Networking

Nebula from Ansible

 November 6, 2026

For many years, I have managed all my systems with Ansible. For a similar amount of time, I have used Nebula as my VPN of choice, so I can always connect securely to all my systems, even on the move.

There are no official Ansible modules for Nebula, so over the years many people asked me how I manage it. I changed my approach over time. Although my previous iterations worked, I wasn’t satisfied enough to share the details. I’m now at a point where I think the process is fairly good, so here I am.

Red Hat EX457 exam

 August 31, 2025

Last week, I renewed my Red Hat Certified Specialist in Ansible Network Automation (EX457) certification. As I’m already a Red Hat Certified Architect and have passed this same exam a couple of years ago, I wasn’t too worried about it. Still, it is always interesting to see how exams evolve.

Since I did not remember the kind of content that was there last time, I read the objectives page and assumed it would have been more on the networking side. But, in reality, the exam leaned much more toward Ansible playbooks, modules, and automation patterns than network-specific plumbing.

Nebula VPN split configuration

 October 31, 2024

We have had Nebula VPN within the Fedora repositories for a couple of years. A couple of months ago, I changed the default systemd service unit. More specifically, this is the change:

-ExecStart=/usr/bin/nebula -config /etc/nebula/config.yml
+ExecStart=/usr/bin/nebula -config /etc/nebula

Although the change is only a few characters, this change allows for a much more flexible use of Nebula. Before this change, the configuration could only be placed in the config.yaml file. After this change, all YAML files in the folders will be read, merged, and used as configuration.

Forward all your traffic with RedSocks

 April 30, 2024

VPNs can be used in different ways based on the desired objective. If the goal is to reach some specific web pages served only within a network, using a proxy will probably do the trick. Another common use for VPNs is to ensure the confidentiality of data transferred between a remote system and a safe site. In this case, we might want to ensure that all traffic from the remote system reaches the safe site via the VPN.

Use Dante to proxy web traffic

 March 31, 2024

A while ago, I posted about using SSH to proxy traffic within a Nebula network context. In the last few months, I changed my implementation because SSH required some steps and accesses that I was not fully happy with.

In the previous iteration, I was using SSH as a SOCKS proxy. The problem, though, is that I need to set up the connection every time and use my SSH credentials, so it becomes difficult to have it always on. A different SOCKS proxy software needs to be used to achieve the same result without SSH.

Please stop using VPN services for privacy!

 March 29, 2024

For many years, VPN companies have advertised their VPNs as a necessary tool for all people who want to preserve their privacy. For the same amount of time, I tried to explain to the people that this view made no sense if not for those company’s sales.

As an example, Onavo, a Meta subsidiary, used to advertise its services, highlighting that, among other advantages, using their product “protects your personal info”. This claim would not be a problem by itself, but it becomes one when a court finds out that this is not actually true and that new courts documents seem to indicate that the behavior was worst than initially thought.

Use SSH to proxy web traffic

 November 29, 2022

As discusse in a previous post, I use nebula to create a VPN connection between the various machines I use. Usually what I really care about this setup is the ability of consuming services those machine expose on my nebula network.

When I travel, I prefer to proxy my data through my nebula network. This allows me to not have to care about the limitations imposed in those networks, as long as I’m able to open my tunnel. The second advantage I have, is that I can choose the location where my traffic leaves my VPN, since I have multiple machines in multiple nations. Another advantage is that I can be sure that no data is visibile by the network manager, even if this is becoming less and less relevant, since the majority of the traffic is encrypted nowadays.

Nebula on Fedora

 June 30, 2022

In the last year, I moved more and more data and services to hardware that I can directly control. A direct consequence of this is that I started to run more hardware at my house. This change has been very positive, but it is suboptimal when not at home. All services I run are secure and could be shared directly on the web, but I prefer a more cautious approach. For this reason, I decided to create a VPN.

Inject DB connections in Golang gRPC API

 March 21, 2022

One of the first issues that I had to solve when I started to use gRPC was how to inject a DB connection pool to the function handling the request. The DB connection injection is needed because creating a new SQL connection every time there is a new gRPC request (and tearing it down at the end) is a massive waste of resources. Also, this approach could limit the scalability of the API since the database probably has a limited number of connections it will accept.

CORS headers with gRPC-Gateway

 July 28, 2021

A few years ago, I wrote a blog post on managing CORS headers with Negroni. Lately, I’ve created a new API server that needed to be accessible from the browser, but this time I used a different technology, more precisely gRPC-Gateway.

Few months after I wrote that blog post, I stopped writing new REST services by hand. I did not rewrite all the services that used the old paradigm just because they needed a fix or a new feature, but for all new services, I moved to gRPC with gRPC-Gateway.