chunkystyles

I just recently went through a much more benign, but scary nonetheless version of this.

I realized that my Ansible directory, that I had made public on GitHub to share as an example to some folks, had secrets committed and pushed.

It was the direct URL and credentials of an app I developed to store non-PII customer data. Now, it wouldn’t be the end of the world if someone noticed this and scraped the data, but it wouldn’t be good, either.

Luckily, I have Caddy access logs, and it appears no one ever accessed it.

So I pulled the secrets out of the Ansible directory and made the repo private, I rotated the credentials, and installed Crowdsec to monitor Caddy access logs and ban bad actors.

I only noticed the secrets because I had just setup Authelia as an OAuth2 provider for my homelab, and I was adding it to my backup scripts.

I was devastated when Google Reader shut down. I switched to another service after that and it shut down not long after that. Maybe a year or so.

I would have paid for that service at the time.

Regarding certificates. I use Caddy for things like that. Even stuff that I don’t want publicly available. It is technically public, but relatively secure.

I use a combination of basic authentication plus a rate limit so the password cannot be brute forced. And then I have a bypass so that auth is not required on my home network. I think it works pretty well.

Dark Souls armor sets.

The first drops off of an extremely hard NPC invader. It has the best stats and is by far the heaviest.

The second drops in pieces off of trash mobs randomly. It has mediocre stats.

The third is the starting armor of the Knight class. It has mediocre stats, but is the lightest.