0x63 blog

Securing Thanos gRPC interfaces with TLS and nginx

Securing Thanos gRPC interfaces with TLS and nginx

Nginx can be used as a reverse proxy with TLS authentication for Thanos API endpoints, which use gRPC instead of HTTP.

Humanize Unix timestamps in Prometheus alerts

Humanize Unix timestamps in Prometheus alerts

Sending some timestamp along with a Prometheus alert text is sometimes very useful to gain better awareness. For example, when exactly will a TLS certificate expire, instdead of some generic text like "TLS certificate will expire in less than x days": groups: - name: Blackbox rules rules: - alert: SSLCertExpiringSoon

Grafana dashboards-as-code with grafonnet-lib

Grafana dashboards-as-code with grafonnet-lib

Setting up and building Grafana dashboards-as-code with jsonnet and grafonnet-lib

Authentication and encryption for Prometheus and its exporters

Authentication and encryption for Prometheus and its exporters

Connections to Prometheus and its exporters are not encrypted and authenticated by default. This is one way of fixing that with TLS certificates and stunnel.

Dynamic prometheus.yml in docker with consul-template

Dynamic prometheus.yml in docker with consul-template

Our approach to dynamilcally generate prometheus.yml for docker using consul-template, to enable setting different external_labels per instance.

Hiding Firefox tab bar

Hiding Firefox tab bar

Recent Firefox upgrade broke customizations for Tree Style Tab extension to hide the default tab row. This was my attempt to fix it.

Setting up Prometheus alerts

Setting up Prometheus alerts

We started out with rather rigid way of defining alerts. Using custom labels, which are defined within the alert rule, we made it simpler.

Synchronize directories with Ansible

Synchronize directories with Ansible

Using Ansible synchronize module can be problematic, if sudo with a password is used on the target host.

Rewriting git committer information

Rewriting git committer information

There are situations, when the committer information of a git repo must be rewritten. For instance, a foreign repo is to be migrated into an environment, that has strict(er) rules for committer information to contain names/surnames and proper e-mail addresses, rather than nicknames and user@workstation.local-type of

Migrating Grafana from SQLite to PostgreSQL

Migrating Grafana from SQLite to PostgreSQL

The easiest-to-use DB backend for Grafana is SQLite, which is fine for small deployments and testing. There might come a time, when a migration to a more robust DB engine becomes necessary. In this case, PostgreSQL was picked. This is a short write-up about what was done to make the

Ansible set theory filters in practice

Ansible set theory filters in practice

Ansible has some really useful filters for various types of objects. A few of those are for sets of something. Recently, I had to use them in practice. In this situation there was a set of system users in users group. Some users needed to be present and their shell

Variables and comments in Vagrantfile

Variables and comments in Vagrantfile

There might come a time when you need to improve a Vagrantfile beyond the basic elements. Here are a couple of tricks that might make some things easier. Variables There is a way to define variables in Vagrantfile for easier management of constants and settings, especially if having more than

Python 2.7+ on CentOS/RedHat 6

Python 2.7+ on CentOS/RedHat 6

If you still use an older version of CentOS/RedHat, the newest Python version available for it is 2.6, which is not supported anymore by Python team (and many other tools as well). In this (CentOS/RedHat 6) case it is not as easy as to just do a

Version numbers in Ansible code

Version numbers in Ansible code

There are two useful Jinja filters that could help dealing with version numbers in Ansible code. One is version_compare, which allows to compare version numbers. The other is regex_replace, which can be used to get a major.minor version number from a longer version number. Version comparison It

File attribute manipulation with chattr

File attribute manipulation with chattr

Linux systems have a utility for changing file attributes on a Linux file system chattr, as well as lsattr that lists the attributes that are set currently. Those are not the -rwxrw-r---type permissions for owner/group/others, but lower level attributes, which have some interesting properties. Previously this functionality was

Scheduling one-time tasks with 'at'

Scheduling one-time tasks with 'at'

There are times when you need to execute a given task just once at a later time on a Unix-like operating system. cron might be the obvious choice for this, however, for a one-time task that would require either an elaborate schedule part (e.g. 05 04 12 08 05)