Infrastructure on nidomiro

More secure DinD in GitLab CI

Thu, 31 Dec 2020 12:00:00 +0000

If you are reading this article you probably already know how to use DinD (DockerInDocker) in GitLab CI. The default way is to set privileged=true in your Runner-config.

This little flag makes everything work; but at the cost of security. There are many articles regarding this topic, eg. this one. The baseline is, if you run a container privileged, and the container uses the root-user inside, you can lose the whole server.

More secure deployments via ssh

Fri, 21 Aug 2020 12:00:00 +0000

If we deploy an application automatically we have to grant the CI (Continuous Integration) access to the server. Common practice is to do that via a GitLab Runner or an ssh account on the server.

Personally I would not recommend using a GitLab Runner for deployments, because you have to maintain it. Another potential issue is, that you normally register runners for your whole GitLab instance or groups. That results in a scenario in which everyone can use that runner and accidentally (or not) destroy, for example, your production server. To avoid that you have to register the GitLab Runner in the Project it belongs to only. But even then your production server can be misused as a build worker and therefore create performance issues.

Handling server configurations

Wed, 15 Jul 2020 12:00:00 +0000

Intro

During my work as a programmer I often encountered that configuration and infrastructure files only lived on the servers they belog to. If they had a copy in git, the states would always divert over time. One reason for this diverting is that you actively have to put the changed files in git, after you finished your work. It’s simply a thing you can forget.

What do I mean by “infrastructure files”? For me infrastructure files are files, that you need to configure the server itself, e.g. nginx-config, docker-compose.yml, … .

Switching to Hugo

Wed, 17 Jun 2020 12:00:00 +0200

If you see this post, my WordPress blog is gone.

My Blog now uses Hugo. I really like formats like Markdown and AsciiDoc. These formats are expressive, and you can edit them with every editor you want and don’t need expensive licenses, like for Word or similar. Another advantage is that you define what should happen by writing and not by clicking a button and hoping the program does what you intended to do.

Install cmake 3.11.1 on Ubuntu

Tue, 17 Apr 2018 20:00:00 +0200

Sometimes you just want a newer version than ubuntu ships. This code will update cmake to version 3.11.1 or any other version you want.

Automatic VirtualBox module signing for UEFI

Tue, 17 Apr 2018 19:49:00 +0200

These steps are for all those people who hate to sign the Virtualbox modules every time and don’t want to disable UEFI.

Ubuntu: automatic password for second encrypted disk

Thu, 15 Dec 2016 21:23:00 +0200

I just encountered the problem that I have to type two passwords at startup, for two encrypted disks. My first disk is encrypted through the Ubuntu installer. After some searching I found the perfect solution for that task. In german, it’s called “Schlüsselableitung”, in English derived keys. But perfect solutions often have a big issue why they don’t work, like here. I’m using Ubuntu 16.04 which uses ´systemd´, and that has problems with derived keys. So I found the second most perfect solution for me, using a key-file. Some people argue that this is a security issue, but the derived key is also obtainable with root rights, just like a key-file. And by the way, your private keys of your certificates are also stored on that disks and nearly nobody complains about that.

How to work on your projects on multiple devices

Tue, 27 Sep 2016 22:26:00 +0200

In the beginning of my programming-life I’ve never thought of synchronization of my projects as an issue. Back at the time I only had a Computer standing in my room. Then I got a Laptop from the company I worked for back at the time. Still, synchronization was not an issue by now because I kept private and work separate. But the whole journey began when I started studying, and I bought myself a Laptop. In the beginning I used a USB-drive to copy my workspace on, after I finished on one device, and copied it to the other machine then. It was simply ugly… After a few weeks I had hundreds of different versions, because I worked a bit on the Laptop, forgot to copy it to my Pc but wanted to save the possible progress I made.