Blog

September 2026

• L2/L3 Сегментация и…

  Задача: изолировать мобильные и IoT-устройства от компьютера, сервера и других устройств, подключенных кабелем на LAN-порты на роутере Mikrotik с помощью VLAN. Замечание: подключиться к роутеру лучше через IP, а не через MAC из-за некоторых технических особенностей. И не забыть включить safe-mode. Зачем нужна L2 и L3-изоляция IoT - недоверенный, плохо патчащийся и потенциально уже скомпрометированный сегмент, поэтому его лучше держать в отдельном L2-домене с default-deny L3-политикой в сторону LAN, оставляя только явно разрешённые направления (обычно только исходящий интернет + при необходимости точечные "дыры" к серверу автоматизации). L2-изоляция через VLAN блокирует ARP-spoofing, ARP-poisoning и sniffing трафика внутри одного broadcast-домена - без неё скомпрометированная IoT-лампочка технически может перехватывать/подменять трафик соседних хостов. Также VLAN ограничевает L2-discovery-протоколы (mDNS, SSDP/UPnP, NetBIOS, LLMNR) от расползания между сегментами - иначе…

  Permanent link to “L2/L3 Сегментация и изоляция домашней сети на роутере Mikrotik”

August 2026

• CI/CD Pipeline…

  CI/CD Pipeline: anime-backlog-web About the Project anime-backlog-web is a custom-built application for tracking anime, consisting of separate Docker containers: Backend — Python Frontend — Node.js / Next.js Database — PostgreSQL 1. Infrastructure Preparation Terraform Terraform is used to provision a virtual machine in Yandex Cloud. The main configuration file requests the following resources: 1 boot disk 1 virtual network 1 subnet 1 virtual machine with minimal specifications attachment of the disk and network to the VM cloud-terraform/main.tf Cloud-init Initial VM configuration (bootstrap), executed once on first boot: user creation SSH key addition cloud-terraform/cloud-init.yml Ansible More detailed configuration of the cloud VM instance: installation and configuration of Docker firewall setup installation of fail2ban hardening of sshd security After the Terraform → Cloud-init → Ansible sequence, the virtual machine is fully prepared for application deployment. ansible/harden.yml…

  Permanent link to “CI/CD Pipeline: anime-backlog-web”

• CI/CD Pipeline…

  CI/CD Pipeline: anime-backlog-web О проекте anime-backlog-web — самописное приложение для отслеживания аниме-тайтлов, состоящее из отдельных Docker-контейнеров: Backend — Python Frontend — Node.js / Next.js База данных — PostgreSQL 1. Подготовка инфраструктуры Terraform С помощью Terraform создаётся виртуальная машина в Yandex Cloud. В главном конфигурационном файле запрашиваются: 1 загрузочный диск 1 виртуальная сеть 1 подсеть 1 виртуальная машина с минимальными характеристиками подключение диска и сети к ВМ cloud-terraform/main.tf Cloud-init Первоначальная настройка ВМ (bootstrap), выполняется один раз при первом запуске: добавление пользователя добавление SSH-ключа cloud-terraform/cloud-init.yml Ansible Более детальная конфигурация облачной машины: установка и настройка Docker настройка firewall установка fail2ban усиление безопасности sshd После связки Terraform → Cloud-init → Ansible виртуальная машина полностью готова к деплою приложения. ansible/harden.yml 2. Запуск pipeline…

  Permanent link to “CI/CD Pipeline: anime-backlog-web (in Russian)”

April 2026

• Anime backlog app

  There's a little oddity about me: I like to make lists and do things systematically and in order. I also like to watch anime, and there are a lot of anime that I’m planning to watch later. And so I had a need to create an app that would solve my problem of making lists of anime that I would like to watch in the future. Before creating this app, I was making do with Google Docs spreadsheets, but I wanted to create something of my own, with features that are difficult or impossible to implement in spreadsheets (for example, requesting information about anime from an external database using the API). And besides, it happened that I got a subscription to chatgpt plus, and so I decided to try my hand at so-called “vibe coding”. I have created applications, simple programs and scripts for my personal use before, but this time I decided to take the project seriously, having read quite a lot of material about vibe-coding. I used a tactic of the multi-staged prompting with set a set of high…

  Permanent link to “Anime backlog app”

• Borgmatic backup…

  Problem When running borgmatic create prune via the systemd service (borgmatic.service), the backup process hung indefinitely during the create phase after the log line Processing files … and the warning /var/lib/docker/containers/...-json.log: file changed while we backed it up. The hang occurred only when the database hooks were active (mariadb_databases and sqlite_databases). These hooks automatically enable --read-special and cause borgmatic to include temporary dump files, which in turn triggered extensive special-file exclusions under /var/lib/docker. A broad exclusion - /var/lib/docker/** prevented the hang but also omitted all Docker volume data (persistent application files located under /var/lib/docker/volumes/). Manual execution of borgmatic create from an interactive root shell completed successfully, confirming the issue was specific to the non-interactive systemd execution environment combined with Docker’s overlay2 layers, container logs, and runtime files. Root Cause…

  Permanent link to “Borgmatic backup issue”

March 2026

• Organazing home…

  I've organized my first home automated backup system and tried my best to describe it (the system seems a bit complicated to me, so in case something goes wrong I'll definitely need a reference). Since this is my first attempt at setting up a backup system, it may have some flaws. Backup System Documentation TL;DR All backups are stored on NAS (192.168.88.40) Storage path: /srv/backups, /mnt/media/backups (for media) Tools: borg + borgmatic + bash scripts + ansible (optional, for bootstrapping) Current Clients: arch-pc, vps-nl, NAS itself Check status: systemctl status borgmatic.timer Logs: journalctl -u borgmatic.service Restore: see "Restore" section Architecture [arch-pc] ──(borgmatic.timer -> daily at 22:00)──borgmatic {/etc/borgmatic.d/arch-pc.yaml} ──▶ [NAS]──/mnt/backups/arch-pc (External HDD) [vps-nl] ──(borgmatic.timer -> daily at 16:00 Server time (21:00 EKT))──borgmatic {/etc/borgmatic/config.yaml} ──▶ [NAS]──/mnt/backups/vps-nl (External HDD) [arch-pc-media…

  Permanent link to “Organazing home backup system”

• Docker container…

  So today last.fm stopped working for Russia: ❯ curl -I https://www.last.fm/ | head -n1 HTTP/2 403 So here's the problem: now my dockerized Navidrome server won't scrobble tracks to last.fm, and since Navidrome doesn't support proxy configuration, I have to route all network traffic from the container through a proxy server. Sometimes I feel like I'm between a rock and a hard place, because the restrictions are coming from both sides... But something good always comes out of every bad situation, and from this one I'll learn a bit more about proxying docker containers. Anyways. What's my goal: make Navidrome scrobble tracks to last.fm again by routing its traffic though my host machine's Xray proxy. What's my steps: Install and configure xray on my server Update docker compose, add proxy variables So first I need to update my Xray configuration. Basically I need to tell Xray to listen on all network interfaces (0.0.0.0) so the Docker container can reach it: "inbounds"…

  Permanent link to “Docker container traffic routing through proxy”