[{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/authors/","section":"Authors","summary":"","title":"Authors","type":"authors"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/tags/automation/","section":"Tags","summary":"","title":"Automation","type":"tags"},{"content":"","date":"April 6, 2026","externalUrl":null,"permalink":"/tags/automatisierung/","section":"Tags","summary":"","title":"Automatisierung","type":"tags"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/posts/","section":"Blog","summary":"","title":"Blog","type":"posts"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/categories/","section":"Categories","summary":"","title":"Categories","type":"categories"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/categories/electrical-engineering/","section":"Categories","summary":"","title":"Electrical Engineering","type":"categories"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/tags/electrical-engineering/","section":"Tags","summary":"","title":"Electrical Engineering","type":"tags"},{"content":"","date":"April 6, 2026","externalUrl":null,"permalink":"/categories/elektrotechnik/","section":"Categories","summary":"","title":"Elektrotechnik","type":"categories"},{"content":"","date":"April 6, 2026","externalUrl":null,"permalink":"/tags/elektrotechnik/","section":"Tags","summary":"","title":"Elektrotechnik","type":"tags"},{"content":"","date":"April 6, 2026","externalUrl":null,"permalink":"/series/energie/","section":"Series","summary":"","title":"Energie","type":"series"},{"content":"","date":"April 6, 2026","externalUrl":null,"permalink":"/tags/energiegewinnung/","section":"Tags","summary":"","title":"Energiegewinnung","type":"tags"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/series/energy/","section":"Series","summary":"","title":"Energy","type":"series"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/tags/energy-generation/","section":"Tags","summary":"","title":"Energy Generation","type":"tags"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/authors/gerhard-sulzberger/","section":"Authors","summary":"","title":"Gerhard Sulzberger","type":"authors"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/tags/heat-pump/","section":"Tags","summary":"","title":"Heat Pump","type":"tags"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/tags/homeassistant/","section":"Tags","summary":"","title":"Homeassistant","type":"tags"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/tags/hot-water/","section":"Tags","summary":"","title":"Hot Water","type":"tags"},{"content":"Disclaimer: I currently work at Fronius. No components have been provided by the company Fronius. All components were paid for by myself. I receive no compensation for writing about this conversion. Please do not understand this as advertising, but as a pure experience report. This is not a guide or advice. Technical regulations can change depending on the prerequisites.\nGoals # Conversion of the system from microinverters to string inverters. 3-phase rotating field in backup power operation. Preparation for battery storage and backup power switching. Initial Situation # Annual total consumption ~2500 kWh Grid access 4 kW Feed-in limit 4 kW Hot Water Preparation # Boiler for hot water preparation with air heat pump: warmwasser-waermepumpe-wpa-450 Nominal power consumption ~1 kW (heat pump)\nHeating # In winter, cooking is done daily on a table stove with through-heating in a tiled stove. On average, we need about 2m³ of softwood and 2m³ of hardwood logs. The wood is processed, dried, and made into firewood in our own forest. The house is built so that most of it is heated by the tiled stove. This drastically reduces the need for electrical energy.\nIf there is no wood in the stove (which almost never happens), we can still use infrared panels in the living rooms and electric underfloor heating in the bathroom. We do not have a water-based heating system in the house, which has proven to be very effective so far.\nPV Planning # 9 kWp generator capacity 12 panels facing southeast, 33° roof pitch, on PV1 in the inverter. 8 panels facing northwest, 33° roof pitch, on PV2 in the inverter. 6 kW inverter Fronius Symo GEN24 6.0 plus connected via LAN 3-phase string inverter with rotating field as preparation for backup solution and battery pack 4 kW dynamic feed-in limitation Smart meter IP with current transformers Grid-independent backup solution Fronius PV Point Preparation for 12 kW electrical storage Plus series is prepared for battery storage Integration into Homeassistant Community Fronius integration and Solar API directly from the inverter Connect AMIS reader to WLAN and also send values via MQTT Time control of hot water preparation Plan (old school) # Implementation # Registration with NetzOOE # Since this is an expansion of the system, I registered this expansion with my grid operator. As always, it was very uncomplicated, and even if there are problems with the form, the responsible people help you in an uncomplicated and very friendly manner. Since the substation or a transformer is already reaching its limits, we were given the requirement to limit the feed-in power to a maximum of 4 kW.\nComponents # Fronius Symo GEN24 6.0 plus 1x Fronius Smartmeter IP 1x Mitterbauer AMIS reader 1x Trina Solar Vertex S+ TSM-450NEG9R.28 20x Construction # Substructure # The construction of the substructure was one of the bigger surprises and challenges. It was also surprising that the substructure on the tiled roof causes higher material costs than the solar generator itself. I am used to working at heights and also handling ropes and harnesses; the safety hooks on the roof were installed by the roofer during the new build. My tip for a new build is to have the substructure built in at the same time for a DIY system. In retrospect, this is already a bit more effort, and the screws and sheet metal roof tiles are also not to be underestimated in terms of cost. The substructure is integrated into the equipotential bonding. If lightning protection is present, it should be clarified with a lightning protection expert how the PV system should be integrated.\nWiring # I laid the string cables in aluminum pipes, which are integrated into the equipotential bonding. Also indoors. In the case of a fire, aluminum pipes do not melt as quickly, and if the solar generator cannot be switched off during firefighting operations, it can be dangerous for emergency crews if water hits several hundred volts of DC voltage. The Fronius inverter has a DC switch with which the solar generator can be disconnected. Nevertheless, a disconnect box should be installed at the roof entry, especially if the inverter is not accessible from the outside. This gives the emergency crews the possibility to disconnect the solar generator even under load. When laying the solar panels, care must be taken to ensure that no induction loops are created. Plus and minus cables should be run as parallel as possible, otherwise high voltages can be induced in the event of a nearby lightning strike, and an indirect lightning strike can cause damage. Even if most disconnect boxes and also the Fronius inverter can be equipped with surge protection modules, induction loops should be avoided. MC4 connector is not the same as MC4 connector. Therefore, always use connector pairs from the same manufacturer. If a different connector is installed on the solar panel, caution is advised. I like to use Weidmuller PV Stick with SNAP IN connections. With this connector type, no crimping tool is needed, but you should have good hearing. If the connector type on the PV modules is different, the connector on the module side must also be mounted at the transitions to string cables. Connector pairs should not be mixed.\nInverter # The inverter itself is connected with 6² equipotential bonding and in my case 4² AC side supply line. The equipotential bonding is required for the surge protection module, which can be additionally installed in the GEN24 models. The Wago terminals are very comfortable during installation, and overall the GEN24 has made a good impression. The connections of the pilot (control module) are, however, already a challenge. Have you ever tried to get the shield of a CAT 5e SFTP cable into the connectors to ensure shielding on the Modbus line? There is room for improvement there. The initial setup is intuitive and simple for standard systems.\nSmart Meter IP # For the price, I would have expected better workmanship of the mechanics regarding the top-hat rail mounting. It is also worth mentioning that the current transformers are individually packaged and must be purchased separately. Here, a Smart Meter IP with direct measurement up to 63A would be desirable.\nAutomation # Homeassistant in Docker on existing Linux Nextcloud server Docker MQTT server Data on NFS storage Reading Meter Data # The Fronius Smart Meter IP offers the possibility to read energy data, and via Modbus, Modbus TCP, or MQTT, the data can be processed by the inverter. Since the existing AMIS reader integrates well into Homeassistant, I have the possibility to compare the data. The control of consumers is realized via Homeassistant, as it provides comprehensive integrations.\nAutomation and Analysis # Solarweb # MPPT Tracker PV1 + PV2 # Energy Balance # Adapting Consumers to Generation # The infrared panels consume between 500W and 1600W. Depending on the priority in the room, these can be switched differently. This way, the required power can be well regulated during the transition period, even if no battery is present. Dynamic Feed-in Limitation # If too much power is available, the inverter can limit the feed-in. With constant surplus, the heat pump of the boiler is activated, and the surplus is fed into the grid. Homeassistant # With Homeassistant, you have many possibilities to create dashboards yourself and thus experiment. I also like to use the app on my mobile phone to control devices and automate scenarios. Planning Further Expansion # Battery storage Optimize consumer control. Washing machine, dryer, dehydrator, and dishwasher could still be devices that can be optimized. However, I think that this topic will fade into the background with the battery storage. Since we heat with a tiled stove and stove in the winter months, the most electrical energy consumption in winter is still hot water preparation. ","date":"6 April 2026","externalUrl":null,"permalink":"/en/posts/pv_2026/","section":"Blog","summary":"Disclaimer: I currently work at Fronius. No components have been provided by the company Fronius. All components were paid for by myself. I receive no compensation for writing about this conversion. Please do not understand this as advertising, but as a pure experience report. This is not a guide or advice. Technical regulations can change depending on the prerequisites.\n","title":"PV Expansion 1","type":"posts"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/series/","section":"Series","summary":"","title":"Series","type":"series"},{"content":" About Me # Specialized in IT infrastructure, automation, and open-source technologies. With a background in electrical engineering, climate technology, tree care, agriculture, technical expertise is combined with ecological awareness.\nPlatform Engineering\nBuilding and operating scalable infrastructures\nSite Reliability Engineering\nReliability and automation using SRE methods\nOpen Source\nFocus on FOSS and open source solutions\nElectrical Engineering \u0026amp; Climate Technology\nElectrical engineer with additional HVAC training\nTree Care \u0026amp; Agriculture\nCertified arborist for tree care \u0026amp; preservation, sustainable agriculture\nLearn more about my profile →\n","date":"6 April 2026","externalUrl":null,"permalink":"/en/","section":"SETE - Platform Engineering \u0026 Sustainability","summary":"About Me # Specialized in IT infrastructure, automation, and open-source technologies. With a background in electrical engineering, climate technology, tree care, agriculture, technical expertise is combined with ecological awareness.\n","title":"SETE - Platform Engineering \u0026 Sustainability","type":"page"},{"content":"","date":"6 April 2026","externalUrl":null,"permalink":"/en/tags/","section":"Tags","summary":"","title":"Tags","type":"tags"},{"content":"","date":"April 6, 2026","externalUrl":null,"permalink":"/tags/w%C3%A4rmepumpe/","section":"Tags","summary":"","title":"Wärmepumpe","type":"tags"},{"content":"","date":"April 6, 2026","externalUrl":null,"permalink":"/tags/warmwasser/","section":"Tags","summary":"","title":"Warmwasser","type":"tags"},{"content":"","date":"22 December 2025","externalUrl":null,"permalink":"/en/categories/automation/","section":"Categories","summary":"","title":"Automation","type":"categories"},{"content":"","date":"22 December 2025","externalUrl":null,"permalink":"/en/tags/devops/","section":"Tags","summary":"","title":"DevOps","type":"tags"},{"content":"","date":"22 December 2025","externalUrl":null,"permalink":"/en/tags/linux/","section":"Tags","summary":"","title":"Linux","type":"tags"},{"content":" Originally published on LinkedIn on 2025-12-22.\nAn Article about Rubenshof - Linux Mint Unattended Installer\nEvery year we set up some devices for our students at school. This year we had the situation of delayed deliveries, because a donation of notebooks took longer than expected. So we have to get faster with setting the devices up. I took this challenge and created a unattended Workstation setup for our school.\nAt the weekend I did some research of already existing projects, I started to learn how they work.\nFAI-project AntonioCarlini linux-mint-unattended-installer FAI project is a very interesting project, and by analysis how it works I also learned about Linux ISO\u0026rsquo;s images and how they are built. For our school project I was looking for a different solution. So I decided to started to development based on the project from Antonio Carlinis. I knew a bit about unattended installations, because I already had experience with kickstart under RHEL and preseeding Ubuntu installations in automated PXE boot environments.\nSo the goal was to take a USB Stick and boot from it. The installer should do everything else. It took a weekend to create something which we already can use. The Rubenshof - Linux Mint Unattended Installerwas the outcome.\nThere is still work in progress and a lot of improvements can be made. But it already make our lives a lot easier when the printer drivers are prepared, Firefox policies are rolled out and the tools for the Univention Domain Join are set up. After 10 Minutes the scholars workstation is in a state where they can login with their users managed by UCS and access the internal Nextcloud Web Interface. Also my final enemy (the printer) is happy and does it\u0026rsquo;s job.\nHappy to use Open Source because Free and Open Source software makes this possible. Many thanks to community and companies who believe in Open Source, and hope I can give a little bit back with this project.\nUnivention Nextcloud Linux Mint\n","date":"22 December 2025","externalUrl":null,"permalink":"/en/posts/linux-mint-unattended-installation/","section":"Blog","summary":" Originally published on LinkedIn on 2025-12-22.\nAn Article about Rubenshof - Linux Mint Unattended Installer\nEvery year we set up some devices for our students at school. This year we had the situation of delayed deliveries, because a donation of notebooks took longer than expected. So we have to get faster with setting the devices up. I took this challenge and created a unattended Workstation setup for our school.\n","title":"Linux Mint Unattended Installation","type":"posts"},{"content":"","date":"22 December 2025","externalUrl":null,"permalink":"/en/tags/packer/","section":"Tags","summary":"","title":"Packer","type":"tags"},{"content":"Originally published on LinkedIn on 2025-11-23.\nIt\u0026rsquo;s common for IT Administrators managing classical enterprise Virtual Machine (VM) infrastructure to overlook powerful, existing tools for automation and scale-out. While the benefits of cloud-native deployment patterns—like disposable, self-configuring infrastructure—are well-understood, many don\u0026rsquo;t realize that similar, workflow-based efficiency is achievable for their on-premises VMs. The necessary technology has been available for years.\nThe most effective solution for modernizing VM deployment involves adopting a two staged approach:\nImage Preparation: Creating standardized, minimal, and repeatable VM base images with packer or other tools. Runtime Configuration with Cloud-Init: Provisioning and customizing these images at launch time. This combination shifts the focus from manually building and configuring each VM to maintaining a reliable, versioned deployment pipeline, making the infrastructure significantly more maintainable and scalable.\nA Simple Lab Environment # To test this I tend to use very basic and simple setup. I focus on cloud-init in the next part, the whole image preperation with packer is a different topic.\nMy lab setup is a tuxedo Infinitybook with KVM, qemu, libvirt and cloud-init . We will use an Almaliux Generic Cloud image as base image. Then create the needed files from scratch to get an understanding.\nTools needed on the Tuxedo OS Workstation for development environment:\nsudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virt-manager cloud-utils virt-manager package is optional, it is a graphical interface to manage the virtual machines.\nWith a simple bash script the lab VM can be spawned:\n#!/bin/bash # Setting important shell options for robustness # -e: Exit immediately if a command exits with a non-zero status. # This helps to catch errors early in the script execution. # -u: Treat unset variables as an error. # This helps to prevent unexpected behavior due to typos or missing variable assignments. # -f: Disable pathname expansion (globbing). # This can be useful when you want to treat asterisks, question marks, etc., literally. # -C: Prevent overwriting existing files by redirection (using \u0026gt;). # To overwrite, you must use \u0026gt;| instead. This helps to avoid accidental data loss. # -o pipefail: If a command in a pipeline fails, the entire pipeline\u0026#39;s exit status is that of the failed command. # Without this, the pipeline\u0026#39;s exit status would be that of the last command in the pipeline. set -eufCo pipefail SSH_PUB_KEY=$(cat $HOME/.ssh/id_ed25519.pub) # NOTE: Prepare lab directory if [[ -d $HOME/lab/one1 ]]; then cd $HOME/lab/one1 else mkdir -p $HOME/lab/one1 cd $HOME/lab/one1 fi # NOTE: Get Almalinux-10-GenericCloud image if [[ -a $HOME/Downloads/AlmaLinux-10-GenericCloud-latest.x86_64.qcow2 ]]; then : # Almalinux 9 GenericCloud image is already in Downloads, do nothing else curl -o ~/Downloads/AlmaLinux-10-GenericCloud-latest.x86_64.qcow2 https://repo.almalinux.org/almalinux/10/cloud/x86_64_v2/images/AlmaLinux-10-GenericCloud-latest.x86_64_v2.qcow2 fi # NOTE: Prepare Image for VM if [[ -a one1.qcow2 ]]; then : # one image already created, do nothing else qemu-img create -f qcow2 -o backing_file=~/Downloads/AlmaLinux-10-GenericCloud-latest.x86_64.qcow2,backing_fmt=qcow2 one1.qcow2 25G fi if [[ -a user-data ]]; then : # user-data exists; do nothing else cat \u0026gt;user-data \u0026lt;\u0026lt;EOF #cloud-config hostname: one1 fqdn: one1.qemu.internal manage_etc_hosts: true users: - name: admin ssh-authorized-keys: - $SSH_PUB_KEY sudo: [\u0026#39;ALL=(ALL) NOPASSWD:ALL\u0026#39;] groups: sudo shell: /bin/bash package_update: true packages: - qemu-guest-agent - curl runcmd: - dnf config-manager --set-enabled crb - dnf install -y epel-release - curl -Lo /var/tmp/minione https://github.com/OpenNebula/minione/releases/download/v7.0.1/minione - chmod +x /var/tmp/minione - sudo /var/tmp/minione --yes EOF fi if [[ -a meta-data ]]; then : # meta-data exists; do nothing else cat \u0026gt;meta-data \u0026lt;\u0026lt;EOF hostname: one1 fqdn: one1.qemu.internal EOF fi if [[ -a network-config ]]; then : # network-config exists; do nothing else cat \u0026gt;network-config \u0026lt;\u0026lt;EOF #network-config network: version: 1 config: - type: physical name: eth0 subnets: - type: static address: 192.168.122.51/24 gateway: 192.168.122.1 dns_nameservers: - 192.168.122.1 - 86.54.11.1 EOF fi # NOTE: Initialize VM sudo virt-install \\ --name one1-lab \\ --ram 2048 \\ --vcpus 2 \\ --disk path=one1.qcow2,format=qcow2 \\ --network network=default \\ --os-variant almalinux10 \\ --graphics spice \\ --import \\ --cloud-init user-data=user-data,meta-data=meta-data,network-config=network-config When virt-install is started it will connected to domain \u0026lsquo;one1-lab\u0026rsquo; If someone is not used to leave the console opened by virsh, the Escape character is ^] (Ctrl + ])An other possible solution is to use an ISO file and mount it when the VM is initialized.\ncloud-localds one1-cloud-init.iso user-data meta-data -N network-config sudo virt-install \\ --name one1-lab \\ --ram 2048 \\ --vcpus 2 \\ --disk path=one1.qcow2,format=qcow2 \\ --network network=default \\ --os-variant almalinux9 \\ --graphics spice \\ --import \\ --cdrom one1-cloud-init.iso OpenNebula miniONE installation via cloud-init within the lab\nRunning Alpine Linux in Nested Virtualization setup within KVM\nA login on the VM on the host system, created by cloud-init, ssh without an password can be used. Therefore the public ssh key was added via the user-data.\nssh-keygen -f ~/.ssh/known_hosts -R \u0026#39;192.168.122.51\u0026#39; ssh 192.168.122.51 -ladmin [admin@one1 ~]$ sudo -u oneadmin onevm list check running VM via cli within VM\nI would not recommend to do such installations like minone with cloud-init, but it demonstrates what cloud-init can do. There is no, ansible, terraform or other tools involved. Just a bit bash, minone, which is also written in bash, and cloud-init. To scale out I would recommend to prepare the images and have packages already installed. Just finalize the configuration with cloud-init. The VM is online faster when it is already prepared and in setups where VM\u0026rsquo;s are used to scale out it will also save Bandwidth. If it is just about compute instances, which do not hold data, non-persistent images can save disk space too.\nWhile enterprise adoption requires acknowledging further points—such as security hardening and comprehensive image lifecycle management—experimenting with Cloud-Init is the most effective way to grasp the principles behind large-scale, automated cloud deployments every Enterprise IT Admin should know. Orchestration tools like Proxmox Server Solutions or OpenNebula Systems have Cloud-Init built in since years and it is a rock solid solution.\nMoving from a basic understanding to full enterprise implementation involves acknowledging critical factors like security policy enforcement, robust image maintenance, and integration with your existing orchestration tools. Nevertheless, gaining practical experience with Cloud-Init serves as a fundamental gateway to understanding the mechanisms that drive scalable, automated deployments in modern cloud infrastructure.\nGet familiar with the concepts, start experimenting with User Data, and begin building your own automated images today.\nHappy Home Labbing!\n","date":"23 November 2025","externalUrl":null,"permalink":"/en/posts/cloud-init-what/","section":"Blog","summary":"Originally published on LinkedIn on 2025-11-23.\nIt’s common for IT Administrators managing classical enterprise Virtual Machine (VM) infrastructure to overlook powerful, existing tools for automation and scale-out. While the benefits of cloud-native deployment patterns—like disposable, self-configuring infrastructure—are well-understood, many don’t realize that similar, workflow-based efficiency is achievable for their on-premises VMs. The necessary technology has been available for years.\n","title":"Cloud-Init What?","type":"posts"},{"content":"","date":"23 November 2025","externalUrl":null,"permalink":"/en/categories/devops/","section":"Categories","summary":"","title":"DevOps","type":"categories"},{"content":"","date":"23 November 2025","externalUrl":null,"permalink":"/en/tags/iac/","section":"Tags","summary":"","title":"IaC","type":"tags"},{"content":"","date":"23 November 2025","externalUrl":null,"permalink":"/en/tags/terraform/","section":"Tags","summary":"","title":"Terraform","type":"tags"},{"content":" Originally published on LinkedIn on 2025-10-22.\nVulnerability scans can be tricky and there are different strategies. It starts already at the datasets provided by the different OS and how they are implemented from the scan tools. For example Alpine. A lot Engineers think it is secure because 0 vulnerabilities shown at scans with tools like trivy.\nBut there is security.alpinelinux.org and information about potential CVEs within Alpine packages.\nAnd Alpine provides also information about CVEs which are already fixed within the secdb.alpinelinux.org service.\nThe information a vulnerability scanner utilizes to detect Common Vulnerabilities and Exposures (CVEs) during the scanning of artifacts, such as container images, is highly relevant. For example, a Trivy scan of an Alpine-based container image that reports zero vulnerabilities often signifies that zero security fixes (secfixes) are currently available for the listed Alpine packages. This approach makes sense, especially when package versions are pinned within the Containerfile, as the focus is on known, fixable issues. Integrating this scanning strategy early in the CI/CD pipeline is highly beneficial, since fixable CVEs are detected during the build process, raising immediate awareness. Consequently, Trivy does not support the detection of truly unfixed CVEs when scanning Alpine. A detail which may not be surprising if the documentation was properly read.\nSee: https://trivy.dev/v0.67/docs/coverage/os/alpine/\nIn contrast, Debian pursues a different strategy. It maintains a database of open, known CVEs for its packages (www.debian.org/security/), and Trivy uses this information for its scans. This results in a completely different outcome: with the same tools in the same workflow, the detection of unfixed CVEs is supported.\nDetails in the Trivy documentation: https://trivy.dev/v0.67/docs/coverage/os/debian/\nThe crucial implication of these contrasting strategies is immediately apparent in the maintenance of the vulnerability baseline: the .trivyignore file. For an Alpine-based image, the .trivyignore file will contain significantly fewer entries, documenting only exceptions for issues where a fix exists but is being deferred. Conversely, the Debian approach necessitates a .trivyignore file with many more entries, as it forces the user to manually suppress or accept known, but as yet unfixable (by simple package updates), CVEs that are reported by the scanner.\nUltimately, teams must decide which vulnerability reporting strategy aligns best with their risk tolerance and pipeline metrics. This distinction is relevant for effective #DevSecOps and #Security practices, underscoring the importance of knowing your tools and their limitations. Maybe also use multiple tools, but evaluate if there are different strategies to detect what is expected.\n","date":"22 October 2025","externalUrl":null,"permalink":"/en/posts/0-vulnerabilities-think-twice/","section":"Blog","summary":" Originally published on LinkedIn on 2025-10-22.\nVulnerability scans can be tricky and there are different strategies. It starts already at the datasets provided by the different OS and how they are implemented from the scan tools. For example Alpine. A lot Engineers think it is secure because 0 vulnerabilities shown at scans with tools like trivy.\n","title":"0 Vulnerabilities - Think twice about it","type":"posts"},{"content":"","date":"22 October 2025","externalUrl":null,"permalink":"/en/tags/alpine/","section":"Tags","summary":"","title":"Alpine","type":"tags"},{"content":"","date":"22 October 2025","externalUrl":null,"permalink":"/en/tags/container/","section":"Tags","summary":"","title":"Container","type":"tags"},{"content":"","date":"22 October 2025","externalUrl":null,"permalink":"/en/tags/debian/","section":"Tags","summary":"","title":"Debian","type":"tags"},{"content":"","date":"22 October 2025","externalUrl":null,"permalink":"/en/series/devsecops/","section":"Series","summary":"","title":"DevSecOps","type":"series"},{"content":"","date":"22 October 2025","externalUrl":null,"permalink":"/en/tags/devsecops/","section":"Tags","summary":"","title":"DevSecOps","type":"tags"},{"content":"","date":"22 October 2025","externalUrl":null,"permalink":"/en/categories/security/","section":"Categories","summary":"","title":"Security","type":"categories"},{"content":"","date":"22 October 2025","externalUrl":null,"permalink":"/en/tags/security/","section":"Tags","summary":"","title":"Security","type":"tags"},{"content":"","date":"22 October 2025","externalUrl":null,"permalink":"/en/tags/trivy/","section":"Tags","summary":"","title":"Trivy","type":"tags"},{"content":"Originally published on LinkedIn on 2025-10-18.\nSince I didn\u0026rsquo;t use Opennebula for a while but had good experience with it at the past, I decided to check what is new within this project. Therefore I instantiated a miniONE instance in the proxmox Homelab.\nDeploy miniONE on the virtualized node: Hotwto Deploy Validate the installation: Validation Run Kubernetes on miniONE: K8S rollout Deployment # miniONE installation on ubuntu 24.04\nValidation # There is already a Alpine Linux template included which can be used to test if the setup works.\nRunning Alpine Linux VM\nAlso easy to access the console of the VM:\nVM console via Browser\nKubernetes # Obennebula has a marketplace where service templates for Kubrnetes are available.\nOpennebula Service Template for K8S\nFollow the Documentation and there is a running K8S cluster within Minutes. IN this case this was done via Sunstone UI; But for automation it is also possible via CLI or with Terraform providers.\noneflow Service OneKE 1.33\nRunning K8S cluster\nMiniONE is nice to play with and to get in touch with Opennebula. There was a lot of progress and I will check Opennebula also to build my Homelab on it. More about this at an other article. Maybe in near future;\nThanks to the OpenNebula Systems community for this great solution!\n","date":"18 October 2025","externalUrl":null,"permalink":"/en/posts/opennebula-evaluation-for-homelab/","section":"Blog","summary":"Originally published on LinkedIn on 2025-10-18.\nSince I didn’t use Opennebula for a while but had good experience with it at the past, I decided to check what is new within this project. Therefore I instantiated a miniONE instance in the proxmox Homelab.\n","title":"Opennebula evaluation for Homelab","type":"posts"},{"content":"","date":"16 October 2025","externalUrl":null,"permalink":"/en/categories/cloud/","section":"Categories","summary":"","title":"Cloud","type":"categories"},{"content":"","date":"16 October 2025","externalUrl":null,"permalink":"/en/tags/cloud/","section":"Tags","summary":"","title":"Cloud","type":"tags"},{"content":"","date":"16 October 2025","externalUrl":null,"permalink":"/en/tags/enterprise/","section":"Tags","summary":"","title":"Enterprise","type":"tags"},{"content":" Originally published on LinkedIn on 2025-10-16.\nIn the technology world, a familiar pattern has become increasingly disruptive. We\u0026rsquo;ve all seen the recent headlines and read the industry articles detailing the licensing chaos and sudden cost increases that follow when major tech companies acquire key industry players. The message is clear: when proprietary giants consolidate power, the terms of engagement often shift dramatically, leaving countless businesses vulnerable.\nThis predictable cycle has companies urgently searching for escape routes and long-term alternatives. But here\u0026rsquo;s the irony: many of the most reliable alternatives are not newly invented solutions; they are open source foundations that have been available, community-tested, and resilient for decades.\nFrom my perspective, this industry-wide challenge is less of a crisis and more of a massive opportunity for enterprises to future-proof their infrastructure.\nI want to share a concrete example of this resilience. Years ago, I had the privilege of being part of a great team at Runtastic. We made a conscious, strategic decision to build our entire infrastructure with an unwavering focus on open source technologies.\nThis is why I\u0026rsquo;m sharing our story with you today: to demonstrate that powerful, sustainable, and vendor-independent alternatives don\u0026rsquo;t just exist—they are the key to long-term stability and success.\nTalks: # 2014: OpenNebulaConf 2014 - OpenNebula as an alternative to commercial products by Armin Deliomini 2015: Take the Next Storage Step by Armin Deliomini - Runtastic 2015: Open Source driven Datacenter - Gerhard Sulzberger - Runtastic 2017: OpenNebulaConf2017EU - Hyper converged infrastructure - Armin Deliomini - Runtastic Articles: # 2015: Why Did We Choose OpenNebula for Runtastic? Hope this is an inspiration for some teams to also evaluate Open Source alternatives.\nAnd many thanks to my former colleagues within the infrastructure team at Runtastic.\n","date":"16 October 2025","externalUrl":null,"permalink":"/en/posts/enterprise-cloud-alternatives/","section":"Blog","summary":" Originally published on LinkedIn on 2025-10-16.\nIn the technology world, a familiar pattern has become increasingly disruptive. We’ve all seen the recent headlines and read the industry articles detailing the licensing chaos and sudden cost increases that follow when major tech companies acquire key industry players. The message is clear: when proprietary giants consolidate power, the terms of engagement often shift dramatically, leaving countless businesses vulnerable.\n","title":"Enterprise Cloud Alternatives - are not newly invented","type":"posts"},{"content":"","date":"16 October 2025","externalUrl":null,"permalink":"/en/tags/infrastructure/","section":"Tags","summary":"","title":"Infrastructure","type":"tags"},{"content":"","date":"October 16, 2025","externalUrl":null,"permalink":"/tags/infrastruktur/","section":"Tags","summary":"","title":"Infrastruktur","type":"tags"},{"content":"","date":"16 October 2025","externalUrl":null,"permalink":"/en/tags/open-source/","section":"Tags","summary":"","title":"Open Source","type":"tags"},{"content":"","date":"October 16, 2025","externalUrl":null,"permalink":"/tags/unternehmen/","section":"Tags","summary":"","title":"Unternehmen","type":"tags"},{"content":"","date":"28 June 2025","externalUrl":null,"permalink":"/en/categories/education/","section":"Categories","summary":"","title":"Education","type":"categories"},{"content":"","date":"28 June 2025","externalUrl":null,"permalink":"/en/tags/education/","section":"Tags","summary":"","title":"Education","type":"tags"},{"content":"","date":"28 June 2025","externalUrl":null,"permalink":"/en/tags/homelab/","section":"Tags","summary":"","title":"Homelab","type":"tags"},{"content":"A small village school needs an IT infrastructure, and the setup should be done with the school\u0026rsquo;s youth. It should be fun and relaxed. Anyone who wants to participate can and may be involved. Digital independence starts with the selection of software and components. In our case, we received hardware from a former Austrian startup.\nIn this case, servers and network hardware as well as racks. One part of the learning will be that these servers consume energy, and we will actively measure and address this topic to optimize it.\nAs a first part, the students learned that you should plan something before taking action. This starts with network segmentation.\n","date":"28 June 2025","externalUrl":null,"permalink":"/en/posts/it-labor-fuer-dorfschule/","section":"Blog","summary":"A small village school needs an IT infrastructure, and the setup should be done with the school’s youth. It should be fun and relaxed. Anyone who wants to participate can and may be involved. Digital independence starts with the selection of software and components. In our case, we received hardware from a former Austrian startup.\n","title":"IT Lab for Village School","type":"posts"},{"content":"","date":"28 June 2025","externalUrl":null,"permalink":"/en/tags/opensource/","section":"Tags","summary":"","title":"OpenSource","type":"tags"},{"content":"","date":"22 January 2025","externalUrl":null,"permalink":"/en/tags/grafana/","section":"Tags","summary":"","title":"Grafana","type":"tags"},{"content":"","date":"22 January 2025","externalUrl":null,"permalink":"/en/categories/monitoring/","section":"Categories","summary":"","title":"Monitoring","type":"categories"},{"content":"","date":"22 January 2025","externalUrl":null,"permalink":"/en/tags/monitoring/","section":"Tags","summary":"","title":"Monitoring","type":"tags"},{"content":" Originally published on LinkedIn on 2025-01-22.\nIn my experience working with cloud environments, I\u0026rsquo;ve extensively used Prometheus, Grafana, and Alertmanager for monitoring. However, when dealing with TV Headends, I\u0026rsquo;ve encountered a common challenge: the lack of Prometheus endpoints for directly scraping metrics.\nTo overcome this, we can leverage the widely available SNMP (Simple Network Management Protocol)\nIntegrating SNMP with Prometheus # SNMP Exporter # Prometheus offers an official open-source SNMP exporter, making it easy to collect SNMP data. To effectively gather metrics from less common hardware, utilize MIB (Management Information Base) files provided by the manufacturer. For example, Astro Strobel BC4 headends offer a downloadable ZIP file containing relevant MIBs from their controller\u0026rsquo;s web interface. This approach allows for seamless integration of traditional SNMP data with the powerful monitoring capabilities of the Prometheus ecosystem.\nTo configure the SNMP Exporter for Astro Strobel BC4 follow these steps.\nPrepare MIB Files: Download the ZIP archive from the BC4 Management Controler and copy the AstroStrobel*.mib files into the snmp_exporter/generator/mibs directory. Configure Generator: Follow the documentation within the snmp_exporter project to set up the MIB generator. Add the following entry to the generator.yml file: Run SNMP Exporter: Download the OS-specific snmp_exporter archive. Unzip the archive and place the generated snmp.yml file in the snmp_exporter directory. Start the snmp_exporter service. It is easy to verify if the SNMP exporter is successfully collecting metrics from your device by making a simple HTTP request. This can be done using a web browser or the curl command-line tool. Replace the snmp_target_IP with a real IP.\nThe snmp_exporter is correctly configured if it successfully retrieves metrics related to the SNMP module.\nPrometheus # Prometheus is an open-source monitoring and alerting system that collects and stores time-series data. It excels at high-volume time series data, making it ideal for monitoring dynamic systems and applications.\nThe scrape target for the snmp exporter has to be added in the prometheus configuration. As first step create a directory for the configuration and the configuration file.\nTo keep things easy, the prometheus container is started with the host network and the configuration file is mounted into the container.\nOpen the prometheus UI via http://127.0.0.1:9090 and check if prometheus can reach the target and the metrics are scraped.\nCheck if target status is OK\nCheck if metrics are available already\nGrafana # Grafana is a solution to visualize dashboards and can use different datasources. Is also available as container which is useful for tests. When used with the host network the webservice is available at http://127.0.0.1:3000 with default credentials admin/admin .\nAs a first step prometheus has to be added as Datasource.\nAdd datasource in grafana\nTo effectively visualize the collected Prometheus data, create a dashboard with panels. Understanding the available metrics is crucial for this process. Let\u0026rsquo;s use bc4DynamicNIT as an example to illustrate this.\nThe \u0026ldquo;bc4DynamicNIT\u0026rdquo; Object Type within the AstroStrobel-Buscontroller.mib is specified as an Integer data type. The possible values, represent a state.\nThis knowledge allows you to effectively use value mappings to accurately visualize the state of the system within the dashboard.\nExample value mapping\nWith this understanding of the MIB and the snmp_exporter it is easy to create more Panels.\nBC and NIT Status\nDevice temperatures\nChannel Signal Status\nIntegrating SNMP data into your monitoring solution offers significant advantages. You can create informative dashboards and, most importantly, establish a robust proactive alerting system to ensure the optimal performance and reliability of your TV Headend.\nThis flexible Monitoring stack can be readily integrated with other services, databases, and solutions. Prometheus and Grafana act as a central hub for collecting and visualizing metrics, providing a unified view of your entire system. There are plenty of exporters and integrations available and also client libraries to add prometheus to applications.\nAlertmanager # Alertmanager is an open-source system designed to handle and route alerts generated by monitoring systems like Prometheus. By integrating Alertmanager with Prometheus and SNMP for TV Headend monitoring, it is possible to establish a proactive and efficient alerting system that ensures timely issue resolution and minimizes service disruptions.\nConclustion # This flexible stack, empowered by a rich ecosystem of exporters, enables seamless integration with various services and infrastructure components. Prometheus and Grafana act as a central hub for collecting and visualizing metrics, providing a comprehensive overview of system performance. Alertmanager, with its extensive support for receivers, ensures timely and effective notification of critical events.\nI hope this article has provided you with an interessting overview of TV Headend monitoring based on SNMP and Prometheus. Feel free to share your thoughts in the comments.\nDisclaimer: I have not received any financial or material compensation from any of the companies mentioned in this article. The idea for this setup came to me while talking with a small cable TV provider. I was really curious to see what was possible.\nMay the Force be with you\nGerhard Sulzberger\n","date":"22 January 2025","externalUrl":null,"permalink":"/en/posts/monitoring-a-tv-headend/","section":"Blog","summary":" Originally published on LinkedIn on 2025-01-22.\nIn my experience working with cloud environments, I’ve extensively used Prometheus, Grafana, and Alertmanager for monitoring. However, when dealing with TV Headends, I’ve encountered a common challenge: the lack of Prometheus endpoints for directly scraping metrics.\n","title":"Monitoring a TV Headend","type":"posts"},{"content":"","date":"22 January 2025","externalUrl":null,"permalink":"/en/tags/prometheus/","section":"Tags","summary":"","title":"Prometheus","type":"tags"},{"content":"","date":"22 January 2025","externalUrl":null,"permalink":"/en/tags/snmp/","section":"Tags","summary":"","title":"SNMP","type":"tags"},{"content":" Originally published on LinkedIn on 2025-01-19.\nThis Lab environment was created for a showcase at a local school. The school, a small community-driven institution based on Montessori principles, serves approximately 70 children and teachers. Open Source and Free and Open-Source Software (FOSS) are valued by some of the teaching staff, and they requested assistance with certain aspects of the school\u0026rsquo;s infrastructure. Considering this preference, a cloud solution was deemed unsuitable.\nImportant Note: This is solely a LAB environment and should not be used for production purposes. It lacks critical security measures, including data protection, backups, encryption, network isolation, and other essential elements required for production environments. This lab is intended for demonstration and educational purposes only.\nGoal # The primary objective was to streamline file sharing and user management on Linux devices within the school.\nLab Environment # As the school lacks a dedicated IT lab for such projects (existing Raspberry Pi devices are primarily used for experimental hacking and recreational purposes), the decision was made to construct the lab within a virtualized environment on the developer\u0026rsquo;s personal laptop. This also provided an opportunity to evaluate the performance of a new Tuxedo Infinitybook Pro Intel Gen9 system.\nNested Virtualization # To achieve this, Nested Virtualization was necessary, which is enabled by KVMintegrated within the Linux kernel. The following steps will verify KVM availability on the current machine.\nConclusion\nThe output confirms that KVM and nested virtualization are supported on this machine. This allows for the creation of virtual machines within other virtual machines, providing a flexible environment for experimentation and development.\nVirtual Machine Manager # With libvirt and qemu and virt-manager there are tools to set things up. virt-manager is a very simple desktop user interface to manage libvirt. Because it is a very common package in a lot of distributions, it is also easy to install at TuxedoOS\nProxmox setup # Then download the installation ISO for proxmox-VE and add them to a directory where libvirt can access it. In this case I created a virtual-images directory in my documents.\nvirt-manager qemu/KVM storage details\nLet\u0026rsquo;s create a proxmox-ve instance\nOnce the configuration is complete, a new virtual machine will be created. The Proxmox VE setup process will then begin and automatically connect to the VM. If this automatic connection fails, use the virt-viewer or virt-manager user interface to connect to the virtual machine\u0026rsquo;s graphical interface.\nFor this lab environment, a single disk was configured. To explore the features of Proxmox, which are based on the ZFS file system, ZFS was chosen as the primary file system for the lab.\nImportant Note: When running multiple instances, careful consideration must be given to IP address assignment. Ensure that each instance within the virtual network has a unique IP address. Failure to do so may result in unexpected network behavior, providing a valuable learning opportunity regarding network configurations.\nWhile automation of the configuration process is possible, it was deemed beyond the scope of this showcase.\nProxmox VE installer overview\nCluster setup\nLogin to a Proxmox node and setup a cluster via Datacenter \u0026gt; Cluster \u0026gt; \u0026ldquo;Create Cluster\u0026rdquo;. Later we will need the Join Information and copy it at a other node of this cluster.\ncreate Proxmox Cluster\nCluster Join Information\nThis is an base64 encoded string. If you are interessted whats in there base64 -d is your friend.\nCluster Join\nUnivention Corporate Server # So we have a running Proxmox cluster and can upload the ISO image to install Univention Corporate Server. The installation ISO is available as download from Univention .\nUpload UCS ISO\nAfter the upload of the UCS installation ISO, create a VM on the same pve node.\nSummary of the VM configuration\nThe virtual machine console can be opened via the browser.\nVirtual machine console via browser\nIn this lab, the default settings were used for the UCS installation. Following the OS installation, UCS will reboot, and the configuration process can then begin. An activation key, obtained via email, is required.\nWithin this lab environment, I created a new UCS domain.\nCreate new UCS domain\nEnter the organization name and a valid email address. Univention will use this address to send the activation key to you.\nOrganization details\nConfigure the FQDN of the machine and LDAP root.\nNetwork configuration\nCheck the settings and start the system configuration.\nStart system configuration\nThe configuration process will set up the entire domain and machine. Once complete, you will be able to log in as the Administrator via a web browser. To start, import the license received via email under System \u0026gt; Welcome \u0026gt; License import.\nLicense import\nSystem dashboard\nCreate a user account within the Univention Corporate Server (UCS) that will be used for subsequent logins from the Linux Mint operating system.\nCreate UCS user\nLinux Mint # Download the ISO image from Linux Mint Project and upload it to a proxmox node.\nLinux Mint ISO download\nProxmox ISO storage\nConnect with graphical console and install Linux Mint. For the lab the oem installation was used with no special settings.\nUnivention Domain Join # There is an issue when univention domain join is used with linux mint. Because of missing dependencies it will fail. This is easy to solve. Univention perhaps you take a look here.\nOpen Univention Domain Join and join the computer.\nUnivention Domain Join\nIn UCS the joined device is listed as Ubuntu computer.\nComputer joined the Domain\nReboot the Linux Mint computer and logout the oem user. May also get rid of the oem user later. Now check if it is possible to login as the user we created in UCS.\nUCS User at Client Device\nIt is possible to manage and assign groups via UMC, therefore I recommend to read the docs.\nNextcloud # It is possible to install Nextcloud via Univention App Center. It will configure Nextcloud and integrate it within the UCS environment. There are more advanced setups possible. I just want to mention that univention has it\u0026rsquo;s own mechanism to configure integrated apps. So be aware of that before changing configuration files inside UCS.\nNextcloud in UCS App Center\nIn the UCS user settings, Nextcloud App is added automatically.\nactiv Nextcloud App at User configuration\nThe Univention portal serves as a central point for presenting available services. This allows users on the Linux Mint client to readily access the Nextcloud service through the portal.\nNextcloud service on Univention Portal\nNextcloud SSO\nUnivention Portal SSO login\nNextcloud User managed with UCS\nAdditional features # Proxmox VM Replication\nI have used Ceph in the past at larger Datacenter setups with a lot machines and Leaf Spine network architecture. This won\u0026rsquo;t be possible in that case. But as Proxmox supports ZFS I like to test some features there too. One feature is replication.\nVM replication\nProxmox VM migration\nAn other is the possibility to migrate VM\u0026rsquo;s between nodes. Be careful with Linked Clones from VM templates, because the migration features are not supported if the VM uses local storage.\nLive migration\nConclusion # Open Source provides a lot of solutions, offering comprehensive features for various needs. For this project, the next steps involve defining the network architecture, hardware requirements, and appropriate backup and security measures.\nIt\u0026rsquo;s important to note that no company mentioned in this article has provided any form of financial compensation.\nSpecial thanks to the vibrant communities around Open Source Software, and specifically those supporting:\nTUXEDO Computers GmbH Proxmox Server Solutions Univention Nextcloud Feel free to hit me up with any burning questions or brilliant improvement ideas! And remember, folks, 2025 is the year of the Linux desktop (at least within these hallowed halls of learning).\nMay the Force of open source be with you all!\nGerhard Sulzberger\n","date":"19 January 2025","externalUrl":null,"permalink":"/en/posts/virtualized-school-it-lab/","section":"Blog","summary":" Originally published on LinkedIn on 2025-01-19.\nThis Lab environment was created for a showcase at a local school. The school, a small community-driven institution based on Montessori principles, serves approximately 70 children and teachers. Open Source and Free and Open-Source Software (FOSS) are valued by some of the teaching staff, and they requested assistance with certain aspects of the school’s infrastructure. Considering this preference, a cloud solution was deemed unsuitable.\n","title":"Virtualized School IT Lab","type":"posts"},{"content":" Goals # The installation of a PV system to cover the energy needs for hot water preparation. Island operation is not intended.\nInitial Situation: # Boiler for hot water preparation: warmwasser-waermepumpe-wpa-450\nNominal power consumption ~1KW (heat pump)\nGrid access 4KW\nImplementation # PV Planning: # Integration into homeassistant 3.5KWp generator capacity Existing open source project to read data from the inverter and integrate it into homeassistant Integration of meter data into homeassistant Microinverter to keep DC voltages in strings low Components: # homeassistant in Docker on existing Linux Nextcloud server MQTT server in homeassistant Data on NFS storages Hoymiles Inverter HMS-1600 2x OpenDTU DIAMEX DX-DTU-MAX, Gateway for Hoymiles 1x Mitterbauer AMIS reader 1x JA Solar Solar Module 435W Glass-Glass Full Black Bifacial 8x Registration with NetzOOE: # Since this system exceeds the generator capacity of 800W and is therefore not a balcony power plant, I registered the system with NetzOOE. This can be registered by an electrical engineering specialist who is a market partner with NetzOOE. If grid access is not exceeded, this is a relatively uncomplicated matter.\nReading Meter Data # The ability to read the data must be activated by the grid operator. This can be done very easily via the NetzOOE portal.\nSetup: # 3 panels facing south, tilted at 15 degrees, with Hoymiles HMS-1600 on phase 1 3 panels facing west, tilted at 15 degrees, with Hoymiles HMS-1600 on phase 2 Installed on the carport for easy work with the test system OpenDTU connected to the inverters reads the values and sends them via WLAN to the MQTT of homeassistant Connect AMIS reader to WLAN and also send values via MQTT Read MQTT in homeassistant Time control of hot water preparation Initial Data # Planning Further Expansion # 4 panels north on the roof 40% on phase 1 4 panels south on the roof 40% on phase 2 Use a switch contact to charge the boiler with solar energy Test the setup in the winter months Since we heat with a tiled stove and stove in the winter months, most of the electrical energy consumption in winter is for hot water preparation.\n","date":"2 August 2024","externalUrl":null,"permalink":"/en/posts/pv_2024/","section":"Blog","summary":"Goals # The installation of a PV system to cover the energy needs for hot water preparation. Island operation is not intended.\n","title":"PV System","type":"posts"},{"content":"","date":"24 May 2023","externalUrl":null,"permalink":"/en/tags/backup/","section":"Tags","summary":"","title":"Backup","type":"tags"},{"content":"","date":"24 May 2023","externalUrl":null,"permalink":"/en/tags/kubernetes/","section":"Tags","summary":"","title":"Kubernetes","type":"tags"},{"content":"","date":"24 May 2023","externalUrl":null,"permalink":"/en/tags/vault/","section":"Tags","summary":"","title":"Vault","type":"tags"},{"content":" Originally published on LinkedIn on 2023-05-24.\nHashicorp Vault # In vault-enterprise there would be an integrated solution to upload backups to S3 compatible storages. In the Open Source version of Vault this feature is missing, so I had to create some solution for this.\nMost times I use the integrated raft storage inside the vault cluster in kubernetes. Data of this StatefulSet is stored in PersistentVolumeClaims. (Where I also patched the default persistentVolumeReclaimPolicy to Retain the deletion of the StatefulSet, but that\u0026rsquo;s a different story)\nSo I searched fo inspiration in the internet and found some sources which I more or less followed.\nGitHub - adfinis/vault-raft-backup-agent: Vault Raft Integrated Storage Snapshot Automation* HashiCorp Vault Backup and Restore Raft Snapshots from Kubernetes to AWS S3* Build a vault-backup container # I decided to build a container based on alpine 3.18. There are actual vault and aws-cli packages available and they did work well in my case. The storage footprint of the image is around 90MB. And we already have gitlab pipelines to create and test containers. So the effort was minimal.\nFROM alpine:3.1 LABEL version=\u0026#34;1.0.0\u0026#34; \\ maintaner=\u0026#34;Gerhard Sulzberger \u0026lt;********@*****\u0026gt;\u0026#34; \\ description=\u0026#34;Image used for vault-backups\u0026#34; RUN apk --no-cache add \\ vault=1.13.2-r0 \\ aws-cli=2.11.21-r0 \\ libcap=2.69-r0 \\ \u0026amp;\u0026amp; addgroup vaultbackup \\ \u0026amp;\u0026amp; adduser -G vaultbackup -g \u0026#34;Backup User\u0026#34; -s /bin/ash -D vaultbackup \\ \u0026amp;\u0026amp; setcap cap_ipc_lock= /usr/sbin/vault USER vaultbackup WORKDIR /home/vaultbackup COPY backupVault.sh /home/vaultbackup/backupVault.sh ENTRYPOINT [\u0026#34;/bin/sh\u0026#34;, \u0026#34;-e\u0026#34;, \u0026#34;/home/vaultbackup/backupVault.sh\u0026#34;] The main magic happens inside the backupVault.sh script\n#!/bin/sh VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id=\u0026#34;$VAULT_APPROLE_ROLE_ID\u0026#34; secret_id=\u0026#34;$VAULT_APPROLE_SECRET_ID\u0026#34;) export VAULT_TOKEN DATE=$(date +%Y%m%d-%H%M%S) vault operator raft snapshot save /tmp/vault-raft-\u0026#34;$DATE\u0026#34;.snap /usr/bin/aws --endpoint-url \u0026#34;$AWS_ENDPOINT_URL\u0026#34; s3 cp /tmp/vault-raft-\u0026#34;$DATE\u0026#34;.snap s3://\u0026#34;$AWS_BUCKET\u0026#34;/vault/ rm /tmp/vault-raft-\u0026#34;$DATE\u0026#34;.snap echo \u0026#34;Completed the backup - \u0026#34; \u0026#34;$DATE\u0026#34; The vault cli creates a short living token via approle authentication. It does the snapshot and with the aws-cli the snapshot will be uploaded to the object storage. Which is not a standard AWS S3 in my case.\nThe script for sure has to be improved, because there is zero safetynet in case of any failure. But it is a starting point which I can extend with some \u0026ldquo;TRY/CATCH\u0026rdquo; functionalities.\nKubernetes CronJob # Kubernetes CronJob resource can be used to schedule when to run the vault-backup pod.\napiVersion: batch/v1 kind: CronJob metadata: name: vault-snapshot-cronjob spec: schedule: \u0026#34;15 */12 * * *\u0026#34; jobTemplate: spec: template: spec: containers: - name: vault-backup image: registry******/******/vault-backup:1.0.0 imagePullPolicy: IfNotPresent envFrom: - secretRef: name: vault-snapshot-agent-token - secretRef: name: vault-snapshot-s3 env: - name: VAULT_ADDR value: https://vault-active.vault.svc.cluster.local:8200 imagePullSecrets: - name: registry-cred restartPolicy: Never backoffLimit: 4 There is a bit of magic in the way how the secrets are managed. The external-secrets-operator manages the secrets which are used as environment variables. Also the imagePullSecrets are manged in this way. The external-secrets-operator uses vault kubernetes auth for authentication and if it has the right policy and permission it will create a kubernetes secret out of a vault secret.\nA good documentation how this works can be found here.\napiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: vault-snapshot-s3 spec: dataFrom: - extract: # AWS_ACCESS_KEY_ID # AWS_BUCKET # AWS_ENDPOINT_URL # AWS_SECRET_ACCESS_KEY key: kvstorage/path/to/secret/vault-snapshot-s3 conversionStrategy: Default refreshInterval: 30s secretStoreRef: kind: ClusterSecretStore name: secrets target: creationPolicy: Owner deletionPolicy: Retain Vault is the perfect place to store credentials.\nAntipattern?\nI missused it a bit for other environment variables. I saw it now and will have to change that later and remove the AWS_ENDPOINT_URL / AWS_BUCKET variables.\nThey probably should be configured like any other environment variable inside the manifest like VAULT_ADDR.\nDeployment # The deployment is done in argocd with the app-of-apps pattern. By this I just can check in everything into git, and argocd will to the work.\nargocd application overview of vault-backup\nRestore # Standard Procedure for Restoring a Vault Cluster | Vault | HashiCorp Developer* Conclusion # With a bit of effort it is possible to automate backups of opensource vault within kubernetes to S3 object storages.\nThere are still todos and things not mentioned in this article.\nImprove backup script \u0026amp; entrypoint A daily routine to test restore procedures Monitoring and alerts with kube-prometheus operator Would be interessting how other IT-folks solved the backup of hashicorp vaults open source version. If you are willing to share insights or crtiticism, please add a comment.\nOfftopic # As we are working much behind screens, we get sometimes tired and think in circles. Then it is time for a break. As much I like tech. I will always enjoy the ancient technology to mow gras with a scythe.\nHave a nice day and don\u0026rsquo;t forget to enjoy life.\nTake a break\n","date":"24 May 2023","externalUrl":null,"permalink":"/en/posts/vault-snap-to-s3-in-kubernetes/","section":"Blog","summary":" Originally published on LinkedIn on 2023-05-24.\nHashicorp Vault # In vault-enterprise there would be an integrated solution to upload backups to S3 compatible storages. In the Open Source version of Vault this feature is missing, so I had to create some solution for this.\n","title":"vault snap to S3 in kubernetes","type":"posts"},{"content":" Originally published on LinkedIn on 2023-05-12.\nIntro # In 2007, when I started to work in tech, IT administrators relied often on shell scripts to automate their workflows. Virtualisation was not that popular and tools like PXE boot and bootstrap files where used to automate the installation of operating systems on multiple servers simultaneously. The network layer was very often operated without automation at all. Later, KVM was also gaining popularity, enabling administrators to create and manage virtual machines. As infrastructure became more complex, configuration management tools like Chef and Ansible became popular, allowing administrators to define infrastructure as code and apply configuration changes across multiple servers quickly and easily.\nOpenNebula, an open-source cloud computing platform, emerged in 2008 as a popular alternative to commercial cloud providers. OpenNebula provided IT administrators with a way to build private cloud infrastructures, enabling organizations to retain complete control over their data. OpenNebula offers a simple and flexible solution to build and manage virtualized infrastructures in both private and hybrid cloud environments.\nThe rise of cloud computing led to the development of Infrastructure as Code (IaC) tools like Terraform and Packer. Terraform made it possible to define infrastructure as code and manage cloud resources across multiple cloud providers, while Packer enabled IT administrators to create machine images for different cloud platforms.\nWith the emergence of containerization, IT administrators turned to container orchestration tools like Kubernetes. Kubernetes provided features like automatic scaling, load balancing, and self-healing, making it possible to manage containers at scale.\nTo manage sensitive information like passwords and API keys, IT administrators turned to tools like Vault. Vault is an open-source tool that enables IT administrators to securely store and manage secrets, ensuring that sensitive information is kept secure and accessible only to authorized users.\nKubernetes operators like cloudnative-pg and external-secrets-operator have been particularly helpful in managing Kubernetes applications and secrets stored in external systems. The cloudnative-pg operator automates the management of PostgreSQL databases, while the external-secrets-operator enables IT administrators to manage secrets stored in external systems like Vault.\nFinally, IT administrators have adopted GitOps workflows using tools like ArgoCD to manage their infrastructure as code. With GitOps, all configuration is stored in a Git repository, and ArgoCD enables IT administrators to define their infrastructure as code and manage it using Git.\nIn conclusion, building and managing IT infrastructure has become more complex over the past two decades, but the emergence of new tools and technologies has made it possible to build highly efficient, secure, and scalable infrastructures. From PXE and KVM to OpenNebula and GitOps, IT administrators have had to adapt to new tools and technologies to keep up with the ever-changing IT landscape.\nGitOPS with ArgoCD # GitOps is a modern approach to managing IT infrastructure that emphasizes the use of Git repositories to store and manage configuration. The idea is to store everything related to infrastructure as code in a Git repository, including configuration, policies, and even application code. By doing so, IT teams can easily manage and version control all aspects of their infrastructure, making it more reliable, consistent, and secure.\nArgoCD is an open-source GitOps tool that makes it easy to deploy and manage Kubernetes applications. ArgoCD can be used to automate the deployment of applications to Kubernetes clusters, monitor the state of the deployed applications, and roll back changes if necessary.\nThe workflow starts with the creation of a Git repository that contains all the configuration files for the kubernetes infrastructure. This Git repository is then connected to ArgoCD, which is configured to watch for changes in the repository. Whenever there is a change, ArgoCD automatically deploys the new version of the infrastructure to the target environment.\nOne of the key features of ArgoCD is the concept of ApplicationSets. ApplicationSets are a way to deploy multiple similar applications using a single configuration. This is particularly useful when deploying applications across multiple environments or clusters, where each environment or cluster requires a slightly different configuration. With ApplicationSets, IT teams can define a single configuration that can be customized for each environment or cluster, making it easy to manage and deploy multiple similar applications.\nArgoCD also provides several other features that make it easy to manage and deploy Kubernetes applications, including:\nRollouts: ArgoCD provides a built-in rollouts feature that enables IT teams to manage the deployment of new versions of applications, ensuring that updates are rolled out gradually and safely. Health monitoring: ArgoCD provides real-time monitoring of the health of deployed applications, enabling IT teams to quickly identify and fix issues as they arise. Automated deployment: ArgoCD can automatically deploy new versions of applications as soon as they are available in the Git repository, ensuring that the infrastructure is always up-to-date. Overall, ArgoCD provides a powerful and flexible GitOps tool for managing Kubernetes applications. By using ApplicationSets, IT teams can easily deploy and manage multiple similar applications, making it easy to manage large and complex infrastructures. With its advanced features like rollouts and health monitoring, ArgoCD makes it easy to deploy and manage applications with confidence, knowing that they are always up-to-date and running smoothly.\nKustomize Overlays # Kustomize is a tool for Kubernetes that allows you to customize and configure your Kubernetes applications by using declarative configuration files. It is used for managing complex deployments that require customization of resources across different environments.\nKustomize uses a simple directory structure to organize your Kubernetes resources. By using overlays and patches, it can make changes to a base configuration without modifying the base directly. This makes it easy to maintain and reuse common configurations while still allowing for environment-specific customizations.\nOne of the key benefits of Kustomize is that it allows you to manage configuration files in a scalable and maintainable way. Rather than creating multiple copies of the same configuration files for different environments, Kustomize enables you to maintain a single base configuration and create overlays for each environment. This reduces the amount of duplication and makes it easier to manage configuration files as they change over time.\nkustomize overlay for environments\nKustomize also provides a simple way to manage environment-specific variables and secrets. By using Kubernetes ConfigMaps and Secrets, you can create environment-specific values that can be used to customize your application at runtime.\nAnother benefit of Kustomize is that it is integrated with other Kubernetes tools, such as kubectl. This means that you can use Kustomize alongside other tools to manage your Kubernetes resources.\nOverall, Kustomize is a powerful tool that simplifies the management of Kubernetes configurations. By using a declarative approach to configuration management, it makes it easier to maintain and scale your Kubernetes applications.\nApp of Apps # The \u0026ldquo;app of apps\u0026rdquo; pattern is a design pattern used in Kubernetes to manage complex applications and environments. It allows you to organize multiple related applications or components into a single parent application that can be managed as a whole.\nThe basic idea behind the app of apps pattern is to create a top-level application that is responsible for deploying and managing multiple child applications, or \u0026ldquo;sub-applications\u0026rdquo;. Each sub-application can be a complex application with its own deployment, services, and other Kubernetes resources.\nBy using the app of apps pattern, you can manage your entire application stack as a single entity. This makes it easier to deploy and manage complex applications and environments, especially in cases where you have many interdependent components.\napp of apps pattern\nSecrets Management # HashiCorp Vault is a tool for managing secrets and sensitive data in modern IT environments. It provides a secure and centralized way to store, access, and manage secrets such as passwords, encryption keys, API keys, and other sensitive data.\nThe main goal of Vault is to provide a secure storage system for secrets, while also providing fine-grained access control and auditing capabilities. Vault uses a variety of encryption techniques, such as encryption-at-rest and encryption-in-transit, to ensure the security of the data it manages. It also provides a range of access control features, such as role-based access control (RBAC), that allow IT teams to manage who has access to which secrets.\nmanage and version secrets with vault-ui\nVault provides a simple API for accessing and managing secrets, making it easy to integrate with other tools and applications. IT teams can use Vault\u0026rsquo;s API to programmatically retrieve and manage secrets, allowing them to build secure and automated workflows.\nOne of the key features of Vault is its ability to generate dynamic secrets. With dynamic secrets, Vault can generate and manage temporary credentials for various systems and services, such as databases, cloud providers, and SSH. This enables IT teams to automatically generate and rotate credentials for these systems and services, reducing the risk of credential theft and misuse.\nOverall, Vault is a powerful and flexible tool for managing secrets in modern IT environments. By providing a secure and centralized way to manage sensitive data, Vault enables IT teams to build secure and automated workflows while reducing the risk of data breaches and credential theft.\nExternal Secrets within Kubernetes # The External Secrets Operator is a Kubernetes operator that enables the Kubernetes cluster to securely access secrets stored outside of the cluster, such as in HashiCorp Vault or AWS Secrets Manager. It simplifies the process of managing secrets by providing a declarative way to define external secret mappings, and automatically syncing secrets between the external store and Kubernetes.\nThe External Secrets Operator uses the Kubernetes Custom Resource Definition (CRD) to define external secrets. These CRDs describe the metadata of an external secret, such as the name, key-value pairs, and where the secret is stored. Once these CRDs are created, the External Secrets Operator retrieves the secrets from the external store and stores them in a Kubernetes secret. This ensures that the secrets are accessible to Kubernetes workloads, without requiring direct access to the external store.\nmanifest to define ExternalSecret\nOne of the key benefits of the External Secrets Operator is that it simplifies the management of secrets. It eliminates the need for developers to manually manage secrets and provides a centralized location to manage and audit secrets. Additionally, because secrets are managed externally, developers do not need to have direct access to the secret store, which improves security and reduces the risk of credential leaks.\nAnother benefit of the External Secrets Operator is that it is highly flexible and can be easily integrated with a variety of external secret stores, including HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault. This makes it easy for Kubernetes clusters to securely access secrets stored in different environments.\nOverall, the External Secrets Operator is a powerful tool that simplifies the management of secrets in Kubernetes clusters. By enabling Kubernetes clusters to securely access external secrets, it makes it easier for developers to build secure and scalable applications.\nMonitoring # Prometheus Operator is a tool for managing and deploying Prometheus instances on Kubernetes clusters. It simplifies the process of setting up, configuring, and scaling Prometheus, making it easier to monitor Kubernetes applications and infrastructure.\nOne of the key components of Prometheus Operator is kube-prometheus. Kube-prometheus is a bundle of Kubernetes manifests and Grafana dashboards that are used to deploy and configure Prometheus and Grafana on Kubernetes clusters. It provides a set of pre-configured dashboards that can be used to monitor Kubernetes components such as nodes, pods, and services, as well as the health and performance of Kubernetes applications.\nKube-prometheus includes Prometheus itself, which is responsible for collecting metrics data from various sources, such as Kubernetes API servers, nodes, and applications. It also includes Alertmanager, which is used to manage and send alerts based on the metrics collected by Prometheus.\nIn addition, kube-prometheus includes Grafana, which is used to visualize and analyze the metrics collected by Prometheus. Grafana provides a rich set of visualization options, including charts, graphs, and dashboards, which can help operators and developers to understand the performance and health of their Kubernetes applications and clusters.\nKube-prometheus also includes a set of Kubernetes manifests that define the various components of the Prometheus and Grafana deployments. These manifests are used to configure and customize the deployments to suit the needs of the Kubernetes cluster.\nOverall, kube-prometheus is a powerful tool that makes it easy to set up and manage Prometheus and Grafana on Kubernetes clusters. It provides a set of pre-configured dashboards and tools that can be used to monitor Kubernetes applications and infrastructure, making it easier for operators and developers to troubleshoot issues and optimize the performance of their Kubernetes deployments.\nLogs # Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system designed to be very cost-effective. It allows users to collect, store, and query log data from their applications and services in a highly efficient and customizable way. Loki uses a unique indexing and storage strategy that enables it to quickly search through and retrieve logs, making it an ideal solution for managing large amounts of log data in a cloud-native environment. Additionally, Loki integrates seamlessly with other popular logging and monitoring tools such as Prometheus and Grafana\nI ran Loki since a while outside of kubernetes, one of my next projects will be to figure out how to use loki-operator and integrate it into my kubernetes environments.\nConclustion # The advent of GitOps and tools like ArgoCD and Kustomize have further streamlined the process of managing and deploying infrastructure, allowing administrators to define and manage complex applications and environments in a simple and scalable way. The app of apps pattern has also emerged as a powerful way to manage complex deployments, allowing administrators to define and manage entire application stacks as a single unit.\nThroughout all of these changes, the role of the IT administrator has remained essential. While the tools and technologies have evolved, the need for skilled professionals who can design, build, and manage complex IT environments has remained constant. As we move forward into an increasingly digital and automated world, the role of the IT administrator will only continue to grow in importance.\nIt\u0026rsquo;s very welcome if you would like to share your experience with these topics. Just write a comment or write me a message.\nCowAI\nYes some parts of this article are written by AI, I\u0026rsquo;m a technician and not a writer. And as convinient IT Admin/DevOps Engineer I like to use tools. ;-)\nLinks # There are plenty of tutorials and sources about these topic. Perhaps some of these links can help to get a better understanding.\nWhat is GitOps?* Infrastructure as Code with Terraform and GitLab | GitLab* ArgoCD Overview* External Secrets Operator* Kustomize* Argocd Cluster Bootstrapping* Openbao - Manage Secrets \u0026amp; Protect Sensitive Data* Prometheus Operator* Grafana Loki OSS | Log aggregation system* ","date":"12 May 2023","externalUrl":null,"permalink":"/en/posts/gitops-with-argocd/","section":"Blog","summary":" Originally published on LinkedIn on 2023-05-12.\nIntro # In 2007, when I started to work in tech, IT administrators relied often on shell scripts to automate their workflows. Virtualisation was not that popular and tools like PXE boot and bootstrap files where used to automate the installation of operating systems on multiple servers simultaneously. The network layer was very often operated without automation at all. Later, KVM was also gaining popularity, enabling administrators to create and manage virtual machines. As infrastructure became more complex, configuration management tools like Chef and Ansible became popular, allowing administrators to define infrastructure as code and apply configuration changes across multiple servers quickly and easily.\n","title":"GitOPS with ArgoCD","type":"posts"},{"content":"","date":"19 June 2022","externalUrl":null,"permalink":"/en/tags/agriculture/","section":"Tags","summary":"","title":"Agriculture","type":"tags"},{"content":"","date":"19 June 2022","externalUrl":null,"permalink":"/en/tags/environment/","section":"Tags","summary":"","title":"Environment","type":"tags"},{"content":" Originally published on LinkedIn on 2022-06-19.\nThis is our contribution to the environment. On the left you can see a planted hedge, in the middle hay that we only mowed in mid-June. On the right, a strip of meadow that has been left standing, a compost heap, a vegetable field\u0026hellip;\n","date":"19 June 2022","externalUrl":null,"permalink":"/en/posts/environmental-protection-instead-of-flying/","section":"Blog","summary":" Originally published on LinkedIn on 2022-06-19.\nThis is our contribution to the environment. On the left you can see a planted hedge, in the middle hay that we only mowed in mid-June. On the right, a strip of meadow that has been left standing, a compost heap, a vegetable field…\n","title":"Environmental protection instead of flying","type":"posts"},{"content":"","date":"19 June 2022","externalUrl":null,"permalink":"/en/categories/sustainability/","section":"Categories","summary":"","title":"Sustainability","type":"categories"},{"content":"","date":"19 June 2022","externalUrl":null,"permalink":"/en/tags/sustainability/","section":"Tags","summary":"","title":"Sustainability","type":"tags"},{"content":"Originally published on LinkedIn on 2022-02-14.\nThese days I learn to build a infrastructure in GCP. The past years I already worked with terraform and so I had already some experience with it. But I didn\u0026rsquo;t use terraform_remote_state as data source in the past.\nA friend showed me how to use it, and it completely changed my way of writing terraform plans. Also the structure of my plans changed with this knowledge.\nBUT be careful, there are important things to know, it has some security drawbacks. Really read the docs before start using it!\n\u0026ldquo;Sharing data with root module outputs is convenient, but it has drawbacks. Although terraform_remote_state only exposes output values, its user must have access to the entire state snapshot, which often includes some sensitive information.\u0026rdquo; source\nBe careful with remote state files in object storages, because it is just a small configuration issue and sensitive data is going public\u0026hellip;\nThis knowledge was a game changer. In the past I used input and output variables a lot together with modules. I also was used to write terraform modules which configure services by triggering chef or ansible. With the focus of deployments on GKE I was wondering about the need of any configuration management. By using kubernetes as managed service there was no need for having configuration management in the stack. Just writing manifests and having a deployment pipeline is an other goal.\nIn the past I was used to structure my terraform plans by application and environments. Inside an application plan I had database, application server, redis and so on. Sure, it also configures all the stuff because ansible also will be triggered. And it had it\u0026rsquo;s ups and downs.\nBack to Terraform. With this preconditions I wrote plans, and define data sources with terraform_remote_state to use the data source in resources. This way I can use the state of an other plan. Somehow this makes sense to me.\nI learned to structure terraform plans in a different way. One plan for project declaration, an other one for databases, the next one for kubernetes. With the usage of the terraform_remote_state it is possible to retrieve variables of an other state and use them inside different plans as data source. This way the database plans can access values of the projects remote state. All database instances are inside a CloudSql terraform configuration, all GKE basis infrastructure in gke plan and both access the projects plan state via terraform_remote_state as data source.\nThere are several ways to structure terraform projects, each one has its advantages and disadvantages.\nahead how to leverage hashicorp terraform remote state digitalocean how to structure a terraform project Jack Roper how to structure terraform projects If you have some experienses or other interessting tutorials, it would be really nice if you can share them as comment.\n","date":"14 February 2022","externalUrl":null,"permalink":"/en/posts/what-are-terraform-remote-states/","section":"Blog","summary":"Originally published on LinkedIn on 2022-02-14.\nThese days I learn to build a infrastructure in GCP. The past years I already worked with terraform and so I had already some experience with it. But I didn’t use terraform_remote_state as data source in the past.\n","title":"What are Terraform remote states?","type":"posts"},{"content":"","date":"3 January 2022","externalUrl":null,"permalink":"/en/categories/career/","section":"Categories","summary":"","title":"Career","type":"categories"},{"content":"","date":"3 January 2022","externalUrl":null,"permalink":"/en/tags/career/","section":"Tags","summary":"","title":"Career","type":"tags"},{"content":"","date":"3 January 2022","externalUrl":null,"permalink":"/en/tags/learning/","section":"Tags","summary":"","title":"Learning","type":"tags"},{"content":"","date":"3 January 2022","externalUrl":null,"permalink":"/en/tags/professional-development/","section":"Tags","summary":"","title":"Professional Development","type":"tags"},{"content":" Originally published on LinkedIn on 2022-01-03.\nWhy I took this set of pictures in the title?\nThe last 20 years I had several jobs and learned a lot in different professions. So I got experiences as farmer, arborist, electrician, CTV technician, Infrastructure engineer and in geospatial projects. I never thought that I will have a chance to combine most of those experiences in a single job.\nBut I got proofed wrong.\nLast year in autumn I got a message from a company because they search for a DevOPS Engineer, maybe I would know someone. I knew R3-GIS since years. My wife and I worked with R3-Trees since years at my wife\u0026rsquo;s company Treetec. This was the start of a very interesting partnership. We as arborist, could add a lot of our experience and help to improve the system. After a while I said to myself what an interesting job offer. I could add my experiences about trees and IT infrastructure in one job. And there is also the lifeurbangreen project, which is dedicated to sustainability.\nI really liked to work with my friends at adidas runtastic. But I had to take the opportunity. It is really hard to leave runtastic again, because I really had a great time there and learned so much. I think the infrastructure team is an awesome team and I\u0026rsquo;m proud that I was a part of it. A time with a lot of fun, memories, parties and work. Thank you all for these memories!\nI\u0026rsquo;m looking forward to meet my friends in trees again, also a very interesting set of professionals. My work will bring me again into a field where I can work together with my wife, because she is also an arborist and will use the platform where I\u0026rsquo;m part of in future. So may I hang around in trees and write code on a couch nearby a coffee machine. The other time you will find me hunting in the forest. Not my profession, but someone said I need a hobby where I can\u0026rsquo;t take my laptop with me.\nWhy I write about this stuff?\nBecause I think it is important to realize, that every experience is important and has it\u0026rsquo;s value. Who knows what is your strength and interest? Don\u0026rsquo;t know who said it but I like the quote:\nI never worked a day in my life. I always loved what I was doing, had a passion for it.\nAnd it is somehow true. If a job is getting just a job to earn money it is just a job and for me it would getting difficult over time. We do a lot of work within our life and spend a lot of time in our job. For myself I figured out, that it should make sense where I\u0026rsquo;m putting my effort into. For myself and for the future of my children. And improve the management of green spaces is one of the projects where I can definitely say this is a passion of mine.\n","date":"3 January 2022","externalUrl":null,"permalink":"/en/posts/lifelong-learning/","section":"Blog","summary":" Originally published on LinkedIn on 2022-01-03.\nWhy I took this set of pictures in the title?\nThe last 20 years I had several jobs and learned a lot in different professions. So I got experiences as farmer, arborist, electrician, CTV technician, Infrastructure engineer and in geospatial projects. I never thought that I will have a chance to combine most of those experiences in a single job.\n","title":"The circle and lifelong learning","type":"posts"},{"content":"Originally published on LinkedIn on 2021-08-10.\nOver the last years I had the pleasure to take care at serveral internal IT tools as an engineer beside production IT. At the beginning it was just about set up a servers, give people access and keep it running (somehow). I often had to focus at multiple things at once. And it was okay. But years later, the company grew. Someone had to take ownership on tools which are used by everyone inside the company. I got asked to do this for a dedicated tool in internal IT and want to share my experiences a bit.\nReally taking ownership about an internal IT tool? # How boring could that be.. was my first thought. What does ownership mean? then next I had to think about it. I talked with other people and realized how important this topic could be for a company. So it might be not the most fancy thing to do, but lets see what happens if you come from DevOPS and take ownership about an internal IT tool.\nAutomate the platform # I was used to have automation for configuration management and deployment. Half a year we worked on topics to increase the quality of our deployment. Some upgrades, migrations and a complete redesign of the whole stack we reached our goal. Now the rollout, configuration and updates can be done via Terraform and AWX/Ansible. We also implemented HA functionality in all parts of the stack. Agile task management, wiki and source control managment services done like in production environments!\nThe automation based deployment changed also an other topic. It is less effort to create a test environment. An example: If you would like to test how you can migrate from an internal directory to an LDAP directory, it can be done in hours instead of days. It is also very easy to give people access if they want to test something or just want to learn how to use the tools.\nInvest in your team # We aslo invested in our skills and did trainings around the internal IT tools. This helped me to understand things better. At a first view a lot of things don\u0026rsquo;t make sense, but if you work with it and understand why it is made like this, at least some thinks can make sense.\nCleanup legacy # In each system you have history. Important is to know when to keep it and when improve things which will block future improvments. An example could be unneeded Plugins where nobody even knows why they are installed. My way is to disable them, see who really needs it and try to understand why. For sure if it is not production related and with some alignment.\nNow we had free time to focus on improvments for our employees.\nCreate a vision # What is the ideal situation for our users and for us as admins to request something?\nOn users side it is SELFSERVICE! On Infrastructure side it is AUTOMATION. Know your needs # Do a small survey and get an idea what emplyoees like and what they think should be improved. Also include the related service team. It could be that users are happy to use direkt communication but the service team is unhappy with the amount of direct messages. Tools like Slack are nice. But not made to use them as help center, collect data, automation or inventory system.\nThink different and create something new # We found a solution based on our existing systems which provided asset management and help center capabilities. After a POC it was clear for us to go in this direction. It helped us to canalise the requests and analyse what people need from us.\nWe imported all IT Assets from our old system. As basis for the next steps we aligned to build up HR information management first. This information is referenced nearly everywhere. Having IT assets and HR information in the same asset management with references gave us a lot possibilities. Automate employee onboarding and device support within workflows is nice for both departments. Approvals can be done without multiple emails. The device requests are handled by our help desk team in a structured an automated way. And workflow automation is used to update our inventory.\nSure it is not perfect yet, but we already saw this saved the HR and IT department already a lot of interupts and time. And this time could be used for other topics.\nCreate what you need # An other key feature was a service created within the IT team. It is kind of a middleware which has endpoints to handle the payload of a ticket or asset information. With this we where able to automate the user and group management on different platforms. Triggered by workflow automation in the task management or help center, changes could be rolled out on multiple platforms.\nConsultancy # Also other departments recognise what could be possible. This is the point where we started to go even further an do a lot of consultancy and try to help other departments with their needs.\nOwnership # For me it is not the tool which made this happen, it can be done with different tools. The reason why we where able to build this up, is the ownership of the tool. And much more important a team with an open mindset, resources, skills and a vision.\nFor me the meaning of ownership got:\nWorking on a vision together with a team and have enough resources to make it happen.\n","date":"10 August 2021","externalUrl":null,"permalink":"/en/posts/service-ownership/","section":"Blog","summary":"Originally published on LinkedIn on 2021-08-10.\nOver the last years I had the pleasure to take care at serveral internal IT tools as an engineer beside production IT. At the beginning it was just about set up a servers, give people access and keep it running (somehow). I often had to focus at multiple things at once. And it was okay. But years later, the company grew. Someone had to take ownership on tools which are used by everyone inside the company. I got asked to do this for a dedicated tool in internal IT and want to share my experiences a bit.\n","title":"Service Ownership","type":"posts"},{"content":"The last Year I learned a lot about Atlassian Products, because I could focus on the Technology and I had the goal to improve the experience for our users. But let me start from the beginning of my Atlassian jounrey.\n2013 I joined a Start Up here in Austria. And this was my first touch point with Jira. At that time we used it as task management for SCRUM based workflows in development. After merging several Jira projects, and database migrations between Jira test instances and production (what a nice time) I also knew something about the data structure and user management.\n","date":"29 July 2021","externalUrl":null,"permalink":"/en/posts/from-atlassian-server-to-data-center/","section":"Blog","summary":"The last Year I learned a lot about Atlassian Products, because I could focus on the Technology and I had the goal to improve the experience for our users. But let me start from the beginning of my Atlassian jounrey.\n","title":"From Atlassian Server to Data Center","type":"posts"},{"content":"","date":"29 July 2021","externalUrl":null,"permalink":"/en/tags/leadership/","section":"Tags","summary":"","title":"Leadership","type":"tags"},{"content":"","date":"29 July 2021","externalUrl":null,"permalink":"/en/tags/serviceownership/","section":"Tags","summary":"","title":"ServiceOwnership","type":"tags"},{"content":"","date":"2 July 2020","externalUrl":null,"permalink":"/en/tags/climate-change/","section":"Tags","summary":"","title":"Climate Change","type":"tags"},{"content":" Originally published on LinkedIn on 2020-07-02.\nOver the last years I learned why it is important to grow your own food. It\u0026rsquo;s much more than eat something, it\u0026rsquo;s kind of lifestyle and also my part against climate change. But why? In my case I focus on regenerative agriculture. Thats even more than a sustainable agriculture does. One of my goals is to give back more than I take from the soil. That\u0026rsquo;s nice, isn\u0026rsquo;t it? But I can tell you it is really difficult. It is really hard to increase the amount of humus in soil when you try to harvest at the same time.\nThis year was really interesting. I started to humify the manure from our horses. It\u0026rsquo;s more than create compost, it\u0026rsquo;s about create microbiology for soil with indigestion.\nIn this case the compost has around 55-65°C and a special fungi together with other microbes is disassembling all the fabrics and nutrients. When the energy is getting less, bacteria is getting more, takes over and builds very good earth. After the whole process it isn\u0026rsquo;t a fertilizer anymore, but it is very good microbiology that you can take to rebuild the microbiology at the fields. A bit of activated biochar and the chance to build up carbonized soil is very high. Do you ever thought about how much carbon could be saved in soil and what humus is, or terra preta? Just google it, and also it\u0026rsquo;s impact on climate change. After that think about industrial agriculture\u0026hellip;. but that\u0026rsquo;s another topic.\nAt first we plow the field, but not with a heavy machine. Because we like it, we plow with the horse. This is really nice work, it is silent, slow and you really can feel the soil.\nAt the moment I can\u0026rsquo;t plant with the horse, but with a small tractor it is also okay for me to plant potatoes and vegetables. After that we take care as whole family. Weed control is really important. And with some people around you it is also funny. This year we where able to work with our horse to control the weeds, which makes things much easier. And we saved a lot of time.\nAnd after some time it looked like this.\nThis is the best time in the year. We planted 7 different types of potatoes. So the time to harvest are different. I always got into the fields with my children when I harvest some potatoes. The joy of the children is the best reward that I can get for the whole work, because then I know that they understand why we plant our own food. This year the first harvest was for french fries, the kids liked it.\nI know I wouldn\u0026rsquo;t like to grow food and sell it to the markets, but I would like to spread the knowledge about those things. So what came into my mind is to create a community here in Upper Austria where we can plant and harvest and exchange. What do you think about such a project, would you like to be a part of such a project/community, or is there already such a community and I didn\u0026rsquo;t know yet?\nI\u0026rsquo;m curious and looking forward for your answers.\n","date":"2 July 2020","externalUrl":null,"permalink":"/en/posts/we-plant-so-we-are/","section":"Blog","summary":" Originally published on LinkedIn on 2020-07-02.\nOver the last years I learned why it is important to grow your own food. It’s much more than eat something, it’s kind of lifestyle and also my part against climate change. But why? In my case I focus on regenerative agriculture. Thats even more than a sustainable agriculture does. One of my goals is to give back more than I take from the soil. That’s nice, isn’t it? But I can tell you it is really difficult. It is really hard to increase the amount of humus in soil when you try to harvest at the same time.\n","title":"We plant, so we are!","type":"posts"},{"content":" Originally published on LinkedIn on 2020-05-27.\nThese days I was on vacation, and I\u0026rsquo;m preparing for my new job which I will start soon. A friend of mine asked for a bit of help with their mapserver RPM packages, because they needed a special combination of mapserver7.4.4 , php7.4, postgresql12 on CentOS7 and CentOS8.\nPacker, Terraform, KVM Ansible solution: # As I worked with some hashicorp products in the past I tried to create something local on my workstation on top of KVM together with packer, terraform-cli, terraform-libvirt and ansible. Nice to play around and get in touch with mapserver and compiling it. But this is way to complicated.\nPodman Container solution: # Yes I\u0026rsquo;m getting old, but I like to try out new stuff. So I was interessted about using podman on my fedora workstation. Wow, very easy to use, just create the Dockerfile and it worked!\nMuch easier, but to prepare the build environment I couldn\u0026rsquo;t use a CentOS7/8 base container. There is plenty of stuff to install inside the container as build requrements. I wouldn\u0026rsquo;t like to rebuild the image every time I trigger a build of mapserver. To solve this I created the build containers with podman on my local fedora workstation.\nThen I used this Container image for the mapserver build. So just de build itselve is trigered when the container starts.\nNice but not perfect.\nBuild Pipelines: # gitlab # So let\u0026rsquo;s do some GitOPS. Let\u0026rsquo;s implement this in a gitlab CI/CD pipeline. Jason Tevnan, friend of mine, worked a lot with pipielines, so I asked him for some hints. I knew that there are build pipeline features available at gitlab. And there is also a built in container registry. I uploaded the prepared containers to the container registry of the gitlab project. Then it\u0026rsquo;s not that much effort anymore to create the CI pipeline. Just a spec file and some gitlab-ci.yml magic and I could download the artifacts.\nstages: - source - build - test - deploy .build_template: \u0026amp;rpm_build_definition stage: build script: - mkdir -p rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} - spectool -g -C rpmbuild/SOURCES \u0026#34;`pwd`/redhat/mapserver-7.4.4.spec\u0026#34; - rpmbuild -D \u0026#34;_topdir `pwd`/rpmbuild\u0026#34; --clean --target x86_64 -ba \u0026#34;`pwd`/redhat/mapserver-7.4.4.spec\u0026#34; artifacts: expire_in: 1 day paths: - rpmbuild/SRPMS/mapserver-*.rpm - rpmbuild/RPMS/x86_64/mapserver-*.x86_64.rpm - rpmbuild/RPMS/x86_64/php-*.x86_64.rpm centos7-build: \u0026lt;\u0026lt;: *rpm_build_definition tags: - linux image: \u0026#34;registry.gitlab.com/treenerd/mapserver:centos7\u0026#34; centos8-build: \u0026lt;\u0026lt;: *rpm_build_definition tags: - linux image: \u0026#34;registry.gitlab.com/treenerd/mapserver:centos8\u0026#34; It\u0026rsquo;s not finished yet and plenty of stuff to improve, but it\u0026rsquo;s a starting point.\nbitbucket # I got asked, if I can do this also with bitbucket. I didn\u0026rsquo;t work with bitbucket that much but the documentation told me that it should be possible. The only thing what I missed, was the build in container registry like in gitlab. But hey let\u0026rsquo;s use the container registry of my gitlab project\u0026hellip; After some bitbucket-pipeline.yml magic the rpm packages where build also there.\nimage: registry.gitlab.com/treenerd/mapserver:centos7 pipelines: default: - step: script: - echo \u0026#34;Everything is awesome!\u0026#34; - pwd - ls -lah - whoami - mkdir -p rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} - spectool -g -C \u0026#34;`pwd`/rpmbuild/SOURCES\u0026#34; \u0026#34;`pwd`/redhat/php-mapserver-7.4.4.spec\u0026#34; - rpmbuild -D \u0026#34;_topdir `pwd`/rpmbuild\u0026#34; --clean --target x86_64 -ba \u0026#34;`pwd`/redhat/php-mapserver-7.4.4.spec\u0026#34; artifacts: - rpmbuild/SRPMS/mapserver-*.rpm - rpmbuild/RPMS/x86_64/mapserver-*.x86_64.rpm - rpmbuild/RPMS/x86_64/php-*.x86_64.rpm Summary # Always be open for new solutions. There is a reason why they exist. Try them, use them and ask people, friends what they think about what you create.\nThank you for your help and also for your questions!\n","date":"27 May 2020","externalUrl":null,"permalink":"/en/posts/use-build-pipelines/","section":"Blog","summary":" Originally published on LinkedIn on 2020-05-27.\nThese days I was on vacation, and I’m preparing for my new job which I will start soon. A friend of mine asked for a bit of help with their mapserver RPM packages, because they needed a special combination of mapserver7.4.4 , php7.4, postgresql12 on CentOS7 and CentOS8.\n","title":"Use Build pipelines","type":"posts"},{"content":"Originally published on LinkedIn on 2020-05-01.\nI really like to automate things. So I also automate the creation and provision of base images for a datacenter environment.\nThere are some tools which solve this. In my case I prefer packer.io.\nWhy? Because it is opensource, supports a lot of different technologies, runs on different platforms and so on and so on. And it is simple and lightweight.\nSo with packer you can, build and provision images in cloud environments but also local with kvm, virtualbox or even hyper-v.\n[gerhardsulzberger@localhost packerkvmcentospgsql]$ cat CentOS-7.7-server-x86_64-kvm.json { \u0026#34;builders\u0026#34;: [ { \u0026#34;type\u0026#34;: \u0026#34;qemu\u0026#34;, \u0026#34;iso_url\u0026#34;: \u0026#34;http://ftp.tugraz.at/mirror/centos/7.7.1908/isos/x86_64/CentOS-7-x86_64-Minimal-1908.iso\u0026#34;, \u0026#34;iso_checksum\u0026#34;: \u0026#34;9a2c47d97b9975452f7d582264e9fc16d108ed8252ac6816239a3b58cef5c53d\u0026#34;, \u0026#34;iso_checksum_type\u0026#34;: \u0026#34;sha256\u0026#34;, \u0026#34;output_directory\u0026#34;: \u0026#34;output_centos_tdhtest\u0026#34;, \u0026#34;shutdown_command\u0026#34;: \u0026#34;echo \u0026#39;packer\u0026#39; | sudo -S shutdown -P now\u0026#34;, \u0026#34;disk_size\u0026#34;: \u0026#34;5000M\u0026#34;, \u0026#34;format\u0026#34;: \u0026#34;qcow2\u0026#34;, \u0026#34;accelerator\u0026#34;: \u0026#34;kvm\u0026#34;, \u0026#34;http_directory\u0026#34;: \u0026#34;http\u0026#34;, \u0026#34;ssh_username\u0026#34;: \u0026#34;root\u0026#34;, \u0026#34;ssh_password\u0026#34;: \u0026#34;changeme\u0026#34;, \u0026#34;ssh_timeout\u0026#34;: \u0026#34;20m\u0026#34;, \u0026#34;vm_name\u0026#34;: \u0026#34;tdhtest\u0026#34;, \u0026#34;net_device\u0026#34;: \u0026#34;virtio-net\u0026#34;, \u0026#34;disk_interface\u0026#34;: \u0026#34;virtio\u0026#34;, \u0026#34;boot_wait\u0026#34;: \u0026#34;10s\u0026#34;, \u0026#34;boot_command\u0026#34;: [ \u0026#34;\u0026lt;tab\u0026gt; text ks=http://{{ .HTTPIP }}:{{ .HTTPPort }}/ks.cfg\u0026lt;enter\u0026gt;\u0026lt;wait\u0026gt;\u0026#34; ] } ] } In case of Redhat images you can create the kickstartfile by the RedHat Kickstart Generator.\nThe image can be used now as base image. But Packer can be do more for you. It can also Provision the base image with different tools like Ansible, Chef or even PowerShell.\nFor more information just take a look at the docs of packer.io.\nHave fun\n","date":"1 May 2020","externalUrl":null,"permalink":"/en/posts/use-the-power-of-automation/","section":"Blog","summary":"Originally published on LinkedIn on 2020-05-01.\nI really like to automate things. So I also automate the creation and provision of base images for a datacenter environment.\nThere are some tools which solve this. In my case I prefer packer.io.\n","title":"Use the power of automation","type":"posts"},{"content":"","date":"30 March 2020","externalUrl":null,"permalink":"/en/tags/fibrechannel/","section":"Tags","summary":"","title":"FibreChannel","type":"tags"},{"content":"Originally published on LinkedIn on 2020-03-30.\nSince I deal with Fibre Channel, I have to deal with new tools as well. Today for example we had some issues on a Linux Server with Fibre Channel HBA setup. In fiber optic network you are looking for Rx/Tx power metrics, which I also get from the SAN switches. But to detect issues it\u0026rsquo;s good to see the RX/TX power also from the host side. The Linux support inside the company told me, that they can\u0026rsquo;t find metrics inside the system. So I tried to get some more knowledge about that topic.\nI checked what kind of adapters we have:\n# lspci | grep -i \u0026#34;fibre\u0026#34; 08:00.0 Fibre Channel: QLogic Corp. ISP8324-based 16Gb Fibre Channel to PCI Express Adapter (rev 02) 08:00.1 Fibre Channel: QLogic Corp. ISP8324-based 16Gb Fibre Channel to PCI Express Adapter (rev 02) And I also checked what I could find in \u0026lsquo;cat /sys/class/fc_host/host*/\u0026rsquo;, but I could\u0026rsquo;t find any Transreciver metrics. So the Linux guy was right.\nPerhaps I just searched on the wrong place\u0026hellip;\nSo let\u0026rsquo;s check Qlogic support pages. And here we go! I did a search for useful tools for my HBA and found QConvergeConsole CLI for Linux (x64).\nhttps://driverdownloads.qlogic.com/QLogicDriverDownloads_UI/Defaultnewsearch.aspx\nInstalled on a Test Server I tried to get the data I wanted:\n# qaucli -pr fc -dm all gen -------------------------------------------------------------------------------- HBA Instance 0: HPAJ764A Port 1 WWPN ****** PortID 16-13-00 Link: Online -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- Media Information -------------------------------------------------------------------------------- Vendor: HP-A Type: 800-M6-SN-I Part Number: AJ718A Speed: 200 MBytes/Sec 400 MBytes/Sec 800 MBytes/Sec Revision: A Serial Number: ********** QLogic SFP Installed: No -------------------------------------------------------------------------------- Temperature Voltage Tx Bias Tx Power Rx Power (C) (V) (mA) (mW) (mW) -------------- ------- ------- -------- -------- Value 46.29 3.32 6.39 0.5534 0.5265 Status Normal Normal Normal Normal Normal High Alarm 100.00 3.80 10.50 0.8000 6.5500 High Warning 95.00 3.63 10.50 0.7000 1.1000 Low Warning -10.00 2.97 2.00 0.1000 0.0490 Low Alarm -15.00 2.80 2.00 0.0500 0.0000 -------------------------------------------------------------------------------- HBA Instance 1: HPAJ764A Port 2 WWPN ****** PortID 7A-13-00 Link: Online -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- Media Information -------------------------------------------------------------------------------- Vendor: HP-A Type: 800-M6-SN-I Part Number: AJ718A Speed: 200 MBytes/Sec 400 MBytes/Sec 800 MBytes/Sec Revision: A Serial Number: ********** QLogic SFP Installed: No -------------------------------------------------------------------------------- Temperature Voltage Tx Bias Tx Power Rx Power (C) (V) (mA) (mW) (mW) -------------- ------- ------- -------- -------- Value 44.30 3.32 6.58 0.5532 0.5553 Status Normal Normal Normal Normal Normal High Alarm 100.00 3.80 10.50 0.8000 6.5500 High Warning 95.00 3.63 10.50 0.7000 1.1000 Low Warning -10.00 2.97 2.00 0.1000 0.0490 Low Alarm -15.00 2.80 2.00 0.0500 0.0000 So I got the data that I wanted, and learned something.\nThink different, never give up and try different solutions to solve issues.\n","date":"30 March 2020","externalUrl":null,"permalink":"/en/posts/get-fibre-channel-hba-adapter-metrics/","section":"Blog","summary":"Originally published on LinkedIn on 2020-03-30.\nSince I deal with Fibre Channel, I have to deal with new tools as well. Today for example we had some issues on a Linux Server with Fibre Channel HBA setup. In fiber optic network you are looking for Rx/Tx power metrics, which I also get from the SAN switches. But to detect issues it’s good to see the RX/TX power also from the host side. The Linux support inside the company told me, that they can’t find metrics inside the system. So I tried to get some more knowledge about that topic.\n","title":"Get Fibre Channel HBA adapter metrics","type":"posts"},{"content":"","date":"30 March 2020","externalUrl":null,"permalink":"/en/categories/infrastructure/","section":"Categories","summary":"","title":"Infrastructure","type":"categories"},{"content":"","date":"30 March 2020","externalUrl":null,"permalink":"/en/tags/storage/","section":"Tags","summary":"","title":"Storage","type":"tags"},{"content":"","date":"19 January 2020","externalUrl":null,"permalink":"/en/tags/ci/cd/","section":"Tags","summary":"","title":"CI/CD","type":"tags"},{"content":"","date":"19 January 2020","externalUrl":null,"permalink":"/en/tags/gitlab/","section":"Tags","summary":"","title":"GitLab","type":"tags"},{"content":" Originally published on LinkedIn on 2020-01-19.\nIn my last article I wrote about Powershell DevOps pipeline and that I would like to use gitlab-ce for that project. So today I combined some things that I\u0026rsquo;m interessted in, at my homelab. Lets spawn gitlab-ce with podman in a Centos 8.1 VM.\n[administrator@podnode01 ~]$ sudo podman run --detach --hostname gitlab.test.vm --env GITLAB_OMNIBUS_CONFIG=\u0026#34;external_url \u0026#39;http://gitlab.test.vm/\u0026#39;\u0026#34; --publish 443:443 --publish 80:80 --publish 222:22 --name gitlab gitlab/gitlab-ce:latest Here we go. I create a git project on my local machine and pushed the repository to the gitlab-ce instance.\nLets spawn also a Windows 2019 server in the lab and lets run a Powershell shell gitlab-runner in it.\nOkay so I have the gitlab-ce server, the powershell gitlab-runner with a \u0026ldquo;windows\u0026rdquo; label and a git repository. How to combine those? Just add a .gitlab-ci.yml file inside the git repository.\ncat .gitlab-ci.yml pages: stage: deploy tags: - windows script: # run PowerShell Command - powershell -Command “Get-Date” # run PowerShell script # - powershell -File copyFiles.ps1 Okay lets do a commit and a push to see if it triggers a \u0026ldquo;build\u0026rdquo;. I know \u0026ldquo;Get-Date\u0026rdquo; isn\u0026rsquo;t a command that triggers a build, but instead of \u0026ldquo;Get-Date\u0026rdquo; we can use other powershell scripts like Pester in the future.\nSo this was just a POC. But I took me less than 1 hour to create the machines, and combine those together. I think that is a easy way to create a build pipeline also for Powershell modules and scripts.\nThe next step will be to run the tests of Pester within the build pipeline.\n","date":"19 January 2020","externalUrl":null,"permalink":"/en/posts/powershell-gitlab/","section":"Blog","summary":" Originally published on LinkedIn on 2020-01-19.\nIn my last article I wrote about Powershell DevOps pipeline and that I would like to use gitlab-ce for that project. So today I combined some things that I’m interessted in, at my homelab. Lets spawn gitlab-ce with podman in a Centos 8.1 VM.\n","title":"Powershell + Gitlab","type":"posts"},{"content":" Originally published on LinkedIn on 2020-01-06.\nHi together, as some of you know I took a new challenge last year and now I work for a big Healthcare Company in the IT department. Over the last years I got a lot of experience how to use automation tools in a homogeneous Linux infrastructure. In my new job things are different.\nIn the past I never thought to use Powershell, because there are tons of really good tools on Linux to configure and deploy stuff. Like Terraform, chef Ansible and so on\u0026hellip;\nSo now I have a Windows workstation \u0026hellip; what a nightmare for me. The last 15 years I didn\u0026rsquo;t touch any Windows PC. Yes I also just support Linux PC\u0026rsquo;s at the \u0026ldquo;family support subscription\u0026rdquo;. So a Windows PC is really a challenge for me.\nSo what did I do first. Yeah hack the BIOS and install WSL, which is nice for some Ansible scripting for the rollout of the new Performance monitoring tools inside our department (I really like Prometheus and Grafana) but thats a different story. But its WSL1 and it\u0026rsquo;s not Windows tooling. So I had the \u0026ldquo;luck\u0026rdquo; to get some Powershell training, which is nice. But it\u0026rsquo;s like with a driving license, you think you are a 18 year old formula1 driver, but in reality I just learned how to drive the car.\nThe good thing is that I had experience with other automation tools, so I looked around what is out there. And I stumbled above some tools and now I try to build up a development stack for Powershell inside our department. Why? We have some storage systems where some API\u0026rsquo;s available, but no one was working with it. And there is no native PowershellCLI available from that vendor. And all the automation should be done by Powershell inside the company. So that\u0026rsquo;s the why.\nDevOps Env # So I investigated a bit whats out there and stumbled over those projects.\nTemplates which can be done with Plaster Versioning I prefer to use Gitlab-CE Testing as I figured out Pester is the common tool for that Documentation structure can be created within the git repository with Plaster Some nice UI for my colleagues, which is Visual Studio Code Build automation by psake Deployment ? That\u0026rsquo;s an open point at the moment. There are options like a Private NuGet server, but I\u0026rsquo;m not sure yet if this is what I would like to have. On the other side there is Gitlab, which is a very powerful tool when it comes to CI/CD. Plaster # For me it is really important to get some structure within the modules that are created by our team. It is some effort to use a tool and create templates, but at the end it pays of. Because people get used to use the structures that we define inside the team. And if it is created by templaes the templates get improved over time. Even if new team members join it\u0026rsquo;s easier to understand whats going on. It is also easier to split up the modules in smaller modules, while having the same structures everywhere. I think the easiest way to understand Plaster is this video in youtube.\nWorking with Plaster (a PowerShell Scaffolding Module\nPerhaps I will find some time to create more articles about that topic. But let\u0026rsquo;s see. If someone has some hint\u0026rsquo;s for me, you are welcome to leave a comment.\n","date":"6 January 2020","externalUrl":null,"permalink":"/en/posts/powershell-for-me-as-psdummy/","section":"Blog","summary":" Originally published on LinkedIn on 2020-01-06.\nHi together, as some of you know I took a new challenge last year and now I work for a big Healthcare Company in the IT department. Over the last years I got a lot of experience how to use automation tools in a homogeneous Linux infrastructure. In my new job things are different.\n","title":"Powershell for me as PSDummy","type":"posts"},{"content":" Originally published on LinkedIn on 2019-09-24.\nI never met my great grandfather, but I had this picture from him. And from time to time I wonderd how it would be to till a field like in the old days.\nThe thing is, the whole farm was leased for years now. But I have always had an eye on the fields and watched as the condition became worse and worse. At the same same time I found something special at my farm. It was some old horse harness. Wow, could it be that this where the old horse harness from the picture I had?\nAfter some cleaning I would say, it could be. I started to think about a horse on the farm. But who can impart some knowledge of the old days? I asked some old people around, everybody could remeber, but nobody was able to teach. Fortunately there was a small community in Austria which tries to preserve some knowledge and bring it into the modern days. This community initiated a certified training course, and I joined it together with my wife. It was a two-year training course, yes you read right. TWO YEARS for a training.\nWhy 2 years. Yeah well, there are season over the year. You have to mow gras, plow, harrow, till and so on. And one very important part of the training was to really do it. Not just in theory. So it is not like a PowerShell training where you can learn the things you need in just 5 days in a well prepared virtual environment. It\u0026rsquo;s outside in the nature, with your own horses. So first you have to learn how to teach your horse, and at the end you will know you learned a lot about yourself.\nWe got knowledge about how to train our own horse in a modern way. Animal welfare is very important! In the meanwhile our horse is like a family member. But it is also important to get the job done. It\u0026rsquo;s a very long process to replace a good trained draft horse.\nAnd over the last 2 years we learned how to get things done over a whole season, just with draft horses.\nWe also grew plants on the field, just that the fields are green. Some years we tilled more than 2ha flowering plants at spring. We could observe an amazing increase of insects and much better soil conditions.\nI would not say the old days where better. But it was amazing to get an idea how my great grandfather worked with his team.\n2 years in modern technologies, like in the IT, can be long. Sometimes a technology got replaced by something better in two years. But when you work on a field with your team, it\u0026rsquo;s completely different. You slow down, you work with equipment which could be hundret years old, but it still works. So I really slowed down at home.\nI also reduced my working hours at my job and I just worked 4 days a week instead of 5. But I got the job done. Also in my new job I work 4 days a week. And also here I get things done in 4 days. Now it is easier for me, to work focused on topics during worktime. I think it\u0026rsquo;s also because I\u0026rsquo;m really realaxed after work at the farm. Very often an Idea related to my job comes in my mind when I work with my horses on the farm. I also recognice that from time to time creativity and innovation is made exactly here, when I am in \u0026ldquo;slow-mode\u0026rdquo;.\npostscript;\n:-D We got the exam done. Now we are \u0026ldquo;Zertifizierte Arbeitstierführer\u0026rdquo; which is something like a \u0026ldquo;certified draft horse leader\u0026rdquo;, some basis to learn every day something new \u0026hellip;.\nLet\u0026rsquo;s see what the future brings\u0026hellip; at least there are some ideas growing\naknowledgements:\n","date":"24 September 2019","externalUrl":null,"permalink":"/en/posts/get-slow-more-efficient/","section":"Blog","summary":" Originally published on LinkedIn on 2019-09-24.\nI never met my great grandfather, but I had this picture from him. And from time to time I wonderd how it would be to till a field like in the old days.\n","title":"Get slow to be more efficient","type":"posts"},{"content":"","date":"24 September 2019","externalUrl":null,"permalink":"/en/tags/work-life-balance/","section":"Tags","summary":"","title":"Work-Life-Balance","type":"tags"},{"content":" Climate Technology and Cooling for IT Infrastructures # Effective air conditioning is crucial for the reliability and lifespan of IT equipment. I offer comprehensive services in climate technology and cooling.\nMy Services # Planning and Consulting # Heat load analysis for IT environments Selection and sizing of air conditioning systems Energy-efficient cooling solutions Redundancy concepts for high availability Installation and Commissioning # Installation of precision air conditioning systems Cold aisle / hot aisle containment Airflow and flow optimization Integration with existing building technology Maintenance and Service # Regular maintenance and inspection Filter replacement and cleaning Troubleshooting and repairs Performance optimization of existing systems Monitoring and Control # Temperature and humidity monitoring Energy consumption analysis Automated control systems Remote monitoring and alerting Typical Application Areas # Data Centers: Precision air conditioning for server rooms Server Rooms: Compact solutions for small IT environments Network Cabinets: Targeted cooling for high heat densities Technical Rooms: Complete solutions for IT and telephony technology Certification # The company is certified for specific activities related to work on refrigeration and air conditioning systems as well as heat pumps according to § 4 para. 1 Fluorinated Greenhouse Gases Act 2009 in connection with the regulation of the Federal Minister for Sustainability and Tourism on qualification and certification measures related to refrigeration and air conditioning systems and heat pumps, BGBl. II No. 2/2011.\nIt has been confirmed that the requirements laid down in Regulation BGBl. II No. 2/2011 have been proven. It is therefore authorized - without prejudice to the fulfillment of the requirements for access to independent commercial activity according to the Trade Regulation 1994, BGBl. No. 194/1994, in the respectively applicable version, in connection with the relevant regulations for access to independent commercial activity - to carry out the following Category II activities:\nLeak checks on refrigeration and air conditioning systems and heat pumps containing fluorinated greenhouse gases with fill quantities from 5 t CO2-equivalent or from 10 t CO2-equivalent for hermetically sealed systems, if the refrigeration circuit is not intervened with Recovery, installation, maintenance and servicing (including leak checks) for systems with a fill quantity of less than 3 kg or for hermetically sealed systems of less than 6 kg within the meaning of Regulation (EU) No. 2015/2067 Contact me for individual consulting.\n","externalUrl":null,"permalink":"/en/services/klimaanlagen/","section":"Services","summary":"Climate Technology and Cooling for IT Infrastructures # Effective air conditioning is crucial for the reliability and lifespan of IT equipment. I offer comprehensive services in climate technology and cooling.\n","title":"Climate Technology and Cooling","type":"services"},{"content":" Electrical Engineering for IT Infrastructures # Electrical safety and reliability are the foundation of any IT infrastructure. I offer comprehensive services in electrical engineering specialized for IT environments.\nMy Services # Power Supply # Planning and installation of power supply systems UPS systems (Uninterruptible Power Supply) Emergency power supply and redundancy concepts Power distribution and cable management Electrical Safety # Safety inspections and maintenance RCD tests and protective measures Grounding and lightning protection Electrical measurements and certifications IT-Specific Solutions # Power supply for server racks and network cabinets PDU installation (Power Distribution Units) Power monitoring and management Energy-saving solutions for data centers Contact me for consulting.\n","externalUrl":null,"permalink":"/en/services/elektrotechnik/","section":"Services","summary":"Electrical Engineering for IT Infrastructures # Electrical safety and reliability are the foundation of any IT infrastructure. I offer comprehensive services in electrical engineering specialized for IT environments.\n","title":"Electrical Engineering for IT Infrastructures","type":"services"},{"content":" Disclosure according to § 25 Media Act # Media owner: Gerhard Sulzberger Company location: Vöcklamarkt, Upper Austria\nWKO Entry\nContact Details # E-mail: info@sete.at\nVAT Number # VAT No: ATU79973003\nContent, Copyright # We would like to explicitly emphasize that we have no influence on the design and content of the linked pages, including all subpages. Therefore, we explicitly distance ourselves from all content of all linked pages, including all subpages on this website, and do not make their content our own. If any content on this website violates a generally applicable copyright, this is not our intention, and we would immediately correct such an infringement.\nAll rights reserved. All content on the website \u0026lt;www.sete.at\u0026gt; is protected by copyright and other protective laws. Legal protection also applies to databases and similar institutions. The content is freely available on the internet only for the intended retrieval. The content of these websites may not be reproduced, distributed, modified, or made accessible to third parties in any form without written permission from Gerhard Sulzberger - SETE, except within the limits of copyright law.\nPrivacy Policy # Processing activities of personal data in the company:\nWhen you provide business cards and contact details (first name, last name, addresses, emails, phone numbers, etc.), you agree that we may process this data in connection with the inquiry until the completion of the order. We initially store business cards in our wallet and later in our circular filing system.\nThe disposal of business cards takes place at different intervals at the local waste collection center (ASZ).\nWe have convinced ourselves that the recycling containers are collected at regular intervals at the ASZ and are sent for recycling.\nIf you contact us by phone, we will make conversation notes, and since we use modern phones, the phone number and the time of the call will be recorded.\nWe have configured our phones so that this data is not uploaded to the manufacturer\u0026rsquo;s cloud, although this cannot be easily controlled.\nThese conversation notes are also stored chronologically in the circular filing system and ultimately disposed of at an ASZ.\nAll customer data in our customer database was deleted with the effective date of the introduction of the GDPR.\nDocuments and emails that are subject to legal retention periods are retained for as long as legally required.\nAfterwards, the data is deleted or shredded and disposed of.\nSince we do not use cookies on this site, there is also no annoying cookie advertising tracking banner.\n","externalUrl":null,"permalink":"/en/imprint/","section":"SETE - Platform Engineering \u0026 Sustainability","summary":"Disclosure according to § 25 Media Act # Media owner: Gerhard Sulzberger Company location: Vöcklamarkt, Upper Austria\nWKO Entry\n","title":"Imprint","type":"page"},{"content":" Platform \u0026amp; Site Reliability Engineering # As a Platform \u0026amp; Site Reliability Engineer, I specialize in building and operating reliable, scalable IT infrastructures.\nMy Services # Infrastructure Design # Planning and implementation of Kubernetes clusters GitOps-based deployment with ArgoCD Infrastructure-as-Code with Terraform Automation of deployment processes Operations and Maintenance # Monitoring and alerting with Prometheus and Grafana Logging solutions with Loki Incident response and post-mortem analysis Capacity planning and scaling Security and Compliance # Implementation of security best practices Secret management with External Secrets Operator Network and firewall configuration Compliance checks Technologies # Container Orchestration: Kubernetes, OpenShift CI/CD: GitLab CI/CD, GitHub Actions Infrastructure as Code: Terraform, Ansible Monitoring: Prometheus, Grafana, Alertmanager Logging: Grafana Loki, Promtail GitOps: ArgoCD, Flux Target Audience # Small and medium-sized data centers IT departments with limited resources Companies with growing IT infrastructure Teams looking to improve their DevOps practices Contact me for individual consulting.\n","externalUrl":null,"permalink":"/en/services/platform-sre/","section":"Services","summary":"Platform \u0026 Site Reliability Engineering # As a Platform \u0026 Site Reliability Engineer, I specialize in building and operating reliable, scalable IT infrastructures.\n","title":"Platform \u0026 Site Reliability Engineering","type":"services"},{"content":" Platform Engineering \u0026amp; Site Reliability for Small Data Centers # My focus is on building and operating IT infrastructures for small to medium-sized data centers. As a Platform \u0026amp; Site Reliability Engineer, I specialize in automating, monitoring, and optimizing systems to ensure maximum reliability and efficiency.\nWith my expertise in:\nPlatform Design \u0026amp; Operations - Scalable infrastructures using Kubernetes, GitOps, and Terraform Electrical Engineering for Data Centers - Power distribution, UPS systems, and electrical safety HVAC \u0026amp; Cooling Systems - Maintenance and optimization of air conditioning and cooling systems for IT environments Storage Solutions - Fibre Channel, block storage arrays, and modern storage technologies I have extensive experience in migrating and operating IT infrastructures, both on-premises and in cloud environments.\nMy Background: Diverse Expertise # My technical expertise is complemented by an unusual career path: In addition to my IT career, I hold certificates as an electrician and in HVAC system maintenance. This combination enables me to approach technical infrastructure not only from a software perspective but also with a deep understanding of hardware and the physical environment.\nAdditionally, I bring experience from other fields:\nCertified Arborist - with years of experience in tree care Agriculture - Practical experience with machinery and sustainable processes Shooting Instructor - Expertise in safety and precise procedures These diverse experiences have given me a unique understanding of complex systems, precision, and the importance of reliability in all areas of work.\nLifelong Learning # Continuous development is not just a professional principle for me, but a life philosophy. Every experience, every field of expertise helps me to approach problems from new perspectives and find innovative solutions.\n","externalUrl":null,"permalink":"/en/about/","section":"SETE - Platform Engineering \u0026 Sustainability","summary":"Platform Engineering \u0026 Site Reliability for Small Data Centers # My focus is on building and operating IT infrastructures for small to medium-sized data centers. As a Platform \u0026 Site Reliability Engineer, I specialize in automating, monitoring, and optimizing systems to ensure maximum reliability and efficiency.\n","title":"Profile","type":"page"},{"content":"I offer professional services in various technical fields. My expertise combines IT infrastructure with practical knowledge of electrical engineering and climate technology.\nMy Service Areas # Platform \u0026amp; SRE\nBuilding and operating scalable IT infrastructures\nElectrical Engineering\nElectrical installations and maintenance for IT environments\nClimate Technology\nClimate control and cooling for server rooms\nTraining\nTraining and workshops for technical teams\n","externalUrl":null,"permalink":"/en/services/","section":"Services","summary":"I offer professional services in various technical fields. My expertise combines IT infrastructure with practical knowledge of electrical engineering and climate technology.\nMy Service Areas # Platform \u0026 SRE\n","title":"Services","type":"services"},{"content":" Technical Training and Workshops # Knowledge is the key to success. I offer technical training and workshops to equip your team with the necessary skills.\nTraining Portfolio # IT Infrastructure and DevOps # Kubernetes Basics and Advanced: Container orchestration GitOps with ArgoCD: Automated deployment Infrastructure as Code with Terraform: Infrastructure as code CI/CD with GitLab: Automated build and deployment pipelines Monitoring with Prometheus and Grafana: Monitoring and alerting Logging with Loki: Central log management Electrical Engineering # Basics of Electrical Engineering for IT Staff: Basic knowledge for safe handling UPS Systems: Selection, installation, and maintenance Power Distribution in Data Centers: Planning and operation Electrical Safety: Standards and regulations Climate Technology # Basics of Climate Technology: Physical principles Data Center Air Conditioning: Special requirements Energy-Efficient Cooling: Energy consumption optimization Maintenance of Air Conditioning Systems: Regular care and maintenance Training Formats # In-Person Training # On-site at your company Individual dates and content Practical exercises and hands-on sessions Online Training # Virtual classrooms Flexible scheduling Interactive sessions with live demos Workshops # Intensive 1-2 day workshops Focus on practical application Small groups for maximum learning effect Target Groups # IT administrators and technicians DevOps engineers System architects Project managers Apprentices and career starters Individual Customization # All training can be individually tailored to your requirements:\nDuration and intensity Content and focus areas Practical exercises and case studies Contact me for an individual training offer.\n","externalUrl":null,"permalink":"/en/services/trainings/","section":"Services","summary":"Technical Training and Workshops # Knowledge is the key to success. I offer technical training and workshops to equip your team with the necessary skills.\n","title":"Technical Training and Workshops","type":"services"}]