Recently I wanted to throw up a tiny little irc server for a small group of friends. I used this opportunity to finally create a sub-account in my personal AWS organization and host it entirely isolated. One of the things I wanted to do was a bog simple backup scheme for this system, but because this is completely isolated from all of my other normal infrastructure I can't use my standard restic backup setup.
From time to time I may post things which discuss technologies or products of HashiCorp, Inc. If you're reading that and are getting a link to this, that means: At the time of authorship of that post, I am an employee of HashiCorp. Said post is explicitly a personal project and is not an official HashiCorp product. The views expressed in that posting are entirely personal and are not statements made on the behalf of HashiCorp, Inc.
This weekend I've been noodling around with my perennial project of building a ersatz HSM (what are you using to protect your home CA root?) A fresh install of Debian 10 on a PCEngines APU2 later, I started some basic setup. One of the first things I started playing with was a source of randomness for the system. In "production" there won't physically be any network connections, and as an isolated box where presumably you'd boot it up, do one or two operations, and shut it back down, there's not a lot of chance to collect some entropy.
Inspired by this recent Chef John video. Prep a whole pork tenderloin as you normally would (I coat with a thin layer of vegetable oil and liberally apply kosher salt). Take a loaf of Italian bread (that's what my local store calls it, it's a long loaf of white bread with sesame seeds on the top), slice in half lengthwise, and coat with butter — I use one stick (1/2 cup) for a whole loaf split in two.
For ages, my psyche has marked the start of spring by having a dream about a tornado. At least back to high school, warmer weather, trees start budding and flowers start poking out and — boom, tornado dream. This year, however, I've had two dreams about tornados in the past week, which is the first time I can remember this happening. I'll have other dreams about weather, but just one with a tornado there ever spring.
See yubi-env in my 'one-offs' repository.
At home I make extensive use of both the Minio object storage server and the Backblaze B2 object storage service. I've also recently started making use of HashiCorp Vault. Given how useful it is to generate dynamic secrets with Vault, I wanted to extend that to my usage of Minio and B2, so writing a secrets engine plugin for Vault has been on my project list for quite some time.
This is Part 5 of my series on building a restic-based system backup series. The rest of the articles can be found here. One of the original design decisions in my restic systems backup setup was isolation between hosts. I didn't want root on one system to be able to access the backups of other hosts, even if they were storing backups on a common backup server. At that time, Minio, the object storage server I was using on the backup server, only supported single-tenancy — there was a single "access key"/"secret key" per instance, with access to every object and every bucket in that instance.
I've been using gopass for a long time as my password manager — with my GnuPG and Yubikey setup accessing my passwords on both my laptop and my colocated box is pretty transparently the same. I randomly came across the fact that mutt will do backtick expansion in its configuration file. With that, I can keep my Mutt imap password in gopass and have mutt fetch it with set imap_pass=`pass mutt_imap_pass`
I've recently installed a Consul cluster at home, mostly to act as an HA backing store for Vault. If you've been following along, I've also been moving to Restic for my system backups so, of course, I want snapshots of Consul to end up there. But this isn't a post about that — when I've got it running well and cleaned up, I'll post it and talk about it. What I want to talk about is the way that I'm wrapping the consul lock command.