Posts

Introduction Have you ever wanted to compile a big C/C++ project, only to find yourself waiting for hours while your machine overheated? Finding out you were missing a CMake option, or editing a header file, and having to recompile half of the project again? Caches like ccache or simple sccache setups can help speeding up a build, but only by reusing existing results. Enter Distributed sccache. sccache has a feature (sccache-dist) that allows you to send your compilation jobs to a cluster of machines, just like the well-known distcc. sccache-dist even goes a step further by automatically uploading your toolchain to the build servers, allowing you to transparently compile from any distribution. ...

This article is an answer to my bug report here: https://github.com/minio/minio/issues/21735 Context S3 buckets can be configured to keep old versions of objects when overwriting/deleting them. This is called a versioned bucket Calling DeleteObject on an object in a versioned bucket will not really delete it, but mark it as so with a delete marker. The object will appear deleted, but can still be viewed/deleted by specifying its versionId. This behaviour is really useful, for example for backups, where you want a client to upload its backups, but not be able to delete them all instantly. In this case, you would allow the client to do DeleteObject calls, but not DeleteObjectVersion, and clean up old versions periodically. ...

I love nftables. I’ve personally found it to be both more simple and featureful compared to other mainstream firewall services. It can be configured from a file with a simple yet powerful syntax, allowing you to create simple port-blocking rules, but also precisely classify and act on traffic. Plus, it can be used side by side with other firewall-like services running on your Linux machine, allowing it to be deployed nearly everywhere without disturbing existing applications. ...

The Arch Linux package management is great. But there are some things I had to change to fit my workflow. There are listed here. Force yourself to read Arch news before upgrading Arch Linux will sometimes upload package updates that will break your systems. Off the top of my head, I can think of a grub update breaking my system in 2022, or linux-firmware in 2025. While these breakages are rare, they can happen, and they can leave your computer unusable after an update. Arch Linux expects you to read the Arch News and be aware of them. ...

Introduction TLDR; destination-IP NAT that redirects to RKE2’s ingress input chain I recently had to make my RKE2 cluster coexist with an in-house service running on the same machines, and also exposing a website through port 80. The obvious problem here is: RKE2 clusters (most of the time) also need to listen on port 80 in order to make our RKE2-hosted websites work. So, how do we share port 80 between RKE2 and another application? ...

Introduction Velero allows you to create backups of your k8s cluster. It handles both the resources (the YAML files) and the volumes. But it has a drawback (as of writing): the lack of encryption. In this post, we’re going to see how we can produce encrypted backups, by chaining Velero with rclone. The key point of this post is: rclone is awesome and a tinkerer’s dream tool. In our case, the two features of rclone that we will use are its crypt remote, and its serve (s3) feature. ...

My goal is to make a daily backup of my Bitwarden vault using restic. I also don’t want to store my master password on disk, which means backing up the encrypted vault. The solution to do that is to use a Bitwarden API key. API keys do not seem to have the capability to decrypt the vault, as you need to enter your master password yourself to unlock the vault before viewing items, which makes them the perfect tool for the job. ...

Introduction Recently, I wanted to create a bunch of domains on my friend’s server, and have TLS certificates delivered. The option I find easiest to manage certificates is to ask my CA (Let’s Encrypt) for a single, wildcard TLS certificate (e.g. *.itrooz.fr). If you are using OVH to manage your domain, you can do that automatically by creating an API key for your account, and using the certbot OVH plugin to create/renew the certificate. Usually, tutorials will tell you to give these permissions to the API key: ...

If you stumble on one of my projects, you may have seen this licence: Licence: GPL-2.0-only OR GPL-3.0-or-later with proxy being me What does that mean? Why did I choose such a long and weird licence? The reason is that I want: to be covered by a strong copyleft licence while being compatible with past/future GPL licences (and not block my project from being used with one that uses a different version of the GPL) and not give power to the FSF to issue a new licence in the future that I would not agree with. The solution to this last point is the proxy clause. Quoting GPL 3.0: ...

A friend of mine wanted to route one of their Docker containers through WireGuard to connect to the internet. I came up with a solution using a Docker container to manage the WireGuard VPN itself. This allows us to fully isolate the VPN and use AllowedIPs=0.0.0.0/0 without affecting the rest of the system. This solution is simple both technically (we just share the same network namespace) and in practice (just add another container without changing the original). ...