Use authelia for 2fa

Disable root ssh

Disable password authentication for ssh. Keys only.

Set up Fail2ban

That’s about all that’s left; 2fa and brute force protection. Good job.

I stood up grafana at work, and I make dashboards to keep my role secure.

Everyone uses my shitty little dashboards :)

Everything else is just those tools but you’re abstracted away from some level of control.

Or ELK.

Think of it in terms of the size of each stair and the size of the person.

If each stair is > the size of my leg, each step is plenty of work. Doubling it engages more muscle groups. In this case obviously more energy.

If each stair is < the sole of my shoe, each step is barely any work. Doubling it is negligible, no new muscles are engaged, they just work slightly harder for double the gain.

So, the answer is both, and it depends on the size of the person and the size of the stairs.

No. Your answer has absolutely nothing to do with infinity nor is it paradoxical.

The paradox is saying that for every number N there is an occupied room in the infinite hotel. But that there is still vacancy.

That’s it.

We take every guest in their room N, and ask them to move to room N+1, and now room 1 is vacant.

So the infinite hotel is always full but always has vacancy. That’s what makes it a paradox.

I have bunted a baseball over a little league fence. Me and some friends tried all day long.

My technique was to push the bunt while turning into the pitch.

Getting it to the outfield is trivial. Home run is very hard. The fence was less than 200 ft.

I mean if it describes what you do accurately then they won’t be able to say much other than yes.

So oddly tier iii is just tier 2. Most places don’t have a tier 2.

1 years experience as sysadmin is great. Here’s the neat little trick no one tells you: what you say your job is on your resume should reflect WHAT YOU DO. Not the title of what you were hired for

Are you doing dev ops at a small outfit as a support engineer? Your resume should not say “support engineer.” It should say what your tasks reflect to the market. Not what some dude said your position is.

I’m sure the job postings will say, but many dev ops roles are looking for someone with senior experience. Like 8-10 years or the resume is ignored.

Id say the way to beat this is look for tier iii roles for folks that don’t know what they need is dev ops. Explain the value of what you want to do as a sysadmin to bring value. Then just write dev ops on your resume when you wind up doing dev ops.

100% building a home lab and being able to talk about it openly, from memory, in your own words, from experience, is invaluable for interviews.

I might update this. I might not. I have a lot to say but In out drinking.

All I will say now is save this list. You’ll look back at it in 5 years and wonder what half of those things are.

…

Okay a bit more from the bar:

If you want dev sec ops, grafana, elk, build dashboards, get your agents setup in your fleet, get it all secure locally. That alone will impress any interviewer who knows anything.

Dev ops specifically? Focus on building a local GitLab instance. Use grafana to monitor it. Run some app that has a busy db. Grafana dashboards on that. Oh my goodness, what a HOG you are GitLab! Tune it for your env. Purposely misconfigure something to watch, idk, the RAM keep growing because you didn’t setup redis or some shit.

The sea is vast. You’re hungry. Employers will see that once you land interviews.

If you want a ton of dev sec ops ideas, I am a good sounding board. Regular dev ops isn’t my daily grind so I know a bit less. What I do know is if you’re not ready to rebuild a multi node cluster some night after hours, you’re not quite a boss (doesn’t mean you’re not ready). So, emulate that nightmare.

Back to drinking 🍻

Edit: double check your *arr ideas bc afaik most of those were abandoned after a few major vulns were uncovered. That was months ago so that may be old hat.

Yep.

It’s like they wanna get bought to compete with GitHub or something.

They’re moving fast and breaking things. And bloating their product in the process. In the last 24 months they paid over $1M to a single bug bounty hunter who basically took them to the cleaners.

But totally agree. It’s the best UX, best product for home lab or even small enterprise use if you’ve got someone to get it tuned appropriately.

While I agree, out of the box the configs ARE NOT for home lab use.

Why this matters –

Traefik’s configs are a little less cumbersome if you’re managing a lot of services.

Black holes not only don’t have surfaces, they dont have suns.

https://crt.sh/

When a CA issues an SSL/TLS certificate, they’re required to submit it to public CT logs (append-only, cryptographically verifiable ledgers). This was designed to detect misissued or malicious certificates.

Red and Blue team alike use this resource (crt.sh) to enumerate subdomains.

Idk of any good series but techno Tim has a great video on using cloudflare and traefik to get wildcard letsencrypt ssls for your docker services.

https://youtu.be/n1vOfdz5Nm8

I think the bulk of users are running discarded junk and raspberry pis.

That was me, I built a ~$5k rig and now some of what I’m doing is just nonsense of a typical self hoster, so the point is somewhat valid, but even those like me mostly started out with discarded junk and raspberry pis.

Docker used to scare me until I tackled a project that required me to use it. Then I realized I learned it without knowing I’d learned it.

Are the two servers on the same LAN? Did you update all configs for the new servers address?

Is the docker container spinning up and running, or failing and exiting?

Run docker ps, it’ll tell you how long your containers have been running or if they exited.

If everything is running then it’s most likely network, and I’d need to know how it is you used to access it on the old server (web address? Ip?)

If it’s not running then you get to dig through error logs to get to the next step 🤓