starkzarn

Oh buddy, let me tell you about amateur radio... If you're having a good time on gmrs, consider exploring the ham hobby. So much fun. There's a lot more landscape to explore than just gmrs gives you. And welcome to the world of RF!

Fair enough! I toyed with the idea of doing it that way because the systemd component would just reference a single yaml file for each service, which feels portable. That said though, my quadlets as they are are pretty portable too. Thanks for sharing!

Just curious why you chose a kube quadlet instead of the typical podman container quadlets?

Slime mold is so god damn cool man

That's because they just terminate TLS at their end. Your DNS record is "poisoned" by the orange cloud and their infrastructure answers for you. They happen to have a trusted root CA so they just present one of their own certificates with a SAN that matches your domain and your browser trusts it. Bingo, TLS termination at CF servers. They have it in cleartext then and just re-encrypt it with your origin server if you enforce TLS, but at that point it's meaningless.

Hey neat, I wrote this.

Happy to answer any questions. Feel free to also comment on the post itself if you see any issues or have strong opinions on the content.

Good callout! You're absolutely right, and here I was primarily focused on publicly accessible services. Thanks for the addition.

That's a super valid question, as it seems sometimes that some of these things are configured in a way that begs the question "why?" As far as contributing to documentation, that's a moot point. This is already in the man pages, and that's exactly what I referenced in writing this post, in addition to some empirical testing of course. As far as implementation goes, I think that probably lies at a per distribution level, where not one size fits all. Although I don't know of it off the top of my head, I'm sure there's a security centric distro out there that implements more of these sandboxing options by default.

Excellent! There's certainly a lot to unpack, but being able to twist all these little knobs is part of the beauty of Linux.

Very glad to gear it! Learning new stuff with Linux is the fun part of the journey.

Hey, much appreciated!

What... This isn't true at all.