ycyr

Automatically unseal HashiCorp Vault via systemd

WARNING!

Automatically unsealing Vault drastically reduces the security of the stored secrets. That being said, there might be scenarios, in which this simple approach could be useful / sufficient.

How it works / installation

This requires Vault to be started by a systemd-unit named vault.service, which typically is the case when installing from a distribution package. The script vault-unseal.sh should be placed in /root and secured with 700 permissions.

ycyr

input {
  kafka {
    bootstrap_servers => "" #configurable
    group_id => "" #configurable
    auto_offset_reset => "" #configurable
    security_protocol => "SASL_SSL"
    sasl_mechanism => "SCRAM-SHA-512"
    sasl_jaas_config => "org.apache.kafka.common.security.scram.ScramLoginModule required username='' password='';"
    ssl_endpoint_identification_algorithm => ""
    topics => [""] #configurable

ycyr

Linux Desktop on Apple Silicon/M1 in Practice

I bought M1 MacBook Air. It is the fastest computer I have, and I have been a GNOME/GNU/Linux user for long time. It is obvious conclusion that I need practical Linux desktop environment on Apple Silicon/M1.

Fortunately, Linux already works on Apple Silicon/M1. But how practical is it?

• Two native ports exist, but they don't have enough device support yet. It certainly takes some time.
  • Corellium https://corellium.com/blog/linux-m1
  • Asahi Linux https://asahilinux.org
• QEMU can run with Hypervisor.framework with:

ycyr

#!/bin/bash
RANCHERENDPOINT=https://your_rancher_endpoint/v3
# The name of the cluster where the user needs to be added
CLUSTERNAME=your_cluster_name
# Username, password and realname of the user
USERNAME=username
PASSWORD=password
REALNAME=myrealname
# Role of the user
GLOBALROLE=user

ycyr

KEY=XXXXXXXXXXXX
HOST="https://metrics.crisidev.org"

mkdir -p dashboards && for dash in $(curl -k -H "Authorization: Bearer $KEY" $HOST/api/search\?query\=\& |tr ']' '\n' |cut -d "," -f 5 |grep slug |cut -d\" -f 4); do 
  curl -k -H "Authorization: Bearer $KEY" $HOST/api/dashboards/db/$dash > dashboards/$dash.json 
done

ycyr

Kafka Cheat Sheet

Display Topic Information

$ kafka-topics.sh --describe --zookeeper localhost:2181 --topic beacon
Topic:beacon	PartitionCount:6	ReplicationFactor:1	Configs:
	Topic: beacon	Partition: 0	Leader: 1	Replicas: 1	Isr: 1
	Topic: beacon	Partition: 1	Leader: 1	Replicas: 1	Isr: 1

ycyr

# to generate your dhparam.pem file, run in the terminal
openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

ycyr

#!/bin/bash

vault mount -path=rootpki pki
vault mount-tune -max-lease-ttl="175200h" rootpki
vault write rootpki/root/generate/exported common_name=example.com ttl="175200h"
vault write rootpki/root/generate/internal common_name=example.com ttl="175200h"
vault write rootpki/intermediate/generate/exported common_name=example.com ttl="175200h"
vault write rootpki/intermediate/generate/internal common_name=example.com ttl="175200h"
vault mount -path=intermediatepki pki
vault mount-tune -max-lease-ttl="8760h" intermediatepki