~luk/

In-place PostgreSQL upgrade on Debian

Sun, 12 Oct 2025 22:05:27 +0200

Before you begin

Check the clusters and their ports with pg_lsclusters. Make sure to create a backup for all databases! You can use pg_dumpall -p <port> command for that.

$ sudo su - postgres
$ export BACKUP_DIR="/tmp/pgbackup"
$ mkdir -p "${BACKUP_DIR}"
$ pg_lsclusters -j \
  | jq -r '.[]|[.config.cluster_name, .config.port] | @tsv' \
  | while IFS=$'\t' read -r cluster port; do \
      pg_dumpall -p "${port}" > "${BACKUP_DIR}/dump_${cluster//\//_}_$( date +"%Y-%m-%dT%H:%M:%S%z" ).sql"; \
    done

Upgrading

To upgrade a cluster to a newer PostgreSQL major version run the following command - in the following example we’re upgrading from version 17 to 18.

How to create an encrypted USB stick

Sun, 21 Feb 2016 00:00:00 +0000

Creating an encrypted USB stick under GNU/Linux is fairly ease. First lets install required packages and erase everything from the stick

$ export USB_STICK="/dev/sdb"
$ apt-get install parted cryptsetup-bin
$ shred -n 10 -v -z "${USB_STICK}"

This process can take some time depending on the stick’s size. After it’s finished, we can create a partition table

$ parted -s -a optimal "${USB_STICK}" -- mklabel msdos mkpart primary ext2 1 -1

Finally we can create an AES encrypted partition

Debugging HTTP traffic like a boss

Sat, 23 May 2015 00:00:00 +0000

One can simply use tcpdump (or Wireshark):

$ tcpdump -ttt -A -q -l 'tcp port 80 or tcp port 443'

If you are looking for more convenient way of viewing HTTP traffic you can use following quick n’ dirty python script, which requires only python-flask and python-requests libraries

#!/usr/bin/python
# -*- coding: utf8 -*-

import requests
from flask import Flask
from flask import Response
from flask import request


app = Flask(__name__)


@app.route('/<path:url>', methods=['POST', 'GET', 'PUT', 'DELETE'])
def proxy(url):

    def print_dict(direction, data):
        for (key, val) in data.iteritems():
            print("{0} {1}: {2}".format(direction, key.title(), val))

    print("> {0} {1}".format(request.method, url))
    print_dict('>', request.form)

    req = requests.request(request.method, url, data=request.form)

    print("< Status code {0}".format(req.status_code))
    print_dict('<', req.headers)
    print(req.content)

    return Response(req.content), req.status_code

if __name__ == '__main__':
    app.run(debug=True)

It will forward all requests to URL specified as a path, e.g.

Fun with kexec

Sun, 08 Mar 2015 00:00:00 +0000

What is kexec?

Simply speaking kexec is a mechanism in Linux kernel which allows you to quickly boot to a new kernel from the currently running one. It’s like a reboot but it skips the entire bootloader stage. There is no hardware initialization. No system firmware. Basically we get extremely fast reboots! Believe me or not, but booting up an enterprise-class machine can take a few minutes…

First steps

First make sure that you have kexec system call enabled in your running kernel:

Artifactory - uploading 3rd party artifacts with Maven

Sun, 01 Mar 2015 22:50:00 +0000

Uploading artifacts to Artifactory via web interface is really clunky… Let’s script it!

#!/bin/bash

ARTIFACTORY_URL="https://artifactory.example.com/artifactory"
ARTIFACTORY_REPO="ext-release-local"

MVN_USERNAME="maven"
MVN_PASSWORD="password"

[[ -z $DEBUG ]] || set -x

umask 0077

if [ $# -lt 4 ]; then
    echo "usage: $( basename "$0" ) groupId artifactId version filename"
    exit 1
fi

GROUP_ID="$1"
ARTIFACT_ID="$2"
VERSION="$3"
FILE="$4"
PACKAGING="${5:-jar}"

TEMP_SETTINGS="$( mktemp --suffix=.xml )"

trap 'rm -rf ${TEMP_SETTINGS}; exit' EXIT INT TERM

cat <<EOF > "${TEMP_SETTINGS}"
<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
    <servers>
        <server>
            <id>${ARTIFACTORY_REPO}</id>
            <username>${MVN_USERNAME}</username>
            <password>${MVN_PASSWORD}</password>
        </server>
    </servers>
</settings>
EOF

mvn -e -s "${TEMP_SETTINGS}" deploy:deploy-file \
    -Dpackaging="${PACKAGING}" \
    -DrepositoryId="${ARTIFACTORY_REPO}" \
    -Durl="${ARTIFACTORY_URL}/${ARTIFACTORY_REPO}" \
    -DgroupId="${GROUP_ID}" \
    -DartifactId="${ARTIFACT_ID}" \
    -Dversion="${VERSION}" \
    -Dfile="${FILE}"

Oracle - LDAP over SSL without OAS

Wed, 06 Nov 2013 16:00:43 +0000

First, you need to install DBMS_LDAP package to use LDAP on Oracle database at all:

CONNECT / AS SYSDBA
@?/rdbms/admin/catldap.sql

then install and configure stunnel:

$ apt-get install stunnel
$ cat <<EOF > /etc/stunnel/ldap.conf
client = yes

[LDAPS-client]
accept  = 127.0.0.1:389
connect = ldap.example.com:636
EOF
$ sed -i.bak 's/ENABLED=0/ENABLED=1/' /etc/default/stunnel4 
$ invoke-rc.d stunnel4 restart

That’s it! Let’s test our configuration:

SET SERVEROUTPUT ON

DECLARE
    LDAPSession DBMS_LDAP.session;
    LDAPResult  PLS_INTEGER;
BEGIN
    DBMS_LDAP.use_exception := TRUE;
    LDAPSession := DBMS_LDAP.init( 
        hostname => '127.0.0.1', 
        portnum  => 389
    );
    LDAPResult  := DBMS_LDAP.simple_bind_s(
        ld     => LDAPSession, 
        dn     => 'cn=user,dc=example,dc=com', 
        passwd => 'password'
    );
    DBMS_Output.put_line('User authenticated!');
    LDAPResult  := DBMS_LDAP.unbind_s(LDAPSession);
END;

Hint: for testing purposes you can also use socat:

Debian amd64 i Juniper VPN

Mon, 19 Aug 2013 23:51:09 +0000

Poniżej znajduję się instrukcja uruchomienia klienta VPN bez 32-bitowej Javy w przeglądarce.

Na początek pobieramy JARa z klientem - po zalogowaniu się do interfejsu www VPNa pobieramy plik /dana-cached/nc/ncLinuxApp.jar

Rozpokowujemy JARa i nadajemy odpowiednie uprawnienia plikom:

$ mkdir -p ~/.juniper_networks
$ unzip -d ~/.juniper_networks/network_connect ncLinuxApp.jar
$ chown root: ~/.juniper_networks/network_connect/ncsvc
$ chmod 6711 ~/.juniper_networks/network_connect/ncsvc
$ chmod 744 ~/.juniper_networks/network_connect/ncdiag

Pobieramy certyfikat serwera:

$ export VPN_SERVER="vpn.example.net"
$ export VPN_PORT="443"
$ openssl x509 -in <(openssl s_client -connect "${VPN_SERVER}:${VPN_PORT}" -prexit 2>/dev/null) \
              -outform der -out ~/.juniper_networks/network_connect/${VPN_SERVER}.der

Instalujemy niezbędne pakiety:

The two basic principles of Windows system administration

Mon, 12 Aug 2013 20:07:00 +0000

For minor problems, reboot
For major problems, reinstall

Debian and PECL

Mon, 12 Aug 2013 20:06:00 +0000

Building PECL packages for Debian GNU/Linux is as easy as:

$ apt-get install dh-make-php
$ dh-make-pecl --depends somelib --build-depends somelib-dev module
$ cd php-module-1.0.0 && dpkg-buildpackage -rfakeroot

Problemy z Subversion

Mon, 12 Aug 2013 20:05:00 +0000

W pewnym momencie, w dość dużym repozytorium (~300MB) wystawionym przez Apache (mod_dav) pojawił się problem:

$ svn up
svn: Decompression of svndiff data failed
$

Rzut oka w logi serwera:

[error] Provider encountered an error while streaming a REPORT response.  [500, #0]
[error] A failure occurred while driving the update report editor  [500, #104]
[error] Error writing base64 data: Connection reset by peer  [500, #104]

Po uruchomieniu svnadmin verify okazało się, że coś jest nie tak z rewizją 413:

Przypadkowy lvremove

Mon, 12 Aug 2013 20:04:00 +0000

Co zrobić gdy omsknie nam się palec na klawiaturze i usuniemy nie ten wolumin co trzeba? Można go przywrócić z backupu:

$ grep remove /etc/lvm/archive/*
/etc/lvm/archive/vgname_00005.vg:description = "Created *before* executing 'lvremove /dev/vgname/lostone"
$ cp /etc/lvm/backup/vgname ~/vgname_lvm_backup
$ vgcfgrestore --verbose  -n lostone vgname
$ lvchange  -ay  /dev/vgname/lostone

Grub2 na patyku

Mon, 12 Aug 2013 20:03:00 +0000

Przygotowanie patyka (zakładam, że na urządzeniu /dev/sdx jest jedna partycja :)):

$ mkfs.vfat -n patyk /dev/sdx1
$ mount /dev/sdx1 /mnt/
$ grub-install --no-floppy --root-directory=/mnt /dev/sdx

Zawartość pliku /mnt/boot/grub/grub.cfg:

set menu_color_normal=white/black
set menu_color_highlight=black/green

# --

menuentry "grml-medium 2011.05" {
	# iso url: http://download.grml.org/grml-medium_2011.05.iso
	loopback loop /iso/grml-medium_2011.05.iso
	echo  'Loading vmlinuz...'
	linux (loop)/boot/grmlmedium/linux26 findiso=/iso/grml-medium_2011.05.iso apm=power-off boot=live nomce noeject noprompt ignore_bootid 
	echo  'Loading initrd...'
	initrd (loop)/boot/grmlmedium/initrd.gz
}

menuentry "grml64-medium 2011.05" {
	# iso url: http://download.grml.org/grml64-medium_2011.05.iso
	loopback loop /iso/grml64-medium_2011.05.iso
	echo  'Loading vmlinuz...'
	linux (loop)/boot/grml64medium/linux26 findiso=/iso/grml64-medium_2011.05.iso apm=power-off boot=live nomce noeject noprompt ignore_bootid 
	echo  'Loading initrd...'
	initrd (loop)/boot/grml64medium/initrd.gz
}

# --

menuentry "PLD Rescue x86" {
	# iso url: http://rescuecd.pld-linux.org/download/2011-02-12/x86_and_x86_64/RCD_11_02.iso
	echo  'Loading vmlinuz...'
	linux /rcd/vmlinuz
	echo  'Loading initrd...'
	initrd /rcd/rescue.cpi /rcd/custom.cpi root=/dev/ram0
}

menuentry "PLD Rescue x86_64" {
	# iso url: http://rescuecd.pld-linux.org/download/2011-02-12/x86_and_x86_64/RCD_11_02.iso
	echo  'Loading vmlinuz...'
	linux /rcd/vmlinuz6
	echo  'Loading initrd...'
	initrd /rcd/rescue6.cpi /rcd/custom.cpi root=/dev/ram0
}

# --

menuentry "Memory test (memtest86+)" {
	linux16 /misc/memtest
}

# --

Error opening terminal: rxvt-256color

Mon, 12 Aug 2013 20:02:00 +0000

$  apt-cache show ncurses-term
[...]
Description-pl: Dodatkowe definicje typów terminali
Funkcje biblioteki ncurses to niezależna od terminalu metoda aktualizacji
wyświetlania znaków na ekranie, z rozsądną optymalizacją.
.
Pakiet zawiera wszystkie definicje wielu terminali, które nie znalazły się w
pakiecie ncurses-base.
[...]
$ apt-get install ncurses-term # :)

Mounting KVM disk image

Mon, 12 Aug 2013 20:01:00 +0000

Click click (zakładam, że urządzenie /dev/loop0 jest dostępne):

$ losetup /dev/loop0 dysk.img
$ kpartx -a /dev/loop0
$ mount /dev/mapper/loop0p1 /mnt

…a po skończonej pracy:

$ umount /mnt
$ kpartx -d /dev/loop0
$ losetup -d /dev/loop0

Dell Latitude XT BIOS upgrade

Mon, 12 Aug 2013 00:00:00 +0000

Przy próbie aktualizacji BIOSu w notebooku Dell Latitude XT, WinPE usilnie zgłaszał brak zasialacza. Pociągało to za sobą niemożność aktualizacji BIOS-u - wymagane są zarówno zasialacz jak i bateria. Po godzinie spędzonej na przeszukiwaniu dokumentacji udało mi się znaleźć rozwiązanie!

DXT_A09.EXE /forceit

About

Mon, 01 Jan 0001 00:00:00 +0000

Contact

GPG key

My GPG public key.

pub   4096R/48AD1541 2014-01-26
      Key fingerprint = 5BEA 0D72 A27F ABB6 2F23  FF2A 2EB8 C2A2 48AD 1541

Astronomy

Mon, 01 Jan 0001 00:00:00 +0000

Astrosprzęt

WIP

Talks

Mon, 01 Jan 0001 00:00:00 +0000

2019

2019-11-29 - Monitoring infrastructure with Prometheus - Jesień Linuksowa (slides)
2019-11-06 - M3 and Prometheus: Monitoring at planet scale for everyone (with Rob Skillington) - O'Reilly Velocity Conference Berlin (event, slides)
2019-01-17 - Monitoring with Prometheus at Devskiller - Krakow Cloud Native Group (event, slides)

2018

2018-10-16 - Infrastructure as Code - Agile & Automation Days (slides)
2018-09-13 - Introduction to monitoring with Prometheus - DevOps Warsaw (event, slides)
2018-06-14 - Monitoring with Prometheus - Cloud Native & Kubernetes Warsaw Meetup (event, slides, video)
2018-06-04 - Monitoring with Prometheus at Devskiller - Warsaw Cloud Native Meetup (event, slides)
2018-01-18 - Prometheus 101 - SysOps / DevOps Warszawa MeetUp (event, slides)

2017

2017-01-26 - Jenkins as Code - Prague Containers Meetup (event)

2016

2016-11-16 - Jenkins as Code - TOPCONF Tallinn (video)
2016-10-14 - Jenkins as Code - High Load Strategy Conference
2016-06-24 - Jenkins as Code (with Marcin Zajączkowski) - Devoxx Poland (video)
2016-03-19 - Jenkins as Code - leveraging Groovy for infrastructure management (with Marcin Zajączkowski) - GR8 Day Warsaw (video)
2016-01-30 - Jenkins as Code (with Marcin Zajączkowski) - FOSDEM (event, slides, video)

2015

2015-11-25 - JaC - Jenkins as Code - DevOpsDays Warsaw (slides, video)
2015-05-19 - Do you think you're doing microservice architecture? - Atmosphere (slides, video)
2015-04-20 - Do you think you're doing microservice architecture? - 4Developers (slides)

2014

2014-10-28 - Warsjawa NFC Case Study - Warszawa Java User Group (slides)
2014-07-22 - Building CI system with Gerrit and Jenkins - DevOps Warsaw (event, slides)