Tim's Blog

Pihole 6 and HTTPS

Sun, 13 Apr 2025 16:56:42 +0000

I run two PiHole's in my home network - one as a container on my NAS, the other also as a container on it's own dedicated VM.

The idea, in theory, is that as long as the NAS is up, I should have some sort of DNS services around. It's kinda one of the staples of the network. Switching, routing is up first.. then the NAS.

PiHole 6 came out recently, so it was time to revisit the container configuration across the board.

Oh AI.

Sun, 23 Mar 2025 14:58:44 +0000

Nothing too big here.

I asked Perplexity for a random 32 characters string for use as a salt for a cookie:

So, neat, copy/paste.. and my app complains that the string is too long.

1>>> foo = "4aG7eJ9dLpM8nBcF5tRgYhK6oIuZ1xWvE3cD2sN"
2>>> len(foo)
3>>> 39

...

I didn't think it was that hard of an ask...

Extending Lubelogger

Sun, 09 Mar 2025 19:35:57 +0000

I recently found a neat little self-hosted projcet called LubeLogger, which is sorta like a vehicle management tool. This does some neat things like recording my fuel usage (which I've been doing for years in a spreadsheet), tracking maintenance and repairs, and scheduling reminders based on milage and/or time.

The only thing it didn't do out of the box was handle tire wear. I have summer and winter tires for my vehicles, and I like keeping track of how much distance they've travelled.

Access Sharepoint Online With Entra Registration

Thu, 27 Feb 2025 18:51:40 +0000

At work, I was recently asked to allow an on-premise Python application access to SharePoint Online (SPO).

The now-depreciated way would be to go to your SPO site, append /_layouts/15/appregnew.aspx to the site's name (so it would look something like https://tenant.sharepoint.com/sites/TestSiteforPythonAPIAccess/_layouts/15/appregnew.aspx). This is creating an app registration on the specified SPO site, but this method is being depricated: https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/retirement-announcement-for-add-ins. It works in my production tenant, but fails in my developer space.

Updates for Debian 12 - Dealing with Pip changes

Mon, 26 Jun 2023 22:18:21 +0000

Stuff

So it's been a little while since I've tinkered with this stuff, so I've been self-refreshing myself as I go along here.

The big catalyst for this work was the release of Proxmox 8. The key takeaway during the upgrade is that it's a typical Debian upgrade, and so it went more or less without incident. Great!

The things that hang off Proxmox

While the upgrade to Proxmox went fine, there's a bunch of stuff that "hangs off" Proxmox: A load balancer, a playbook to create cloud images, a backup system, and so on. Some of these are one-off application installs, or single-purpose VMs that do a specific thing, but in other cases, they're stuff that I've written.

Certbot DNS challenge with Apache and Cloudflare

Mon, 13 Feb 2023 04:39:43 +0000

A short post while I am thinking about this - because I sorta figured it out.

I am still working on sunsetting my monolithic server (well, it's a glorified desktop with relatively more storage than other hosts on my network), and was working on setting up CheckMK on a newly minted VM.

CheckMK is an open-source monitoring solution that I have used at home for some time, and wound up implementing it at work. It's .. almost a LAMP stack app, but without the M part.

Proxmox Cloud-init image using Ansible

Fri, 13 Jan 2023 02:45:07 +0000

Whelp, I'm not really certain how I got here.. but at some point, I wound up with a pair of computers running Proxmox with the intent of running Kubernetes. It started out pretty innocently: I watched a TechnoTim video:

And it looked neat enough, so sure.. why not, let's try that out.

In the video, around the 6:00 minute mark, he makes reference to another video of his - using cloud-init images to make Ubuntu machines:

Gotcha Day

Wed, 11 Jan 2023 15:54:15 +0000

One year ago, we welcomed this idiot into our home.

Hopefully he'll stick around for several years more, taking us on his adventures.

Tinkering With My Home Network

Mon, 26 Dec 2022 23:35:39 +0000

I am not very good at networking stuff together. I mean, if it's a simple network, I can usually manage. When it comes to thinking about VLANs and similar topics, I start to get a bit hazy.. but when it gets into configuring devices to carry VLAN traffic, I really need to get back to basics and do a lot of "Ok, make sure X, Y and Z work here. Done.. now, make sure X, Y and Z work there.." and so on.

Powershell Set-Acl: an exception of type system.security.principal.identitynotmappedexception was thrown

Fri, 04 Nov 2022 20:42:18 +0000

I have this short little PowerShell function that I use all over the place. It simply adds an ACL entry to an object, usually a network folder:

 1function AddNTFSPermissions($path, $object, $permission) {
 2  $FileSystemRights = [System.Security.AccessControl.FileSystemRights]$permission
 3  $InheritanceFlag = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
 4  $PropagationFlag = [System.Security.AccessControl.PropagationFlags]'None'
 5  $AccessControlType = [System.Security.AccessControl.AccessControlType]::Allow
 6  $Account = New-Object -TypeName System.Security.Principal.NTAccount -ArgumentList ($object)
 7  $FileSystemAccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList ($Account, $FileSystemRights, $InheritanceFlag, $PropagationFlag, $AccessControlType)
 8  $DirectorySecurity = Get-Acl $path
 9  $DirectorySecurity.AddAccessRule($FileSystemAccessRule)
10  Set-Acl $path -AclObject $DirectorySecurity
11}

I didn't write this function .. it came from the depths of the internet early on as I was learning PowerShell and using it for all my bits of automation.

Uploading PDF's to SharePoint Online

Fri, 28 Oct 2022 20:49:32 +0000

The problem...

I have something like 1200 PDfs, and the list is growing, of deliverables that we own the copywrite to that we want to put in a central place called SharePoint Online. This library will then get the benefit of being searchable, have associated metadata, and should free up time from a bunch of people for having to search for this information manually.

The solution...

This took a little while to get to, and some of the iterative steps that transpired between inception and solution are long since gone. That's OK, that's how the process worked. I had to laugh at myself a bit when I started searching for some solutions to the problems I ran into, and found my own posts on the topic...

Employee Directory in SharePoint Online

Wed, 19 Oct 2022 01:10:13 +0000

The Issue

We have been working on a long, slow project to bring some new services online for our staff. One is our "Knowledge Hub", the other is our "Connect" site - a SharePoint Hub site, linking various functional group's SharePoint sites together.

This post is about "Connect".

One feature that is seemingly missing in SharePoint online is a straight up employee list. There are a few alternatives - people finders, org chart visualizers, etc.. but we're a small enough operation, that a list of people is sufficient for our needs. Additionally, another page showing all the staff's photos has been valuable to help figure who's who.

Windows Firewall

Sat, 02 Apr 2022 03:13:33 +0000

Another post with notes from my former to my future self.

What was I trying to do?

We had to wire up a firewall configuration policy for a group of computers so that they'd be prevented from accessing the internet. Ok, no problem, except that our email comes from Office 365 which happens to be on the internet.

Microsoft is nice enough to publish a list of IP addresses that are used by Office 365 services and bonus - it looks like its updated pretty frequently!

Azure Automation

Thu, 10 Feb 2022 16:00:29 +0000

The problem to solve...

Every so often, I need to automate something. Duh. Today, I would like to manage the group memberships of some Azure AD users. This doesn't require any local resources so there's no reason to run this on-premise. There's also no need to store credentials in the script - that's what managed identities are for.

The problem is that every time I do this, I feel like I'm just flailing around in the dark trying to get a working solution to my problem :P

"HA" Pihole between Debian, Synology and Docker

Mon, 29 Nov 2021 20:52:13 +0000

A while back, scrolling through YouTube, I stumbled across a video titled "High Availability Pi-Hole? Yes Please!", which I thought was interesting - it seemed to address a problem that I didn't really think I had.. but why not poke around at it?

Pi-Hole is a network-wide ad blocking DNS server. It can function as a DHCP server too, but I figure my router is mighty fine at that. It's not very good at custom DNS entries, local CNAMEs and other DNS functionality that I would like. Since PiHole is basically running DNSMasq under the hood (or, was? I'm not really clear TBH), this seemed like a bit of a fun project.

Haproxy for Active Directory LDAPS

Thu, 25 Nov 2021 04:00:53 +0000

One more issue to solve...

We have one domain controller at work that is kinda critical to the entire operation. I mean, not like this particular server is the only AD server on the site, but it somehow became only LDAPS server responsible for authentication for non-AD enabled services.

Like VPN. Like our ERP.

So when it's down, it's a bit of a problem. We tend to avoid making it go down during operational hours, but nothing is 100% infallible. Plus with trying to be more hands-off with hosts (I prefer cattle instead of pets), more and more Active Directory specific CVE's coming out, this one machine is being a bit of a pain in the ass.

Ansible and LetsEncrypt

Mon, 25 Oct 2021 02:41:04 +0000

More on the host configuration

In my last post on this topic, I had left a to-do to get LetsEncrypt setup and running on the host.

After spending quite a bit of time on the effort and learning what tools were at my disposal, I figured out (pretty late in the process) that.. my initial approach had a considerable flaw:

No automatic renewals.

I think I've read about running Ansible in more of a "continuous" mode on the endpoint, and in this scenario, I can see my initial method working - the playbook could run on a scheduled task and re-acquire and install the certificates on a periodic basis... but that's generally not how I run my stuff, and not how I intend to use this playbook.

Ansible and Host Configuration

Sat, 23 Oct 2021 20:29:39 +0000

Backstory

I think just about everyone of my posts I start with some sort of justification why I'm writing the post. I don't really know why .. other than I think it serves as a good reminder of what I was doing when I wrote the darned post ...

As usual, these things start off at work.

We had a bit of a security audit on one of our 3rd party hosts (hosted off-domain in Azure), and it yielded some basic misconfigurations that should get fixed: Some old TLS settings that were no longer supported, updating PHP version, updates to the application to remove unsupported dependencies and so on.

Covid and MS PowerApps

Tue, 19 Oct 2021 02:25:17 +0000

Some of my notes on how we used PowerApps to solve some COVID problems at work

I should have done this sooner, because I'm not likely to remember all the details too much. This won't be a "technology post" so much, or even a how-to - maybe more a reminder of the tools we used to solve the problems we ran into when COVID came to town.

The Visitor Screening App

Out of the gate, we all went home, and for a brief period, it was fine. One location outright closed up, the other location practised what were considered good practices at the time - distancing, cleaning, no sharing, masks and most importantly: No visitors. As we all collectively learned more about the pandemic and looked to re-open, visitors (as in, non-company employees) were being welcomed back into the building.

Cloudflare

Sun, 12 Sep 2021 21:29:19 +0000

And just like that, all my base are belong to Cloudflare.

It started with DNS ...

It started out pretty simply: Cloudflare offered front-end caching for your website, provided you ran your DNS through them. They would proxy the connections for me, provide SSL (through Lets Encrypt), and I could still update DNS through an API calls from a handy Python library that enables me to keep a DNS record pointing to my home IP address all the time (I need this for an IPSec tunnel I have to work).

Maps for Garmin Devices

Sun, 25 Jul 2021 19:12:51 +0000

Maps on portable devices

Getting working maps on a mobile device is reasonably straightforward, especially if you're able to be connected to a cellular service.

The challenge starts to increase when you may not have connectivity, or have limited bandwidth or speed on your device. Offline maps within tools like Google Maps generally work well enough, but start to become feature limited in terms of POIs.

And while cellular coverage is obviously great in most parts of civilized Canada, there are still many close destinations that lack connectivity (specifically highway 93 in Alberta).

Microsoft Defender & Virustotal

Wed, 02 Jun 2021 14:20:20 +0000

Say what now?

Sure, MS, VirusTotal really is a nefarious site that you should prevent me from going to.

Bathroom

Fri, 19 Feb 2021 05:04:53 +0000

We started back in May 6, 2015 - we deconstructed the old bathtub, cut it up, and threw it out.

The tub had a good crack in the bottom of it, and as it turned out, it had been leaking on to the subfloor below it. Nothing major in terms of damage - most of the water had been soaked up by the wood in the bathtub construction. We bought a replacement tub, installed it, had a plumbing leak, had help fixing it, installed tile, realised we installed tile incorrectly, took it all down... and there it sat for a while.

Manipulating PDFs with iText in powershell

Sun, 07 Feb 2021 16:36:05 +0000

So, I can write a PDF...

Last post I managed to generate an empty PDF with Powershell using iText, after working through dependencies and order of inclusion for running some .NET libraries in powershell. It's made me wonder if there's a better way to handle the inclusion of libraries in a Powershell script, and if there's a better way to Install-Package that actually handles dependencies correctly..

However. The point of this whole thing was to automate the processing of some large collections of PDFs.

Nuget in Powershell

Thu, 04 Feb 2021 16:36:05 +0000

Using nuget stuff in Powershell

I was asked to write some automation to deal with several thousand pages of PDF work.. Cool, sounds like something new, and not quite in my wheelhouse, so a good reason to get to some learning. After a bit of searching (and searching through old work), I find that iText7 seems to be the current favourite for working with PDF files in .NET and Java. Since I can use .NET stuff in Powershell, seemed like a good start.

PnP Powershell - for Sharepoint

Sun, 31 Jan 2021 01:16:14 +0000

Work is finally getting around to enabling OneDrive for Business (ODFB) for all our users. This is cool, because finally we'll be able to legit be able to collaborate on stuff - instead of this song and dance of save files to the network, wait for a lock to close and so on.

One of the things we ran up against is that when you share a file to someone through MS Teams, a copy is uploaded to your ODFB folder Microsoft Teams Chat Files. That's fine, except we have a legitimate concern that work will be done in this space, and not be captured in the correct locations for data.

VSCode, Hugo and developing in Docker

Wed, 27 Jan 2021 23:41:10 +0000

I attended the "VS Code Day" event through Meetup, and learned about a neat new function of the IDE for developing in a container. The session was neat and interesting, and opened my eyes up a bit as to what Microsoft intends you to use VSCode for.

When thinking about the session afterwards, I was trying to apply it to how I work. I have two primary workspaces that I use: Powershell and C++ (for Arduino/ESP type devices). These are defined as a workspace, with specific extensions configured for each. Out of the box, I get to thinking:

Synology, Docker, Pihole and Cloudflare

Sun, 17 Jan 2021 20:56:45 +0000

A while ago, I got really sick and tired of dealing with the hardware that Telus shipped me for my residential gateway, and so a new "internal" router was added. Things were good, but then I wanted to do network-wide ad blocking (to deal with ads on streaming devices...), but found that even if I specified an additional DNS server, the router would still advertise itself as a DNS server, as well as any additional DNS server I added.

Gitea and Drone

Wed, 13 Jan 2021 23:54:46 +0000

How I got here...

Part of the whole effort to mess around with Docker was to get a better understanding of what people do for continuous integration and continuous deployment - CICD. There are no shortage of services online that do this for you - Github, Azure Devops, Bitbucket.. are all names that are familiar in terms of being able to do CICD.

I wanted to wire it up on my own, and least understand what the moving parts are.

More Docker

Sun, 22 Nov 2020 01:30:36 +0000

So, as it turns out, solving the ToDo's from my last posting was pretty easy. Traefik solved most of the todo's / desired outcomes:

Internal ports 80 and 443 were already occupied by other services, such as my wiki, Git repo, etc. Putting these in a container, and letting Traefik handle the path mapping addressed this.
Internal addressing is wonky.. I am running PiHole (as a container) on my Synology. This enables DHCP and DNS to be served from something other than my ISP supplied router, which gives me more control.
Docker Registry proxy was moved to a separate DNS name, which I did configure with my external DNS. Since I want this to be internal only, I then set Traefik to whitelist traffic from my internal network. This will almost for certain break the Lets Encrypt certificate renewal.. we'll see in 90 days.

I didn't need to explore DNS Validation for Lets Encrypt - simply creating the DNS record (and then letting Taefik handle it) was sufficient. It's magic!

Docker Registry

Wed, 11 Nov 2020 04:51:26 +0000

Learning Docker

I'm still getting my feet wet with Docker, and using it to post my blog page, as well as a few other services that I run for my own usage.. but it didn't take me long to find out about the rate limit that was implemented in early November this year.

Collaboration!

Sun, 18 Oct 2020 21:26:55 +0000

When I started looking at a static site, I first poked at Jekyll. I found a basic theme that I like. It had a bit of a failing though - there was an issue if I had the site in a subdirectory (like timatlee.com/blog/), the navigation links at the top of the header wouldn't work.

It seemed like there was an assumption that the site would always be at the domain root, which in my case, turns out isn't the case.

Playing with Hugo

Sat, 17 Oct 2020 04:15:07 +0000

I had this bit of a weird thought the other day.

I'd switched my blog to Wordpress a little while back. The site had been running Drupal, and since we switched from Drupal to Wordpress at work, it's a great opportunity to mess around with the same platform and do some learning as I went.

The problem is, is that I'm just not motivated to be a Wordpress developer or site builder. I'm much more enjoying the sysadmin/netadmin thing than being a PHP developer.