Skip to content

Instantly share code, notes, and snippets.

View cpu's full-sized avatar
❄️

Daniel McCarney cpu

❄️
View GitHub Profile
@gdamjan
gdamjan / default.nix
Last active November 26, 2022 12:19
A demo "Portable Service" for a shell program built with nix - https://systemd.io/PORTABLE_SERVICES/
{ pkgs ? import <nixpkgs> { } }:
let
demo-program = pkgs.writeShellScriptBin "helloWorld" "while sleep 3; do echo Hello World; done";
demo-service = pkgs.substituteAll {
name = "demo.service";
src = ./demo.service.in;
demoExe = "${demo-program}/bin/helloWorld";
};
demo-socket = pkgs.concatText "demo.socket" [ ./demo.socket ];
@lizthegrey
lizthegrey / attributes.rb
Last active February 24, 2024 14:11
Hardening SSH with 2fa
default['sshd']['sshd_config']['AuthenticationMethods'] = 'publickey,keyboard-interactive:pam'
default['sshd']['sshd_config']['ChallengeResponseAuthentication'] = 'yes'
default['sshd']['sshd_config']['PasswordAuthentication'] = 'no'
@ageis
ageis / certbot_exporter.md
Last active November 15, 2023 23:22
certbot Prometheus exporter (Let's Encrypt metrics)

This is a script written in Python intended to run alongside a certbot instance and export statistics for monitoring purposes. It assumes the existence of certbot in the PATH plus read access to /etc/letsencrypt.

It tracks stuff like: number of certs, number of SANs, expiry time, seconds until expiry, and the status of the certificate per ACME.

How it works

Prometheus is a monitoring system and time-series database.

@chpatrick
chpatrick / nix-cmake
Created September 15, 2018 11:38
Using CLion with Nix
#!/usr/bin/env python3
# let's say you have a C++ project in Nix that you want to work on with CLion so that the Nix dependencies are available
# put this script in your project directory
# then, in Settings -> Build, Execution, Deployment -> Toolchains set CMake to this script
# if you need any extra nix-shell arguments, add them to the invocation at the bottom
import os
import sys
import shlex
@ayende
ayende / LetsEncryptClient.cs
Created January 11, 2018 22:26
ACME v2 client for Let's Encrypt
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
@ageis
ageis / systemd_service_hardening.md
Last active May 4, 2024 15:57
Options for hardening systemd service units

security and hardening options for systemd service units

A common and reliable pattern in service unit files is thus:

NoNewPrivileges=yes
PrivateTmp=yes
PrivateDevices=yes
DevicePolicy=closed
ProtectSystem=strict
@cfra
cfra / freenas-iohyve.md
Last active February 14, 2018 05:23
A short description on how to use iohyve on FreeNAS 9.10

Introduction

FreeNAS 9.10 is based on FreeBSD 10.3 and as such, supports the BSD hypervisor bhyve. There are different frontends for bhyve, one of them is iohyve which is included in FreeNAS 9.10. This document describes how to setup iohyve for operation on FreeNAS 9.10 and basic VM management tasks.

Setting up Iohyve

Iohyve is already installed in FreeNAS 9.10, so it only needs to be enabled. This is done by adding the following lines to /conf/base/etc/rc.conf:

iohyve_enable="YES"

iohyve_flags="kmod=1 net=igb0 pool=storage-volume"

@jgamblin
jgamblin / Streisand.sh
Last active May 31, 2019 18:07
Streisand Server Install Bash Script
Please see: https://gist.github.com/cpu/9fe42bd664c99bff6ae85c0f386a0ae0
#!/bin/bash
# Installs the Streisand server for you https://github.com/jlund/streisand
#sudo apt-get update && sudo apt-get install -y git python-paramiko python-pip python-pycurl python-dev build-essential
#sudo pip install ansible markupsafe dopy==0.3.5
#git clone https://github.com/jlund/streisand.git && cd streisand/playbooks
##sed -i 's/streisand-host/127.0.0.1/g' streisand.yml
#sudo ansible-playbook -i "localhost," -c local streisand.yml
#sed -i "s/localhost/$(curl -s ipecho.net/plain)/g" ../generated-docs/streisand.html