Notes

I am one of those people who function better by writing things down. One day, I realized that most of my notes don’t have to be private, so here they are - my second brain. Be warned that, if you stumble upon something here that doesn’t make sense to you, it isn’t meant to!

Self-hosted email solutions

Here are some good, self-hostable and all-in-one email server projects I’ve encountered. Mail-in-a-Box: too opinionated out of the box. Posteo. Docker based: Docker mail-server: Decent number of maintainers, decently lightweight (for e.g., 2GB RAM), secure enough etc. No web UIs. Mailcow. Requires ~8 GB RAM though. Mailu. Modoboa. The following look interesting but are maintained by a single maintainer (something that I’d like to avoid): Maddy. Mox - looks lightweight. Stalwart - again, lightweight plus modern. However, in my limited experience of couple of months, there is a lot that can go wrong while self-hosting email, especially things that aren’t in your control. So, apart from intellectual curiosity or if you are getting paid, there is no good reason to go this route.

mTLS using Step CA and Traefik

I self-host Step CA alongside Traefik in my home environment. Last weekend, I tried setting up mTLS using the two for additional security. Helpful commands: # I got the certificate fingerprint by running the following inside the Step CA Docker container: step certificate fingerprint certs/root_ca.crt # Bootstrap Step CA CLI on my MacOS (which is a different device than the one that hosts the CA): step ca bootstrap \ --ca-url https://web-server.lan:9000 \ --fingerprint=foo # Generate a new client certificate: step ca certificate \ ketan-ios ketan-ios.crt ketan-ios.key \ --ca-url=https://web-server.lan:9000 \ --provisioner='admin' \ # There is a command to list provisioners inside the Step CA container. --not-after=87600h # Convert the client cert and key into a file format that can be imported into an iOS device. step certificate p12 ketan-ios.p12 ketan-ios.crt ketan-ios.key With all this, I was able to connect through Curl: ...

How to think of Kubernetes

Here are some mental models that I am building while reading The Kubernetes Book: Pods are the smallest building block. They are a collection of containers that are created, destroyed, deployed etc. together. Kubernetes is a generic control plane that allows you to run applications using these pods. For example: how to make sure X pods are running all the time, how to automatically recover from pod failures, how to deploy or rollabck safely, how to route traffic to these pods etc.? On the surface, the idea seems powerful. For e.g., the AWS service that I am currently part of manages its own control plane which takes care of Docker containers for customers. That’s pretty similar to what Kubernetes would have provided us. However, I haven’t operated Kubernetes myself, so my knowledge is theoretical and I don’t know how it works in practice. Kubernetes provides an imperative interface: users define what end state they want and Kubernetes figures out how to get there.

Self-hosted certificate authority

I recently setup a private CA, i.e. certificate authority, using Step CA. Here are a few things I learnt: Step CA generates the following at the start: Root certificate and corresponding private key. Former should be distributed to required client devices. Latter is super-secret and should ideally be kept offline. Intermediate certificate and corresponding private key. Latter is a secret but not super-secret and supposed to be kept online. These two are used to generate the end certificates that services should use. These certificates will have short expiry (such as 1 to 90 days). If compromised, can be thrown away and a new {certificate, private-key} pair can be generated using the root pair. The {certificate, private-key} pair generates new certificates that are used by the service. On the client side, the chain of trust, all the way back to the root certificate, allows it to setup a proper TLS connection with the service. Why Step CA and not regular X.509 certificates? ...

1ffcb882

Causality: Transaction A could happen before B, after or concurrently. In the first 2 cases, there is said to be causal connection between the transactions. Cross channel timing dependencies: if there are 2 communication channels between 2 systems, one slow channel can break causality. Causal order is not equal to total order. Linearizability, by definition,gives the latter because it makes the system behave as if there is a single copy of the data. However, has a performance penalty and many systems that pretend to require linearizability, in reality, only require causality. Lamport clocks. How are they different from version vectors?

IP blacklist

Nice tool(s) for verifying blacklist/spamlist status for an IP address or domain: https://multirbl.valli.org/lookup/5.78.92.211.html

Power DNS

Follow these steps, if on Oracle. Follow: https://repo.powerdns.com/ to add official distribution repo. If port 53 is in use, free that up before proceeding. Similar to this, run: sudo sed -r -i.orig 's/#?DNSStubListener=yes/DNSStubListener=no/g' /etc/systemd/resolved.conf sudo systemctl restart systemd-resolved sudo apt-get install -y pdns-server pdns-backend-sqlite3 sqlite3 Allow ingress traffic for DNS - port 53 for both TCP/UDP - on the cloud provider. Now, follow steps here to setup a Sqlite backend. (Config file is present here: /etc/powerdns.) Follow this if you want to setup an ALIAS record. The value of resolver should be one that is able to make recursive DNS queries to upstream. Check /etc/resolv.conf: on Oracle, I had to put: resolver=169.254.169.254. On the domain registrar, put DNS glue records as: ns1.tw.in.eu.org -> 155.248.213.202 Helpful commands: ...

TLS vs STARTTLS

At least for SMTP: TLS: Forced TLS connection from the start. Port: 465. STARTTLS: Starts off with an unencrypted connection and upgrades to TLS right after. Port: 587. Usually preferred to TLS.

Ski gear rental near home

Play it again sports, Lynnwood. $50 for daily. Technically, it’s for the whole weekend because I can pick today, any time, and return the day after by noon. $135 weekly. $239 annually. Westra: Don’t do rentals. Not sure why their website says otherwise. Bothell ski and bike: $55 per day. Again, it’s almost 3 days actually. $300 annual for used gear, 400 for new items. Seattle Ski and Snowboard.

My professional background, from a judging perspective

To do: I should update the following with what awards I’ve already judged so far or will judge in the near future. Cover letter Hi, I am a Staff/Senior Software Development Engineer at the AWS division in Amazon, Seattle. I have more than 12 years of experience in the IT/software industry, almost 10 of that with Amazon. For the past 4 years, I’ve been working for AWS, as part of which I am building the “cloud” itself. I solve hard problems in distributed systems and help democratize the cloud for people around the globe. AWS has taught me deep expertise in running software at high scale. Before that, I spent almost 5 years in the advertising organization of Amazon. As part of that, I built automated systems that advertised for Amazon on social networks (like Facebook, Twitter, Pinterest etc.). These systems would spend XX million dollars a year all without any human involvement! So, they had to be highly optimized on ad targeting, bidding and reporting - and I helped those. Long before that, I built the mobile business of India’s 2nd biggest e-commerce website from ground up. (You may still find some of my code running on https://www.snapdeal.com/.) I have been deeply involved with the internet for majority of my life. And would love to get an opportunity to contribute back. ...