Yet Another SysAdmin Website - Blog

Introduction Not many Virtual Private Server (VPS) providers consider FreeBSD a first-class citizen, and few encourage you to encrypt your hard drive from inside the VPS. Though encrypting a VPS hard drive does not protect against everything and requires one to access the web KVM of the provider to type in a password on each reboot, I still find it reassuring. You need a little know-how to be able to set up FreeBSD in a not so friendly environment. There are several procedures to achieve this…

Introduction I have blogged about my pf firewall configurations a few times, but never my Linux ones. There is nothing especially unusual about it, but it does differ somewhat from the common nftables examples. Configuration This is the configuration for my Gentoo laptop. It has two Wireguard interfaces and references two egress interfaces, one for Ethernet and one for WiFi: #!/sbin/nft -f flush ruleset define allowed_icmp_types = { echo-reply, echo-request }; define trusted_icmp_types = {…

Introduction For almost a decade, I have been operating my own mesh overlay network using a combination of point to point OpenVPN tunnels with OSPF on top. It was well automated with Ansible and served me well all these years. I decided it was time I tried to move this to Wireguard instead and spent a bit of time making it all work. This article does not explain everything I did, but will present some lessons I learned in the process. Routing OSPF over Wireguard By default, Wireguard encourag...

Introduction I recently had my phone die on me and had to get a new one. One of the first apps I install is Syncthing, in order to restore my photos and app data. Syncthing on Android has had quite the history, and for a time it was the norm to use Syncthing-Fork. A few months ago, this fork went through an ownership change, and I stopped updating this app until things settled. On a new device, I wanted an up to date setup I could trust long-term and maintain myself. I found that the safest w...