feat(ci): switch to Garage

Follow up post for Podman 4.0 and libvirt network mesh

.forgejo/workflows/deploy.yml

@@ -0,0 +1,32 @@
+name: Deploy pages
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22.x"
+      - uses: https://code.icb4dc0.de/prskr/setup-hugo@main
+        with:
+          dart-sass: true
+      - uses: actions/cache@v4
+        with:
+          path: /home/runner/.cache/hugo_cache
+          key: ${{ runner.os }}-hugomod-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-hugomod-
+      - name: Build & deploy
+        run: |
+          hugo mod get
+          hugo --minify --environment production
+          hugo deploy
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.GARAGE_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.GARAGE_SECRET_KEY }}

.github/workflows/gh-pages.yml

@@ -1,32 +0,0 @@
-name: github pages
-
-on:
-  push:
-    branches:
-      - main  # Set a branch to deploy
-  pull_request:
-
-jobs:
-  deploy:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: true  # Fetch Hugo themes (true OR recursive)
-          fetch-depth: 0    # Fetch all history for .GitInfo and .Lastmod
-
-      - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2
-        with:
-          hugo-version: 'latest'
-          # extended: true
-
-      - name: Build
-        run: hugo --minify
-
-      - name: Deploy
-        uses: peaceiris/actions-gh-pages@v3
-        if: github.ref == 'refs/heads/main'
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./public

.gitignore

@@ -14,3 +14,8 @@ hugo.linux
 
 # IntelliJ project files
 .idea/
+
+*.o
+cmake-build-debug
+out/
+CMakeLists.txt

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "themes/anubis"]
-	path = themes/anubis
-	url = https://github.com/mitrichius/hugo-theme-anubis.git

.vscode/settings.json

@@ -0,0 +1,5 @@
+{
+    "yaml.schemas": {
+        "https://json.schemastore.org/github-workflow.json": "file:///Users/baez/sources/code.icb4dc0.de/prskr/blog/.forgejo/workflows/deploy.yml"
+    }
+}

Dockerfile

@@ -0,0 +1,15 @@
+FROM docker.io/golang:1.19-alpine as builder
+
+WORKDIR /tmp
+
+RUN apk add -U --no-cache hugo git
+
+WORKDIR /src
+
+COPY . /src/
+
+RUN hugo --minify --environment production --config config.toml
+
+FROM code.icb4dc0.de/prskr/ci-images/caddy:latest as final
+
+COPY --from=builder /src/public /usr/share/caddy

code/libvirt-podman-network-mesh/libvirt.json

@@ -0,0 +1,23 @@
+{
+    "name": "libvirt",
+    "id": "0489e6e643b97003c47b27a9ce0a6f6a8dce7d5f08329603e79a0ba48ad5285f",
+    "driver": "bridge",
+    "network_interface": "conbr0",
+    "created": "2022-04-05T09:18:48.198960971+01:00",
+    "subnets": [
+         {
+              "subnet": "10.10.1.0/24",
+              "gateway": "10.10.1.42",
+              "lease_range": {
+                   "start_ip": "10.10.1.1",
+                   "end_ip": "10.10.1.10"
+              }
+         }
+    ],
+    "ipv6_enabled": false,
+    "internal": false,
+    "dns_enabled": false,
+    "ipam_options": {
+         "driver": "host-local"
+    }
+}

config.toml

@@ -1,58 +1,67 @@
-baseURL = 'https://www.1533b4dc0.de/'
+baseURL = 'https://www.icb4dc0.de/'
 languageCode = 'en-us'
-title = '1533B4dC0.de'
+title = 'icb4dc0.de'
-theme = "anubis"
-paginate = 10
-enableEmoji = true
 
-[author]
+[module]
-name = "Peter Kurfer"
+[[module.imports]]
+  path = 'github.com/LordMathis/hugo-theme-nightfall'
 
 [params]
-author = "Peter Kurfer"
 style= "auto"
 copyCodeButton = true
 rssAsSocialIcon = true
+readingTime = true
+published = true
 
-[[menu.main]]
+  [params.author]
-identifier = "about"
+  name = "Peter Kurfer"
-name = "About"
+  email = "peter.kurfer@gmail.com"
-url = "/about/"
-weight = 1
 
-[[menu.main]]
+[menu]
-identifier = "projects"
+  [[menu.header]]
-name = "Projects"
+    name = "blog"
-url = "/projects/"
+    weight = 0
-weight = 2
+    url = "blog"
-
+  [[menu.header]]
-[[menu.main]]
+    name = "about"
-identifier = "tags"
+    weight = 1
-name = "Tags"
+    url = "about"
-url = "/tags/"
+  [[menu.header]]
-weight = 3
+    name = "projects"
-
+    weight = 2
-[[menu.main]]
+    url = "projects"
-identifier = "archive"
+  [[menu.header]]
-name = "Archive"
+    name = "tags"
-url = "/posts/"
+    weight = 3
-weight = 4
+    url = "tags"
 
 [[params.social]]
-id = "github"
+name = "forgejob"
-name = "baez90"
+url = "https://code.icb4dc0.de"
+icon = "fa-brands fa-git"
+target = "_blank"
+aria = "Forgejo Instance"
 
 [[params.social]]
-id = "linkedin"
+name = "github"
-name = "peter-s-kurfer"
+url = "https://github.com/prskr"
+icon = "fa-brands fa-github"
+target = "_blank"
+aria = "GitHub Profile"
 
 [[params.social]]
-id = "xing"
+name = "linkedin"
+url = "https://www.linkedin.com/in/peter-s-kurfer/"
+icon = "fa-brands fa-linkedin"
+target = "_blank"
+aria = "LinkedIn Profile"
+
+[[params.social]]
+name = "xing"
 url = "https://www.xing.com/profile/Sebastian_Kurfer"
+icon = "fa-brands fa-xing"
+target = "_blank"
+aria = "Xing Profile"
 
-[taxonomies]
+[[deployment.targets]]
-category = "categories"
+ URL = "s3://blog?endpoint=garage.garage.svc:3900&disableSSL=true&s3ForcePathStyle=true&region=hel1"
-tag = "tags"
-
-[markup.goldmark.renderer]
-unsafe = true

content/about.md

@@ -2,8 +2,9 @@
 title: 'About me'
 button: 'About me'
 weight: 1
+showMetadata: false
 ---
 
-My name's Peter. I'm a passionate software developer especially interested in all kind of networking stuff but also asynchronous data processing, software architecture, testing and automatic software quality analysis and many more.
+My name's Peter. I'm a passionate software developer especially interested in all kind of networking stuff but also asynchronous data processing, software architecture, distributed computing, testing and automatic software quality analysis and many more.
 
-I'm the author of [InetMock](https://gitlab.com/inetmock/inetmock) and [Goveal](https://github.com/baez90/goveal) (more on [projects](/projects)) but I'm also trying to contribute to other open source projects.
+I'm the author of [InetMock](https://gitlab.com/inetmock/inetmock) and [Goveal](https://github.com/baez90/goveal) (more on [projects](/projects)) but I'm also trying to contribute to other open source projects like [testcontainers-go](https://github.com/testcontainers/testcontainers-go)

content/post/2022-02-libvirt-podman-netavark-follow-up.md

@@ -0,0 +1,110 @@
++++
+author = "Peter Kurfer"
+title = "Libvirt & Podman: follow up for Podman 4.0 and netavark"
+date = "2022-02-24"
+description = "Joining libvirt VMs and containers with Podman 4.0's new network stack netavark"
+tags = [
+    "podman",
+    "libvirt",
+    "netavark"
+]
++++
+
+This is a follow up post to ["Joining libvirt {{<abbr short="VM" full="Virtual Machine" >}}s and Podman container in a common network"]({{<relref "2022-02-libvirt-podman-network-mesh.md" >}}).
+Therefore I won't cover all the basics again and how to configure libvirt because nothing's changed on that side.
+
+## Podman 4.0
+
+Podman 4.0 comes with a completely new network stack replacing the previous [{{<abbr short="CNI" full="Container Network Interface" >}}](https://www.cni.dev/) stack:
+
+* [Netavark](https://github.com/containers/netavark)
+* [Aardvark](https://github.com/containers/aardvark-dns)
+
+There are [great resources](https://www.redhat.com/sysadmin/podman-new-network-stack) that explain the backgrounds of both tools and I don't think I could describe it better than the folks implementing it :smile: so if you're interested have a look at the aforementioned article or the [release post](https://podman.io/releases/2022/02/22/podman-release-v4.0.0.html).
+
+## Netavark and libvirt
+
+After reading the announcement I was most curious if I would be able to configure an equivalent setup for Netavark like I described it with Podman 3.x and CNI.
+
+__Short answer:__ yes, it is possible! :tada:
+
+_"But how?!"_ do you ask?
+Well it's pretty much equivalent to the previous solution: you need to create a new Podman network I once more named it _'libvirt'_.
+To get an idea how the config should look like and where it should placed.
+I reused the CLI call from my previous article:
+
+```bash
+podman network create \
+    --disable-dns \
+    --internal \
+    --gateway 10.10.2.37 \
+    --ip-range 10.10.2.160/29 \
+    --subnet 10.10.2.0/24 \
+    libvirt
+```
+
+The configuration files are now obviously resided in `/etc/containers/networks/` and my (already modified) `libvirt.json` now looks like so:
+
+```json
+{
+     "name": "libvirt",
+     "id": "0489e6e643b97003c47b27a9ce0a6f6a8dce7d5f08329603e79a0ba48ad5285f",
+     "driver": "bridge",
+     "network_interface": "conbr0",
+     "created": "2022-04-05T09:18:48.198960971+01:00",
+     "subnets": [
+          {
+               "subnet": "10.10.1.0/24",
+               "gateway": "10.10.1.42",
+               "lease_range": {
+                    "start_ip": "10.10.1.1",
+                    "end_ip": "10.10.1.10"
+               }
+          }
+     ],
+     "ipv6_enabled": false,
+     "internal": false,
+     "dns_enabled": false,
+     "ipam_options": {
+          "driver": "host-local"
+     }
+}
+```
+
+_Side note: I'm really happy they dropped the `.conflist` extension because this way most editors offer really helpful syntax highlighting in the first place!_
+
+Note that `"internal": false` is mandatory. Otherwise I wasn't able to establish communication between VM and container.
+I also disabled the Aardvark {{<abbr short="DNS" full="Domain Name System">}} server and IPv6 support because I don't need it and I also don't expect much benefit of it due to the fact that it can't be aware of the VMs present in the network same as `dnsmasq` won't be able to resolve containers in the libvirt network.
+
+Having this in place I was again able to reuse the CLI command from my previous article:
+
+```bash
+podman run \
+    --rm \
+    -d \
+    --name nginx \
+    --network libvirt \
+    --ip 10.10.1.151 \
+    docker.io/nginx:alpine
+```
+
+to create a Nginx container that can be reached from a VM.
+
+## Troubleshooting
+
+Sometimes the communication between container and VM fails - don't know if I restarted the libvirt network previously or somehow fucked up the container network configuration but a:
+
+```bash
+podman network reload <container ID/container name>
+```
+
+often resolved the problem.
+
+## Final thoughts
+
+I haven't used _Netavark_ and _Aardvark_ a lot, yet.
+But I already noticed a few **really awesome** things:
+
+- the `docker-compose` support seems to be a lot better now because containers are actually able to talk to each other by _service name_, something I wasn't able to configure properly in Podman 3.x - at least not rootless.
+- with _Netavark_ all the Podman configuration is now unified within `/etc/containers` or `$HOME/.config/containers` respectively
+- the new configuration format is a little bit cleaner the the previous one due to the fact that _Netavark_ does not support plugins and with a `.json` extension editors do help a lot more without requiring extra "configuration"

content/post/2022-02-libvirt-podman-network-mesh.md

@@ -9,9 +9,9 @@ tags = [
 ]
 +++
 
-_Disclaimer: I tested all this with Podman 3.x even though Podman 4.0 is already announced but the CNI driver is still available with Podman 4.0 and as soon as I get my hands on 4.0 I'll give **Netavark** a try, too!_
+_Disclaimer: I tested all this with Podman 3.x even though Podman 4.0 is already announced but the {{<abbr short="CNI" full="Container Network Interface" >}} driver is still available with Podman 4.0 and as soon as I get my hands on 4.0 I'll give **Netavark** a try, too!_
 
-When playing around with containers and VMs one might ask if it's possible to bring VMs and containers into a common network segment.
+When playing around with containers and {{<abbr short="VM" full="Virtual Machine" >}}s one might ask if it's possible to bring VMs and containers into a common network segment.
 I see 'why the hell would I need a VM anyway when already having containers' or something similar I almost see on your face :stuck_out_tongue_winking_eye:
 
 Well 1st of all, not everything can be solved with containers.
@@ -19,7 +19,7 @@ For instance windows applications can be run in Windows containers but I'm not a
 
 But also in pure Linux environments there are cases where a VM is probably a better fit for the problem.
 As you might know I'm a bit of network :nerd: and I love playing around with 'weird' stuff almost no one else does even think about if not forced to.
-So if you try to implement for example your own DHCP server you might want to isolate your experiments (especially at the beginning) to avoid discussion about "why's Netflix on the TV not working?!" :smile: or also if you try to implement your own 'firewall' with DNAT support (stay tuned - post's following!).
+So if you try to implement for example your own DHCP server you might want to isolate your experiments (especially at the beginning) to avoid discussion about "why's Netflix on the TV not working?!" :smile: or also if you try to implement your own 'firewall' with {{<abbr short="DNAT" full="Destination network address translation" >}} support (stay tuned - post's following!).
 
 ## Part 1: Libvirt preparation
 

content/post/2024-04-forgejo-deploy-hugo.md

@@ -0,0 +1,155 @@
++++
+author = "Peter Kurfer"
+title = "Build & deploy a Hugo site with Gitea/Forgejo actions"
+description = "How to host a Hugo site with Cloudflare pages and deploy it automatically with Forgejo actions"
+date = "2024-04-30"
+tags = [
+    "hugo",
+    "cloudflare",
+    "CD/CD",
+    "actions"
+]
++++
+
+I admit it. I like self-hosting.
+I like the idea of being able to control every aspect of my infrastructure.
+It was only consequent to also self-host my blog.
+This article describes my odyssey and why I ended up letting [Cloudflare](https://www.cloudflare.com/) do the hosting.
+
+In the beginning - there was a repository.
+As we all know, the repository is the truth.
+When the time came for deploying the blog, I already had a Kubernetes (K8s) cluster at hand so the obvious choice was to containerize the web page and host it there.
+I wrote a simple Dockerfile with a multi-stage build, just like this:
+
+```Dockerfile
+FROM docker.io/golang:1-alpine as builder
+
+WORKDIR /tmp
+
+RUN apk add -U --no-cache hugo git
+
+WORKDIR /src
+
+COPY . /src/
+
+RUN hugo --minify --environment production --config config.toml
+
+FROM caddy as runtime
+
+COPY --from=builder /src/public /usr/share/caddy
+```
+
+prepared my deployment manifests and setup a CI pipeline (back then with DroneCI) to deploy everything.
+
+So far so good, the only complicacy was that I now had two 'truths'.
+One was the repository and the second one was the container registry - let alone that I also had to 💸 the storage for both.
+Of course, various container registries have cleanup options but being a software engineer, why using something existing when you can build the 11th solution to solve the same problem, right?
+
+Yes...actually, no!
+
+In the beginning I just accepted the fact and went on.
+Every now and then, when the amount of images became costlier, I manually deleted a few until I reached a reasonable count - say...five, I mean in the end there was no reason to keep any old version at all, but you know, I was lazy.
+At some point I had a similar problem at work with our SPAs and I couldn't help but wonder: is this really the best way?
+Not only because I'm duplicating the content every time, but also the web server needs patching, every now and then a breaking change in the configuration system happens and so on and so forth.
+I came across the possibility to serve a S3 bucket (or similar) directly from a [K8s ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/#resource-backend).
+That sounded awesome!
+No need to build a container image, no need to waste compute resources, simple copy to S3 bucket and be done with it!
+
+So I came back to my blog and tried to migrate to this approach.
+I wasted a few hours of my spare time, only realizing that - apparently - Cloudflare R2 or some CLI or something else is ignoring the content type of my files, leaving me with `application/octet-stream` which is absolutely useless for web pages.
+It might be different when I would use [MinIO](https://min.io/) or AWS S3 but I didn't want to waste even more resources (and 💵) on hosting a MinIO instance in my cluster.
+Also, I am already using Hetzner Cloud and didn't feel like distributing my costs around multiple cloud providers, so I started looking for alternative solutions.
+
+I then stumbled upon [Cloudflare Pages](https://pages.cloudflare.com/).
+After a 'quick' prototype I was happy and decided to migrate - actually not so quick, I spent a few evenings on migrating my whole DNS setup to [external-dns](https://github.com/kubernetes-sigs/external-dns) and experimented with Cloudflare DNS for DoS protection but that's a topic for another day.
+
+The only other problem I had was: I also got rid of DroneCI in favor of [Forgejo Actions](https://forgejo.org/docs/latest/user/actions/).
+I know, if I would use GitHub, there would be perfect integration from Cloudflare to build my Hugo page and deploy it, but we don't want to make things too easy, right?
+
+But using Forgejo Actions also seemed pretty straight forward:
+
+```yaml
+name: Deploy pages
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Hugo
+        uses: peaceiris/actions-hugo@v3
+      - name: Build
+        run: hugo --minify --environment production
+      - name: Deploy
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CF_PAGES_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy public --project-name=blog
+```
+
+Well, not so fast kiddo!
+
+At first I noticed, when using [Hugo modules](https://gohugo.io/hugo-modules/) you need to fetch those modules before being able to build anything, alright:
+
+```yaml
+    // ...
+      - name: Build
+        run: |
+          hugo mod get
+          hugo --minify --environment production
+    // ...
+```
+
+then, obviously, I realized, for being able to fetch those modules, you need a Go SDK, there you go (pun intended):
+
+```yaml
+    // ...
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22.x"
+      - name: Setup Hugo
+        uses: peaceiris/actions-hugo@v3
+    // ...
+```
+
+and now we're getting - finally - to the point when things got really annoying...
+I'm using the [github.com/LordMathis/hugo-theme-nightfall](https://github.com/LordMathis/hugo-theme-nightfall) theme.
+Although being a very minimalistic theme, it requires [dart-sass](https://gohugo.io/functions/resources/tocss/#dart-sass).
+Even though this also seem straight forward, especially because there's only [documentation for Github Actions](https://gohugo.io/functions/resources/tocss/#github-pages), with Forgejo Actions it isn't.
+The key difference between Github Actions and Forgejo Actions is, that Forgejo Actions are running in containers.
+The officially recommended way to install `dart-sass` in Github Actions is via `snap`, but snap doesn't really work in containers, so I had find another way.
+When doing some research, you might come across the official [`dart-sass` repository](https://github.com/sass/dart-sass) that mentions another installation method:
+
+```bash
+npm install -g sass
+```
+
+but:
+
+> The `--embedded` command-line flag is not available when you install Dart Sass as an npm package.
+
+(*see [here](https://github.com/sass/dart-sass?tab=readme-ov-file#embedded-dart-sass)*)
+
+unfortunately, Hugo requires the `--embedded` flag, so also not an option.
+Eventually I came around this abomination:
+
+```yaml
+      - name: Install sass
+        run: |
+          export SASS_VERSION=$(curl https://api.github.com/repos/sass/dart-sass/releases | jq -r '. | first |.tag_name | capture("(?<version>[[:digit:]]+\\.[[:digit:]]+\\.[[:digit:]]+)") | .version')
+          curl -L "https://github.com/sass/dart-sass/releases/download/${SASS_VERSION}/dart-sass-${SASS_VERSION}-linux-arm64.tar.gz" | tar xvz -C /opt/
+          ln -s /opt/dart-sass/sass /usr/local/bin/
+```
+
+*Don't get confused by the huge capture in the `jq` expression, I'm using this snippet whenever I have to use the version of a package in the filename and this way I don't have to think about, is there a `v` prefix or not, looking at you 'goreleaser' 👀*
+
+That downloads the latest release of `dart-sass` and makes it available in the `$PATH`.
+So far I'm not considering the CPU architecture because whenever possible I'm running my CI jobs on ARM machines anyway, but if I find the time, I might try to implement a custom action similar to `peaceiris/actions-hugo@v3` but with `dart-sass` support.
+
+You can imagine how happy I was realizing the `cloudflare/wrangler-action@v3` step 'just worked' ™.

content/projects.md

@@ -2,6 +2,7 @@
 title: 'Projects'
 button: 'Projects'
 weight: 2
+showMetadata: false
 ---
 
 ## INetMock

go.mod

@@ -0,0 +1,5 @@
+module code.icb4dc0.de/prskr/blog
+
+go 1.22
+
+require github.com/LordMathis/hugo-theme-nightfall v0.7.1 // indirect

go.sum

@@ -0,0 +1,2 @@
+github.com/LordMathis/hugo-theme-nightfall v0.7.1 h1:n8T4Eg/5ZJLXGWmRHHAZ9DrbIv0yXBATeNo/A3p8EoM=
+github.com/LordMathis/hugo-theme-nightfall v0.7.1/go.mod h1:0tCPxAeg5+tWhv17517Q8Lti/TPh0KNyON/uferEU30=

layouts/partials/custom-head.html

@@ -0,0 +1,4 @@
+{{ if hugo.IsProduction }}
+<script defer src="https://analytics.icb4dc0.de/script.js" data-website-id="fcc44d94-82fe-433a-bee1-46b586dc69f8"></script>
+{{ end }}
+<script src="https://kit.fontawesome.com/e6634cbc14.js" crossorigin="anonymous"></script>

layouts/shortcodes/abbr.html

@@ -0,0 +1 @@
+<abbr title="{{ .Get "full" }}">{{ .Get "short" }}</abbr>

themes/anubis

@@ -1 +0,0 @@
-Subproject commit 8e618548dad3553e196aeae334900d9afe76256e