Intermediate on Tom Meurs

Talos Linux Vendor Lock-In: Five Questions, Run on My Own Nodes

Tue, 06 Oct 2026 09:00:00 +0200

TL;DR I ran the five questions from my licence post on the OS under my own cluster. The licence holds. The Talos Linux vendor lock-in sits in two defaults that point at Sidero’s servers, the BSL code Sidero keeps adding around the MPL core, and a company Yardi has owned since 14 September.

Your Dependency's Business Model Is Part of Your Threat Model

Wed, 23 Sep 2026 19:00:00 +0200

TL;DR A vendor freezing its free edition belongs in your risk register next to the expiring certificate. Thirty-six dated cases below, three kinds of event, and five questions to score your own stack. My own register had the Vault row missing for three years.

On 11 September, Portainer’s CEO published “Portainer 3.0 is coming, and here’s what it means for you”. I read it the Monday after and shrugged.

Here’s what it says. 3.0 is a Kubernetes-first codebase for enterprise customers, and “we are not cutting a separate CE build of it”. Community Edition stays on 2.x. 2.45 LTS “is the last release in the 2.x line”. A few days later they added a clarification: 2.45 keeps getting security fixes, bug fixes and back-ports of any 3.x feature that has a Docker API equivalent, “for as long as that LTS is supported”. The lifecycle page puts that at May 2027. Want 3.x for free? There’s a Business Edition key called 3 Nodes Free, one per organisation.

KVM/QEMU Scripts and Aliases: Making Virtualization Actually Usable

Wed, 03 Jun 2026 21:17:00 +0100

I run VMs all day. A Kubernetes deployment I want to test, a distro I read about, Windows for that one stubborn application, an experiment I’d rather not run on my actual machine. KVM/QEMU is the right tool for all of it. It lives in the Linux kernel and runs close to native speed. Nothing in it phones home, and no vendor gets a say in what I do with my own hardware.

Infrastructure as Code for People Who Need to Understand

Sat, 30 May 2026 19:45:00 +0100

Someone opens a cloud console, clicks through a wizard, accepts a few defaults, and a resource appears. The dashboard goes green and everyone moves on. That’s still how a lot of infrastructure gets built in 2026, and I’ve built some of it that way myself.

I can’t work like that for long. When I click a button and infrastructure appears, it feels borrowed. I want the configuration written down somewhere I can read it back, and I want to know why something exists, not only that it exists. The console gives me a green tick. It doesn’t give me any of that.

Backup Strategy for Your Homelab: The 3-2-1 Rule in Practice

Mon, 18 May 2026 19:30:00 +0100

TL;DR Three copies, two kinds of media, one of them offsite. Restic for files, Velero for the cluster, a Backblaze bucket for the offsite copy, and a restore test on a schedule. Mine costs about €5 a month, and the restore test is the part I still have to make myself do.

Picture the disk in your homelab dying tonight. Not corrupting, not throwing SMART warnings for a week first, just gone. The git server with every repo you care about, the password vault, fifteen years of family photos, the home automation that runs the house. All of it on a drive that’s decided it’s done.

Grafana Dashboards That Actually Get Used

Sat, 02 May 2026 20:15:00 +0100

TL;DR Each dashboard answers one question, and within five seconds I know whether I need to care. Four kinds of dashboard cover everything, variables and links tie them together, and the JSON lives in Git. My homelab runs five, and anything that goes a month unopened gets deleted.

You have Grafana. You have Prometheus metrics. You have logs in Loki and traces in Tempo. The data’s all there.

You also have 47 dashboards nobody opens.

K3s Cluster Setup on Refurbished Mini-PCs

Fri, 24 Apr 2026 21:12:00 +0100

TL;DR Three refurbished mini-PCs, K3s with embedded etcd, kube-vip for one API address that survives a dead node, then MetalLB, Traefik and Longhorn on top. About €450 in hardware and an afternoon. Below are the commands, in the order I ran them.

Three mini-PCs sit on a shelf in my house. Between them they run my GitLab, my monitoring stack, home automation, file sync, a password manager, and a pile of other things I’d rather not hand to someone else’s computer. The whole setup cost less than one month of the managed Kubernetes bill for the same thing, and I know what every layer does because I put it there.

cert-manager: Automatic TLS Certificates in Kubernetes

Sun, 12 Apr 2026 21:38:00 +0100

TL;DR cert-manager watches Certificate resources, fetches the certificate from Let’s Encrypt, your own CA or Vault, stores it in a Secret and renews it 30 days before it expires. I run one DNS-01 ClusterIssuer through Cloudflare and one wildcard certificate, copy that Secret into the namespaces that need it, and let two Prometheus alerts tell me when a renewal is stuck. Nothing left to remember.

For years my certificates renewed the way most people’s do. A calendar reminder, a manual certbot run, and the hope that I’d get to it before the thing expired. It worked, right up to the morning a service started throwing cert errors at me and I had no idea why. The renewal cron had been failing for weeks. Quietly.

Distributed Tracing with Tempo and OpenTelemetry

Sat, 04 Apr 2026 19:47:00 +0100

TL;DR Tempo is where my traces go. The OpenTelemetry Collector receives spans from every service, tail sampling keeps every error and every slow request, and Tempo writes the rest to MinIO with three days of retention. From a span in Grafana I click through to the Loki lines with the same trace ID. My production values are at the bottom.

Your metrics say something is slow. Your logs say errors happened. Fine. Which request failed, where did the latency come from, and which service in the chain ate the timeout? Neither of them can tell you.

Loki for Kubernetes Logging: The Prometheus-Like Approach

Tue, 31 Mar 2026 21:15:00 +0100

TL;DR Loki indexes labels and stores the log text as compressed chunks, so a month of logs fits on commodity hardware. The trade is full-text search. Below is the single-binary install I’d hand anyone first, the same chart on MinIO with three replicas, and the knobs I didn’t touch until the volume was real.

You’ve got Prometheus for metrics, so you can already see what’s happening across your clusters. Metrics tell you request latency spiked at 14:32. They don’t tell you the payment service threw a null pointer because someone shipped a config change with a typo. For that you need the log line.

NixOS as a Hypervisor: KVM and QEMU Can Do Everything

Thu, 19 Mar 2026 21:52:00 +0100

TL;DR KVM and QEMU are the engine inside Proxmox and most of the cloud you rent. On NixOS, with libvirt on top, that engine is one block of config, and live migration, memory ballooning, GPU passthrough, SR-IOV and CPU pinning are each a command or an XML snippet away. What Proxmox adds is the dashboard and the delegation, and I’m honest below about how much that’s worth.

Ask around how to run a “real” hypervisor at home and you get the same shortlist. VMware, Hyper-V, or at minimum Proxmox. Something with a web UI, a clustering tab and a marketing page full of enterprise features. The shortlist is so well worn that running VMs without one of those products feels like cutting corners. I don’t blame anyone for that. The marketing is good.

Arch vs NixOS as a Workstation: Professional and Personal Use

Tue, 03 Mar 2026 21:28:00 +0100

TL;DR I’ve run Arch and NixOS as my daily machine, and today it’s Arch on both desktops and NixOS on the servers. Arch’s reputation for breaking is mostly a missing snapshot. With btrfs, Snapper, dotfiles in git and a package list, a rollback takes 2 minutes and the fear of updates goes away. NixOS earns its learning curve when several machines have to stay identical, and on a server I wouldn’t run anything else.

CTF and Forensics Skills That Make You a Better DevOps Engineer

Fri, 27 Feb 2026 19:52:00 +0100

TL;DR I spend my evenings on Hack The Box and it’s made me better at my day job, which is platform engineering and has nothing to do with pentesting. The first ten minutes on a CTF box and the first ten minutes on a broken production server are the same loop, with “flag” swapped for “incident”. Below is the toolkit that loop runs on, from one host up to a Kubernetes pod, with the CTF use and the work use side by side for every command.

When not to use Kubernetes

Sat, 17 Jan 2026 10:00:00 +0100

I write a lot about Kubernetes, and I run it at home every day. I like it.

So it might surprise you that I spend a fair amount of my time talking people out of it.

The situation I keep walking into goes like this. A small team, one product, a roadmap full of features customers are waiting for, and someone has decided the first milestone is a Kubernetes cluster. Three nodes minimum, etcd, a CNI , an ingress controller, cert-manager, a monitoring stack. Weeks of work before a single customer sees anything. Everyone nods along, because that’s what a serious setup is supposed to look like.

YubiKey + Pass + GPG + SSH: One Key to Rule Them All

Tue, 13 Jan 2026 17:00:00 +0100

TL;DR One YubiKey carries a GPG key with a signing, an encryption and an authentication subkey. gpg-agent hands the authentication subkey to SSH, git signs with the signing subkey and pass decrypts with the encryption subkey, so one PIN in the morning and a touch per action replace every password I used to type. The SSH part alone is three steps and worth doing on its own.

Every morning I plug in my YubiKey, type one PIN, and that’s the last secret I type until I pull it out again. SSH to a server, no password. Sign a commit, no passphrase. Pull a secret out of pass, touch the key. One thing in a USB port, and the rest of the day my authentication happens without me.

Unbreakable - My Fascination.

Tue, 23 Dec 2025 20:00:00 +0100

As a kid I called the things that fascinated me unbreakable. Indestructible never fit, because indestructible means it never breaks. Unbreakable means it keeps working after it breaks.

I know exactly when it started. A photo of an A-10 Thunderbolt II back from a mission with half a wing gone, the tail in tatters and the fuselage full of holes. It still brought its pilot home.

Luck had nothing to do with it. Somebody sat at a drawing board years before that mission and decided the plane had to come home looking like that.

Prometheus and Thanos: Metrics at Scale

Sun, 31 Aug 2025 10:00:00 +0200

TL;DR Prometheus on its own keeps a couple of weeks of metrics on local disk and can’t answer a question across clusters. Thanos puts a sidecar next to each Prometheus, ships the blocks to object storage, and puts a querier in front that reads all of it back through the same PromQL. Below is the install, the four components, the HA and multi-cluster wiring, and the numbers I run in production.

Kubernetes RBAC: Least Privilege in Practice

Tue, 19 Aug 2025 10:00:00 +0200

TL;DR Kubernetes ships with a permission model that hands every pod a token and lets the default service account collect rights nobody remembers granting. Least privilege means a service account per workload, no token unless the app talks to the API, and roles that name the namespace, the resource and the verb. Below are the four RBAC resources, the five settings that cap the blast radius, the bindings I copy most often, and how I check and enforce all of it.

Vault for Beginners: Secrets Management in Kubernetes

Wed, 02 Jul 2025 10:00:00 +0200

The first time I ran kubectl get secret myapp -o yaml and base64-decoded the value, I felt my stomach drop. There was my database password, sitting in etcd, readable by anyone who could reach the API with the right RBAC. Kubernetes Secrets are not secrets. They’re base64-encoded plain text with a fancy name. That’s the default, and it’s the thing nobody warns you about on day one.

Every cloud provider has a fix for sale. AWS has Secrets Manager, Google has Secret Manager, Azure has Key Vault. They work. The catch shows up later: the day you need to migrate, the day you want to know exactly what happens to a secret after you write it, the day you realise your most sensitive data lives in a system you can’t inspect.

Container Image Scanning with Trivy in Your CI Pipeline

Sun, 08 Jun 2025 10:00:00 +0200

Pull a base image, copy in your code, push it to production. That’s the loop most of us run on autopilot. The part nobody looks at is the base image itself, which quietly drags in a few hundred packages you never chose. Any one of them could carry a known CVE , and you’d have no idea.

Automating Semantic Versioning with GitLab CI

Tue, 27 May 2025 19:44:00 +0200

Picture the end state first. You merge a branch to main, walk away to get coffee, and by the time you’re back the project has a new version tag, a fresh changelog entry, and a GitLab release with notes written from your commits. Nobody decided “is this 1.4.0 or 1.3.5?” because nobody had to. The version fell out of the work itself.

That’s where I want to get to in this post. I run a self-hosted GitLab and I do not want versioning to be a thing I think about. A version number that someone picks by hand is a tiny black box: it depends on whether that person remembered the rules, was paying attention, and agreed with everyone else about what counts as a breaking change. I would rather the number be a consequence of the commits, something I can inspect and reproduce.

GitLab CI for Kubernetes: From Commit to Deployment

Thu, 15 May 2025 20:33:00 +0200

For a long time my CI lived on someone else’s servers. Push code, wait for a hosted runner, watch the minutes tick down against a monthly quota, hope the provider doesn’t change the rules next quarter. It worked, right up until I started asking where my source code actually sat while it was being built, and who else could see it.

So I moved GitLab in-house. I run it self-hosted now, on my own hardware, next to the clusters it deploys to. That’s sovereignty applied to CI/CD: my code, my builds, my artifacts, no vendor that can change pricing, deprecate a feature I depend on, or read my repositories without me knowing.

ArgoCD vs Flux: When to Choose What

Fri, 28 Mar 2025 21:33:00 +0200

“Should I use ArgoCD or Flux ?”

I get this question over coffee, in Slack, in PR comments, probably once a week. People want me to declare a winner so they can stop thinking about it and go build something.

Here is my bias, up front, so you can weigh everything that follows: I run ArgoCD on my own clusters. I have a few years of it under my belt and I like it. That preference is going to leak through no matter how careful I am, so I am telling you now instead of pretending I am neutral.

ArgoCD for Beginners: Your First GitOps Deployment

Sun, 16 Mar 2025 19:15:00 +0100

Here is the thing I never want to do again: ask a cluster what it is running and not trust the answer. For years that was normal. Someone ran kubectl apply, maybe from a laptop, maybe from a CI job nobody could find anymore, and the live state slowly drifted away from anything written down. When I switched to GitOps, that whole category of uncertainty disappeared. I push to Git, and the cluster converges to match. If I want to know what is deployed, I read a file.

Kubernetes Network Policies: A Visual Guide to Pod Security

Sat, 08 Feb 2025 19:34:00 +0100

Picture this: an attacker pops a single pod in your cluster, maybe through a vulnerable image or a leaked token. From that one foothold, they can reach every database, every internal API, every secret-fetching sidecar you run. Nothing stops them, because by default nothing tries to.

Network Policies are the thing that stops them. They turn “one compromised pod” into “one compromised pod, and that’s it.” Everyone knows they should use them. Almost nobody actually does, because the YAML looks scary and the behaviour is weird until the mental model clicks.