Security

Nebula from Ansible

 November 6, 2026

For many years, I have managed all my systems with Ansible. For a similar amount of time, I have used Nebula as my VPN of choice, so I can always connect securely to all my systems, even on the move.

There are no official Ansible modules for Nebula, so over the years many people asked me how I manage it. I changed my approach over time. Although my previous iterations worked, I wasn’t satisfied enough to share the details. I’m now at a point where I think the process is fairly good, so here I am.

SOPS for Ansible

 October 24, 2026

I’ve used Ansible for more than 10 years, and one problem I’ve seen everyone deal with is handling secrets in Ansible. Many people put them in the code, but since Ansible code often ends up in Git, that means adding secrets to Git repositories, which you should avoid at all costs.

Ansible Vault is a good solution, since it lets you encrypt files. I’ve used Ansible Vault for many years, but I think it has 2 major limitations.

On finding vulnerabilities and shipping fixes

 August 17, 2026

Over the last year, I’ve watched AI models and tools that find vulnerabilities in code take a central role in security industry communications. Every few weeks, a new product announcement promises impressive results, such as AI tools that detect SQL injection, spot memory corruption bugs, identify logic flaws at scale, or chain tens of known vulnerabilities together. This can be impressive for attack purposes, but it is more an interesting novelty than defensive security.

On photographing physical keys

 February 28, 2025

Every one of us probably has some physical keys in our pocket or purse right now. This familiarity with this common object might make us forget about how the security of those objects actually works.

I see pictures of keys shared very often in groups or on social media. Sometimes this happens because a set of keys has been found somewhere, and the person uploading the picture is trying to help their owner to identify their keys. Other times is simply a picture where the keys are not the subject, but are casually in frame.

A bad year for open source databases

 December 31, 2024

Although the definitions of Open Source are related to specific software characteristics (i.e., the license), the reality is much more complex. Open-source is way more related to a social contract that the software’s creator and its users morally sign than the definition might lead you to believe. This social contract’s key aspect concerns the software’s current license and the licenses of future versions. This is because although users of open-source software usually do not pay to use it, they incur high costs to do so. Examples of those costs are training costs and potential costs to replace a certain technology should it become unavailable in the future.

Hyperscalers are not serious about Service Level Agreements (SLA)

 November 30, 2024

I often talk with people about Service Level Agreements (SLAs) in public cloud contexts, and I discover that their idea of what those SLAs are is often distorted.

I believe SLAs need to be approached with a healthy dose of skepticism. In reality, they often provide little meaningful recourse when things go awry. There are two big issues, in my opinion, with the SLA provided by many companies, including the hyperscalers:

Nebula VPN split configuration

 October 31, 2024

We have had Nebula VPN within the Fedora repositories for a couple of years. A couple of months ago, I changed the default systemd service unit. More specifically, this is the change:

-ExecStart=/usr/bin/nebula -config /etc/nebula/config.yml
+ExecStart=/usr/bin/nebula -config /etc/nebula

Although the change is only a few characters, this change allows for a much more flexible use of Nebula. Before this change, the configuration could only be placed in the config.yaml file. After this change, all YAML files in the folders will be read, merged, and used as configuration.

On Out of Office emails

 August 26, 2024

This summer, I found myself multiple times reading out-of-office emails. Actually, this is not a new phenomenon: it has happened every summer since I started working. Obviously, it also happens outside the summer, but it is far easier to notice it during the summer.

I think the majority of people should not configure an out-of-office replyer.

By recipient

Many people might write to you and receive an out-of-office email if you have set up an out-of-office replayer. Let’s analyze the various personas that might send you emails and whether the out-of-office message makes sense for them.

Forward all your traffic with RedSocks

 April 30, 2024

VPNs can be used in different ways based on the desired objective. If the goal is to reach some specific web pages served only within a network, using a proxy will probably do the trick. Another common use for VPNs is to ensure the confidentiality of data transferred between a remote system and a safe site. In this case, we might want to ensure that all traffic from the remote system reaches the safe site via the VPN.

Use Dante to proxy web traffic

 March 31, 2024

A while ago, I posted about using SSH to proxy traffic within a Nebula network context. In the last few months, I changed my implementation because SSH required some steps and accesses that I was not fully happy with.

In the previous iteration, I was using SSH as a SOCKS proxy. The problem, though, is that I need to set up the connection every time and use my SSH credentials, so it becomes difficult to have it always on. A different SOCKS proxy software needs to be used to achieve the same result without SSH.