~Ben Roberts/

Systems administration for fun and profit

  • vCenter OIDC authentication using KeyCloak

    vCenter OIDC authentication using KeyCloak

    VMWare vCenter 7 adds support for OIDC single-sign on. Officially only ADFS is supported, but with some tweaks, KeyCloak can be used instead

  • ZFS testing on Sabayon

    At the time of writing, Sabayon ships the stable version of ZFS-on-Linux, 0.7.13. A new 0.8.0 release dropped a couple weeks ago, with some long-awaited features: Native ZFS encryption (including zero-knowledge send/recv support for off-site backups) SSD TRIM support Direct IO Given the major changes to the code and this is a point-zero release, Sabayon is not yet shipping 0.8.0 in the main repositories, and probably won’t be for a while yet to come. In the meantime, if you want to test the new features, we have a new ZFS SCR repository available. This contains the latest zfs and zfs-kmod…

  • Going Paperless: Revisited

    A few years ago, I wrote about a system I setup to automatically OCR and upload scanned documents to Google Drive. Since then I decommissioned the old server it used to run on. Rather than set this up again on the replacement server directly, I thought I’d package it up as a docker container. The advantages of this being: I no longer need to maintain the Sabayon package or dependencies The required pieces are nicely captured by the Dockerfile, so its easy to see what the requirements are in future I can update the dependency package versions easily by rebuilding…

  • Managing volume usage in Bacula

    Overview I’ve been a user of Bacula for several years now, managing a large deployment for work. In this case, by large I mean multiple petabytes of data tracked by the catalog across tens of thousands of volume files. The past few years have seen several incremental improvements that now mean for the most part the setup hums along, requiring very little maintenance. The three typical tasks that require my attention are: Regular test restores (a backup is only as good as your restore process and ability to execute it) Resizing pool limits as backup sizes change over time Bringing additional…

  • Puppet custom type validation woes

    Since I’ve just lost a full day to troubleshooting this issue, I’m documenting it in case it hits anyone else. In at least puppet versions 4.7.0 and earlier, global type validation cannot be used to ensure the presence of paramters without breaking puppet resource. Simplified example type: This works fine to validate that in a puppet manifest the `package` parameter is provided, but not when puppet resource interrogates the state of the existing system due to the way the object is constructed. Puppet calls the `provider.instances` to obtain a list of the resources on the system managed by that provider.…

  • puppet-sabayon

    I’ve just uploaded my first puppet module to the forge, optiz0r-sabayon, which improves support for the Sabayon Linux distribution in puppet. This does the following things: Overrides the operatingsystem fact for Sabayon hosts Adds a provider for entropy package manager, and sets this as the default for Sabayon Adds a shim service provider, that marks systemd as the default for Sabayon hosts Adds an enman_repo type which manages installation of Sabayon Community Repositories onto a Sabayon host Adds entropy_mask and entropy_unmask types, which manage package masks and unmasks I’ll add more features as and when I need them. In the meantime, pull requests welcome!

  • Going Paperless

    Too much paper! My house is full of paperwork. Bank statements, invoices, letters about services. There’s far too much of it, and I’ve never been good at throwing it away in case I need it later on. But physically filing lots of paper requires lots of boxes to be organised, which takes up lots of space and time. Neither of which I have a lot of. So the end result is I have a stack of “loosely-chronologically filed” paperwork on my desk which has been mounting up for a couple of years. And then on the occasion I do need…

  • Removing stale facts from PuppetDB

    PuppetBoard and PuppetExplorer are both excellent tools but can be slowed down significantly if there are a very large number of facts in PuppetDB. I recently had an issue with some legacy facts tracking stats about mounted filesystems causing a significant amount of bloat, and this is how I cleaned them up. The problem A long time ago, someone decided it would be useful to have some extra fact data recording which filesystems were mounted, the types and how much space was being used on each. These were recorded such as: It turned out that none of these ever got…

  • Setting up hiera-eyaml-gpg

    It’s inevitable at some point while writing puppet manifests that you’ll need to manage some sensitive configuration; be that a database password, an SSH deploy key, etc. One way to deal with this is to lock down your puppet code so that only trusted developers can see the contents. Another approach is to encrypt the secrets within the puppet code, which is where hiera-eyaml comes in. Hiera-eyaml provides a pluggable backend for your hiera data that can contain secrets encrypted through different means. By default hiera-eyaml uses a symmetric passphrase to protect the secrets, but hiera-eyaml-gpg adds a GPG backend…

  • ZFS on Sabayon

    Does ZFS work on Sabayon? Yes, very nicely 🙂 Here’s how: