ryansch

[    0.000000] Linux version 4.9.4-rancher (root@1165eab7f7a9) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.4) ) #1 SMP Sun Jan 15 22:26:11 UTC 2017
[    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.9.4-rancher rancher.autologin=tty1 rancher.autologin=ttyS0 console=tty0 console=ttyS0 printk.devkmsg=on  initrd=/boot/initrd
[    0.000000] KERNEL supported cpus:
[    0.000000]   Intel GenuineIntel
[    0.000000]   AMD AuthenticAMD
[    0.000000]   Centaur CentaurHauls
[    0.000000] Disabled fast string operations
[    0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'

ryansch

FROM docker:latest

RUN apk add --no-cache bash sudo iptables openvpn

ryansch

This uses https://github.com/kylemanna/docker-openvpn for most of the heavy lifting. I've also wrapped it with some persistence management for production usage at https://github.com/outstand/docker-openvpn. I'm using a data container in production as rancherOS doesn't support named volumes in cloud config yet.

I skipped using elliptic curves until both easyrsa and openvpn support choosing the curve (NIST curves are considered harmful).

When you're done, you'll have your PKI in the named volume on your workstation and only the files that the server needs on S3. Back up the contents of the volume somewhere secure. You can't issue new certs or revoke old ones without it.

Setup

• OVPN_DATA="openvpn-data"
• `docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -d -N -C AES-256-CBC -T TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 -a SHA512 -n <VPC_DNS_IP> -p 'route <VPC_CIDR> 255.255.0.0' -p 'route <ANOTHER_VPC_CIDR> 255.255.0.0' -u udp://<VPN_SERVER_FQDN> -e 'topology subnet' -p 'dhcp-optio

ryansch

# Ring the bell if any background window rang a bell
set -g bell-action any

# Default termtype. If the rcfile sets $TERM, that overrides this value.
set -g default-terminal screen-256color

# Keep your finger on ctrl, or don't
bind-key ^D detach-client

# Create splits and vertical splits

ryansch

init.vim and settings.vim go under ~/.config/nvim Follow the installation instructions for https://github.com/junegunn/vim-plug and place plug.vim in ~/.config/nvim/autoload

ryansch

def current_region
  return @current_region if @current_region != nil

  response = Excon.get(
    'http://169.254.169.254/latest/meta-data/placement/availability-zone',
    expects: [200],
    connect_timeout: 2,
    read_timeout: 2,
    write_timeout: 2,
    tcp_nodelay: true

ryansch

require 'find'
require 'archive/tar/minitar'

module IdiomaticTar
  def create_tarball(filename:, directory:)
    base_dir = Pathname.new(directory).parent
    FileUtils.cd(base_dir) do
      Pathname.new(filename).open('wb') do |tarball|
        Zlib::GzipWriter.wrap(tarball) do |gz|
          Archive::Tar::Minitar::Output.open(gz) do |tar|

ryansch

# Ring the bell if any background window rang a bell
set -g bell-action any

# Default termtype. If the rcfile sets $TERM, that overrides this value.
set -g default-terminal screen-256color

# Keep your finger on ctrl, or don't
bind-key ^D detach-client

# Create splits and vertical splits

ryansch

#!/bin/sh
 
# create an account alias
#sudo dscl . -append /Users/$USER RecordName Pair pair
 
# configure sshd to only allow public-key authentication
#sudo sed -E -i.bak 's/^#?(PasswordAuthentication|ChallengeResponseAuthentication).*$/\1 no/' /etc/sshd_config
 
# add pair user public key(s)
GITHUBUSER=$1

ryansch

require 'feature/feature_helper'

feature 'Something involving chargify webhooks', :vcr, driver: :mechanize do
  def chargify_webhook(from:, to:, subscription_id:)
    payload = {subscription: {
      id: subscription_id,
      previous_state: from,
      state: to
      # Any other needed subscription info should go here
    }}