bingo-bongo

You can use whatever name you like and the “x-“ indicates it’s experimental.

An RFC exists that discourages the “x-“ naming, but it’s still very much in use in the wild.

Yeah, way to go Willy! We’re rooting for you!

My setup is a bit over the top, but I like tinkering and build a lot of odd projects:

3x$5VPS: Garage S3 cluster for static sites and project builds, behind haproxy. Also runs Postgres w/ patroni and a small game server for a game I’m working on and some nameservers. My website is on all 3 VMs and has a little gimmick, where state is tracked between them.

3xOld MiniPC: Proxmox cluster for running Gitlab+Runners, monitoring vm, Valheim server, Syncthing, plus a couple of other odd projects. The oldest hw is probably close to 10 years old (NUC7) and the other two is refurbished Lenovo M710q I think, so nothing fancy.

Everything is connected- and communicate over Tailscale.

I’ve had ~15 cars over the past 25 years, different make and models, some really cheap, some fairly expensive. One thing they all have in common: their terrible infotainment UI.

I’m sure they are trying and it has gotten slightly better lately - but it’s still not great imho. If they really want to do it better than Apple etc., they seriously need to up their game - and I really wish they would, but I don’t see that happening, the cost is too high.

..and with faster and faster iterations :|

I started studying IT back in ‘99 and got a strict warning from the school my first year, because I had used the schools network to access the internet from my own laptop. I had “gained access” by plugging an ethernet cable into a random socket in the wall, and was doing some homework, when radom employee walked by. Since there wasn’t any rules (yet), that allowed nor disallowed it, I got of with only a warning ... from a school, that teaches IT :|

Just remember: never use Environment= for secrets, since they are visible to all users on the system.

(Use EnvironmentFile= instead)

> ..laymen..

That’s the behavioral problem.

When AI is assisting a professional, the outcome is vastly different.

The comparison is somewhat skewed, since they went from an (expensive) virtual server to a cheaper dedicated server (hardware).

One of the new risks is if anything critical happens with the hardware, network, switch etc. then everything is down, until someone at Hetzner go fixes it.

With a virtual server it’ll just get started on a different server straight away. Usually hypervisors also has 2 or more network connections etc.

And hopefully they also got some backup setup.

It’s still a huge amount of of savings and I’d probably do the same of I were in their shoes, but there is tradeoffs when going from virtual- to dedicated hardware.

We've setup and used peer-relays since it was first announced and they've been great, but they do solve a somewhat specific problem.

Some of our users experienced fairly limited throughput from time to time. Under certain circumstances (eg. always ipv4 NAT/double-NAT, never for ipv6) their Tailscale client couldn't establish a direct connection to the Tailscale node in the datacenter, so data was relayed through Tailscales public relay nodes. Which at times was rate limited/bottleneck - in all fairness, that is to be expected according to their docs.

The first mitigation was to "ban" the specific public relay they were using in the policy. Which helped, but still not a great solution and we might just end up in a weird whack-a-mole-ish ban game with the public peer relays in the long run.

So we setup a peer relay, which networking-wise is in a DMZ sort of network (more open), but location wise still in the datacenter and allowed it to easily reach the internal (more restricted networking) Tailscale nodes. Which solved all throughput problems, since we no longer have users connecting through the public relays.

Also, the peer relays feels a little bit magic, once you allow the use of them in the Tailscale policy, it just works(tm) - there is basically zero fiddling with them.

EDIT: I'll happily provide more details if interested - we did a fair amount of testing and debugging along the way :)

Try “UsePAM no” and ensure “UseDNS no” in sshd_config on Ubuntu and you’ll probably experience the same fast login time.

“We care about your privacy..”

Followed by something about 1800+ companies they want to sent my data to .. :|