https://www.renemoser.net/blog/Recent content in Blogs on René MoserHugoen-usMon, 19 Mar 2018 22:23:30 +0100https://www.renemoser.net/blog/2018/03/19/vultr-and-firewalling/Mon, 19 Mar 2018 22:23:30 +0100https://www.renemoser.net/blog/2018/03/19/vultr-and-firewalling/This is the second part of a post series What’s new in Ansible 2.5. In the previous post we learned the basic steps to deploy a server on Vultr. In this follow up post, you will see how we can secure our server. This post was written in 2018 for Ansible 2.5, when the Vultr modules shipped with Ansible itself as vr_*. They were renamed to vultr_* in Ansible 2.8 and today live in the vultr.https://www.renemoser.net/blog/2018/03/18/vultr-with-ansible/Sun, 18 Mar 2018 15:14:49 +0100https://www.renemoser.net/blog/2018/03/18/vultr-with-ansible/Ansible 2.5 is just around the corner, perfect timing to show some of the new features I was involved with and included in this release. This is the first part of a post series What’s new in Ansible 2.5. This post was written in 2018 for Ansible 2.5, when the Vultr modules shipped with Ansible itself as vr_*. They were renamed to vultr_* in Ansible 2.8 and today live in the vultr.https://www.renemoser.net/blog/2017/09/02/ansible-handlers-listen/Sat, 02 Sep 2017 00:00:00 +0000https://www.renemoser.net/blog/2017/09/02/ansible-handlers-listen/Since version Ansible 2.2, so quite a while, there is another way to notify a handler or a couple of handlers or no handlers. No handlers? Right, this sounds a bit funny, doesn’t it? Well, it is a bit comparable with talking to kids: if no one is listening, no one will react :). Notifying Handlers Before 2.2, there was only one way to notify a handler, by notifying the name of the handler:https://www.renemoser.net/blog/2017/08/19/exoscale-dns-with-ansible/Sat, 19 Aug 2017 00:00:00 +0000https://www.renemoser.net/blog/2017/08/19/exoscale-dns-with-ansible/Introduction In this post I will show you how to use Ansible to configure DNS records on Exoscale, a Swiss public cloud provider. Exoscale offers a DNS service at an affordable price, with geo replication, anycast and an API. The two modules we are going to use, exo_dns_domain and exo_dns_record, are ones I wrote, and they have shipped with Ansible since version 2.2.0. This post was written in 2017, when these modules were part of Ansible itself.https://www.renemoser.net/blog/2016/01/09/release-strategies/Sat, 09 Jan 2016 00:00:00 +0000https://www.renemoser.net/blog/2016/01/09/release-strategies/Every now and then I run into a discussion about how releases should be done: how to tag them, which git workflow to use, how often to ship. I would like to share how I do releases, and how I like to see a project do releases as a user of its software. Releases What is a release? A release is a named snapshot of a development cycle — a version.https://www.renemoser.net/blog/2014/04/28/manage-bind-and-zones-files-using-ansible/Mon, 28 Apr 2014 00:00:00 +0000https://www.renemoser.net/blog/2014/04/28/manage-bind-and-zones-files-using-ansible/You might have seen my quite simple role ansible-bind-role which lets you manage your bind configs and syncs your zone files. Precondition First let me explain why zones files are not generated in this role: My precondition was, that zones might come from different sources. They may be generated from an application or rsynced from anywhere else. Further, I didn’t want to force people to handle zone files the one way.https://www.renemoser.net/blog/2014/03/27/using-vagrant-for-ansible-roles/Thu, 27 Mar 2014 00:00:00 +0000https://www.renemoser.net/blog/2014/03/27/using-vagrant-for-ansible-roles/Continuous integration will tell you whether a role still applies cleanly, but while you are writing one you want a faster loop: a machine you can throw away, apply the role to, break, and recreate. A local hypervisor such as VirtualBox plus Vagrant gives you exactly that for a role like ansible-role-ntp. This post was written in 2014 for Vagrant 1.x and Ansible 1.x. The Vagrantfile below has been updated so it still works: the original precise32 box and the files.https://www.renemoser.net/blog/2013/12/30/european-timetable-console/Mon, 30 Dec 2013 00:00:00 +0000https://www.renemoser.net/blog/2013/12/30/european-timetable-console/If you want a properly geeky departure board for your train connections — on your own terminal, or on a wallboard at an event — you can have one in two commands. This post is from 2013. fahrplan is a thin client over the public transport.opendata.ch API and has seen little development since; the API itself is unofficial and its response format has changed over the years. Note also that pip install into the system Python is refused on current distributions — use pipx or a virtual environment, as below.https://www.renemoser.net/blog/2009/11/22/convert-avi-into-mp3-on-linux/Sun, 22 Nov 2009 00:00:00 +0000https://www.renemoser.net/blog/2009/11/22/convert-avi-into-mp3-on-linux/I look this up every few months, so here it is in one place. ffmpeg takes the video apart and writes just the audio track to an MP3 file. The whole file: ffmpeg -i sample.avi -vn -c:a libmp3lame -b:a 256k sample.mp3 -vn drops the video stream, -c:a libmp3lame selects the MP3 encoder and -b:a 256k sets the audio bitrate. For a variable bitrate instead, replace -b:a 256k with -q:a 2, which gives roughly 190 kbit/s at a noticeably better size-to-quality ratio.https://www.renemoser.net/blog/2009/09/02/postfix-host-not-found-try-again/Wed, 02 Sep 2009 00:00:00 +0000https://www.renemoser.net/blog/2009/09/02/postfix-host-not-found-try-again/If you configured Postfix to relay all outgoing mail through a smarthost and that host does not have an MX record — or does not have one anymore — the queue starts filling up and the log fills with deferrals: Jul 14 12:45:39 myhostname postfix/smtp[2349]: 74FBF30501: to=<recipient@example.org> relay=none, delay=3944, status=deferred (Name service error for name=smtp.example.com type=MX: Host not found, try again) The Postfix FAQ is right about the cause, which still leaves the question of what to do about it.https://www.renemoser.net/blog/2008/12/23/assign-ips-to-geographical-location/Tue, 23 Dec 2008 00:00:00 +0000https://www.renemoser.net/blog/2008/12/23/assign-ips-to-geographical-location/Knowing roughly where a visitor is connecting from is genuinely useful: you can send them to the shop of their own country, show events happening near them, or keep whole regions away from your SSH daemon. It is not, however, something to build a security control on. Visitors behind a proxy in another country, behind a corporate VPN, or coming out of a Tor exit node will be placed wherever their exit point is, and mobile carriers routinely hand out addresses that geolocate hundreds of kilometres from the actual device.https://www.renemoser.net/blog/2008/12/09/use-dns-blacklists-in-php/Tue, 09 Dec 2008 00:00:00 +0000https://www.renemoser.net/blog/2008/12/09/use-dns-blacklists-in-php/A DNS blacklist (DNSBL) is queried like any other DNS name: reverse the octets of the address you want to check, append the zone of the list, and resolve it. If the name resolves, the address is listed. No API keys, no HTTP client, no library — a resolver is all you need. The snippet below checks one address against a list of DNSBL zones and stops at the first hit.https://www.renemoser.net/blog/2008/06/23/signserver-application-framework-in-java-performing-cryptographic-operations/Mon, 23 Jun 2008 00:00:00 +0000https://www.renemoser.net/blog/2008/06/23/signserver-application-framework-in-java-performing-cryptographic-operations/SignServer is an application framework written in Java that performs cryptographic operations on behalf of other applications. Instead of teaching every application in your organisation how to talk to a hardware security module, you run one signing service and let the others call it. That is useful in two situations in particular: when the keys have to live in hardware that the existing enterprise applications cannot be connected to, and when the operations are sensitive enough that you want them managed and audited in exactly one place.https://www.renemoser.net/blog/2008/01/15/ldap-authentication-using-java/Tue, 15 Jan 2008 00:00:00 +0000https://www.renemoser.net/blog/2008/01/15/ldap-authentication-using-java/Authenticating a user against an LDAP directory does not require a framework. A plain JNDI context is enough: bind to the directory as the user with the password they supplied and let the directory server decide whether the credentials are valid. This post was written in 2008. The JNDI API shown here is still part of the JDK and still works, but the original example connected over an unencrypted ldap:// URL, which sends the password over the network in clear text.