o/1MS\o ⌨️🐧 | #WeAreNatenom

u/db_geek@norden.social
0 posts · 35 comments

Recent posts

No posts.

Recent comments

on Update policy · c/homeassistant · 3 pts · 1d

@JelleWho I'm running Home Assistant as container with podman quadlet.
I'm using an Ansible Playbook, which is executed manually for updating of Home Assistant.

If a new HA container image has been fetched, the podman quadlet is stopped, a backup of the container volumes is executed and afterwards the podman quadlet is started again, using the new container image for the container.

@Epzillon Don't know, if it fits your needs, I'm currently running https://tvheadend.org/ and MiniDLNA https://sourceforge.net/projects/minidlna/ on an Odroid XU4Q with Arch Linux Arm.
My TV can direct use DLNA, so no further software is necessary.

Tvheadend is recording actual tv shows and recordings are manually converted into h264 videos afterwards and placed on the DLNA server.
Shows, which I don't want to archive, are also served by the DLNA server.

@Hercules So it was possible to use one of the other keyslots to open the encryption?

Probably you can test your wanted configuration in a virtual machine with some small virtual drives to avoid any loss of data.
I found it relative difficult to find the correct UUID which had to be used when I setup my system in the past.

@Hercules My exampled assumed, that you only have a password set on keyslot 0.

LUKS keyslots are starting at 0, so it seems, that you deleted the initial set password.
I hope, you know the other keyslots.

As far I can see, you can specify, which keyslot has to be selected for unlocking the volume key.
More information you can find in the man page.

man cryptsetup-luksaddkey

cryptsetup luksAddKey /dev/md0 --new-key-slot 0 --key-slot 1  

@Hercules I have a similar setup with RAID1 and BTRFS.
I'm using a keyfile for that:
dd bs=512 count=4 if=/dev/random of=/etc/crypttab.d/keyfile-data.bin iflag=fullblock
chmod 600 /etc/crypttab.d/keyfile-data.bin

cryptsetup luksAddKey /dev/mapper/raid /etc/crypttab.d/keyfile-data.bin --new-key-slot 1

entry in /etc/crypttab:
data UUID=<blkid from /dev/md0> /etc/crypttab.d/keyfile-data.bin luks

entry in /etc/fstab:
UUID=<blkid from /dev/mapper/raid> /mnt/data .....

@FilthyShrooms From my point of view most Linux- or *BSD-OS will be a good choice.

I'm running rootless podman on Manjaro Linux, but for many people an Arch Linux based system can be problematic related to possible stability issues from rolling updates.

A Debian based distribution could be a better choice for many people, especially when the provided services are running as container or in another virtualized environment.

@ohlaph

An "old" PC with an i7-4790T and 32 GB RAM.

I have also some Odroid devices based on 32bit-ARM.
But 32bit-ARM has the problem, that meanwhile many container images doesn't support this architecture anymore.
So, when your Pi is already 64bit-ARM it could be ok.
Otherwise the possible selection regarding available prepared container images may be smaller.

[Unit]  
Description=Container running Portainer container management platform  
Wants=podman-user-wait-network-online.service  
After=podman-user-wait-network-online.service  
After=local-fs.target  
Requires=podman.socket  

@Excaliburr Yes, you are right.

Do you have already a single container running with rootless podman?
Your given Arr-Stack seems to me relative complex when you are a beginner with podman.
Probably you could get some experience, when you start with just a single container.

In following posts are my personal quadlet settings for running Portainer, which could be helpful for getting insights of your running containers.

https://docs.portainer.io/start/install-ce/server/podman/linux

[Container]  
AutoUpdate=registry  
ContainerName=con-portainer  
HostName=con-portainer  
Image=docker.io/portainer/portainer-ce:lts  
Notify=conmon  
PublishPort=8000:8000  
PublishPort=9443:9443  
Pull=missing  
Volume=vol-portainer:/data  
Volume=%t/podman/podman.sock:%t/podman/podman.sock  
[Install]  
\# Start by default on boot without explicit enabling  
\# To avoid automatic start Install section has to be  
\# disabled  
WantedBy=default.target multi-user.target

[Service]  
\# Restart service in case of failures  
Restart=on-failure  
TimeoutStartSec=20  
TimeoutStopSec=20  
Type=notify