Andrew's blog (Entries tagged as geek)

Let's Encrypt with Octavia in OpenStack

andrew@etc.gen.nz (Andrew Ruthven) — Sun, 23 Oct 2022 05:09:00 +0000

I like using Catalyst Cloud to host some of my personal sites. In the past I used to use CAcert for my TLS certificates, but more recently I've been using Let's Encrypt for my TLS certificates as they're trusted in all browsers. Currently the LoadBalancer as a Service (LBaaS) in Catalyst Cloud doesn't have built in support for Let's Encrypt. I could use an apache2/nginx proxy and handle the TLS termination there and have that manage the Let's Encrypt lifecycle, but really, I'd rather use LBaaS.

So I thought I'd set about working out how to get Dehydrated (the Let's Encrypt client I've been using) to drive LBaaS (known as Octavia). I figured this would be of interest to other people using Octavia with OpenStack in general, not just Catalyst Cloud.

There's a few things you need to do. These instructions are specific to Debian:

Install and configure Dehydrated to create the certificates for the domain(s) you want.
- apt install barbican
Create the LoadBalancer (use the API, ClickOps, whatever), just forward port 80 for now (see sample Apache configs below).
Save the sample hook.sh below to /etc/dehydrated/hook.sh, you'll probably need to customise it, mine is a bit more complicated!
Insert the UUID of your LoadBalancer in hook.sh where LB_LISTENER is set.
Create /etc/dehydrated/catalystcloud/password as described in hook.sh
Save OpenRC file from the Catalyst Cloud dashboard as /etc/dehydrated/catalystcloud/openrc.sh
Install jq, openssl and the openstack tools, on Debian this is:
- apt install jq openssl python3-openstackclient python3-barbicanclient python3-octaviaclient
Add TLS termination to your LoadBalancer
You should be able to rename the latest certs /var/lib/dehydrated/certs/$DOMAIN and then run dehydrated -c to have it reissue and then deploy a cert.

As we're using HTTP-01 Challenge Type here, you need to have the LoadBalancer forwarding port 80 to your website to allow for the challenge response. It is good practice to have a redirect to HTTPS, here's an example virtual host for Apache:

<VirtualHost *:80>
    ServerName www.example.com
    ServerAlias example.com

    RewriteEngine On
    RewriteRule ^/.well-known/ - [L]
    RewriteRule ^/(.*)$ https://www.example.com/$1 [R=301,L]

    <Location />
        Require all granted
    </Location>
</VirtualHost>

You all also need this in /etc/apache2/conf-enabled/letsencrypt.conf:

Alias /.well-known/acme-challenge /var/lib/dehydrated/acme-challenges

<Directory /var/lib/dehydrated/acme-challenges>
        Options None
        AllowOverride None

        # Apache 2.x
        <IfModule !mod_authz_core.c>
                Order allow,deny
                Allow from all
        </IfModule>

        # Apache 2.4
        <IfModule mod_authz_core.c>
                Require all granted
        </IfModule>
</Directory>

And that should be all that you need to do. Now, when Dehydrated updates your certificate, it should update your LoadBalancer as well!

Sample hook.sh:

deploy_cert() {
    local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" \
          CHAINFILE="${5}" TIMESTAMP="${6}"
    shift 6

    # File contents should be:
    #   export OS_PASSWORD='your password in here'
    . /etc/dehydrated/catalystcloud/password

    # OpenRC file from the Catalyst Cloud dashboard
    . /etc/dehydrated/catalystcloud/openrc.sh --no-token

    # UUID of the LoadBalancer to be managed
    LB_LISTENER='xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'

    # Barbican uses P12 files, we need to make one.
    P12=$(readlink -f $KEYFILE \
        | sed -E 's/privkey-([0-9]+)\.pem/barbican-\1.p12/')
    openssl pkcs12 -export -inkey $KEYFILE -in $CERTFILE -certfile \
        $FULLCHAINFILE -passout pass: -out $P12

    # Keep track of existing certs for this domain (hopefully no more than 100)
    EXISTING_URIS=$(openstack secret list --limit 100 \
        -c Name -c 'Secret href' -f json \
        | jq -r ".[]|select(.Name | startswith(\"$DOMAIN\"))|.\"Secret href\"")

    # Upload the new cert
    NOW=$(date +"%s")
    openstack secret store --name $DOMAIN-$TIMESTAMP-$NOW -e base64 \
        -t "application/octet-stream" --payload="$(base64 < $P12)"

    NEW_URI=$(openstack secret list --name $DOMAIN-$TIMESTAMP-$NOW \
        -c 'Secret href' -f value) \
        || unset NEW_URI

    # Change LoadBalancer to use new cert - if the old one was the default,
    # change the default. If the old one was in the SNI list, update the
    # SNI list.
    if [ -n "$EXISTING_URIS" ]; then
        DEFAULT_CONTAINER=$(openstack loadbalancer listener show $LB_LISTENER \
            -c default_tls_container_ref -f value)

        for URI in $EXISTING_URIS; do
            if [ "x$URI" = "x$DEFAULT_CONTAINER" ]; then
                openstack loadbalancer listener set $LB_LISTENER \
                    --default-tls-container-ref $NEW_URI
            fi
        done

        SNI_CONTAINERS=$(openstack loadbalancer listener show $LB_LISTENER \
            -c sni_container_refs -f value | sed "s/'//g" | sed 's/^\[//' \
            | sed 's/\]$//' | sed "s/,//g")

        for URI in $EXISTING_URIS; do
            if echo $SNI_CONTAINERS | grep -q $URI; then
                SNI_CONTAINERS=$(echo $SNI_CONTAINERS | sed "s,$URI,$NEW_URI,")
                openstack loadbalancer listener set $LB_LISTENER \
                    --sni-container-refs $SNI_CONTAINERS
            fi
        done

        # Remove old certs
        for URI in $EXISTING_URIS; do
            openstack secret delete $URI
        done
    fi
}

HANDLER="$1"; shift
#if [[ "${HANDLER}" =~ ^(deploy_challenge|clean_challenge|sync_cert|deploy_cert|deploy_ocsp|unchanged_cert|invalid_challenge|request_failure|generate_csr|startup_hook|exit_hook)$ ]]; then
if [[ "${HANDLER}" =~ ^(deploy_cert)$ ]]; then
    "$HANDLER" "$@"
fi

Install Fedora CoreOS using FAI

andrew@etc.gen.nz (Andrew Ruthven) — Sun, 19 Apr 2020 06:43:00 +0000

I've spent the last couple of days trying to deploy Fedora CoreOS to some physical hardware/bare metal for a colleague using the official PXE installer from Fedora CoreOS. It wasn't very pleasant, and just wouldn't work reliably.

Maybe my expectations were to high, in that I thought I could use Ignition to prepare more of the system for me, as my colleague has been able to bare metal installs correctly. I just tried to use Ignition as documented.

A few interesting aspects I encountered:

The PXE installer for it has a 618MB initrd file. This takes quite a while to transfer via tftp!
It can't build software RAID for the main install device (and the developers have no intention of adding this), and it seems very finicky to build other RAID sets for other partitions.
And, well, I just kept having problems where the built systems would hang during boot for no obvious reason.
The time to do an installation was incredibly long.
The initrd image is really just running coreos-installer against the nominated device.

During the night I got feed up with that process and wrote a Fully Automatic Installer (FAI) profile that'd install CoreOS instead. I can now use setup-storage from FAI using it's standard disk_config files. This allows me to build complicated disk configurations with software RAID and LVM easily.

A big bonus is that a rebuild is a lot faster, timed from typing reboot to a fresh login prompt is 10 minutes - and this is on physical hardware so includes BIOS POST and RAID controller set up, twice each.

I thought this might be of interest to other people, so the FAI profile I developed for this is located here: https://github.com/catalyst-cloud/fai-profile-fedora-coreos

FAI was initially developed to deploy Debian systems, it has since been extended to be able to install a number of other operating systems, however I think this is a good example of how easy it is to deploy non-Debian derived operating systems using FAI without having to modify FAI itself.

linux.conf.au 2019 - Call for Proposals

andrew@etc.gen.nz (Andrew Ruthven) — Mon, 23 Jul 2018 04:57:00 +0000

At the start of July, the LCA2019 team announced that the Call for Proposals for linux.conf.au 2019 were open! This Call for Proposals will close on July 30. If you want to submit a proposal, you don't have much time!

linux.conf.au is one of the best-known community driven Free and Open Source Software conferences in the world. In 2019 we welcome you to join us in Christchurch, New Zealand on Monday 21 January through to Friday 25 January.

For full details including those not covered by this announcement visit https://linux.conf.au/call-for-papers/, and the full announcement is here.

IMPORTANT DATES

Call for Proposals Opens: 2 July 2018
Call for Proposals Closes: 30 July 2018 (no extensions)
Notifications from the programme committee: early-September 2018
Conference Opens: 21st January 2019

Missing opkg status file on LEDE...

andrew@etc.gen.nz (Andrew Ruthven) — Sun, 17 Sep 2017 11:51:56 +0000

I tried to install LEDE on my home router which is running LEDE, only to be told that libc wasn't installed. Huh? What's going on?! It looked to all intents as purposes as though libc wasn't installed. And it looked like nothing was installed.

What to do if opkg list-installed is returning nothing?

I finally tracked down the status file it uses as being /usr/lib/opkg/status. And it was empty. Oh dear.

Fortunately the info directory had content. This means we can rebuild the status file. How? This is what I did:

cd /usr/lib/opkg/info

for x in *.list; do

  pkg=$(basename $x .list)

  echo $pkg

  opkg info $pkg | sed 's/Status: .*$/Status: install ok installed/' >> ../status

done

And then for the special or virtual packages (such as libc and the kernel):

for x in *.control; do

  pkg=$(basename $x .control)

  if ! grep -q "Package: $pkg"  ../status

  then

    echo $pkg is missing; cat $x >> ../status

  fi

done

I then had to edit the file tidy up some newlines for the kernel and libc, and set the status lines correctly. I used "install hold installed".

Now I that I've shaved that yak, I can install tcpdump to try and work out why a VoIP phone isn't working. Joy.

Network boot a Raspberry Pi 3

andrew@etc.gen.nz (Andrew Ruthven) — Sat, 02 Sep 2017 11:31:00 +0000

I found to make all this work I had to piece together a bunch of information from different locations. This fills in some of the blanks from the official Raspberry Pi documentation. See here, here, and here.

Image

Download the latest raspbian image from https://www.raspberrypi.org/downloads/raspbian/ and unzip it. I used the lite version as I'll install only what I need later.

To extract the files from the image we need to jump through some hoops. Inside the image are two partitions, we need data from each one.

 # Make it easier to re-use these instructions by using a variable
 IMG=2017-04-10-raspbian-jessie-lite.img
 fdisk -l $IMG

You should see some output like:

 Disk 2017-04-10-raspbian-jessie-lite.img: 1.2 GiB, 1297862656 bytes, 2534888 sectors
 Units: sectors of 1 * 512 = 512 bytes
 Sector size (logical/physical): 512 bytes / 512 bytes
 I/O size (minimum/optimal): 512 bytes / 512 bytes
 Disklabel type: dos
 Disk identifier: 0x84fa8189
 
 Device                               Boot Start     End Sectors  Size Id Type
 2017-04-10-raspbian-jessie-lite.img1       8192   92159   83968   41M  c W95 FAT32 (LBA)
 2017-04-10-raspbian-jessie-lite.img2      92160 2534887 2442728  1.2G 83 Linux

You need to be able to mount both the boot and the root partitions. Do this by tracking the offset of each one and multiplying it by the sector size, which is given on the line saying "Sector size" (typically 512 bytes), for example with the 2017-04-01 image, boot has an offset of 8192, so I mount it like this (it is VFAT):

 mount -v -o offset=$((8192 * 512)) -t vfat $IMG /mnt
 # I then copy the data off:
 mkdir -p /data/diskless/raspbian-lite-base-boot/
 rsync -xa /mnt/ /data/diskless/raspbian-lite-base-boot/
 # unmount the partition now:
 umount /mnt

Then we do the same for the root partition:

 mount -v -o offset=$((92160 * 512)) -t ext4 $IMG /mnt
 # copy the data off:
 mkdir -p /data/diskless/raspbian-lite-base-root/
 rsync -xa /mnt/ /data/diskless/raspbian-lite-base-root/
 # umount the partition now:
 umount /mnt

DHCP

When I first set this up, I used OpenWRT on my router, and I had to patch /etc/init/dnsmasq to support setting DHCP option 43. As of the writting of this article, a similar patch has been merged, but isn't in a release yet, and, well, there may never be another release of OpenWRT. I'm now running LEDE, and the the good news is it already has the patch merged (hurrah!). If you're still on OpenWRT, then here's the patch you'll need:

https://git.lede-project.org/?p=source.git;a=commit;h=9412fc294995ae2543fabf84d2ce39a80bfb3bd6

This lets you put the following in /etc/config/dnsmasq, this says that any device that uses DHCP and has a MAC issued by the Raspberry PI Foundation, should have option 66 (boot server) and option 43 set as specified. Set the IP address on option 66 to the device that should be used for tftp on your network, if it's the same device that provides DHCP then it isn't required. I had to set the boot server, as my other network boot devices are using a different server (with an older tftpd-hpa, I explain the problem further down).

 config mac 'rasperrypi'
         option mac 'b8:27:eb:*:*:*'
         option networkid 'rasperrypi'
         list dhcp_option '66,10.1.0.253'
         list dhcp_option '43,Raspberry Pi Boot'

tftp

Initially I used a version of tftpd that was too old and didn't support how the RPi tried to discover if it should use the serial number based naming scheme. The version of tftpd-hpa Debian Jessie works just fine. To find out the serial number you'll probably need to increase the logging of tftpd-hpa, do so by editing /etc/default/tftpd-hpa and adding "-v" to the TFTP_OPTIONS option. It can also be useful to watch tcpdump to see the requests and responses, for example (10.1.0.203 is the IP of the RPi I'm working with):

  tcpdump -n -i eth0 host 10.1.0.203 and dst port 69

This was able to tell me the serial number of my RPi, so I made a directory in my tftpboot directory with the same serial number and copied all the boot files into there. I then found that I had to remove the init= portion from the cmdline.txt file I'm using. To ease debugging I also removed quiet. So, my current cmdline.txt contains (newlines entered for clarity, but the file has it all on one line):

idwc_otg.lpm_enable=0 console=serial0,115200 console=tty1 root=/dev/nfs
nfsroot=10.1.0.253:/data/diskless/raspbian-lite-base-root,vers=3,rsize=1462,wsize=1462
ip=dhcp elevator=deadline rootwait hostname=rpi.etc.gen.nz

NFS root

You'll need to export the directories you created via NFS. My exports file has these lines:

/data/diskless/raspbian-lite-base-root	10.1.0.0/24(rw,no_root_squash,sync,no_subtree_check)
/data/diskless/raspbian-lite-base-boot	10.1.0.0/24(rw,no_root_squash,sync,no_subtree_check)

And you'll also want to make sure you're mounting those correctly during boot, so I have in /data/diskless/raspbian-lite-base-root/etc/fstab the following lines:

10.1.0.253:/data/diskless/raspbian-lite-base-root   /       nfs   rw,vers=3       0   0
10.1.0.253:/data/diskless/raspbian-lite-base-boot   /boot   nfs   vers=3,nolock   0   2

Network Booting

Now you can hopefully boot. Unless you into this bug, as I did. Where the RPi will sometimes fail to boot. Turns out the fix, which is mentioned on the bug report, is to put bootcode.bin (and only bootcode.bin) onto an SD card. That'll then load the fixed bootcode, and which will then boot reliably.

Allow forwarding from VoiceMail to cellphones

andrew@etc.gen.nz (Andrew Ruthven) — Sun, 24 Jul 2016 03:22:59 +0000

Something I've been wanting to do with our Asterisk PBX at Catalyst for a while is to allow having callers that hit VoiceMail to be forwarded the callee's cellphone if allowed. As part of an Asterisk migration we're currently carrying out I finally decided to investigate what is involved. One of the nice things about the VoiceMail application in Asterisk is that callers can hit 0 for the operator, or * for some other purpose. I decided to use * for this purpose.

I'm going to assume a working knowledge of Asterisk dial plans, and I'm not going to try and explain how it works. Sorry.

When a caller hits * the VoiceMail application exits and looks for a rule that matches a. Now, the simple approach looks like this within our macro for handling standard extensions:

[macro-stdexten]
...
exten => a,1,Goto(pstn,027xxx,1)
...

(Where I have a context called pstn for placing calls out to the PSTN).

This'll work, but anyone who hits * will be forwarded to my cellphone. Not what I want. Instead we need to get the dialled extension into a place where we can perform extension matching on it. So instead we'll have this (the extension is passed into macro-stdexten as the first variable - ARG1):

[macro-stdexten]
...
exten => a,1,Goto(vmfwd,${ARG1},1)
...

Then we can create a new context called vmfwd with extension matching (my extension is 7231):

[vmfwd]
exten => 7231,1,Goto(pstn,027xxx,1)

I actually have a bit more in there to do some logging and set the caller ID to something our SIP provider will accept, but you get the gist of it. All I need to do is to arrange for a rule per extension that is allowed to have their VoiceMail callers be forwarded to voicemail. Fortunately I have that part automated.

The only catch is for extensions that aren't allowed to be forwarded to a cellphone. If someone calling their VoiceMail hits * their call will be hung up and I get nasty log messages about no rule for them. How do we handle them? Well, we send them back to VoiceMail. In the vmfwd context we add a rule like this:

exten => _XXXX,1,VoiceMail(${EXTEN}@sip,${voicemail_option})
  same => n,Hangup

So any extension that isn't otherwise matched hits this rule. We use ${voicemail_option} so that we can use the same mode as was used previously.

Easy! Naturally this approach won't work for other people trying to do this, but given I couldn't find write ups on how to do this, I thought it be might be useful to others.

Here's my macro-stdexten and vmfwd in full:

[macro-stdexten]
exten => s,1,Progress()
exten => s,n,Dial(${ARG2},20)
exten => s,n,Goto(s-${DIALSTATUS},1)
exten => s-NOANSWER,1,Answer
exten => s-NOANSWER,n,Wait(1)
exten => s-NOANSWER,n,Set(voicemail_option=u)
exten => s-NOANSWER,n,Voicemail(${ARG1}@sip,u)
exten => s-NOANSWER,n,Hangup
exten => s-BUSY,1,Answer
exten => s-BUSY,n,Wait(1)
exten => s-BUSY,n,Set(voicemail_option=b)
exten => s-BUSY,n,Voicemail(${ARG1}@sip,b)
exten => s-BUSY,n,Hangup
exten => _s-.,1,Goto(s-NOANSWER,1)
exten => a,1,Goto(vmfwd,${ARG1},1)
exten => o,1,Macro(operator)

[vmfwd]

exten => _XXXX,1,VoiceMail(${EXTEN}@sip,${voicemail_option})
  same => n,Hangup

#include extensions-vmfwd-auto.conf

And I then build extensions-vmfwd-auto.conf from a script that is used to generate configuration files for defining accounts, other dial plan rule entries and phone provisioning files.

With thanks to John Kiniston for the suggestion about the wildcard entry in vmfwd.

Cloud - in New Zealand!

andrew@etc.gen.nz (Andrew Ruthven) — Thu, 10 Jul 2014 22:19:05 +0000

I've spent a reasonable chunk of the past year working on a project we launched last month, Catalyst Cloud! It is using OpenStack with Ceph as the object store. It has taken a lot of work, and it is now very exciting seeing the level of interest there we're receiving about this new service!

The great part of this is that we can now offer private cloud services to our customers which provides all the flexibility that we've come to expect with the "cloud", but hosted in New Zealand by a New Zealand owned company so no concerns about jurisdiction of your data! Not only are we able to offer private cloud services on our OpenStack cluster(s), but we can also deploy OpenStack onto our customers own hardware using our ProdStack solution (I get to look directly at the Dashboard shown on that page, which is pretty cool).

Next up is deploying another OpenStack cluster in our new data centre (which is another project I'm working on). In the near future we also hope to start using Open Compute Project hardware for our clusters.

LCA2015 - Debian Miniconf submitted

andrew@etc.gen.nz (Andrew Ruthven) — Thu, 10 Jul 2014 21:43:25 +0000

Phew, I've submitted a proposal to run a Debian Miniconf at linux.conf.au 2015 here's hoping that it is accepted!

The Debian Miniconf was held in 2008 in Melbourne, so I feel it is well overdue to run it again.

Laptops and networks

andrew@etc.gen.nz (Andrew Ruthven) — Tue, 28 Jan 2014 09:32:36 +0000

Back in the old days, we had workstations. And only workstations. They lived on a network, and having them work in that network was simple. Printers just worked (thank you printcap), network shares just worked (thank you NFS) and life was good.

Then along came laptops. We wanted to be more mobile, using our laptops on different networks or even without a network! No one wanted hardcoded printers anymore, or network shares defined in /etc/fstab. Using an Automounter was an option, but if you were on a different network then having the Automounter around would stall tools like nautilus and file indexers etc.

So we need something which can start up relevant services when you connect to a network, and then stop them when you leave that network.

To support this, a few years ago I wrote a NetworkManager dispatcher.d script to do just that. When you connect to a specific network (using the NetworkManager UUID or a specific gateway MAC) or a VPN connection then autofs is started, users GTK bookmarks have any bookmarks for their Network shares added and CUPS is restarted.

When the connection goes away, then autofs is stopped, any GTK bookmarks for the Network shares are removed and any mounts for the Network shares are lazily unmounted.

I'm not sure if this will of use to anyone else, but if it is I'd love to hear from you. You can browse the code or clone the repo.

Included are sample autofs config files, the dispatcher, and the tools for managing the GTK bookmark files.

linux.conf.au 2014 - Call for papers

andrew@etc.gen.nz (Andrew Ruthven) — Mon, 01 Jul 2013 01:42:09 +0000

Holy crap, it's the last week of the linux.conf.au 2014 call for papers! We've got a bunch of great submissions, but we want more!

From the CFP Announcement:

The linux.conf.au 2014 papers committee is looking for a broad range of proposals, and will consider submissions on anything from programming and software, to desktop, mobile, gaming, userspace, community, government, space and education. There is only one rule:

Your proposal must be related to open source

This year, the papers committee is going to be focused on linux on the frontier and deep technical content-- that might range from cybernetics and mobile operating environments to large astronomy projects and big data projects.

However, the conference is to a large extent what the speakers make it -- if we receive many excellent submissions on a topic, then it’s sure to be represented at the conference. Here’s a few ideas to get you started:

The Cloud - What is it, how can we use it and why is it running on my toaster?
Kernel and core systems: file systems, embedded devices
Networking: peer to peer networking, or tuning a TCP/IP stack
Desktop: office and productivity applications, peripherals, support
Mobile: kernel, applications, programming, challenges, user interfaces
Servers: clusters and supercomputers, databases and cloud computing
Embedded systems: constraints in storage/memory, real-time aspects, open hardware
Virtualisation: benefits, challenges, management, kernel and application support
Systems administration: maintaining large numbers of machines, disaster recovery
Security: application security, network security, cryptography, malware, viruses
Programming: programming languages, software engineering practices, testing, continuous integration/deployment, different development methodologies, version control
Modern web technologies: Open source web browsers, HTML5, CSS3, JavaScript, web apps, accessibility
Audio and video: video editing, VoIP, WebRTC, video player development, live streaming
Open Community: licensing changes, patent threats, open data, open apis.
Free software use: home automation, IT, education, manufacturing, research, government applications, home security

LCA is known for presentations and tutorials that are strongly technical in nature, but proposals for presentations on other aspects of free software and open culture, such as educational and cultural applications of open source, are welcome.

linux.conf.au 2013 - Call for Proposals

andrew@etc.gen.nz (Andrew Ruthven) — Thu, 07 Jun 2012 22:58:14 +0000

We are pleased to announce that the Call for Proposals for linux.conf.au 2013 is now open!

The conference will showcase the best of open source and community-driven software and hardware. It will be held in Canberra at the Australian National University from Monday 28 January to Saturday 2 February, 2013, and provides a great opportunity for open source developers, users, hackers, and makers to share their ideas and further improve their projects.

Important Dates

Call for proposals opens: 1 June 2012
Call for proposals closes: 6 July 2012
Email notifications from papers committee: 28 August 2012
Early Bird registrations open: 1 October 2012
Conference dates: Monday 28 January to Saturday 2 February 2013

Information on Proposals

The linux.conf.au 2013 papers committee is looking for a broad range of proposals, and will consider submissions on anything from programming and software, to desktop, userspace, community, government, and education. There is only one rule:

Your proposal must be related to open source.

This year, the papers committee is going to be focused on deep technical content, and things we think are going to really matter in the future -- that might range from freedom and privacy to open source cloud systems or to energy efficient server farms of the future.

However, the conference is to a large extent what the speakers make it -- if we receive many excellent submissions on a topic, then it’s sure to be represented at the conference.

For more information see the full call for proposals on the linux.conf.au 2013 website.

Wolrd IPv6 Day - Catalyst

andrew@etc.gen.nz (Andrew Ruthven) — Wed, 08 Jun 2011 00:39:21 +0000

Excellent, due to a little hack we now have the Catalyst website up on IPv6. Thanks David!

This is using the same method that we used to get another large NZ site IPv6 enabled for World IPv6 Day.

Funnily enough we've discovered there is a NZ company that is providing a commercial solution using the same method we're using. Even though it is dirty, and is really, really the wrong way to do it.

Note: It is worth noting that Catalyst's email server has been IPv6 enabled for several years now, as have our DNS servers.

World IPv6 Day

andrew@etc.gen.nz (Andrew Ruthven) — Tue, 07 Jun 2011 21:30:58 +0000

In the vein of World IPv6 Day, I've finally re-enabled IPv6 for the etc.gen.nz mailserver and for our main website (and my git repo).

These services used to have IPv6 enabled, but when I moved them from my home server to one hosted in a data centre we lost IPv6 support. However in the last few months, our hosting company has deployed IPv6 support to their hosting facility, and I finally found time to finish setting it up on the server.

So, we're back on IPv6, just in time for World IPv6 Day!

LCA2011 - We're going!

andrew@etc.gen.nz (Andrew Ruthven) — Wed, 08 Dec 2010 09:20:44 +0000

Booked flights: check
Booked accommodation: check
Andrew Registered for LCA: check
Andrew Hacked Silly Description: check
Susanne Registered for LCA: in progress
Andrew Hacked Silly Description for Susanne: pending

Awesome. I've just registered for lca2011, it looks to be an awesome conference! They have a great line up of speakers, some amazing venues (I know, I've seen some of them already), and a fantastic group of people in one place.

The reason that I've already seen some of the venues is that Susanne and I attended the ghosts weekend that the lca2011 Ninjas held earlier in the year. During the ghosts weekend the current organising team bring a number of previous organisers, some people from Linux Australia and their team into one place, lock them in a room and absorb as much information as they possibly can. They bombard us with questions, they tease out tidbits of knowledge and in exchange for that they let us into a few of their secrets and show us around. Admittedly they show us around and then interrogate us on what we think of them.

That was my first time in Brisbane, and an overnight stay is no where near long enough. I'm looking forward to spending a week in Brisbane, and hopefully getting a chance to take in a bit more of the city. As much of a chance as you get when attending a conference that is though...

Geek Parents

andrew@etc.gen.nz (Andrew Ruthven) — Sat, 29 May 2010 10:40:25 +0000

There have been many things about becoming parents that have surprised us. There are also been things from organising LCA2010 that have surprised us. One of the more surprising things that is that Susanne has become more of a geek.

Not terribly surprising really, that after co-directing one of the ultimate geek conferences that you'd pick up a few things. Not only is Susanne now an expert Inkscape user, she is now at home hacking HTML, writing using LaTeX, posting on Twitter & identi.ca, using request tracking systems and last but not least IRC. IRC was vital to organising LCA, but Susanne and I have continued to use IRC now that LCA is over to chat while I'm at work, and as it turns out around the house. For example:

<MadHatter> 16:10:54> Please pick up your son
<MadHatter> 16:11:05> now please
<MadHatter> 16:11:10> NOW please
<MadHatter> 16:11:12> NOW
<MadHatter> 16:11:18> NOW NOW NOW NOW NOW
<MadHatter> 16:11:28> I'm on strike
<MadHatter> 16:11:41> Andrew
<MadHatter> 16:11:56> Andrew Graeme Ruthven!
<MadHatter> 16:12:10> Pick. Up. Your. Son
<MadHatter> 16:12:13> Please
<MadHatter> 16:12:19> Please!

The funniest part was that, even though I was using my laptop, my IRC client wasn't running. My IRC proxy was happily logging those requests, so when Susanne was cracking up with laughter (thinking I was ignoring her) I was able to catch up on what was happening...