If you have caddy as a reverse proxy inside podman user namespace separated networks, they don't take the upstream client IP address and instead you get local IP addresses assigned to logs. Socket activation is kinda required if you want to get the client's real IP address in your logs.
xinayder
joined 2 years ago
I use openSUSE MicroOS as the container host, with podman. It was a bit tricky to install it in my Hetzner VPS and get used to how MicroOS handles system updates (it's an immutable system), but I am quite happy with it. I found it interesting and decided to try out so I could learn how to use the system.
How do I get started on contributing to new articles (written by a human) for my language? I always wanted to help out but never found an easy way to do so.
With Encrypted Client Hello you can have some more privacy on obtaining certificates for wildcard domains, IIRC.
You can, you can create a profile based on a sensor. I had to install the it87 driver for Linux to identify the case cooling fans I had.
I had the same considerations when I self-hosted headscale as the controller for accessing my VPS. However, I figured that it shouldn't be a big deal, and there's no chance of someone registering rogue devices on your mesh, because, even though any device can request enrollment to Tailscale, ultimately you need to execute a command in your headscale server to confirm the enrollment/account creation, so there shouldn't be that much of a problem leaving the web server exposed.
One more question, how did you manage to get the reverse proxy to proxy your pods? I just added two containers to one, and I cannot access the containers anymore by their names. Do I need to expose their ports on the pod configuration?
Personally, I would avoid host network mode as you expose those containers to the world (good if you want that, bad if you don’t)… possibly the same with using the public IP address of your instance.
My instance is only exposing the HTTP/HTTPS ports, those are the only ports enabled in the firewall.
It seems simple. Does it use pasta as the default networking backend? Also, I guess separating each app into their own network is added security, right? So if anything happens to one app, it cannot move laterally to the other apps unless it manages to gain access to the reverse proxy, which then it would be a huge problem.
Yes, it made people realize we don't need Secure Boot and it's just a pit of vulnerabilities.
I realized it happened with me whenever my computer was idle for a few minutes and the monitor turned off. Eventually it fixed itself, but it sure was annoying having to change the brightness back to the value it was before it went on stand-by.
view more: next ›
Both. How do I get started creating a new article, and how do I contribute to them, or other articles?