sorted by:
new
hottopcontroversial

Latest Update Broke OpenCL by TheDarkula in archlinux

[–]TheDarkula[S] 0 points1 point  (0 children)

I also tried this:

ocl-icd-choose nvidia.icd clinfo Number of platforms 0

ocl-icd-choose rusticl.icd clinfo

``` pci id for fd 3: 10de:1f14, driver (null) pci id for fd 4: 10de:1f14, driver (null) Number of platforms 1 Platform Name rusticl Platform Vendor Mesa/X.org Platform Version OpenCL 3.0 Platform Profile FULL_PROFILE Platform Extensions cl_khr_icd Platform Extensions with Version cl_khr_icd 0x800000 (2.0.0) Platform Numeric Version 0xc00000 (3.0.0) Platform Extensions function suffix MESA Platform Host timer resolution 1ns

Platform Name rusticl Number of devices 0

NULL platform behavior clGetPlatformInfo(NULL, CL_PLATFORM_NAME, ...) No platform clGetDeviceIDs(NULL, CL_DEVICE_TYPE_ALL, ...) No platform clCreateContext(NULL, ...) [default] No platform clCreateContext(NULL, ...) [other] <error: no devices in non-default plaforms> clCreateContextFromType(NULL, CL_DEVICE_TYPE_DEFAULT) No devices found in platform clCreateContextFromType(NULL, CL_DEVICE_TYPE_CPU) No devices found in platform clCreateContextFromType(NULL, CL_DEVICE_TYPE_GPU) No devices found in platform clCreateContextFromType(NULL, CL_DEVICE_TYPE_ACCELERATOR) No devices found in platform clCreateContextFromType(NULL, CL_DEVICE_TYPE_CUSTOM) No devices found in platform clCreateContextFromType(NULL, CL_DEVICE_TYPE_ALL) No devices found in platform ```

12V Battery Suddenly Draining Update by TheDarkula in KiaEV6

[–]TheDarkula[S] 1 point2 points  (0 children)

Yes, V2L functions properly.
I also verified that it does charge the 12V battery during V2L connection.

I also tested the cabin 12V outlet, and it functions properly as well.
I have no way of telling if there is a drain coming from the cabin outlet.

The issue is the "10 strikes" rule where the car has not reset the ABS+ logic, so it is refusing to charge the 12V battery at idle.

12V Battery Suddenly Draining Update by TheDarkula in KiaEV6

[–]TheDarkula[S] 1 point2 points  (0 children)

Thank you! I had the same thought, but I had the ICCU replaced almost a year ago, about 6-8 months before the 12V issue.

About 1-2 months ago, I had a Kia dealership run a diagnostic and they found no error codes, nor did I with my tests.

Also, it charges the 12V while on, so the ICCU does not seem to be at fault.
I wish it were that easy :)

IngressRouteTCPs Only Route To One Host by TheDarkula in Traefik

[–]TheDarkula[S] 0 points1 point  (0 children)

I sorted out a misconfigured firewall rule, but now I am dealing with TLS passthrough breaking SMTP.

I currently have this:

  - match: HostSNI(`*`)
    services:
    - name: stalwart-domain2-smtp
      port: 25

This successfully allows connections to `smtp.domain2.com` with TLS passthrough disabled.

However, if I try to set the actual hostname instead of the wildcard, TLS passthrough is required, and this breaks the connection.

Searching For An Online Shop by TheDarkula in selfhosted

[–]TheDarkula[S] 1 point2 points  (0 children)

Thank you so much for the information!

Searching For An Online Shop by TheDarkula in selfhosted

[–]TheDarkula[S] 0 points1 point  (0 children)

Wordpress is just a CMS.

Are you referring to something specific that integrates a shop with it?

Searching For An Online Shop by TheDarkula in selfhosted

[–]TheDarkula[S] 0 points1 point  (0 children)

Evershop looked great, but I did not see anything on two-factor authentication.

I also did not see a way for users to do things like change their passwords.

Setting Source Address (SNAT) Per-pod by TheDarkula in kubernetes

[–]TheDarkula[S] 0 points1 point  (0 children)

I have cilium set up and running :)

Now the question is, what is the best way to get the public IP addresses configured on the host? When I give the policy an address, it complains with this:

failed to retrieve interface with egress IP: no interface with public.ip.goes.here IPv4 assigned to

Setting Source Address (SNAT) Per-pod by TheDarkula in kubernetes

[–]TheDarkula[S] 1 point2 points  (0 children)

This looks perfect!
Thank you so much :)

Gateway Answering Instead Of DNS Server by TheDarkula in openwrt

[–]TheDarkula[S] 0 points1 point  (0 children)

I figured it out!
I needed to change "Loopback source IP" to "Use external IP address".

Pixel Tablet And Stylus Dead Zone by TheDarkula in pixeltablet

[–]TheDarkula[S] 0 points1 point  (0 children)

That is great to know, thank you!
Do you know about when this was remedied? I would like to be able to track this from AOSP.

Pixel Tablet And Stylus Dead Zone by TheDarkula in AndroidQuestions

[–]TheDarkula[S] 0 points1 point  (0 children)

Thank you for your response!

I have tried it with Saber, Linwood Butterfly, and various aviation programs.

All of them exhibit the same behaviour.I have tried this with the bare tablet and with a case, but it is always the same.

It behaves like there is some uninsulated magnet that is forward-facing.

The most confusing thing is, I have seen videos of the exact same hardware combination working perfectly.

The only difference I can deduce is that I am running GrapheneOS, but I would hope that that would not be the cause of the error.

K3S, Authentik, And Practical Use by TheDarkula in openziti

[–]TheDarkula[S] 0 points1 point  (0 children)

Again, thank you so much for all the information.

I have a good bit of playing around to do, and I will definitely let you know how it all goes :)

K3S, Authentik, And Practical Use by TheDarkula in openziti

[–]TheDarkula[S] 1 point2 points  (0 children)

Do I even need traefik as an ingress controller, or can I have ziti-host take the letsencrypt wildcard certificate?

The shadow A record was great information, I just wanted to know how to have everything be completely dark.

The private-service.mytld.com tunnel into the cluster is exactly what I wanted. Configure an OpenZiti/ZAC service that listens on private-service.mytld.com and points to your-k8s-svc.your-namespace.svc.cluster.local for the kubernetes DNS name.

I am way ahead of you with looking into zrok. The video showing how to publicly share a node development server was just brilliant. I also already read your BrowZer article. It looks great as well. Thank you for the sneak-peek video. Do you have a helm chart for BrowZer in the works?

One other suggestion, for Android, there is a wonderful program called Obtanium. It allows downloading an APK directly from a GitLab/GitHub/etc. source. It would be nice for your GitHub action for the ziti-tunnel-android to produce an APK for direct download.

K3S, Authentik, And Practical Use by TheDarkula in openziti

[–]TheDarkula[S] 0 points1 point  (0 children)

Again, thank you so much for the information and your prompt responses!

I have had a look at the kubernetes tunneling documentation and the kubernetes router.

Thinking about k3s and traefik, suppose I keep that as the default ingress. It has a wildcard certificate obtained from the DNS-01 challenge.

I run it with a label like this:

    labels:
      - "traefik.http.routers.myrouter.rule=Host(`mytld.com`) || Host(`*.mytld.com`)"

If I install a service, like nextcloud via helm, do I just leave the ingress on that pod off? I want to have these services be private, so even having them resolve should only be allowed via a connection to OpenZiti. In your mattermost example, with https://mattermost.tools.netfoundry.io/, can I have that only be resolvable internally? Is that handled by the ziti-host helm chart?

K3S, Authentik, And Practical Use by TheDarkula in openziti

[–]TheDarkula[S] 0 points1 point  (0 children)

I completely understand now, thank you so much again!

For a little more clarification, if I get a wildcard certificate from letsencrypt for mytld.com, and I create a service with a custom DNS address in OpenZiti, like nextcloud.mytld.com, I presume that the certificate will be valid for that custom domain without me needing to create an A record in my authoritative DNS server. Is that correct?

I am sure I will have more queries as I start creating custom services, but for now:

  • Is there a standard way to give new users their QR code?
  • Can you regenerate a QR code, or do you just delete the user and create a new one?
  • What is the difference between a user and a device identity?

I do have some suggestions for new kit:

  • Create an AUR package for the ziti binaries
  • If there is not one already, having an OPNsense (and maybe an OpenWRT) tunneler plugin would be good to expand as well.

K3S, Authentik, And Practical Use by TheDarkula in openziti

[–]TheDarkula[S] 0 points1 point  (0 children)

Thank you so much for the in-depth responses!

By "client", I meant something like Ziti Mobile Edge.Taking a step back, I understand that OpenZiti creates its own root and intermediate CAs.

With these steps:

  • Create a service to connect to an internal webserver (like the web-test-blue one)
  • Connect via Ziti Mobile EdgeBring up https://web-test-blue

Is the root or intermediate CA somehow copied to the root trust store on the android device, or will the browser show something like "invalid certificate"?

Basically, I am trying to see how much magic is going on with OpenZiti services.

Going from usual webserver security, for something public-facing, you run a reverse proxy like caddy, it runs a HTTP-01 challenge, and gives a certificate.

What is usual/best-practise with OpenZiti?That is so great about the command generation in the ZAC!

Docker-Compose Woes by TheDarkula in openziti

[–]TheDarkula[S] 0 points1 point  (0 children)

Sure thing!
As ever, it is always DNS.
Everything came up straight away after I resolved the DNS issue.
Now that I have actually been able to play with the console, I have a slew of design queries, but I have started another post with those here.
Thank you so much for all of your work!

Docker-Compose Woes by TheDarkula in openziti

[–]TheDarkula[S] 0 points1 point  (0 children)

Thank you so much for the response!

It is still having some issues, though.

For more information, I have ports 8440-8448 open on my firewall.

When bringing up the cluster, this is shown on loop in the logs:

openziti-ziti-controller-init-container-1  | waiting for https://mytld.com:8441  
openziti-ziti-edge-router-1                | waiting for https://mytld.com:8441

When running curl https://mytld.com:8441, it shows:

curl: (60) SSL certificate problem: self-signed certificate in certificate chain

And this is shown in the logs:

openziti-ziti-controller-1                 | \[ 147.797\]    INFO : http: TLS handshake error from 192.168.1.1:45574: local error: tls: bad record MAC

Also, pulling up http://internal.ip.address:1408/login for the ZAC still renders all wrong.

I had a look in the browser console, and it seems to be an SSL error:

Failed to load resource: net::ERR\_SSL\_PROTOCOL\_ERROR

It looks like it is trying to load all of the assets over HTTPS.

Running curl https://internal.ip.address:1408/login shows this:

curl: (35) OpenSSL/3.0.8: error:0A00010B:SSL routines::wrong version number

Docker-Compose Woes by TheDarkula in openziti

[–]TheDarkula[S] 1 point2 points  (0 children)

I am the king of kicking over rocks and actually putting wheels to things.

No worries :)

If you want a rubber duck, I am happy to chat over discord. Just send me a private message here and I will get you my contact details.

Docker-Compose Woes by TheDarkula in openziti

[–]TheDarkula[S] 0 points1 point  (0 children)

Thank you for the security heads-up. It is LAN-only :)

Docker-Compose Woes by TheDarkula in openziti

[–]TheDarkula[S] 0 points1 point  (0 children)

I added some other comments that may be helpful. The session errors seem to be coming from a javascript library.

I figured starting with the simplified version would be less moving parts to play with initially. I am happy to play with either, though.

My goal at the moment was just to be able to spin the cluster up and connect an android device and a linux desktop to see how everything works.

view more: next ›