asdf

I spent a fair amount of time this Christmas hacking around on the Raspberry Pi with my electrical-engineer brother-in-law. On top of that, he gave me an Arduino Uno Starter Pack for Christmas. So now we have a great foundation of common ground between our neighboring disciplines.

His original project goal for the Raspberry Pi was, "A webpage I can use from my phone to click a button and make lights turn on and off." With the help of Pylons Pyramid and an existing GPIO Python module I was able to make a rudimentary GPIO web interface. It allows you to designate pins as input or output, and read or set the state of each pin. You can even (thanks to Twitter's Bootstrap) visit it from your phone, and it won't look all that terrible.

The Arduino is my first real foray into embedded programming (unless you count the rudimentary CPU I built in my undergraduate Computer Organization and Design course). At the suggestion of my brother-in-law and the Internet I set out to create the "Hello, world!" of electronics: a blinking LED. That said, the Arduino IDE on Debian was so easy to use (it's literally an apt-get install arduino away) that I wasn't terribly satisfied with the relatively minimal work it took to achieve my blinking light. It had been a while since I'd written much C, so I took the opportunity to make a more full-featured "Hello, world!" with the addition of Morse code, serial console logging, and analog encoding control.

When he returns from a visit with his own respective in-laws, we're going to brush up on my soldering skills by building the Adafruit proto shield. Here's hoping that projects like these keep us collaborating, despite the physical distance between us after the holidays are over.

People seemed to like this comment that I made at LISA 2013:

It’s important to see documentation as a habit, rather than as a task to be completed. Don’t ask how you can catch up on the backlog of documentation that isn’t written; just document what you do and answers to questions you’ve had to ask from here on out.

I generally keep on top of my to-do list at work, thanks to my “keep everything in org-mode habit.” Since I spend all day at work in front of a computer, org-mode is always a few keys away, and it’s easy to review my agenda throughout the day and keep my lists up-to-date.

There was a time when that was true of my personal lists as well; but, for whatever reason, I don’t tend to have org-mode open at home any more. There will be times (like this instant) where I remember, and will open emacs, and will review my agendas; but, most often, that just leads to me continuing to procrastinate, given how far behind I already am.

I’m pretty sure that what I need is better access to my agenda; and my best guess for how to implement this is to have my agenda available on my iPhone.

I’ve tried to use mobile-org before, but just couldn’t integrate it into my workflow. Maybe that’s still the right thing, and I’ll eventually figure out how to do it. Until then, I want to just configure my agenda to automatically export to html on the web whenever I push to my central repo, and be able to review that whenever I’m out-and-about.

I’m doing an AMA on /r/saudiarabia regarding my time in the kingdom and at KAUST. It appears to be going pretty well so far.

I’ve updated the ikiwiki heme that I use here. It’s now based on Bootstrap version 3.0.0. I’ve also cleaned it up a bit (for example, to use CDNs to get bootstrap and jQuery) and published it on GitHub.

My only real problem with Salt vs Puppet is its security model for files stored in the manifest. Puppet’s fileserver supports per-node export configuration, allowing for node-private file distribution. Salt, on the other hand, exposes all files to all nodes at all times.

# fileserver.conf
[mount_point]
path /path/to/files
allow *.example.com
deny *.wireless.example.com

[private]
path /data/private/%h
allow *

# file_roots.sls
file_roots:
  base:
    - /srv/salt
    - /srv/salt-example.com:
      - allow: *.example.com
      - deny: *.wireless.example.com
    -
  dev:
    - /srv/salt/dev/services
    - /srv/salt/dev/states
  prod:
    - /srv/salt/prod/services
    - /srv/salt/prod/states

file_roots:
  base:
    - /srv/salt
  *.example.com:
    - /srv/salt-example.com

My evaluation of Salt Stack is going pretty well. I’ve moved my main vps over to it with no ill effect, and was able to transcribe its Puppet manifest almost in its entirety. In many instances, I think the Salt version is more readable, and feels lighter than the Puppet version.

One glaring hole, though, is Salt’s support for firewall configuration. I was using the Puppet Labs firewall module to maintain iptables rules for my vps. That worked pretty well; but all Salt has right now is the ability to append new rules to a chain. The existing iptables state is documented at-risk for deprecation, too, so it’s a bad place to start.

It is expected that this state module, and other system-specific firewall states, may at some point be deprecated in favor of a more generic firewall state.

(Salt does have good support for iptables at the functional layer; it’s just the configuration management part that’s lacking.)

Since the firewall module I used before worked well enough, and I have a bunch of config based on it already, I’ve started reimplementing its interface in a Salt state module.

"100 salt-master":
  firewall_rule:
    - managed
    - protocol: tcp
    - ports: 4505:4506
    - action: accept

I’ve found developing a Salt state to be a pretty simple process so far. I really like how Salt’s effective layers cleanly separate between functionality, state management, and configuration. (My firewall state makes liberal use of the existing iptables module, for example.)

I’ve just published the module so far on github. This module at least recognizes that my existing config exists, and would be able to rebuild it in the proper order (sorted lexically by comment) if necessary. There’s a lot of functionality missing, but it’s a place to start. If anyone else uses it, that will just be an excuse to make it better!

I’ve been a pretty stalwart Puppet user since I first discovered it in 2009. At that time, my choices were, as I saw them, between the brand-new cfengine3, the I’ve-seen-how-the-sausage-is-made bcfg2, and Puppet. Of those choices, Puppet seemed like the best choice.

In particular, I liked Puppet’s “defined state” style of configuration management, and how simple it was to describe dependencies between the various packages, files, and services to be configured.

Like I said, I’ve been using Puppet happily for the past 4 years; but now, I think I’ve been swayed by Salt Stack.

I know I looked at salt stack before; but, at the time, I think I dismissed it as just “remote execution.” Salt does, after all, start from a very different place than Puppet. At its most simple, it is a mechanism for shipping Python functions to remote nodes and executing them. It seemed the very opposite of the idempotent state management that I was looking for.

But now that I’ve taken the time to look deeper into the documentation (or, perhaps, now that the project has grown further) I’ve found Salt Stack States: the state enforcement configuration management system I was looking for; and with a trivial-to-setup remote execution layer underneath it.

Salt is based on 0MQ. I don’t know much about message queues; but I do know that I could never get ActiveMQ working for use with Puppet’s MCollective. After only 30 minutes of hacking, I had Salt, with 0MQ, running on two OS X machines and two Debian machines, all taking to the same master, each from behind its own form of inconveniently private network.

$ sudo salt '*' test.ping
ln1.civilfritz.net:
    True
Jonathons-MacBook-Pro.local:
    True
numfar.civilfritz.net:
    True
dabade.civilfritz.net:
    True

Glorious.

Some other things that I like about Salt:

• States are defined in YAML, so there’s no proprietary (cough poorly defined cough) language to maintain.

• The remote execution layer and state module layer help keep executable code separate from state definitions.

• Key management is a bit less foolish. (It shows you what you’re about to sign before you sign it.)

Of course, no new technology arrives without the pain of a legacy conversion. I have a lot of time and effort invested into the Puppet manifests that drive ln1.civilfritz.net; but converting them to Salt Stack States is serving as a pretty good exercise for evaluating whether I really prefer Salt to Puppet.

I’ve already discovered a few things I don’t like, of course:

• The abstraction of the underlying Python implementation is a bit thin. This is sometimes a good thing, as it’s easier to see how a state definition maps to individual function calls; but it also means that error messages sometimes require an understanding of Python. Sometimes you even get full tracebacks.

• Defined states don’t seem to understand the correlation between uid and uidNumber. In Puppet I started specifying group ownership as 0 when I discovered that AIX uses the gid system rather than root. In Salt, this appears to try to reassign the group ownership every time.

• All hosts in a Salt config have access to all of the files in the master.

• YAML formatting can be a bit wonky. (Why are arguments lists of dictionaries? Why is the function being called in the same list as its arguments?)

• No good firewall (iptables) configuration support. The iptables module isn’t even present in the version of Salt I have; but the documentation warns that even it is likely to be deprecated in the future.

That said, I can’t ignore the fact that, since Salt happens to be written in Python, I might actually be able to contribute to this project. I’ve already done some grepping around in the source code, and it seems immediately approachable. Enhancing the roots fileserver, for example, to provide node-restricted access to files, shouldn’t be too bad. I might even be able to port Puppet Lab’s firewall module from Ruby to Python for use as a set of Salt modules.

Time will tell, I suppose. For now, the migration continues.

I started playing Minecraft with my brother and old college roommate a few weeks ago. My expectations have been proven correct, as I’ve found it much more compelling to play on a persistent server with a group of real-life friends. In fact, in the context of my personal dedicated server instance, I’m finding the game strikes a compelling chord between my gamer side and my sysadmin side.

There’s already some documentation for running a Minecraft server on the Minecraft wiki, but none of it was really in keeping with how I like to administer a server. I don’t want to run services in a screen session, even if an init script sets it up for me.

I wrote my own Debian init script that uses start-stop-daemon and named pipes to allow server commands. Beyond that, I made a Puppet module that can install and configure the server. You can clone it from Git at git://civilfritz.net/puppet-minecraft.git.

I also really like maps, so I started looking for software that would let me generate maps of the world. (I was almost pacified when I learned how to craft maps. Almost.) I eventually settled on Minecraft Overviewer, mostly because it seems to be the most polished implementation. They even provide a Debian repository, so I didn’t have to do anything special to install it.

I’ve configured Minecraft Overviewer to update the render once a day (at 04:00 EST, which hopefully won’t conflict with actual Minecraft server use), with annotations updated once an hour. You can see it at http://civilfritz.net/minecraft/overview.

I couldn’t get Overviewer to display over https for some reason I don’t understand yet; so all access is redirected back at http for now.