Nov 6, 2013 - A Gerrit Workflow for Puppet Environments

Managing Puppet manifests in source control is nothing new. Puppet Labs has their own suggested workflow that uses a git post-receive hook to automatically publish a git branch as an environment. It’s a clever idea, but not one that I think scales well with a bigger team. It would be better if manifests could go through code review, and be approved before going live.

This is the perfect use for Gerrit: any proposed changes go into a pending queue, and are only merged after a review process.

In the Puppet workflow with Gerrit, committers push their proposed changes to the pending change area for master, and then they go through review. Once approved, they are committed to master. When ready to move on to another environment, they can be promoted – by way of gerrit – by merging to development, then quality, then production for example. Life cycle management for your puppet modules.

git_flow

The diagram below shows how it works: a developer gets an authoritative copy of the repo, and makes some changes, but instead of committing back to the authoritative branch, it is committed to a special staging area. The staged commit shows up in the Gerrit code review GUI. Members of the team review the code, and provide any relevant feedback. Once the code gets a +2 vote, it’s merged into the authoritative repo.

Figure 1

When a change is merged, the change-merged hook is executed. I’ve written one that will automatically publish the puppet environment. Unfortunately we need this separate hook, because gerrit does not look at anything in the .git/hooks directory.

Now, an interesting thing about gerrit is that all of the reviewers do not need to the human. Using the Gerrit Trigger for Jenkins, a staged commit can be tested, run through puppet-lint, or any other steps that are needed. The Jenkins wiki explains in more detail how it works. Basically, Jenkins can submit a vote back based on it’s results. Assuming the tests were successful, reviewer(s) can examine the proposed changes – and once the final approval is given, it’s deployed instantly to your puppetmaster.

Sep 19, 2013 - Roku with Raspberry Pi VPN Appliance

See my previous post on this topic, Legal Television and Movies for Expats

Diagram of Network Setup

Roku

Roku is one of the more popular streaming appliances in the U.S. It has “channels” such as Netflix, Amazon, Hulu, et al. It can be a key component in legally streaming your favorite content from home, but to use it abroad, you’ll need to configure a VPN gateway that the Roku can use.

I decided to use my Raspberry Pi for that purpose. I use StrongVPN as my provider, and I was able to import the Roku 3 device from Amazon in the U.S.

Important! Don’t connect your Roku to your WLAN until you’re VPN gateway is configured, otherwise Roku uses geolocation and will configure your device for whatever country you’re in – which limits your access significantly to channels. If you already did this, you can factory reset it and register it with a different account.

Picking a Linux Distro

I decided on Red Sleeve Linux, an Arm clone based on the sources of Red Hat Enterprise Linux. Any Linux distro will do, but I picked Red Sleeve because I’m familiar with the RHEL family, and it’s a bit more stable/static than Pidora. I just want to set the device and mostly forget about it.

The rest of these instructions are specific to RHEL (and Pidora probably too).

After installing RSEL, there’s two key things to keep in mind:

  • You may need to set the date before creating any users/changing any passwords. Even though there's ntpdate sync command in rc.local, it doesn't seem like it worked for me on firstboot. So after you get the network up and running, run ntpdate -s nist.time.gov, for example.
  • Red Sleeve ships mistakenly with a persistent net rule -- so your NIC is going to come up as eth1. To fix it, remove the entry from /etc/udev/rules.d/70-persistent-net.rules and reboot.

Configure VPN

My VPN provider offers PPTP and OpenVPN. I initially chose PPTP, but it had lousy performance on my Pi. I didn’t spend too much troubleshooting it, and just switched over to OpenVPN. There’s a number of good reasons to pick OpenVPN over PPTP.

I’ve provided instructions for both types anyway.

1. PPTP Instructions

Install PPTP Software

yum -y install pptp

Configure PPP Peer

In /etc/ppp/peers/strongvpn for example, input the relevant username/password/vpn server info:

pty "pptp $VPN_SERVER --nolaunchpppd --debug"
name $USERNAME
password $PASSWORD
remotename strongvpn
require-mppe-128
require-mschap-v2
refuse-eap
refuse-pap
refuse-chap
refuse-mschap
noauth
debug
persist
maxfail 0
defaultroute
usepeerdns

Configure up/down scripts

/etc/ppp/ip-up.local runs when you’re connected to the VPN. I do this to have it set the default route and enable IP forwarding.

/sbin/route add default ppp0
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward

/etc/ppp/ip-down.local runs when you’re disconnected from the VPN connection. I don’t want any Internet traffic going out except through the VPN, so I disable IP fowrarding at disconnect:

/bin/echo 0 > /proc/sys/net/ipv4/ip_forward

Connect to the VPN

In /usr/share/doc/ppp-*/scripts, you’ll find “pon” and “poff” which are easy to use scripts to connect to the VPN. I put these in /usr/local/sbin and mark them +x.

After to connect:

pon strongvpn

To disconnect:

poff strongvpn

2. OpenVPN Instructions

OpenVPN is simple, except you need to enable EPEL on RSEL. Create epel.repo in /etc/yum.repos.d/ with this content:

[epel]
name=epel-6
failovermethod=priority
baseurl=http://ftp.redsleeve.org/pub/yum/epel/RPMS
enabled=1
metadata_expire=0s
gpgcheck=0

Install OpenVPN:

yum -y install openvpn

Drop your config files and certificates into /etc/openvpn/, and connect:

openvpn --config /etc/openvpn/strongvpn.ovpn --daemon

Disconnect:

killall -SIGINT openvpn

I haven’t played much with the auto disabling ip forarding and such.

Configure iptables

Below is a simple firewall config I made with Red Hat’s tool (it automatically sets up stateful firewall and such, no need to write rules manually - yay!). You should install it to pull in all the iptables dependencies RSEL seems to be missing:

yum -y system-config-firewall-tui

In /etc/sysconfig/iptables (simply replace ppp0 with tun0 for OpenVPN):

*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o ppp0 -j MASQUERADE
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i lo -j ACCEPT
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -o ppp0 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

And restart iptables, and make sure to chkconfig iptables on.

Configure DHCP

Unfortunately, I found out the Roku provides no way to set a static network configuration. I have no idea why they chose to do things that way, but this means you’ll need to disable the DHCP server on your wireless router and setup one on the Pi to explicitly give your Roku the VPN gateway.

Note the hardware address is printed on the bottom of the Roku.

Install the dhcp package:

yum -y install dhcp

Example config:

subnet 192.168.1.0 netmask 255.255.255.0 {
        option routers                  192.168.1.1;
        option subnet-mask              255.255.255.0;
        option domain-search            "bitbin.de";
        option domain-name-servers      8.8.8.8;
        range                           192.168.1.10 192.168.1.100;
}

host roku {
   hardware ethernet B8:3E:DE:AD:BE:EF;
   fixed-address                   192.168.1.101;
   option routers                  192.168.1.2; # Raspberry Pi
   option subnet-mask              255.255.255.0;
   option domain-search            "bitbin.de"
   option domain-name-servers      8.8.8.8;
}

Start streaming!

After the VPN connection is up, and your DHCP server is working, go ahead and connect the Roku to your network and go through the registration process.

SOCKS Proxy Trick

One more thing to mention is, it’s likely you’ll want to use the VPN connection sometimes on your laptop, or desktop computer – but not 100% of the time. You can also setup a SOCKS proxy on the Pi very easily, and then use Firefox + FoxyProxy to set up rules only for netflix, amazon, etc.

You could install something like Delegate, or Dante, but the easiest thing to do is install screen:

yum -y install screen

And start and SSH connection in screen like this:

ssh youruser@localhost -D 192.168.1.2:3128

Viola! SOCKS5 proxy. Don’t forget to update Firefox to use DNS through the SOCKS proxy – by going to about:config, and set network.proxy.socks_remote_dns to true.

Aug 2, 2013 - 10-Day Vipassana Course

dhamma


I’ve just returned from five weeks in Southeast Asia, and I have to say it was one of the best experiences of my life. My time in Asia began with a 10-day Buddhist retreat in the middle of the jungle learning Vipassana.

These courses are free of charge; no money is accepted from any new student. Likewise, no teacher or volunteer receives any payment for their services. Previous students have paid for you to be there. It’s intentionally designed this way, and is this way for a similar reason that Buddhist monks beg: it’s incredibly humbling to realize you eat, sleep, and drink only due to the compassion of others.

The web site is dhamma.org, and you can find a list of centers in many countries (including Europe and the U.S.). After applying to a 10-day course, you’ll hear back in a few days and get a confirmation if there’s space.

I took the course in Thailand, at the Dhamma Kancana center. It’s located in the beautiful Thai jungle, about 6 hours by bus from Bangkok. You can see photos of the center here. It is known as one of the nicest centers in Thailand, but there are several closer to Bangkok if you’d prefer not to atravel far.

What is Vipassana?

From the website:

"Vipassana, which means to see things as they really are, is one of India's most ancient techniques of meditation. It was taught in India more than 2500 years ago as a universal remedy for universal ills, i.e., an Art of Living. "

These courses are taught by a man named S.N. Goenka, who learned the tradition from his mentor, Sayagyi U Ba Khin. There’s other traditions of the Vipassana meditation technique, and details can vary between different Buddhist sects, but largely, the fundamentals are the same. Goenkaji’s teaching is based in Theravada Buddhism, specifically the Satipatthana Sutta. However, for these courses it has largely had the religious aspects stripped from the teaching. There’s no mention of Theravada Buddhism in the course, and very little mention of Buddha at all. There are no statues on the course’s properties, and there’s no focus on one sect over another. You can be a member of any religion or none.

Modern day Buddhist sects as practiced in Asian countries certainly bolt on a lot of mysticism and rituals that appeal to that culture. Accept these rituals and rites if they are beneficial to you, or you may disregard them. It’s entirely up to you. They are not taught during the course, the focus is on 3 meditation techniques, with the primary one being Vipassana.

Arrival

P1000911

Arrival day is day “0,” which starts sometime in the afternoon. You’re assigned to a room, eat dinner, and attend the introduction to the course. The rooms are basic, but adequate. Some centers have shared accommodations like a barracks, although most have small private rooms. I was given a room in a 2-room cabin. It was basic, clean and relatively comfortable.

There weren’t many westerners. I had expected it to be mostly tourists, but the course was total about 60 people, 85% of the course were Thai, and only 15% foreigners. A handful of the participants were Buddhist monks.

Noble Silence

Before going to your room however, you’re asked to turn in all of your valuables and distractions including mobile phones, books, laptops, etc. At Dhamma Kancana, you’re given a private locker and you retain the key so there’s no worry about security. The reason for this is Noble Silence. During the course you may have no contact with the outside world, nor communicate in any way with your fellow meditators. Complete silence of speech, body, and mind.

Your bags are not searched to determine if you turned everything in, this is really only for your benefit so you can focus on what you came to do. If you’re communicating, or otherwise stimulating your mind, you will lose your ability to concentrate. After a conversation, and you go into the meditation hall, your mind will still be buzzing with thoughts. It’s very difficult to concentrate and learn if you’re busy thinking about other things.

For me, Noble Silence wasn’t particularly difficult as I’m somewhat of a loner anyway, but the lack of being connected to the world, while jarring for the first couple days, I believe was the single most important factor for me being successful during these 10 days.

Precepts

As part of the course, you’re required to accept 5 precepts for the entire duration of your stay:

  1. to abstain from killing any living thing
  2. to abstain from taking that which is not given freely
  3. to abstain from all sexual activity
  4. to abstain from telling lies
  5. to abstain from all intoxicants

The first precept, in addition to meaning you shouldn’t be killing the various bugs you might encounter in the jungle, also translates into a vegan diet; there are no animal products served during the course. Actually, Dhamma Kancana where I took the course is quite renowned for it’s food. It is some of the best vegan food I’ve had in my entire life, and I’ve definitely taken some ideas home with me. I was already vegetarian so I didn’t need much convincing.

As part of Vipassana practice, it’s recommended to continue these precepts after after leaving the course, however it’s not required for the practice, and some may be modified. There’s no magic in following these, and there’s no Flying Spaghetti Monster in the sky keeping track.

Goenkaji suggests that being vegetarian is good practice for developing mettā (compassion), however, Theravada Buddhists, as is practiced in Thailand for example, do generally eat quite a lot of meat. Other sects of Buddhism are quite strict about it. However, every Buddhist will readily admit that being vegetarian is the better option. As I’m fortunate enough to live in a wealthy country with many resources, I have a choice in what to eat, and I can’t see taste preference as being a justification to cause the suffering of another living thing.

Post-course, precept #3 is normally taken by lay Buddhists as avoiding “misconduct”, not celibacy. This is also not the Judeo-Christian view of “misconduct”. Sexual misconduct in the context of Buddhism is any sexual practice that leads to suffering. Consensual sex between adults of same or opposite genders is allowed.

For old students in the course, there are some additional precepts such as no “high and luxurious beds” and no eating after noon.

Schedule

The schedule is intense, beginning at 4 am and ending at 9 pm every day. All said and done, you’re meditating for around 10 hours per day. There’s a set schedule, with about half of the meditation sessions being allowed to be in your room if you wish. The room is more comfortable as you can sit on the bed with your legs hanging off, instead of having to hold an uncomfortable position in the hall. There is free time during the day to walk mindfully around the facility, do laundry, clean your room, etc.

Breakfast and lunch are substantial meals, but dinner is only afternoon tea: tea with fruit. They also had bread and jelly as well during dinner, and occasionally peanut butter. The days with peanut butter were nice as I could make a PB&J. The amount food is more than sufficient, you’re not doing a lot of physical activity and should eat less than you think.

The day ends in the late evening with a 1-2 hour video lecture by S.N. Goenka, followed by a 30-45 minute practice session of any new techniques, and an optional time period to ask questions to the teacher in private. Communication with the staff is allowed, it’s not breaking Noble Silence, but it should be infrequent.

The video lectures are some of the most interesting and engaging things I’ve ever listened to. Goenkaji is a prolific and interesting speaker. If you’re taking the course and speak English well, opt to view the videos in Goenkaji’s excellent English. I suspect his charisma is lost in the translations.

On day 10, you are free from your obligation of Noble Silence by mid-morning, and are encouraged to talk again. It was actually quite odd, I had spoken a couple of times to the teacher during the week, but when I went to say something at normal volume, my throat cracked and I couldn’t talk!

Techniques

Beginning on the evening of day 0, and continuing on days 1, 2, and 3, you are taught a “mindfulness of breathing” technique known as anapanasati. It is as simple as it sounds: you sit and be aware of your breathing. You don’t control it, but simply remain aware of the breath, the feeling as it enters and leaves your nose, which nostrils it is in, and the feeling on the upper lip. These first 3 days are useful to build your mind’s concentration.

If you’ve ever sat for meditation before, you know that it’s quite difficult to maintain concentration. The mind wanders every few seconds! Part of the exercise of the first 3 days of anapanasati is to build your ability to stay equanimous when this happens: you simply acknowledge the thought without feeling upset (building compassion for yourself while developing concentration), and you return to breathing. You’ll notice as the days continue, the mind begins to wander less and less.

On the evening of the 3rd day, you are introduced to vipassana. One of the core teachings of Buddhism is that everything in the universe is impermanent (the concept of anicca). Because everything in the universe is constantly arising and passing away, there’s no sense in being attached to it. Vipassana teaches you to avoid cravings and aversions for anything that happens in life. Craving and aversion lead to attachment, which always leads to suffering. Vipassana is a meditation technique that intuitively teaches you this lesson; it changes the habit pattern of the mind by giving you direct experience of anicca.

So, what exactly is vipassana? It has to do with observing bodily sensations. You’ll spend the next 7 days observing your body by examining piece by piece, and acknowledging but not reacting to the various sensations you experience. Sometimes they are pleasant, sometimes they are not, but they are always impermanent – they will always pass away.

It’s a simple but effective technique. You are changing your habit patterns in how you react – you develop equanimity, mindfulness, and compassion for yourself using this technique. It’s hard to explain, which is why you should take the 10 day course to learn it in detail!

The final meditation technique you learn is mettā bhavanawhich is taught in only a few hours on the last day. It is essentially what you should do at the end of every vipassana meditation session for a few minutes: it’s compassion meditation. Basically, you’re contemplating and “sending” (if you believe such things are possible) your compassion to specific people or people in general, and as well as yourself. It’s a way of wishing good feelings for everyone.

Results

I found the course beneficial. The technique is extremely helpful in becoming a more balanced person, and becoming more mindful of what’s going on in day-to-day life. I’ve definitely noticed changes in how I react to things that happened.

One interesting side effect in the days following the course was the incredible expansion of my attention span. Google is making us stupid, and blogs are destroying our attention spans. In the days that followed, I digested a number of pieces of long form writing, including three whole books – and the books were consumed mindfully, often pausing and spending time to think about what was being said. Vipassana is definitely a cure for at least this modern ill!

I haven’t maintained the practice perfectly, but seem to be able to meditate almost every other day. However, I was on vacation and in different places so it was hard to keep up. I hope to try to do the recommended 1 hour in the morning and evening now that I’m back home.

I won’t lie, the course was challenging. On day 0, as I was laying in bed without any of my electronic crutches like my iPhone, I was looking at out the prospect of 10 whole days dealing with this. It was frightening. From the outside 10 days seems like nothing; from the inside it seems like everything. Days are big, big things when you’re silent, alone, and disconnected.

For the first few days, I was counting meals because they seemed like much shorter time periods to adjust to! At the end of day 1, I kept saying “Ok, look, you’ve already had 4 meals, and you’ve hardly been here any time at all. You’ve only got 27 more, and they’ll go by faster than you think.” I worried about what was going on in the outside world, concerned even I hadn’t told my tax accountant I would be offline in case the Finance Ministry had questions about my tax return. The thoughts faded as the days went on, 27 meals became 18, 18 became 15, and eventually I stopped counting and became content with the disconnection from the world. It wasn’t without it’s difficulties, though. One day in particular was hard enough I contemplated quitting. Everyone going through this course will face some of their own demons, and will have a moment like I did. It could come on day 3, or on day 9, but it will happen.

The day that we learned the Vipassana technique, I could not get my mind under control. I was fidgeting non-stop, and it was everything I could do just not to walk out the gate to the center and go home. I was angry: angry at the teacher for making me sit so uncomfortably, angry at not being able to concentrate, and even angry at myself for feeling angry. At the end of that 2-hour session, I went back to my room and laid in bed, quite upset at how I reacted, how I hadn’t paid enough attention to the teaching, etc.

I began to think how far too often I’ve made knee jerk reactions in life to uncomfortable circumstances. I did anapanasati, and calmed myself down. I returned for the next session and made it through the remaining 7 days without significant problems

It’s challenging, you’ll be pushing yourself to the limit of what you think you can do. However, if you persist, you’re bound to be successful.

Bhavatu Sabba Maṅgalaṃ (May All Beings Be Happy)