Introduction

Rocky Linux 9 is a bug-by-bug clone of Red Hat Enterprise Linux 9 (RHEL 9). We generally recommend using RHEL 9 for mission-critical workloads, but for less important services Rocky Linux 9 is a very good choice if you’re in the Red Hat land already. Official Rocky images are only available in AWS Marketplace, which complicates things when you need to programmatically determine the latest version. This is a common requirement when you do infrastructure as code, for example with Ansible, Terraform or Packer. Although we speak of latest Rocky Linux AMI here, everything in here is applicable for any other AWS Marketplace images, for example Alma Linux.

Introduction

Ansible is an infrastructure as code tool that uses SSH as its transport mechanism. When the targeted nodes are close, latency-vise to the Ansible controller things usually work fine with the default settings. However, when the targets are far away or latency is big, you may notice that ansible-playbook hangs on some long-running task and never recovers. When you rerun the playbook it may proceed further and then hang at some other task. Or the same task. This is incredibly frustrating, but fortunately also fairly easy to fix.

Introduction

Prometheus is a great tool for “cloud-native” metrics gathering and monitoring. It is particularly easy to manage with infrastructure as code methods. Prometheus can collect metrics from various sources, including Azure Monitor. You can use Azure Metrics Exporter to convert Azure Monitor metrics into Prometheus metrics, but doing so is definitely not trivial unless you’re pretty familiar with Prometheus, Azure Monitor and Microsoft Entra ID apps. This article tries to help you make monitoring Azure with Prometheus a breeze instead of a struggle. We won’t go into a lot of detail about Prometheus or Azure Monitor as there’s plenty of information available elsewhere about both of them. Also note that this article is about vanilla Prometheus, not Microsoft’s “Azure Monitor managed service for Prometheus”.

Introduction

We sell digital products in AWS Marketplace, Azure Marketplace and Udemy - see our products page for detail. The end customers of our products are located around the world, including the Unites States of America. All the aforementioned platforms a located in the U.S. This means that they comply with the U.S. tax laws both on the state and federal level. Internal Revenue Service (IRS) is responsible for collecting the federal taxes, which are relevant for this article. Foreign (e.g. European) corporations that sell (digital) products or services to U.S. customers need to prove to IRS that it should not withhold federal taxes from the income coming from U.S. end customers. The goal of this article is to help European corporations (companies) avoid double taxation: first by the IRS and then by the tax office of its own home country. We have all the basic information that a typical European corporation (company) needs to do to avoid double taxation when selling services or digital products to U.S. end customers.

We’ve recently started using alldomains.hosting for what we call “programmatic emails”. For that purpose alldomains.hosting is dirt cheap (~1€/year/email address), which makes one quite motivated to suffer through the confusing website to figure out how to buy stuff from them. Once you’ve managed to buy your domain and/or mail services they just “tend to work”. Alldomains.hosting IPv6 support, or lack of it, may be a problem for you, though.

For example, in AWS EC2 you nowadays really want to avoid assigning public IPv4 addresses to EC2 instances as they cost quite a lot. So, you set up an IPv6-only egress-only internet gateway in your VPC and, for the most part, everything “just works”. Then you try to add mail delivery via alldomains.hosting and IPv6 and “boom”, it does not work. According to their support (as of 25.9.2024) their mail servers lack IPv6 support.

Introduction

Microsoft Entra ID, formerly known as Azure Activate Directory (AAD), is replacing classic on-premise Active Directory installations slowly but surely. It replaces “legacy” protocols such as LDAP and Kerberos with “modern” protocols such as SAML, OIDC and OAuth2. However, the client-side support in various operating systems such as Windows, Linux and MacOS is spotty, to say the least. You can make things work, but only if the stars (or rather, bits) are aligned just right. This article explains how multi-factor authentication in RDP works with Azure VMs when using Microsoft Entra ID. Note the emphasis on MFA: without MFA you can make logins with Entra ID work more easily by using the normal username + password authentication in RDP.

Introduction

OpenBSD 7.5 is a UNIX-like operating system. The project’s “efforts emphasize portability, standardization, correctness, proactive security and integrated cryptography”. Compared to modern Linux distributions OpenBSD is very compact, but comes with the usual packages and ports tree you would expect from any *BSD operating system. This article shows the process of installing OpenBSD 7.5 with virt-install, making it a virtualization guest on Linux.

Downloading the ISO installer

First you need to download the OpenBSD 7.5 ISO installer on your Linux system. On most systems the amd64 install75.iso is the correct choice. Check the OpenBSD download page for other architectures.

Introduction

Hiera is a very powerful “key-value configuration data lookup system” used mainly, but not exclusively, with the Puppet configuration management and orchestration system. In Hiera data is stored in in yaml files in, as the name implies, a hierarchy or set of prioritized levels. A typical Hiera lookup goes through the hierarchy starting from the highest-priority level and stops when it finds a match. That match could come from a node yaml file, a deployment (e.g. production or staging) yaml file or from site-wide yaml. What this essentially means is that you can define common, site-wide parameters at the lowest level of the hierarchy and override those when needed at higher levels. How does Hiera and Ansible work together, then? The short answer is “they don’t, really”, but the long answer is more complex than that.

Introduction

Upcloud is a Finnish Cloud provider that focuses on high-quality services. There is no built-in support for installing RHEL on Upcloud, which is quite typical of “small Clouds”. Sometimes you don’t want to use clones (e.g. Rocky Linux) and need real RHEL instead. This is where this article comes handy, as the RHEL installation process in Upcloud is far from trivial. This article focuses on RHEL 9, but the process may work with older and newer versions as well. The process I describe here applies almost 1:1 to any Linux operating system Upcloud does not natively support.

Introduction

The mechanisms for configuring Buildbot build order is documented fairly well. However, what that documentation lacks is a centralized place where ordering is explained. My personal goal was to run smoke tests first and if those don’t pass then cancel all other build requests. That seemed straightforward, but turned out not to be so. There were many, many ways that could in theory be achieved, but most of those did not work at all, or worked only partially. This article attempts to fill the “how do I order builds in Buildbot” gap, including what can and can’t be achieved with each strategy.