Koodihommia

The snowflake VM I run my experiments on has a serious flaw. I can't remember what I have installed there. It is embarrassing as some essential services to me run there. As an enterprisey developer, my attention draws naturally towards IaC solutions for this particular memory issue. The code of the experimentations is in git, so why not the infra. Some would say it is a major overkill since we are talking literally about one domain running on the puniest DigitalOcean droplet. I say I have a weekend to spare on silly stuff. The easiest choice is to write some Terraform. Yet come to think of it, is it still an obvious pick in 2022? I've never written anything too complex with it but having heard so much backlash against Terraform language, is it time for something new? The answer turns out to be a yes. The IaC solution for me in 2022 is Pulumi. It has a catchy name, a base for a good dad joke for a Finn. Besides that, Pulumi has some attractive qualities to it. It is declarative ...

A few random things that I have been dealing with My Digitalocean droplet suffered recently a brute force ssh attack. Unfortunately I noticed it a couple of days after the attack had happened but luckily the act caused little harm except very high CPU usage from sshd process for a few days. I'm not sure how to really protect against such attacks (cheaply) but I decided to try out fail2ban. With fail2ban I could protect the server also against attacks towards nginx. Installing it was simple enough and I saw it was working rather well. There were some 3K ssh login attempts per day and the iptables based port blocking reduced the amount to some hundreds. After a while though I noticed that the fail2ban stopped blocking unauthorized IPs. I took a look at fail2ban github and saw some issues with ssh regex filters (fail2ban works by monitoring logs and matching those against predefined regexes). I made some small adjustments but still no luck, it did not ban anything. I turned on d...