the null-log

More

On the Malaise of the Dispossessed Millenial

The vastly dispossessed Millennial consumer class sees little hope in the future and thus it turns to high confidence high risk get rich quick schemes such as sports betting and crypto out of sheer desperation and as their hail mary, all stemming from a desire to avert the all-so-imminent economical crash. The reason why the fatigued, exploited, tired Millennial turns to these is because every institution, every father figure, every person who was supposed to tend to them and care after them seems to have rugpulled them out of a future. They feel like they got fucked by the powers that be who left them with nothing but a phone, funko pops and an Onlyfans subscription instead of a house and a family. And thus they go and open up binance every day and look at the price –or their portfolio, or their whatever else, dreading the worst.

One of my biggest gripes with the modern world is how Crypto is used as an speculative asset or an investment, something to be exchanged into fiat, whereas the whole raison d'etre of Cryptocurrency is to be tender itself, something to trade with that will necessarily only obtain value out of how many people believe in it and accept it for goods and services. It will most absolutely be used to that effect in due time by the way, but currently, we’re in the fringe between the old and the new. But the Millennial FOMOs, and desires to get in on the wave.

Do not fret, my children.

The crossing of the great waters is coming. Be patient. Meditate. Do not give into the many distractions why try to sap away your Zen and return to the source…

Never give up.

More

Securing Turing Pi Kubernetes Cluster With HTTPS

Of course I’m not done yet. I’m a responsible citizen :)

Last time, I told you to encrypt everything or else I was going to eat you. Do you want me to eat you? Do you now? I am going to eat you if you come to me with a silly “this certificate is not valid” warning on your website.

Encryption costs literally 0 thanks to http://letsencrypt.org. You don’t have to pay a CA to get an SSL certificate for your site. Of course, in some cases in the enterprise you will, but as an indie, you literally don’t have to fork a single cent with letsencrypt, or with a self signed certificate. I cannot stress this enough, I need you to learn how to wrangle certificates. It’s not that bad and it pays massive dividends.

If you setup your Turing Pi Raspberry Pi cluster with k3s-ansible you will notice that the traefik ingress you get by default already created a dummy certificate for “ExampleCorp” if you visit your site with https://. Of course, this certificate is malformed, and you will see a google chrome warning if you try to open your site under https. This is referenced in the issue here: https://github.com/k3s-io/k3s-ansible/issues/109

Let’s setup traefik on Kubernetes now with cert-manager so it can generate letsencrypt certificates and use them for SSL when people visit your site under HTTPS. For more details about SSL certificates and how SSL works with the CA system, refer to the video I linked above.

  1. Install the traefik CRDs with a kubectl apply -f .... This includes the Middleware CRD, which we’ll use to handle HTTP traffic incoming to our cluster.
    • CRDs are additional domain models added to the Kubernetes domain models which allow for new features and definitions. Third parties will offer them as a way to extend what Kubernetes does or to implement their own systems and features with them.
  2. Now, install a version of cert-manager compatible for your Kubernetes 1.17 cluster (I picked 1.6.2): kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.6.2/cert-manager.yaml. This will create some pods, let it finish.
    • Cert-manager is an extension that talks to ACME certificate services, integrates their resources into Kubernetes and handles their lifecycle so you don’t have to. For example, for us, when this is setup correctly, cert-manager will drop our letsencrypt certificate into a Secret of our choice.
  3. Next, create a certmanager ClusterIssuer. Save the following into issuer.yaml, ensure that you have exported the EMAIL and DOMAIN environment variables first, and run cat issuer.yml | envsubst | kubectl apply -f -:

    apiVersion: cert-manager.io/v1
    kind: ClusterIssuer
    metadata:
      name: letsencrypt-prod
    spec:
      acme:
        email: ${EMAIL}
        server: https://acme-v02.api.letsencrypt.org/directory
        privateKeySecretRef:
          name: letsencrypt-prod
        solvers:
        - http01:
            ingress:
              class: traefik
    
  4. Next, create the traefik Middleware. Save this as middleware.yaml and run kubectl apply -f middleware.yaml:

    apiVersion: traefik.containo.us/v1alpha1
    kind: Middleware
    metadata:
      name: redirect-https
    spec:
      redirectScheme:
        scheme: https
        permanent: true
    
  5. Finally, **reconfigure the smbdxfortunes-ingress traefik ingress you set up last time to allow for HTTPS traffic, adding annotations for certmanager and traefik. You probably want to modify your deploy.yaml from the other time…

    • Pay close attention to the secretName field under tls in the spec: it seems a bit counterintuitive, but the name here will be used to create the secret which will host your letsencrypt certificate over time.
    apiVersion: networking.k8s.io/v1beta1
    kind: Ingress
    metadata:
      name: smbdxfortunes-ingress
      annotations:
        kubernetes.io/ingress.class: traefik
        cert-manager.io/cluster-issuer: letsencrypt-prod
        traefik.ingress.kubernetes.io/router.middlewares: default-redirect-https@kubernetescrd
    spec:
      rules:
      - http:
          paths:
          - path: /
            backend:
              serviceName: smbdxfortunes
              servicePort: 80
      tls:
        - secretName: smbdxfortunes-tls
          hosts:
            - ${DOMAIN}
    

And presto, if done correctly (takes a couple minutes to kick in fully), open https://smbdxfortunes.zapto.org and you should get a nice, beautiful lock symbol next to https on the address bar. Thanks :3

More

How to Migrate from Heroku Free Tier to an On-Prem Kubernetes cluster

I am so, so sad… last November, they killed off the Heroku free tier. Woe! I probably owe my career and a vast amount of my learning to the fact that I was able to deploy a whole frickin rails monolith back then with a simple git push heroku master.

Git push heroku master…

Git push heroku master…

Has a beautiful ring to it, doesn’t it? Boom, you deploy, and it’s online in seconds. How beautiful is that? And it doesn’t cost a dime, son. Sure, your app goes to “sleep” after a while and there’s a plethora of restrictions, but it doesn’t cost a dime! Oh! Did I also mention that you get a free managed PostgreSQL database? OH MY GOODNESS, Heroku I love you.

It’s perfect to teach and learn, to run labs, proof-of-concepts, exercises, tutorials, etc. I taught people how to build a whole-ass imageboard with it back then. Thank you, rails and Heroku for your amazing generosity. I owe my career to you :)

Alas, we’re grumpy old men who have to worry about endless scalability™ to ~~keep Moloch happy~~ ~~not get the ax~~ make our goals and we don’t get Heroku free anymore, and this means my Mario Tarot is not online anymore.

RIP https://smbdxfortunes.herokuapp.com/

Even worse, this means that now we have to use hacks to run our apps on shit like AWS lambda ~~because the solutions architect hypnotized the CTO and now we are tied to the Amazon ecosystem~~ to try to run things on cloud and not break the bank for Jeffrey B. and we end up with bullshit like this to run fucking Wordpress:

And… no! As much as I love Heroku, I don’t want to pay the $5 a month for the eco dyno. I want it my way because I’m a stupid fool! I learn the Hard Way because I’m a fucking idiot!

I tried mounting Mario Tarot on Lambda without success (I was perfectly aware that this wasn’t the use case, but I’ve seen people hack AWS lambda a lot for things like this).

You know what? And I quote, “fuck this”. I’m not going to pay AWS for this. FORGET ABOUT THE CLOUD. Let’s mount this on-prem (or “edge” cloud computing as people will tell you, which is kind of a fancy marketing buzzword for “a local server”, but, sure, “cloud on the edge”) with the raspberry cluster I set up the other time. I got a lot of compute there which I can repurpose for my homebridge server, etc.

  1. Convert app to sqlite:
    • This is a personal choice. I could actually persist all of the fortunes in a ruby module, under a trie (hashmap-of-hashmap), but I’m lazy, so sqlite it is, because I want to reuse the sql script I used with Heroku (RIP liek if u cri everytiem). I can just package it in a container image and we’re off to the races.
  2. Dockerize app:

    • Add a Dockerfile. Notice that we’re binding the rack server to serve on local on 0.0.0.0, instead of the loopback (aka localhost):

      FROM ruby:2.7.7
      
      WORKDIR /app
      ADD . /app
      RUN gem install bundler:1.16.0
      RUN bundle install --system
      
      EXPOSE 4567
      
      CMD ["ruby", "fortune.rb", "-o", "0.0.0.0"]
      
      • Build the image for ARM v7, because raspberry Pis run on ARM! and push to a repository (don’t forget the tag!): docker buildx build --platform linux/arm/v7 -t nullset2/smbdxfortunes:latest --push . If all goes well you can test with docker run -p 4567:4567 nullset2/smbdxfortunes:latest and you can hit localhost:4567.
  3. Deploy on kubernetes:

    1. We are going to design a Pod consisting of an application container exposing port 4567 (which is what Sinatra is listening to) and a separate container which updates our dynamic DNS on no-ip.
      • Why use no-ip? I am running this from the nullhouse, and like most everyone else, I do not have a static IP at home (because for most intents and purposes as a consumer you don’t need it, you’re behind NAT, and ISPs charge you extra if you want a static IP).
      • Thus I need dynamic DNS so the dynamic IP of my router on the public internet is exposed through a static hostname (smbdxfortunes.zapto.org) and I can reliably access it from anywhere on the Internet.
      • One way to achieve this is with the no-ip DUC, which I can run on a cron on my cluster. The only downside is that you have to sign in every 30 days to confirm that you still want your zapto.org subdomain (sigh… eh, it’s not that bad…).
      • I will integrate Dynamic DNS with docker image aanousakis/no-ip:latest. This will run at certain intervals, getting the public IP of the router, and feeding it to no-ip so we don’t have to.
    2. Besides the Pod, I need an Ingress and a Service.

      • Ingresses are how Kubernetes allows things from outside the cluster to connect to the internal networking of the cluster, which is virtual, simulated.
      • What we are interested in, the sinatra app, resides in a pod, in a container exposing port 4567.
      • A pod can contain many containers which expose different ports. These containers can be scaled up or down at will and will change IP addresses (in the internal kubernetes virtual networking) over time.
      • So, a Service must be mounted between the Ingress and the Pod, so the Pod exposes a uniform interface.
      • An Ingress requires an Ingress Controller. Lucky for us, we get traefik out of the box with k3s, covering the Ingress controller and Ingress part.
      • Look at your Kubernetes services and you should notice that there’s an EXTERNAL IP for the LoadBalancer for traefik. This is what you’re going to feed to your router on the next step.
      • So we just need to configure an Ingress on port 80, that reaches the Pod through a Service on port 80, which connects to the Sinatra container on port 4567.
      • This is the full manifest, save it as deploy.yaml:
      ---
      kind: Deployment
      apiVersion: apps/v1
      metadata:
        name: smbdxfortunes
        namespace: default
        labels:
          app: smbdxfortunes
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: smbdxfortunes
        template:
          metadata:
            labels:
              app: smbdxfortunes
          spec:
            volumes:
            - name: tz-config
              hostPath:
                path: /etc/localtime
            containers:
            - name: smbdxfortunes
              imagePullPolicy: IfNotPresent
              image: nullset2/smbdxfortunes:latest
              ports:
              - name: web
                containerPort: 4567
            - name: no-ip
              image: aanousakis/no-ip:latest
              imagePullPolicy: IfNotPresent
              env:
              - name: USERNAME
                value: {{REDACTED}}
              - name: PASSWORD
                value: {{REDACTED}}
              - name: DOMAINS
                value: smbdxfortunes.zapto.org
              volumeMounts:
              - name: tz-config
                readOnly: true
                mountPath: /etc/localtime
              terminationMessagePath: /dev/termination-log
              terminationMessagePolicy: File
      ---
      apiVersion: v1
      kind: Service
      metadata:
        name: smbdxfortunes
      
      spec:
        ports:
          - name: web
            port: 80
            targetPort: web
      
        selector:
          app: smbdxfortunes
      ---
      apiVersion: networking.k8s.io/v1beta1
      kind: Ingress
      metadata:
        name: smbdxfortunes-ingress
      spec:
        rules:
        - http:
            paths:
            - path: /
              backend:
                serviceName: smbdxfortunes
                servicePort: 80
      
    • NOTE: I had to use the networking.k8s.io/v1beta1 version of Ingress because my meek, poor k3s cluster is fixed to Kubernetes 1.17, otherwise the master node would just blow up by the use of etcd. Alas!
  4. Enable port forwarding on my router:
    • When your router gets requests from the outside world through Dynamic DNS, it will not know what to do with them unless if explicitly allowed through a technique called “Port Forwarding”.
    • Depending on your ISP, Port Forwarding may actually be explicitly forbidden so you may want to double check on this, but personally I’m using Comcast and I know they allow for this in the admin interace. I actually don’t use the Xfinity router personally, though; instead, I set my router to what’s known as “bridge mode”, which makes the ISP box act as a passthrough to my personal router running FreshTomato custom firmware, so I need to setup the port forwarding rules in FreshTomato instead.
    • This is how my port forwarding looks:
  5. Get it all in: kubectl apply -f deploy.yaml

It’s done. Check out http://smbdxfortunes.zapto.org/. As a conclusion, I present an Architecture Diagram for your enjoyment:

I love you.

More

Remain steadfast

I know that everything sucks and that it feels as if it’s all collapsing, but it’s all going to be alright.

More

Catholic Guilt

Upon colonization, the Spaniards knew that the Indio was useful workforce to keep around, so they chose to teach them Christianity rather than how in North America the Indians were genocided. This created an interesting phenomena: sure, the mestizo occupies the lowest rung in the social order, but at least it’s something. It’s a position. It’s effectively to be given a new lease in life, shitty as it may be. Unfortunately, this complex of Catholic guilt, like a generational trauma, has trickled down the collective unconscious of Latin-American people. Yet another classic example of “Nature or Nurture?”.

I remember when I started working outsourcing with USA companies, a lot of my colleagues would constantly tell me that it was not necessary to be so apologetic. I didn’t even know I was being overtly apologetic, though: I merely continued to display a localized version of my mannerisms and my usual way of conducting. Looking back and being critical of myself (while at the same time trying to be kind towards myself, of course), I see the remnants of this whiplash still present in me then.

A mutation in this is in the Puritan work ethic and morality, which teaches people to be ashamed of themselves and their bodies, to conceive themselves from an inherently sinful point of view rather than just “being themselves”. I am strongly convinced, now that I’ve broadened my horizons, that these forces still resonate in the collective unconscious very strongly.

Mexican Catholicism in particular has this very strong element of flagellation to it, of “oh woe is me because God says so, so I shall crawl all the way to the main temple in town under the scorching sun until my knees bleed”, which is something that I do find interesting, but I believe we owe it to ourselves to also be critical of this: are you displaying any such biases in your daily life?

The upside to this is that it leverages the principle of sacrifice, which is a principle that is sorely lacking in the North American collective unconscious. Good things do come from sacrifice, but maybe drop the silly raceplay-based power dynamic and the “oh woe is me because…”, because those principles don’t hold true.

More

I’ve felt so shitty today that I had to take aspirin. I felt like crud. I feel completely drained and my whole body feels sore.

More

You know what I’ve learned? That, yes, people are prejudiced, and they’re meanies and a lot of things are going horribly wrong in the world and I will never get the acceptance or approval of some people.

And that’s fine.

You just keep going.

It should never preclude the richness and happiness of your inner world.

As platitudinal and vapid as the fetishization of the modern rugged individualist life is, and as devoid of meaning, absurd and ruthless everything is in life, actually embrace it and do stupid fucking bullshit with it, and sometimes just out of sheer miracle, this will lead you to powerful, great things.

Yes, it feels frustrating to hear the same talking points over and over: to be stoic, to read Seneca’s epistles, to not worry about anything else but your own welfare, to love yourself, to enjoy your solitude, to be “outcome independent”, to just “be patient”; there’s still a problem, that of pervasive, vicious alienation. My shoulders feel heavy and my body still feels sore.

But, listen, those points are actually true, so heed them.

Yes, I know you’re sad that this is not the way you hoped things would go. Receive the warmest of hugs. It’s okay.

I know that things look grim. If all women are being convinced that having children is a bad thing, and if love is over, and if the only women who want me are bad news, I understand why things look so dark. It’s like a massive suicide pact. It’s okay. You’re not the problem.

I feel like somebody may pull a mean prank on me anytime. I feel as if I could die. People ignore you, and they don’t actually care about you. It’s all right. I’m here with you.

The solution is not in moping around. Keep going. Do the next right thing, or just simply do the next thing right (if you don’t know what the next right thing is). Nothing stays the same forever.

More

sandmandaddy69:

image