.oO( Wer heutzutage immernoch das Wurstblatt "Der Spiegel" konsumiert dem ist auch nicht mehr zu helfen … das war mir schon von vielen Jahren zu großer Schmutz )

I have an opinionated style of building backends and infrastructure. I have my opinions on what languages and software I prefer. It isn’t often the popular choice and ppl. have questioned them over the years. That makes me question and reflect on my choices - which I consider a good thing.

Today I realized that there’re setups live and in production for 15+ years, which I have built or helped build, that never became a bottleneck or had a major outage.

Some form of choice validation :)

Ouh brb - gotta watch the new Anika Interview with the Rolling Stone :D

https://www.youtube.com/watch?v=m2nBbzkc9oc

I do feel like performing ancient wizardry, waking up a bunch of servers that have been asleep for a couple of months, bootstrapping them with FreeBSD + ZFS and getting them ready for use. 🧙‍♂️🪄

Realistically most ppl from younger/more recent generations are starting so many abstraction layers above that in some “fancy” cloud web interfaces :D

For me it is a very enjoyable realm - the abstraction layer basement.

I’ve updated my FreeBSD ZFS Bootstrap scripts. There’s now an iso and a memstick version. Nothing fundamental has changed. Cleanup, few disk / zfs settings were made explicit rather than relying on defaults.

You should still read through and adapt as needed.

The reason I use the script rather than the installer is that I want just one ZFS volume for the OS and not separate volumes for /var /usr etc. Jails will get a dedicated volume each.

https://codeberg.org/hukl/freebsd-toolbox/src/branch/main/freebsd_zfs_bootstrap_iso.sh

https://codeberg.org/hukl/freebsd-toolbox/src/branch/main/freebsd_zfs_bootstrap_memstick.sh

Sending zfs snapshots between hosts via ssh is one of these things that still get me excited. It works so flawless - for years.

zfs send pool/volume@snapshot | ssh user@host zfs recv -u pool/volume

Oh what a joy zfs is …

No joke, yesterday I mention med in conversation that the last thing that is missing this week is some linux kernel vulnerability … at least with FreeBSD I’m in a different partition of the Cyber Cycle …

Ok I’ll admit, I fell in love …

with wood drill bits from Japan :D

They make by far the most clean and precise holes and you can get this practical and well made roll bag for them. Isn’t the 3rd picture adorable? :D

Me gusta ლ(´ڡ`ლ)

But seriously - if you’re doing some wood work, keep Star-M drill bits in the back of your mind.

I’ve updated all FreeBSD jails still running some PHP software. I build the pkgs from the ports on the host and then shared the pkgs with all jails.

What an exciting day :D

Currently setting up the FreeBSD equivalent of AppArmor via `kldload mac_bsdextended` and `ugidfw` to prevent php-fpm from remote code execution as per OS.

Lets see if this works … 🤞

In other news: I’ve added a little lua function to my rspamd which checks sender names of received emails against a list of trusted contacts (email - name). If a mail arrives with a sender name which is on the list, the lua function checks if the email address matches. If not it’s marked as spam and a (UN)TRUSTED_SENDER flag is added

Mails from senders that are not on my trusted_senders.map file will use the normal rspam pipeline

That feels like it should be a default feature, right?

Thanks to ezjail it was pretty quick work to fix the Root CA issue for all my FreeBSD jails.

ezjail-admin update -u did the trick

Thanks @nprofile1q... ;)