Stephan Herbers - Stephan Herbers

Use TemporaryFileSystem to hide files or directories from systemd services

For decades people used chroot to restrict the access a service has to the filesystem tree. This was never meant to be a security boundary and there are many ways to break out of it. Implementations got better over time, but where never good enough to be called a security

zabbix

PageSpeed Insights Automation with Zabbix

The Google PageSpeed Insights Score is an important metric to measure. It not only gives you a score and some recommendation to improve the speed of your side, it is also directly affects your google search ranking. You can use the website to get a point-in-time score or you can

elasticsearch

Monitor CO2 concentration over time with Elasticsearch

Out of curiosity I bought a AIRCO2NTROL MINI CO2 meter from TFA Dostmann a few months ago to see just how much a single person (me) increases the CO2 concentration in a room. CO2 concentration is measured in parts per million and a normal value outside is about 410 ppm.

systemd

Continuously import Logfiles into journald

I use Journalbeat to forward my systemd-journal to Logstash/Elasticsearch. When possible, I configure every software on my servers to log to syslog which on moderns systems means logging to systemd-journald. If they don't support syslog I can also log to stdout which systemd writes to the syslog by default

cloudflare

Running my own dynamic DNS service with cloudflare

Like for many people, the IP address of my home internet connection changes regularly. This can be annoying when you want to run a website or a VPN on your home network and want to access it from the internet. To get around this most people use a dynamic DNS

nginx

Running NGINX without root

Update 08.01.2021: Use LogsDirectory and CacheDirectory instead of ReadWritePaths. I like creating my own systemd services for software that hasn't one or only a very basic one with little to no sandboxing. See my goals when creating my own services and explanations for all the sandboxing features here:

ansible

The better Ansible vscode extension

I edit my Ansible configuration, which resides in a GitHub repository, with Visual Studio Code. When searching for ansible in the extensions tab a lot of smaller single purpose extension show up and one extension just called Ansible published by Microsoft itself. Since Visual Studio Code is from Microsoft and

cloudflare

Cache HTML with Cloudflare workers

Caching dynamically generated html of your website can greatly speed up its Time to First Byte, decrease the load on your webservers and reduce traffic cost, but can also lead to stale content on frequently changing sites. In this post I will focus on improving the Time to First Byte

nginx

Sichere TLS Konfiguration mit NGINX

Dies ist die Übertragung des einziges Inhaltes meiner vorherigen Seite Grundlagen und RessourcenEinleitungDiese Seite gibt eine Einführung in die sichere Einrichtung von TLS mit NGINX. Sicher heißt hier, dass nur Protokolle / Verschlüsselungsalgorithmen / Schlüsselaustausch Cipher benutzt werden, zu denen NOCH keine, aus nutzbaren, Schwachstellen bekannt sind. TLS steht für Transport Layer