google.com:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ./cert.pem
```
curl --cacert google.pem https://google.com

Get cipher
```
echo quit | openssl s_client -connect lb.examle.com:443 2>/dev/null | grep -i cipher
```

```
openssl s_client -connect 10.x.x.x:6514
```

PKI
```
#!/usr/bin/env bash
set -eu
# ref: https://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/

bits=4096
# cert_cn=insights.example.com
ca_dir=ca
keys_dir=ca/keys
mkdir -p $ca_dir
mkdir -p $keys_dir
# cd $ca_dir
ca_subject="-subj \"/C=US/ST=Utah/L=Lehi/O=Example/OU=IT/CN=ca.example.com\""

create_CA(){
echo "Configuring rootca certs for issueing certs to nodes via CN/fqdn."
openssl genrsa -out $ca_dir/ca.key $bits
openssl genrsa -des3 -out $ca_dir/ca.key $bits
# openssl genrsa -nodes -out $ca_dir/ca.key $bits
# openssl req -x509 -new -nodes -key $ca_dir/ca.key -sha256 -days 10240 -out $ca_dir/ca.pem $ca_subject
openssl req -x509 -new -nodes -key $ca_dir/ca.key -sha256 -days 10240 -out $ca_dir/ca.crt -subj "/C=US/ST=Utah/L=Lehi/O=Example/OU=IT/CN=ca.example.com"
}

create_client(){
cert_cn=$1
echo "Configuring certs for nodes with CN/fqdn."
openssl genrsa -out $keys_dir/${cert_cn}.key $bits
openssl req -new -key $keys_dir/${cert_cn}.key -out $keys_dir/${cert_cn}.csr -subj "/C=US/ST=Utah/L=Lehi/O=Example/OU=IT/CN=$cert_cn"
openssl x509 -req -in $keys_dir/${cert_cn}.csr -CA $ca_dir/ca.crt -CAkey $ca_dir/ca.key -CAcreateserial -out $keys_dir/${cert_cn}.crt -days 730 -sha256
}

copy_keys_to_rsyslog(){
cert_cn=$1
cp $keys_dir/${cert_cn}.key ../files/etc/rsyslog.d/keys/
cp $keys_dir/${cert_cn}.crt ../files/etc/rsyslog.d/keys/
cp $ca_dir/ca.crt ../files/etc/rsyslog.d/keys/
}

create_CA
create_client insights.example.com
copy_keys_to_rsyslog insights.example.com

# Notes

# sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt
```

# Shadow
```
openssl passwd -6 -salt ly7/kMnF yourpass
```

LDAP
```
openssl s_client -showcerts -connect ldap.yourdomain.com:636
```
# Refs
- https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/#becoming-certificate-authority
- https://github.com/OpenVPN/easy-rsa/blob/master/README.quickstart.md
- https://www.feistyduck.com/library/openssl-cookbook/online/ch-testing-with-openssl.html

# More

```
openssl s_client -connect 127.0.0.1:8443 -tls1_3

openssl s_client -showcerts -servername www.example.com -connect www.example.com:443 </dev/null

openssl s_client -showcerts -connect www.example.com:443 </dev/nul

$ echo | \
openssl s_client -servername www.example.com -connect www.example.com:443 2>/dev/null | \
openssl x509 -text
```

```
openssl verify -verbose -CAfile _.example.com.crt _.example.com.crt
```

get cert
```
openssl x509 -in a.crt -text -certopt no_header,no_pubkey,no_subject,no_issuer,no_signame,no_version,no_serial,no_validity,no
_extensions,no_sigdump,no_aux,no_extensions
```

pkcs12 from key and crt
```
openssl pkcs12 -export -out keyStore.p12 -inkey my.key -in my.crt
```

Swap space

2026-08-01T21:03:21Z

Busk:

# Linux

## Disable swap

# Disable swap immediately
sudo swapoff -a

# Comment out or remove any swap entries from /etc/fstab to persist on reboot
sudo sed -i.bak '/\bswap\b/s/^/#/' /etc/fstab

## Clear swap
```
free -m
swapoff -a
# wait about 30 seconds
swapon -a
```

## Check swappiness
```
sysctl -a | grep swap
vm.swappiness = 10
```

Gitlab runner LXD

2026-08-01T20:10:13Z

Busk: Created page with "https://docs.gitlab.com/runner/executors/custom_examples/lxd/ You need to **install the `gitlab-runner` apt package first**. Installing the package creates the `gitlab-runne..."

https://docs.gitlab.com/runner/executors/custom_examples/lxd/

You need to **install the `gitlab-runner` apt package first**.

Installing the package creates the `gitlab-runner` system user and the `/etc/gitlab-runner/` directory structure where `config.toml` lives.

Here is the step-by-step order of operations to get everything set up correctly:

---

## Step 1: Install the GitLab Runner Package

Run these commands on your host machine to add GitLab's official repository and install the runner:

```bash
# 1. Download and run the official GitLab repository setup script
curl -L "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh" | sudo bash

# 2. Install the gitlab-runner package
sudo apt-get install gitlab-runner

```

---

## Step 2: Create the LXD Executor Scripts

Next, create your wrapper scripts for the custom executor (e.g., in `/opt/gitlab-runner/`).

```bash
# Create directory for custom executor scripts
sudo mkdir -p /opt/gitlab-runner

# Create the prepare, run, and cleanup scripts
sudo touch /opt/gitlab-runner/lxd-prepare.sh
sudo touch /opt/gitlab-runner/lxd-run.sh
sudo touch /opt/gitlab-runner/lxd-cleanup.sh

# Make them executable
sudo chmod +x /opt/gitlab-runner/lxd-*.sh

```

*(Paste the script contents into these files and ensure the LXD TLS certificate generation step you performed earlier is configured under the `gitlab-runner` system user's home directory so it can authenticate against LXD).*

---

## Step 3: Register and Configure `config.toml`

Finally, register the runner with your GitLab instance, which will automatically generate or update `/etc/gitlab-runner/config.toml`.

```bash
# Register the runner (you'll need a registration token from GitLab UI)
sudo gitlab-runner register \
--non-interactive \
--url "https://gitlab.com/" \
--token "YOUR_RUNNER_AUTHENTICATION_TOKEN" \
--executor "custom" \
--description "lxd-restricted-runner" \
--custom-prepare-exec "/opt/gitlab-runner/lxd-prepare.sh" \
--custom-run-exec "/opt/gitlab-runner/lxd-run.sh" \
--custom-cleanup-exec "/opt/gitlab-runner/lxd-cleanup.sh"

```

Once registered, you can edit `/etc/gitlab-runner/config.toml` directly if you need to fine-tune concurrency limits or execution parameters.

Kubernetes Bare Metal

2026-08-01T19:26:06Z

Busk: Created page with "https://www.digitalocean.com/community/tutorials/bare-metal-kubernetes You probably want to use cloud-init like this Ubuntu 24.04 `cloud-init` configuration for provisioning..."

https://www.digitalocean.com/community/tutorials/bare-metal-kubernetes

You probably want to use cloud-init like this Ubuntu 24.04

`cloud-init` configuration for provisioning Kubernetes nodes on **Ubuntu 24.04 LTS**.

This script handles:

* Disabling swap (required by `kubelet`)
* Enabling necessary kernel modules (`overlay`, `br_netfilter`)
* Setting required `sysctl` networking parameters
* Installing and configuring `containerd` with the `SystemdCgroup` driver enabled
* Adding the official `pkgs.k8s.io` repository (configured for Kubernetes **v1.30**)
* Installing and locking (`apt-mark hold`) `kubelet`, `kubeadm`, and `kubectl`

---

## Cloud-Init YAML (`user-data`)

```yaml
#cloud-config
package_update: true
package_upgrade: false

packages:
- apt-transport-https
- ca-certificates
- curl
- gpg
- containerd

write_files:
# Enable required kernel modules for container networking
- path: /etc/modules-load.d/k8s.conf
permissions: '0644'
content: |
overlay
br_netfilter

# Set sysctl rules for iptables bridge & IP forwarding
- path: /etc/sysctl.d/k8s.conf
permissions: '0644'
content: |
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1

runcmd:
# 1. Disable swap immediately and persistently across reboots
- swapoff -a
- sed -i '/ swap / s/^$.*$$/#\1/g' /etc/fstab

# 2. Load kernel modules and apply sysctl settings
- modprobe overlay
- modprobe br_netfilter
- sysctl --system

# 3. Configure containerd with SystemdCgroup enabled
- mkdir -p /etc/containerd
- containerd config default | tee /etc/containerd/config.toml > /dev/null
- sed -i 's/SystemdCgroup = false/SystemdCgroup = true/g' /etc/containerd/config.toml
- systemctl restart containerd
- systemctl enable containerd

# 4. Add official Kubernetes v1.30 apt repository
- mkdir -p -m 755 /etc/apt/keyrings
- curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
- chmod 644 /etc/apt/keyrings/kubernetes-apt-keyring.gpg
- echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' | tee /etc/apt/sources.list.d/kubernetes.list

# 5. Install Kubernetes binaries and prevent auto-upgrades
- apt-get update
- apt-get install -y kubelet kubeadm kubectl
- apt-mark hold kubelet kubeadm kubectl
- systemctl enable --now kubelet

```

---

## Next Steps After Boot

Once your machine finishes running `cloud-init`, choose your role:

### For the Control Plane (Master Node)

Initialize the cluster with your control plane IP and preferred pod CIDR (e.g., Flannel/Calico):

```bash
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

```

### For Worker Nodes

Run the `kubeadm join` command provided at the end of your control plane's `kubeadm init` output.

AWS vs Azure

2026-08-01T15:46:53Z

Busk:

Here is how the core AWS services map directly to their Azure counterparts across key infrastructure categories:

### Core Service Mapping

| Category | AWS Service | Azure Equivalent | Description |
| --- | --- | --- | --- |
| **Compute** | **EC2** | Virtual Machines (VMs) | On-demand virtual instances/servers. |
| | **AWS Lambda** | Azure Functions | Event-driven serverless compute. |
| | **Elastic Beanstalk** | Azure App Service | Managed PaaS for web app deployment. |
| **Containers** | **EKS** | Azure Kubernetes Service (AKS) | Managed Kubernetes engine. |
| | **ECS / Fargate** | Azure Container Apps / ACI | Serverless container execution. |
| | **ECR** | Azure Container Registry (ACR) | Docker/OCI image repository. |
| **Storage** | **S3** | Azure Blob Storage | Scalable object storage. |
| | **EBS** | Azure Managed Disks | Block storage attached to compute instances. |
| | **EFS / FSx** | Azure Files | Fully managed network file shares (NFS/SMB). |
| | **S3 Glacier** | Azure Archive Storage | Cold/archival storage for backups. |
| **Databases** | **RDS** | Azure SQL Database / Flexible Server | Managed relational databases (PostgreSQL, MySQL, SQL Server). |
| | **DynamoDB** | Azure Cosmos DB | Fully managed NoSQL key-value/document database. |
| | **ElastiCache** | Azure Cache for Redis | In-memory caching. |
| **Networking** | **VPC** | Virtual Network (VNet) | Isolated private cloud networking. |
| | **Route 53** | Azure DNS | Managed DNS routing service. |
| | **Direct Connect** | Azure ExpressRoute | Dedicated private link to on-premise hardware. |
| | **ALB / NLB** | Application Gateway / Load Balancer | Layer 7 (HTTP/HTTPS) and Layer 4 load balancing. |
| **Identity & Security** | **AWS IAM** | Microsoft Entra ID (Azure AD) + RBAC | Identity management, auth, and role definitions. |
| | **AWS KMS** | Azure Key Vault | Key, secret, and certificate management. |
| | **AWS Shield / WAF** | Azure DDoS Protection / Web Application Firewall | DDoS defense and application security. |
| **Analytics & AI** | **Redshift** | Azure Synapse Analytics | Cloud data warehousing. |
| | **Amazon SageMaker** | Azure Machine Learning | Platform for building, training, and deploying ML models. |
| | **AWS Glue** | Azure Data Factory | Managed ETL and data integration pipelines. |

---

### Key Structural Differences

* **Identity Model:** AWS centers permissions around IAM policies attached to users/roles via JSON documents. Azure heavily relies on Microsoft Entra ID with Role-Based Access Control (RBAC) applied across standard scope hierarchies (Management Groups → Subscriptions → Resource Groups → Resources).
* **Resource Management:** Azure mandates that every resource resides within a **Resource Group** for unified lifecycle management. AWS tags resources globally or groups them logically, but lacks the strict single-container grouping model native to Azure.

**for most greenfield projects, standard microservices, and general container workloads, Fargate is the default best choice.**

The reduced configuration, lack of node management (no OS patching, no AMI rotations, no cluster autoscaling setup), and per-task scaling make it the lower-overhead option for developer velocity.

However, saying it’s *only* when resources are "mostly pegged" misses a few critical non-cost boundaries where Fargate simply cannot be used or becomes significantly more expensive.

---

### Non-Cost Constraints (When Fargate Is Not an Option)

Sometimes you **must** use EC2 regardless of price or utilization:

1. **GPU / Specialized Hardware Workloads:** Machine learning inference/training (NVIDIA GPUs), high-performance media encoding, or AWS Inferentia/Trainium hardware require EC2 instance types. Fargate doesn't support GPU pass-through.
2. **Custom Daemon / Host-Level Monitoring:** If you rely on daemonsets/agents that must run at the host OS level (e.g., specific kernel-level eBPF tracing, custom security agents, or system-wide log forwarders), Fargate’s serverless boundary prevents host access. Sidecar containers are required on Fargate instead.
3. **Privileged Mode & Kernel Tweaks:** Tasks requiring Linux `--privileged` access, custom kernel module loading, raw network sockets, or `sysctl` modifications are blocked by Fargate’s isolation boundary.
4. **Extreme Local Disk I/O:** Fargate task storage tops out at 200 GB of ephemeral storage. If your app requires terabytes of high-speed local NVMe scratch disk (like `i3en` or `z1d` instances), you need EC2.

---

### Cost Decision Matrix

```
Is the workload continuous & predictable?
/ \
/ \
YES NO (Bursty / Batch / Variable)
/ \
Are you running high-volume baseline? --> Use FARGATE
/ \ (Zero idle capacity waste)
/ \
YES NO
/ \
Are you using 3-yr Savings --> Use FARGATE
Plans + tight bin-packing? (Engineering time > ~20% savings)
/
YES
/
Use EC2
(Save up to 50%+)

```

---

### Summary Checklist

| Dimension | Default Choice | Shift to EC2 when... |
| --- | --- | --- |
| **Operational Effort** | **Fargate** (Zero node maintenance) | You already have robust node automation (e.g., Karpenter/Cluster Autoscaler) and dedicated DevOps resource. |
| **Scale Mechanism** | **Fargate** (Fast task provisioning) | Scaling is predictable and you can handle warm node pools. |
| **Hardware** | **Fargate** (Standard CPU/ARM + RAM) | You require GPUs, host storage, or kernel/privileged access. |
| **Cost at Scale** | **Fargate** (No waste from idle nodes) | Your monthly compute bill is large enough ($5k–$10k+/mo) that saving 30–50% pays for the engineering time to manage nodes. |

AWS vs Azure

2026-08-01T15:46:15Z

Busk: Created page with "**for most greenfield projects, standard microservices, and general container workloads, Fargate is the default best choice.** The reduced configuration, lack of node managem..."

**for most greenfield projects, standard microservices, and general container workloads, Fargate is the default best choice.**

The reduced configuration, lack of node management (no OS patching, no AMI rotations, no cluster autoscaling setup), and per-task scaling make it the lower-overhead option for developer velocity.

However, saying it’s *only* when resources are "mostly pegged" misses a few critical non-cost boundaries where Fargate simply cannot be used or becomes significantly more expensive.

---

### Non-Cost Constraints (When Fargate Is Not an Option)

Sometimes you **must** use EC2 regardless of price or utilization:

1. **GPU / Specialized Hardware Workloads:** Machine learning inference/training (NVIDIA GPUs), high-performance media encoding, or AWS Inferentia/Trainium hardware require EC2 instance types. Fargate doesn't support GPU pass-through.
2. **Custom Daemon / Host-Level Monitoring:** If you rely on daemonsets/agents that must run at the host OS level (e.g., specific kernel-level eBPF tracing, custom security agents, or system-wide log forwarders), Fargate’s serverless boundary prevents host access. Sidecar containers are required on Fargate instead.
3. **Privileged Mode & Kernel Tweaks:** Tasks requiring Linux `--privileged` access, custom kernel module loading, raw network sockets, or `sysctl` modifications are blocked by Fargate’s isolation boundary.
4. **Extreme Local Disk I/O:** Fargate task storage tops out at 200 GB of ephemeral storage. If your app requires terabytes of high-speed local NVMe scratch disk (like `i3en` or `z1d` instances), you need EC2.

---

### Cost Decision Matrix

```
Is the workload continuous & predictable?
/ \
/ \
YES NO (Bursty / Batch / Variable)
/ \
Are you running high-volume baseline? --> Use FARGATE
/ \ (Zero idle capacity waste)
/ \
YES NO
/ \
Are you using 3-yr Savings --> Use FARGATE
Plans + tight bin-packing? (Engineering time > ~20% savings)
/
YES
/
Use EC2
(Save up to 50%+)

```

---

### Summary Checklist

| Dimension | Default Choice | Shift to EC2 when... |
| --- | --- | --- |
| **Operational Effort** | **Fargate** (Zero node maintenance) | You already have robust node automation (e.g., Karpenter/Cluster Autoscaler) and dedicated DevOps resource. |
| **Scale Mechanism** | **Fargate** (Fast task provisioning) | Scaling is predictable and you can handle warm node pools. |
| **Hardware** | **Fargate** (Standard CPU/ARM + RAM) | You require GPUs, host storage, or kernel/privileged access. |
| **Cost at Scale** | **Fargate** (No waste from idle nodes) | Your monthly compute bill is large enough ($5k–$10k+/mo) that saving 30–50% pays for the engineering time to manage nodes. |

Saltstack docker

2026-07-31T07:15:26Z

Busk:

```
services:
salt-master:
image: saltstack/salt:latest
container_name: salt-master
restart: unless-stopped
ports:
- "4505:4505"
- "4506:4506"
volumes:
- ./config/master:/etc/salt/master:ro
- salt-pki:/etc/salt/pki
- ./srv/salt:/srv/salt
- ./srv/pillar:/srv/pillar
- salt-cache:/var/cache/salt
- salt-run:/var/run/salt

watchtower:
image: containrrr/watchtower
container_name: watchtower
restart: unless-stopped
environment:
# Run at 2:00 AM every night
# Format: Seconds Minutes Hours DayOfMonth Month DayOfWeek
- WATCHTOWER_SCHEDULE=0 0 2 * * *
# Remove old unpatched image layers from disk after updating
- WATCHTOWER_CLEANUP=true
# Check for base image updates regardless of local tag
- WATCHTOWER_INCLUDE_RESTARTING=true
volumes:
# CRITICAL: This must point to the rootless user's socket, not /var/run!
# Replace '1001' with the output of `id -u`
- /run/user/1001/docker.sock:/var/run/docker.sock
# Restrict Watchtower to ONLY update the salt-master container
command: salt-master

volumes:
salt-pki:
salt-cache:
salt-run:
```

```
#!/bin/bash
set -e

# ==========================================
# CONFIGURATION
# ==========================================
# Replace with your Dockerized Salt Master's IP or DNS name
SALT_MASTER="mysalt.example.com"

# Uses the machine's hostname by default, or you can hardcode a name (e.g., "web-server-01")
MINION_ID=$(hostname)
# ==========================================

if [[ $EUID -ne 0 ]]; then
echo "Error: This script must be run as root. Try using: sudo $0"
exit 1
fi

echo "==> Installing prerequisites..."
apt-get update
apt-get install -y curl gnupg

echo "==> Adding Salt Project repository for Ubuntu 24.04 LTS (Noble)..."
mkdir -p /etc/apt/keyrings
curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg \
https://repo.saltproject.io/salt/py3/ubuntu/24.04/amd64/SALT-PROJECT-GPG-PUBKEY-2023.gpg

echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg arch=amd64] https://repo.saltproject.io/salt/py3/ubuntu/24.04/amd64/3006 noble main" \
| tee /etc/apt/sources.list.d/salt.list > /dev/null

echo "==> Installing Salt Minion..."
apt-get update
apt-get install -y salt-minion

echo "==> Configuring Minion to connect to $SALT_MASTER..."
mkdir -p /etc/salt/minion.d
echo "master: $SALT_MASTER" > /etc/salt/minion.d/master.conf
echo "$MINION_ID" > /etc/salt/minion_id

echo "==> Enabling and starting Salt Minion service..."
systemctl enable --now salt-minion
systemctl restart salt-minion

echo "=================================================="
echo "Success! The Salt Minion ($MINION_ID) is running."
echo "It has sent its public key to $SALT_MASTER."
echo "You must now log into the Master server and accept this key."
echo "=================================================="
```

```
# List pending keys to verify the minion showed up
docker compose exec salt-master salt-key -L

# Accept the specific minion key
docker compose exec salt-master salt-key -a
```

Saltstack docker

2026-07-31T07:14:03Z

Busk: Created page with "``` #!/bin/bash set -e # ========================================== # CONFIGURATION # ========================================== # Replace with your Dockerized Salt Master's..."

```
#!/bin/bash
set -e

# ==========================================
# CONFIGURATION
# ==========================================
# Replace with your Dockerized Salt Master's IP or DNS name
SALT_MASTER="mysalt.example.com"

# Uses the machine's hostname by default, or you can hardcode a name (e.g., "web-server-01")
MINION_ID=$(hostname)
# ==========================================

if [[ $EUID -ne 0 ]]; then
echo "Error: This script must be run as root. Try using: sudo $0"
exit 1
fi

echo "==> Installing prerequisites..."
apt-get update
apt-get install -y curl gnupg

echo "==> Adding Salt Project repository for Ubuntu 24.04 LTS (Noble)..."
mkdir -p /etc/apt/keyrings
curl -fsSL -o /etc/apt/keyrings/salt-archive-keyring-2023.gpg \
https://repo.saltproject.io/salt/py3/ubuntu/24.04/amd64/SALT-PROJECT-GPG-PUBKEY-2023.gpg

echo "deb [signed-by=/etc/apt/keyrings/salt-archive-keyring-2023.gpg arch=amd64] https://repo.saltproject.io/salt/py3/ubuntu/24.04/amd64/3006 noble main" \
| tee /etc/apt/sources.list.d/salt.list > /dev/null

echo "==> Installing Salt Minion..."
apt-get update
apt-get install -y salt-minion

echo "==> Configuring Minion to connect to $SALT_MASTER..."
mkdir -p /etc/salt/minion.d
echo "master: $SALT_MASTER" > /etc/salt/minion.d/master.conf
echo "$MINION_ID" > /etc/salt/minion_id

echo "==> Enabling and starting Salt Minion service..."
systemctl enable --now salt-minion
systemctl restart salt-minion

echo "=================================================="
echo "Success! The Salt Minion ($MINION_ID) is running."
echo "It has sent its public key to $SALT_MASTER."
echo "You must now log into the Master server and accept this key."
echo "=================================================="
```

```
# List pending keys to verify the minion showed up
docker compose exec salt-master salt-key -L

# Accept the specific minion key
docker compose exec salt-master salt-key -a
```

Rootless docker

2026-07-31T02:30:32Z

Busk:

Works on Ubuntu 24.04

https://docs.docker.com/engine/security/rootless/

install-rootless-docker-on-ubuntu.sh
```
#!/bin/bash
set -e

SERVICE_USER="dockeruser"

# 1. Ensure script is run with sudo/root privileges
if [[ $EUID -ne 0 ]]; then
echo "Error: This script must be run as root. Try using: sudo $0"
exit 1
fi

# ==========================================
# 2. PRE-SCRIPT SECTION
# ==========================================
echo "==> Running pre-installation tasks..."
# Add any commands you want to run before the setup begins right here.
# For example, you could source an external script if it exists:
# if [ -f "./pre-install.sh" ]; then
# source ./pre-install.sh
# fi
#
# apt-get remove -y docker.io || true # Example: remove old conflicting packages

# ==========================================
# 3. DOCKER-CE & DEPENDENCY INSTALLATION
# ==========================================
echo "==> Setting up Docker's official apt repository..."
apt-get update
apt-get install -y ca-certificates curl
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
tee /etc/apt/sources.list.d/docker.list > /dev/null

echo "==> Installing docker-ce and rootless dependencies..."
apt-get update
apt-get install -y \
docker-ce docker-ce-cli containerd.io \
docker-buildx-plugin docker-compose-plugin \
docker-ce-rootless-extras uidmap dbus-user-session slirp4netns

# ==========================================
# 4. SYSTEM CONFIGURATION & ROOTLESS SETUP
# ==========================================
echo "==> Configuring Ubuntu 24.04 unprivileged user namespaces..."
sysctl -w kernel.unprivileged_userns_clone=1
echo "kernel.unprivileged_userns_clone=1" > /etc/sysctl.d/50-rootless-docker.conf

echo "==> Stopping and disabling rootful Docker to prevent socket conflicts..."
systemctl stop docker.service docker.socket || true
systemctl disable docker.service docker.socket || true
rm -f /var/run/docker.sock

echo "==> Creating dedicated user: $SERVICE_USER..."
if id "$SERVICE_USER" &>/dev/null; then
echo "User $SERVICE_USER already exists, skipping creation."
else
useradd -m -s /bin/bash "$SERVICE_USER"
echo "User $SERVICE_USER created successfully."
fi

echo "==> Enabling user lingering (ensures containers run without active SSH session)..."
loginctl enable-linger "$SERVICE_USER"

# Wait a moment for systemd to initialize the new user's DBUS environment
sleep 2

echo "==> Installing Rootless Docker as $SERVICE_USER..."
sudo -i -u "$SERVICE_USER" bash << 'EOF'
# Define systemd runtime variables for the user session
export XDG_RUNTIME_DIR="/run/user/$(id -u)"
export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"

# Run the rootless installer
dockerd-rootless-setuptool.sh install

# Configure .bashrc for future logins
if ! grep -q "DOCKER_HOST" ~/.bashrc; then
echo 'export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock' >> ~/.bashrc
echo 'export PATH=/usr/bin:$PATH' >> ~/.bashrc
fi

# Start and enable the systemd service for Docker
systemctl --user enable --now docker

echo "==> Rootless Docker installed successfully for $(whoami)!"
docker info | grep -i rootless
EOF

echo "==> Script complete!"
echo "To manage your containers, switch to the new user by running:"
echo "sudo su - $SERVICE_USER"
```

Rootless docker

2026-07-31T02:01:46Z

Busk:

Rootless docker

2026-07-31T02:00:06Z

Busk: Created page with "Works on Ubuntu 24.04 install-rootless-docker-on-ubuntu.sh ``` #!/bin/bash set -e SERVICE_USER="dockeruser" # 1. Ensure script is run with sudo/root privileges if $EUID..."

Works on Ubuntu 24.04

install-rootless-docker-on-ubuntu.sh
```
#!/bin/bash
set -e

SERVICE_USER="dockeruser"

# 1. Ensure script is run with sudo/root privileges
if [[ $EUID -ne 0 ]]; then
echo "Error: This script must be run as root. Try using: sudo $0"
exit 1
fi

echo "==> Installing dependencies..."
apt-get update
apt-get install -y uidmap dbus-user-session slirp4netns docker-ce-rootless-extras

echo "==> Configuring Ubuntu 24.04 unprivileged user namespaces..."
sysctl -w kernel.unprivileged_userns_clone=1
echo "kernel.unprivileged_userns_clone=1" > /etc/sysctl.d/50-rootless-docker.conf

echo "==> Stopping and disabling rootful Docker to prevent socket conflicts..."
systemctl stop docker.service docker.socket || true
systemctl disable docker.service docker.socket || true
rm -f /var/run/docker.sock

echo "==> Creating dedicated user: $SERVICE_USER..."
if id "$SERVICE_USER" &>/dev/null; then
echo "User $SERVICE_USER already exists, skipping creation."
else
useradd -m -s /bin/bash "$SERVICE_USER"
echo "User $SERVICE_USER created successfully."
fi

echo "==> Enabling user lingering (ensures containers run without active SSH session)..."
loginctl enable-linger "$SERVICE_USER"

# Wait a moment for systemd to initialize the new user's DBUS environment
sleep 2

echo "==> Installing Rootless Docker as $SERVICE_USER..."
# We use sudo to switch users and explicitly set XDG_RUNTIME_DIR so systemctl --user works
sudo -i -u "$SERVICE_USER" bash << 'EOF'
# Define systemd runtime variables for the user session
export XDG_RUNTIME_DIR="/run/user/$(id -u)"
export DBUS_SESSION_BUS_ADDRESS="unix:path=${XDG_RUNTIME_DIR}/bus"

# Run the rootless installer
dockerd-rootless-setuptool.sh install

# Configure .bashrc for future logins
if ! grep -q "DOCKER_HOST" ~/.bashrc; then
echo 'export DOCKER_HOST=unix:///run/user/$(id -u)/docker.sock' >> ~/.bashrc
echo 'export PATH=/usr/bin:$PATH' >> ~/.bashrc
fi

# Start and enable the systemd service for Docker
systemctl --user enable --now docker

echo "==> Rootless Docker installed successfully for $(whoami)!"
docker info | grep -i rootless
EOF

echo "==> Script complete!"
echo "To manage your containers, switch to the new user by running:"
echo "sudo su - $SERVICE_USER"
```

Tpm2

2026-07-31T01:03:51Z

Busk:

Ubuntu 24.04
ls -l /dev/tpm*

```
# 1. Update your package lists and install the Clevis toolset
sudo apt update
sudo apt install clevis clevis-tpm2 clevis-luks clevis-initramfs

# 2. Bind your LUKS partition to the TPM (specifying sha256 to prevent errors)
sudo clevis luks bind -d /dev/nvme0n1p3 tpm2 '{"pcr_bank":"sha256","pcr_ids":"1,4,7"}'

# 3. Rebuild the boot image so the Clevis decryption hooks load during early boot
sudo update-initramfs -u -k all
```

reboot

Tpm2

2026-07-30T22:22:57Z

Busk: Created page with "Ubuntu 24.04 ls -l /dev/tpm* sudo apt install libtss2-rc0t64 libtss2-esys-3.0.2-0t64 tpm2-tools systemd-cryptenroll --tpm2-device=list lsblk -f | grep -i luk sudo systemd-cryp..."

Ubuntu 24.04
ls -l /dev/tpm*
sudo apt install libtss2-rc0t64 libtss2-esys-3.0.2-0t64 tpm2-tools
systemd-cryptenroll --tpm2-device=list
lsblk -f | grep -i luk
sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=1+4+7 /dev/nvme0n1p3
sudo reboot
sudo update-initramfs -u -k all

Codex gemini install cli

2026-07-26T02:01:05Z

Busk:

# Debian/Ubuntu

```
sudo apt-get remove -y nodejs npm
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs

mkdir -p ~/.npm-global
npm config set prefix '~/.npm-global'
export PATH=~/.npm-global/bin:$PATH
echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc

npm install -g npm@latest
npm install -g --allow-scripts=@github/keytar,node-pty @openai/codex @google/gemini-cli

codex --version
gemini --version
```

Codex gemini install cli

2026-07-26T01:57:23Z

Busk:

# Debian/Ubuntu

```
sudo apt-get remove -y nodejs npm
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt-get install -y nodejs
sudo npm install -g npm@latest
sudo npm install -g npm@latest @openai/codex @google/gemini-cli
codex --version
gemini --version
```

Kubectl sniff

2026-07-25T21:16:09Z

Busk: Created page with "kubectl debug -i my-container-77c5f975d8-mt7mm -n my-ns --image=nicolaka/netshoot --target=my-container --profile=netadmin -- tcpdump -i any -nn -A -s 0 'tcp port 8080'..."

kubectl debug -i my-container-77c5f975d8-mt7mm -n my-ns --image=nicolaka/netshoot --target=my-container --profile=netadmin -- tcpdump -i any -nn -A -s 0 'tcp port 8080' | grep -iE 'X-Forwarded-For|Host:'

Cka kubeadm init upgrade

2026-07-24T17:30:10Z

Busk:

## Prep Ubuntu 24.04 & 22.04 Node

```
#!/bin/bash
set -eu

k8s_minor_version=1.31

prep_k8s_node(){
sudo apt update && sudo apt upgrade -y
sudo apt install apt-transport-https curl -y

# https://kubernetes.io/docs/setup/production-environment/container-runtimes/
sudo apt install containerd -y
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml > /dev/null
# Instruct containerd to use the Systemd cgroup hierarchy (typically cgroupv2) for managing container resources.
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
sudo systemctl restart containerd
echo "net.ipv4.ip_forward = 1" | /etc/sysctl.d/k8s.conf
sudo sysctl --system

# https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#installing-kubeadm-kubelet-and-kubectl
curl -fsSL https://pkgs.k8s.io/core:/stable:/v${k8s_minor_version}/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v${k8s_minor_version}/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt update
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

swapon -s # returns summary text if swap is enabled
sudo swapoff -a
sudo sed -i '/ swap / s/^$.*$$/#\1/g' /etc/fstab

# overlay is already modprobed by containerd
sudo modprobe br_netfilter
echo -e "br_netfilter" | sudo tee /etc/modules-load.d/k8s.conf
lsmod | grep overlay
lsmod | grep br_netfilter

echo "export KUBECONFIG=/etc/kubernetes/admin.conf" >> ~/.bashrc
sudo reboot
}

prep_k8s_node
```

## Install kubeadm kubectl kubelet

https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#installing-kubeadm-kubelet-and-kubectl

```
sudo apt-get update
# apt-transport-https may be a dummy package; if so, you can skip that package
sudo apt-get install -y apt-transport-https ca-certificates curl gpg

# If the directory `/etc/apt/keyrings` does not exist, it should be created before the curl command, read the note below.
# sudo mkdir -p -m 755 /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.32/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

# This overwrites any existing configuration in /etc/apt/sources.list.d/kubernetes.list
echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.32/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list

sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl
```

## Init Control Plane

https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/#initializing-your-control-plane-node

HA with LB for control see - https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/ - --control-plane-endpoint

```
kubeadm init --apiserver-advertise-address <local ip>

```

## Cilium

This is only needed on one node in the cluster for admin functions if wanted as helm is what installs cilium agent on k8s nodes

https://kubernetes.io/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy/

```
https://kubernetes.io/docs/tasks/administer-cluster/network-policy-provider/cilium-network-policy/
sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
rm cilium-linux-amd64.tar.gz
cilium install && cilium wait status
```

## Join worker node
```
kubeadm join
```

## Enable metrics-server api for kubectl top node

```
helm search hub metrics-server -o yaml
helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/
helm install metrics-server metrics-server/metrics-server --set args[0]='--kubelet-insecure-tls'
```

Docker install ubuntu

2026-07-15T17:05:45Z

Busk: Created page with "``` sudo apt update sudo apt install -y ca-certificates curl gnupg sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /..."

```
sudo apt update
sudo apt install -y ca-certificates curl gnupg

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
```

Lxc launch

2026-07-15T17:00:03Z

Busk:

lxc launch images:debian/11 bullseye-vm --vm

```
lxc --target lxdnode1 init ubuntu:22.04 --vm -c limits.cpu=6 -c limits.memory=12GB docker
lxc config device override docker root size=100GB
lxc start docker
```

lxc launch images:debian/11 docker-server --vm -c limits.cpu=4 -c limits.memory=12GiB -d root,size=50GiB

```
s. Assumptions: 1) One zfs pool called ‘default’ that lives on the hard drive at /var/lib/lxd/disks/default.img. 2) Running as root. 3) Growing pool ‘default’ from 25GB to 45GB. Stop all running containers. #truncate -s +20G /var/lib/lxd/disks/default.img #zpool set autoexpand=on default #zpool status -vg default 4a. Note th…
```

```
lxc init images:ubuntu/focal ${VM} -p default -p vm --vm
lxc config set ${VM} limits.cpu ${CPU}
lxc config set ${VM} limits.memory ${MEM}
lxc config device override ${VM} root size=${DISK}
lxc start ${VM}
```

# Centos7
```
lxc launch images:centos/7/amd64 centos7
```

Envoy from nginx for ingress

2026-06-22T05:29:40Z

Busk:

go install github.com/kubernetes-sigs/ingress2gateway@latest

# Translate an existing NGINX ingress into Gateway API manifests
ingress2gateway print --providers ingress-nginx > new-envoy-routes.yaml

ingress-to-envoy-gateway.sh
```
#!/usr/bin/env bash
set -euo pipefail

usage() {
cat <<'USAGE'
Usage:
scripts/ingress-to-envoy-gateway.sh -n NAMESPACE INGRESS [options]

Converts one Kubernetes Ingress into Gateway API resources for Envoy Gateway.
By default the script prints YAML. Use --apply to apply it.

Options:
--gateway NAME Gateway name. Default: INGRESS-gateway
--gateway-namespace NAMESPACE Gateway namespace. Default: Ingress namespace
--use-existing-gateway Do not emit a Gateway; attach routes to --gateway
--gateway-class NAME GatewayClass name. Default: eg
--issuer NAME ClusterIssuer name for generated Certificates. Default: letsencrypt-prod
--emit-certificate Emit cert-manager Certificate resources for Ingress TLS secrets.
With --use-existing-gateway, Certificates are emitted in
the Gateway namespace and --apply patches the Gateway
HTTPS listener certificateRefs.
--force-tls Route to the HTTPS listener even if the Ingress has no TLS block
--tls-secret NAME TLS Secret/Certificate name to use with --force-tls
--backend-tls none|system|ca Handle nginx backend-protocol=HTTPS. Default: none
--backend-tls-hostname NAME SNI/validation hostname for BackendTLSPolicy. Default: first Ingress host
--backend-tls-ca-configmap NAME
ConfigMap with ca.crt when --backend-tls=ca
--apply Apply generated YAML instead of printing it
-h, --help Show this help

Examples:
# Preview conversion for uapp/ucontrol-ui.
scripts/ingress-to-envoy-gateway.sh -n uapp ucontrol-ui --backend-tls system

# Apply conversion.
scripts/ingress-to-envoy-gateway.sh -n uapp ucontrol-ui --backend-tls system --apply

# Attach uapp/ucontrol-ui to an existing central Gateway.
scripts/ingress-to-envoy-gateway.sh -n uapp ucontrol-ui \
--use-existing-gateway \
--gateway default-gateway \
--gateway-namespace example-io \
--backend-tls system

Notes:
- The original Ingress is not changed or deleted.
- DNS must be moved to the new Envoy Gateway IP after verification.
- nginx.ingress.kubernetes.io/backend-protocol=HTTPS requires BackendTLSPolicy.
Use --backend-tls system for publicly trusted backend certs, or --backend-tls ca
with --backend-tls-ca-configmap for private CAs.
USAGE
}

die() {
printf 'error: %s\n' "$*" >&2
exit 1
}

need() {
command -v "$1" >/dev/null 2>&1 || die "missing required command: $1"
}

default_kubectl() {
if [[ -x /snap/kubectl/current/kubectl ]]; then
printf '%s\n' /snap/kubectl/current/kubectl
else
printf '%s\n' kubectl
fi
}

yaml_quote() {
printf '%s' "$1" | sed "s/'/''/g; s/^/'/; s/$/'/"
}

resource_name() {
printf '%s' "$1" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9.-]+/-/g; s/^-+//; s/-+$//' | cut -c1-63
}

resolve_service_port() {
local svc="$1"
local port_name="$2"

"$kubectl_cmd" get svc -n "$namespace" "$svc" -o json |
jq -r --arg name "$port_name" '
.spec.ports[] | select(.name == $name) | .port
' | head -n 1
}

gateway_has_cert_ref() {
local secret="$1"

"$kubectl_cmd" get gateway -n "$gateway_namespace" "$gateway" -o json |
jq -e --arg secret "$secret" '
.spec.listeners[]
| select(.name == "https")
| (.tls.certificateRefs // [])
| any(.name == $secret)
' >/dev/null
}

patch_gateway_cert_ref() {
local secret="$1"

if gateway_has_cert_ref "$secret"; then
printf 'Gateway %s/%s already references TLS secret %s\n' "$gateway_namespace" "$gateway" "$secret" >&2
return
fi

"$kubectl_cmd" patch gateway "$gateway" -n "$gateway_namespace" --type json \
-p="[{\"op\":\"add\",\"path\":\"/spec/listeners/1/tls/certificateRefs/-\",\"value\":{\"name\":\"$secret\"}}]"
}

namespace=""
ingress=""
gateway=""
gateway_namespace=""
create_gateway="true"
gateway_class="eg"
issuer="letsencrypt-prod"
emit_certificate="false"
backend_tls="none"
backend_tls_hostname=""
backend_tls_ca_configmap=""
force_tls="false"
tls_secret_override=""
apply="false"
kubectl_cmd="${KUBECTL:-$(default_kubectl)}"

while [[ $# -gt 0 ]]; do
case "$1" in
-n|--namespace)
namespace="${2:-}"
shift 2
;;
--gateway)
gateway="${2:-}"
shift 2
;;
--gateway-namespace)
gateway_namespace="${2:-}"
shift 2
;;
--use-existing-gateway)
create_gateway="false"
shift
;;
--gateway-class)
gateway_class="${2:-}"
shift 2
;;
--issuer)
issuer="${2:-}"
shift 2
;;
--emit-certificate)
emit_certificate="true"
shift
;;
--force-tls)
force_tls="true"
shift
;;
--tls-secret)
tls_secret_override="${2:-}"
shift 2
;;
--backend-tls)
backend_tls="${2:-}"
shift 2
;;
--backend-tls-hostname)
backend_tls_hostname="${2:-}"
shift 2
;;
--backend-tls-ca-configmap)
backend_tls_ca_configmap="${2:-}"
shift 2
;;
--apply)
apply="true"
shift
;;
-h|--help)
usage
exit 0
;;
-*)
die "unknown option: $1"
;;
*)
if [[ -n "$ingress" ]]; then
die "unexpected extra argument: $1"
fi
ingress="$1"
shift
;;
esac
done

[[ -n "$namespace" ]] || die "namespace is required"
[[ -n "$ingress" ]] || die "ingress name is required"
case "$backend_tls" in
none|system|ca) ;;
*) die "--backend-tls must be one of: none, system, ca" ;;
esac
if [[ "$backend_tls" == "ca" && -z "$backend_tls_ca_configmap" ]]; then
die "--backend-tls-ca-configmap is required when --backend-tls=ca"
fi
if [[ "$force_tls" == "true" && -z "$tls_secret_override" ]]; then
die "--tls-secret is required when --force-tls is set"
fi

need jq
need sed
need tr
need cut
need head
if [[ "$kubectl_cmd" == */* ]]; then
[[ -x "$kubectl_cmd" ]] || die "kubectl is not executable: $kubectl_cmd"
else
need "$kubectl_cmd"
fi

gateway="${gateway:-$(resource_name "${ingress}-gateway")}"
gateway_namespace="${gateway_namespace:-$namespace}"

ingress_json="$("$kubectl_cmd" get ingress -n "$namespace" "$ingress" -o json)"

mapfile -t hosts < <(jq -r '.spec.rules[]?.host // empty' <<<"$ingress_json" | awk 'NF' | sort -u)
[[ "${#hosts[@]}" -gt 0 ]] || die "Ingress has no host rules"

if [[ -z "$backend_tls_hostname" ]]; then
backend_tls_hostname="${hosts[0]}"
fi

mapfile -t tls_secrets < <(jq -r '.spec.tls[]?.secretName // empty' <<<"$ingress_json" | awk 'NF' | sort -u)
if [[ -n "$tls_secret_override" ]]; then
tls_secrets=("$tls_secret_override")
fi
has_tls="false"
if [[ "${#tls_secrets[@]}" -gt 0 || "$force_tls" == "true" ]]; then
has_tls="true"
fi
if [[ "$create_gateway" == "false" && "$has_tls" == "true" ]]; then
emit_certificate="true"
fi

ssl_redirect="$(
jq -r '
.metadata.annotations["nginx.ingress.kubernetes.io/ssl-redirect"] //
.metadata.annotations["nginx.ingress.kubernetes.io/force-ssl-redirect"] //
"false"
' <<<"$ingress_json"
)"
backend_protocol="$(jq -r '.metadata.annotations["nginx.ingress.kubernetes.io/backend-protocol"] // "HTTP"' <<<"$ingress_json" | tr '[:lower:]' '[:upper:]')"

if [[ "$backend_protocol" == "HTTPS" && "$backend_tls" == "none" ]]; then
printf 'warning: %s/%s uses nginx backend-protocol=HTTPS; generated route will need BackendTLSPolicy or backend HTTP support.\n' "$namespace" "$ingress" >&2
fi

tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT

{
if [[ "$create_gateway" == "true" ]]; then
cat <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: $gateway
namespace: $gateway_namespace
labels:
app.kubernetes.io/managed-by: ingress-to-envoy-gateway
app.kubernetes.io/source-ingress: $ingress
spec:
gatewayClassName: $gateway_class
listeners:
- name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Same
EOF

if [[ "$has_tls" == "true" ]]; then
cat <<'EOF'
- name: https
port: 443
protocol: HTTPS
tls:
mode: Terminate
certificateRefs:
EOF
for secret in "${tls_secrets[@]}"; do
printf ' - name: %s\n' "$secret"
done
cat <<'EOF'
allowedRoutes:
namespaces:
from: Same
EOF
fi
printf '%s\n' '---'
fi

cat <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: $ingress
namespace: $namespace
labels:
app.kubernetes.io/managed-by: ingress-to-envoy-gateway
app.kubernetes.io/source-ingress: $ingress
spec:
hostnames:
EOF
for host in "${hosts[@]}"; do
printf ' - %s\n' "$(yaml_quote "$host")"
done
cat <<EOF
parentRefs:
- name: $gateway
namespace: $gateway_namespace
sectionName: $([[ "$has_tls" == "true" ]] && printf 'https' || printf 'http')
rules:
EOF

route_count="$(jq '[.spec.rules[]?.http.paths[]?] | length' <<<"$ingress_json")"
[[ "$route_count" != "0" ]] || die "Ingress has no HTTP paths"

for i in $(seq 0 "$((route_count - 1))"); do
item="$(jq -c "[.spec.rules[]?.http.paths[]?][$i]" <<<"$ingress_json")"
path="$(jq -r '.path // "/"' <<<"$item")"
path_type="$(jq -r '.pathType // "Prefix"' <<<"$item")"
svc="$(jq -r '.backend.service.name // empty' <<<"$item")"
port_number="$(jq -r '.backend.service.port.number // empty' <<<"$item")"
port_name="$(jq -r '.backend.service.port.name // empty' <<<"$item")"

[[ -n "$svc" ]] || die "path $i has no Service backend"
if [[ -z "$port_number" && -n "$port_name" ]]; then
port_number="$(resolve_service_port "$svc" "$port_name")"
[[ -n "$port_number" ]] || die "could not resolve named port $svc/$port_name"
fi
[[ -n "$port_number" ]] || die "path $i has no Service port"

case "$path_type" in
Prefix) gateway_path_type="PathPrefix" ;;
Exact) gateway_path_type="Exact" ;;
ImplementationSpecific) gateway_path_type="PathPrefix" ;;
*) gateway_path_type="PathPrefix" ;;
esac

cat <<EOF
- matches:
- path:
type: $gateway_path_type
value: $(yaml_quote "$path")
backendRefs:
- name: $svc
port: $port_number
EOF
done

if [[ "$has_tls" == "true" ]] && { [[ "$ssl_redirect" == "true" ]] || [[ "$force_tls" == "true" ]]; }; then
cat <<EOF
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: $(resource_name "${ingress}-https-redirect")
namespace: $namespace
labels:
app.kubernetes.io/managed-by: ingress-to-envoy-gateway
app.kubernetes.io/source-ingress: $ingress
spec:
hostnames:
EOF
for host in "${hosts[@]}"; do
printf ' - %s\n' "$(yaml_quote "$host")"
done
cat <<EOF
parentRefs:
- name: $gateway
namespace: $gateway_namespace
sectionName: http
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
matches:
- path:
type: PathPrefix
value: /
EOF
fi

if [[ "$backend_protocol" == "HTTPS" && "$backend_tls" != "none" ]]; then
mapfile -t https_services < <(
jq -r '.spec.rules[]?.http.paths[]?.backend.service.name // empty' <<<"$ingress_json" |
awk 'NF' | sort -u
)
for svc in "${https_services[@]}"; do
cat <<EOF
---
apiVersion: gateway.networking.k8s.io/v1
kind: BackendTLSPolicy
metadata:
name: $(resource_name "${ingress}-${svc}-backend-tls")
namespace: $namespace
labels:
app.kubernetes.io/managed-by: ingress-to-envoy-gateway
app.kubernetes.io/source-ingress: $ingress
spec:
targetRefs:
- group: ""
kind: Service
name: $svc
validation:
hostname: $(yaml_quote "$backend_tls_hostname")
EOF
if [[ "$backend_tls" == "system" ]]; then
cat <<'EOF'
wellKnownCACertificates: System
EOF
else
cat <<EOF
caCertificateRefs:
- group: ""
kind: ConfigMap
name: $backend_tls_ca_configmap
EOF
fi
done
fi

if [[ "$emit_certificate" == "true" && "$has_tls" == "true" ]]; then
for secret in "${tls_secrets[@]}"; do
mapfile -t cert_hosts < <(
jq -r --arg secret "$secret" '
.spec.tls[]? | select(.secretName == $secret) | .hosts[]?
' <<<"$ingress_json" | awk 'NF' | sort -u
)
[[ "${#cert_hosts[@]}" -gt 0 ]] || cert_hosts=("${hosts[@]}")
cat <<EOF
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: $secret
namespace: $([[ "$create_gateway" == "false" ]] && printf '%s' "$gateway_namespace" || printf '%s' "$namespace")
labels:
app.kubernetes.io/managed-by: ingress-to-envoy-gateway
app.kubernetes.io/source-ingress: $ingress
spec:
secretName: $secret
dnsNames:
EOF
for host in "${cert_hosts[@]}"; do
printf ' - %s\n' "$(yaml_quote "$host")"
done
cat <<EOF
issuerRef:
group: cert-manager.io
kind: ClusterIssuer
name: $issuer
EOF
done
fi
} >"$tmp"

if [[ "$apply" == "true" ]]; then
"$kubectl_cmd" apply -f "$tmp"
if [[ "$create_gateway" == "false" && "$has_tls" == "true" ]]; then
for secret in "${tls_secrets[@]}"; do
patch_gateway_cert_ref "$secret"
done
fi
else
cat "$tmp"
fi
```

Envoy from nginx for ingress

2026-06-22T02:18:10Z

Busk: Created page with "go install github.com/kubernetes-sigs/ingress2gateway@latest # Translate an existing NGINX ingress into Gateway API manifests ingress2gateway print --providers ingress-nginx..."

go install github.com/kubernetes-sigs/ingress2gateway@latest

# Translate an existing NGINX ingress into Gateway API manifests
ingress2gateway print --providers ingress-nginx > new-envoy-routes.yaml

AI notes

2026-06-20T10:24:51Z

Busk: Created page with "https://youtu.be/sOPDGQjFcuM?is=pGCLuNECaFYHC2xa"

https://youtu.be/sOPDGQjFcuM?is=pGCLuNECaFYHC2xa

Docker install

2026-06-19T23:10:20Z

Busk:

# Install

## Ubuntu Docker-CE Install using zfs for data mount
```
#!/bin/bash

set -e

DATASET_NAME="tank-nvme/docker"
DOCKER_DIR="/var/lib/docker"

if ! sudo zfs list "${DATASET_NAME%%/*}" &>/dev/null; then
echo "Error: ZFS pool '${DATASET_NAME%%/*}' does not exist." >&2
exit 1
fi

if sudo zfs list "$DATASET_NAME" &>/dev/null; then
echo "ZFS dataset $DATASET_NAME already exists."
else
sudo zfs create -o mountpoint=legacy "$DATASET_NAME"
fi

# Add Docker's official GPG key:
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

sudo systemctl stop docker
sudo systemctl stop docker.socket

sudo mkdir -p "$DOCKER_DIR"

if ! mountpoint -q "$DOCKER_DIR"; then
sudo mount -t zfs "$DATASET_NAME" "$DOCKER_DIR"
fi

if ! grep -q "$DATASET_NAME" /etc/fstab; then
echo "$DATASET_NAME $DOCKER_DIR zfs defaults 0 0" | sudo tee -a /etc/fstab > /dev/null
fi

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json > /dev/null <<EOF
{
"storage-driver": "zfs"
}
EOF

sudo systemctl start docker
sleep 5
sudo docker run hello-world
```

Docker install

2026-06-19T23:08:21Z

Busk:

# Install

## Ubuntu Install using zfs for data
```
#!/bin/bash

set -e

DATASET_NAME="tank-nvme/docker"
DOCKER_DIR="/var/lib/docker"

if ! sudo zfs list "${DATASET_NAME%%/*}" &>/dev/null; then
echo "Error: ZFS pool '${DATASET_NAME%%/*}' does not exist." >&2
exit 1
fi

if sudo zfs list "$DATASET_NAME" &>/dev/null; then
echo "ZFS dataset $DATASET_NAME already exists."
else
sudo zfs create -o mountpoint=legacy "$DATASET_NAME"
fi

# Add Docker's official GPG key:
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

sudo systemctl stop docker
sudo systemctl stop docker.socket

sudo mkdir -p "$DOCKER_DIR"

if ! mountpoint -q "$DOCKER_DIR"; then
sudo mount -t zfs "$DATASET_NAME" "$DOCKER_DIR"
fi

if ! grep -q "$DATASET_NAME" /etc/fstab; then
echo "$DATASET_NAME $DOCKER_DIR zfs defaults 0 0" | sudo tee -a /etc/fstab > /dev/null
fi

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json > /dev/null <<EOF
{
"storage-driver": "zfs"
}
EOF

sudo systemctl start docker
sleep 5
sudo docker run hello-world
```

Docker install

2026-06-19T23:07:23Z

Busk:

#!/bin/bash

set -e

DATASET_NAME="tank-nvme/docker"
DOCKER_DIR="/var/lib/docker"

if ! sudo zfs list "${DATASET_NAME%%/*}" &>/dev/null; then
echo "Error: ZFS pool '${DATASET_NAME%%/*}' does not exist." >&2
exit 1
fi

if sudo zfs list "$DATASET_NAME" &>/dev/null; then
echo "ZFS dataset $DATASET_NAME already exists."
else
sudo zfs create -o mountpoint=legacy "$DATASET_NAME"
fi

# Add Docker's official GPG key:
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update

sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

sudo systemctl stop docker
sudo systemctl stop docker.socket

sudo mkdir -p "$DOCKER_DIR"

if ! mountpoint -q "$DOCKER_DIR"; then
sudo mount -t zfs "$DATASET_NAME" "$DOCKER_DIR"
fi

if ! grep -q "$DATASET_NAME" /etc/fstab; then
echo "$DATASET_NAME $DOCKER_DIR zfs defaults 0 0" | sudo tee -a /etc/fstab > /dev/null
fi

sudo mkdir -p /etc/docker
sudo tee /etc/docker/daemon.json > /dev/null <<EOF
{
"storage-driver": "zfs"
}
EOF

sudo systemctl start docker
sleep 5
sudo docker run hello-world
```

Zfs pool

2026-06-15T21:46:57Z

Busk:

```
sudo zpool create -o ashift=12 tank-nvme mirror /dev/disk/by-id/nvme-eui.0025385281b1b872 /dev/disk/by-id/nvme-eui.0025385281b1b878

sudo wipefs -a /dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3X3NF0K204029J
sudo wipefs -a /dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3X3NF0K204035E

sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RMS
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RPX
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN0339T
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RFB

sudo zpool create -o ashift=12 tank-hdd mirror /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RMS /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RPX mirror /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN0339T /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RFB
```

sudo zfs create -o atime=off -o compression=lz4 -o xattr=sa -o acltype=posixacl tank-nvme/lxd

## ashift

`ashift` stands for **alignment shift**. It dictates the minimum block size ZFS will use when formatting and writing data to the physical storage devices in your pool.

The number you provide is an exponent of 2:

* `ashift=9` means $2^9=512$ bytes.
* `ashift=12` means $2^{12}=4096$ bytes (4K).
* `ashift=13` means $2^{13}=8192$ bytes (8K).

Here is why forcing `ashift=12` is critical for modern storage.

### **The 512-byte Lie (Emulation)**

Historically, hard drives used physical sectors that were exactly 512 bytes in size. However, almost all modern hard drives and SSDs use **Advanced Format**, meaning their physical layout is built on 4096-byte (4K) sectors. This larger size allows for higher storage density and better error correction.

To avoid breaking older operating systems and legacy hardware controllers, many modern 4K drives "lie" to the host system. They use a firmware feature called **512e (512-byte emulation)** to report themselves as having old-school 512-byte sectors, even though their physical architecture is 4K.

### **The Read-Modify-Write Penalty**

If you create a ZFS pool without specifying the `ashift` value, ZFS will often interrogate the drive, hear the 512-byte lie, and set `ashift=9`. This creates a severe misalignment between ZFS's logical blocks and the drive's physical sectors.

If ZFS attempts to write a 512-byte block to a physical 4K sector, the storage drive is forced to execute a **Read-Modify-Write** operation:

1. **Read:** The drive reads the entire 4K physical sector into its internal memory.
2. **Modify:** The drive inserts the 512 bytes ZFS sent into the 4K block.
3. **Write:** The drive writes the whole 4K sector back to the disk.

This massive overhead completely destroys write performance (especially random I/O) and causes severe "write amplification," which prematurely burns through the endurance limits of NVMe and SSD drives.

### **The Solution**

By explicitly appending `-o ashift=12` to your `zpool create` command, you force ZFS to align all of its data payloads to exact 4K boundaries. This ensures ZFS writes map perfectly to the physical hardware beneath it, entirely bypassing the emulation penalty and ensuring optimal throughput and drive lifespan.

> **Note:** The `ashift` value is permanently baked into a top-level virtual device (vdev) at the moment of creation. If you create a pool with the wrong `ashift`, it cannot be changed later; you have to destroy the pool, wipe the drives, and start over.

Zfs pool

2026-06-15T20:56:16Z

Busk:

```
sudo zpool create -o ashift=12 tank-nvme mirror /dev/disk/by-id/nvme-eui.0025385281b1b872 /dev/disk/by-id/nvme-eui.0025385281b1b878

sudo wipefs -a /dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3X3NF0K204029J
sudo wipefs -a /dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3X3NF0K204035E

sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RMS
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RPX
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN0339T
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RFB

sudo zpool create -o ashift=12 tank-hdd mirror /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RMS /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RPX mirror /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN0339T /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RFB
```

## ashift

`ashift` stands for **alignment shift**. It dictates the minimum block size ZFS will use when formatting and writing data to the physical storage devices in your pool.

The number you provide is an exponent of 2:

* `ashift=9` means $2^9=512$ bytes.
* `ashift=12` means $2^{12}=4096$ bytes (4K).
* `ashift=13` means $2^{13}=8192$ bytes (8K).

Here is why forcing `ashift=12` is critical for modern storage.

### **The 512-byte Lie (Emulation)**

Historically, hard drives used physical sectors that were exactly 512 bytes in size. However, almost all modern hard drives and SSDs use **Advanced Format**, meaning their physical layout is built on 4096-byte (4K) sectors. This larger size allows for higher storage density and better error correction.

To avoid breaking older operating systems and legacy hardware controllers, many modern 4K drives "lie" to the host system. They use a firmware feature called **512e (512-byte emulation)** to report themselves as having old-school 512-byte sectors, even though their physical architecture is 4K.

### **The Read-Modify-Write Penalty**

If you create a ZFS pool without specifying the `ashift` value, ZFS will often interrogate the drive, hear the 512-byte lie, and set `ashift=9`. This creates a severe misalignment between ZFS's logical blocks and the drive's physical sectors.

If ZFS attempts to write a 512-byte block to a physical 4K sector, the storage drive is forced to execute a **Read-Modify-Write** operation:

1. **Read:** The drive reads the entire 4K physical sector into its internal memory.
2. **Modify:** The drive inserts the 512 bytes ZFS sent into the 4K block.
3. **Write:** The drive writes the whole 4K sector back to the disk.

This massive overhead completely destroys write performance (especially random I/O) and causes severe "write amplification," which prematurely burns through the endurance limits of NVMe and SSD drives.

### **The Solution**

By explicitly appending `-o ashift=12` to your `zpool create` command, you force ZFS to align all of its data payloads to exact 4K boundaries. This ensures ZFS writes map perfectly to the physical hardware beneath it, entirely bypassing the emulation penalty and ensuring optimal throughput and drive lifespan.

> **Note:** The `ashift` value is permanently baked into a top-level virtual device (vdev) at the moment of creation. If you create a pool with the wrong `ashift`, it cannot be changed later; you have to destroy the pool, wipe the drives, and start over.

Zfs pool

2026-06-15T20:52:51Z

Busk:

```
sudo zpool create -o ashift=12 tank-nvme mirror /dev/disk/by-id/nvme-eui.0025385281b1b872 /dev/disk/by-id/nvme-eui.0025385281b1b878

sudo wipefs -a /dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3X3NF0K204029J
sudo wipefs -a /dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3X3NF0K204035E

sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RMS
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RPX
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN0339T
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RFB

sudo zpool create -o ashift=12 tank-hdd mirror /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RMS /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RPX mirror /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN0339T /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RFB
```

## ashift

ashift stands for alignment shift. It dictates the minimum block size ZFS will use when formatting and writing data to the physical storage devices in your pool.The number you provide is an exponent of 2:ashift=9 means $2^9=512$ bytes.ashift=12 means $2^{12}=4096$ bytes (4K).ashift=13 means $2^{13}=8192$ bytes (8K).Here is why forcing ashift=12 is critical for modern storage.The 512-byte Lie (Emulation)Historically, hard drives used physical sectors that were exactly 512 bytes in size. However, almost all modern hard drives and SSDs use Advanced Format, meaning their physical layout is built on 4096-byte (4K) sectors. This larger size allows for higher storage density and better error correction.To avoid breaking older operating systems and legacy hardware controllers, many modern 4K drives "lie" to the host system. They use a firmware feature called 512e (512-byte emulation) to report themselves as having old-school 512-byte sectors, even though their physical architecture is 4K.The Read-Modify-Write PenaltyIf you create a ZFS pool without specifying the ashift value, ZFS will often interrogate the drive, hear the 512-byte lie, and set ashift=9. This creates a severe misalignment between ZFS's logical blocks and the drive's physical sectors.If ZFS attempts to write a 512-byte block to a physical 4K sector, the storage drive is forced to execute a Read-Modify-Write operation:Read: The drive reads the entire 4K physical sector into its internal memory.Modify: The drive inserts the 512 bytes ZFS sent into the 4K block.Write: The drive writes the whole 4K sector back to the disk.This massive overhead completely destroys write performance (especially random I/O) and causes severe "write amplification," which prematurely burns through the endurance limits of NVMe and SSD drives.The SolutionBy explicitly appending -o ashift=12 to your zpool create command, you force ZFS to align all of its data payloads to exact 4K boundaries. This ensures ZFS writes map perfectly to the physical hardware beneath it, entirely bypassing the emulation penalty and ensuring optimal throughput and drive lifespan.Note: The ashift value is permanently baked into a top-level virtual device (vdev) at the moment of creation. If you create a pool with the wrong ashift, it cannot be changed later; you have to destroy the pool, wipe the drives, and start over.

Zfs pool

2026-06-15T20:47:33Z

Busk:

Zfs pool

2026-06-15T20:47:12Z

Busk: Created page with " ``` sudo zpool create -o ashift=12 tank1 mirror /dev/disk/by-id/nvme-eui.0025385281b1b872 /dev/disk/by-id/nvme-eui.0025385281b1b878 sudo wipefs -a /dev/disk/by-id/nvme-Samsu..."

```
sudo zpool create -o ashift=12 tank1 mirror /dev/disk/by-id/nvme-eui.0025385281b1b872 /dev/disk/by-id/nvme-eui.0025385281b1b878

sudo wipefs -a /dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3X3NF0K204029J
sudo wipefs -a /dev/disk/by-id/nvme-Samsung_SSD_960_EVO_1TB_S3X3NF0K204035E

sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RMS
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RPX
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN0339T
sudo wipefs -a /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RFB

sudo zpool create -o ashift=12 mypool mirror /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RMS /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RPX mirror /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN0339T /dev/disk/by-id/ata-ST4000DM004-2CV104_ZFN07RFB
```