Graham Stevens – Grh.am

M1 MacBook Pro as a k3s Node with Asahi Linux

Sun, 08 Feb 2026 16:45:00 +0000

Background

At home, I run a small 4 node k3s cluster on Dell Wyse 5070, primarily for the experience but also just for the fun of it. It houses all sorts of containers, but happily handles almost everything I throw at it, including Home Assistant, an MQTT instance, Predbat, Smokeping etc. etc.

This little stack of 4 Dell thin clients sits on the corner of my desk, each being powered via a single USB power supply - this means it only takes up a single power socket under the desk for neatness. Each node is also connected to a single Ubiquiti 5 port POE switch (USW-Flex), which again means no plug sockets being used up under the desk (but of course requires a POE switch to power it elsewhere…). Lovely and neat! Each node has two 8GB sticks of RAM, and I’ve replaced the M.2 WiFi cards with M.2 to NVME adapters to all me to expand the local storage.

Preserving Laptop Stickers - A Post Factum

Mon, 22 Jul 2019 15:57:00 +0100

~~TL;DR - With such an overwhelming response to the original post, I have turned this into a KickStarter in an attempt to make this work. You can check it out here.~~

Even better news, this is now not just a thing, but an actual physical product! Please check out LidLayer.com

A few days ago, I posted about my MacBook Pro sticker prototype to help protect the lid, preserve my various stickers, and subsequently show how it can be removed to archive my laptop lids through time.

Preserving Laptop Stickers on MacBooks

Wed, 10 Jul 2019 20:57:00 +0100

This is now a thing! Here is the follow-up post, containing the details. Join the Kickstarter here!

Even better news, this is now not just a thing, but an actual physical product! Please check out LidLayer.com

Preface

I’ve always liked the idea of putting stickers on my MacBook Pro, but have always avoided it for two key reasons:

Resale - By putting stickers on my laptop, I am either going to have to try to remove them again once I come to selling it, lowering my resale price because the laptop isn’t in near pristine condition.
Damage - There is a worry that some stickers may leave a horrible hard-to-remove residue, or maybe leave a discolouration to the aluminium.

Who would realistically buy a used high-end laptop, covered in someone else’s stickers which will likely mean nothing to them? Let alone running the risk that the stickers would leave a horrible sticky residue when you try to remove them or leave permanent marks.

WireGuard Setup Guide for iOS

Thu, 29 Nov 2018 20:27:00 +0000

16th January 2019 - I have updated the article to include DNS lookups over VPN too, where as previously they would have been going out via your ISP/WiFi/mobile provider.

WireGuard is the new kid on the block when it comes to VPNs. I could try and explain what it is and why you should switch from OpenVPN or IPsec to it, but they do a great job of that themselves:

NVMe SSD Upgrade Guide for an Early 2015 MacBook Pro

Mon, 22 Oct 2018 12:00:00 +0100

It’s early 2016, and my employer comes up with a scheme that can help us purchase a laptop and spread the cost over 12 months. For those of us in the UK, it is managed by the same company that also do the Cycle To Work Scheme vouchers etc.

At the time, I had a capable but old MacBook Pro (2011 I believe), so the temptation of an upgrade was too great, and I jumped at the opportunity for a shiny new retina MacBook Pro (Early 2015). As it turns out, they were just drop-shipping the standard builds, which meant any customisation (upgrading the RAM etc.) was out of the question. Entry-level 128GB SSD, 8GB RAM it is then!

A look at the Compromised Gitea Release

Fri, 08 Jun 2018 08:14:58 +0100

Whilst casually browsing Hacker News, I stumbled upon a fairly new post which had hit the front page suggesting that a Gitea (a self-hosted GitHub alternative) may have had some of its release binaries compromised.

The post linked to an issue on the Gitea’s GitHub page, where at the time it was unclear what & how this had happened, just that the releases had been altered and were distributing something malicious. A few hours later, some new information comes to light in the form of SHA256 hashes.

Recovering a Corrupted Elasticsearch 5.x/6.x Index Shard

Mon, 21 May 2018 16:18:32 +0100

Note If you follow my process, you are pretty much guaranteed to lose data. Please think carefully before running any commands from this page.

A few days ago Elasticsearch died on one of my servers due to a lack of memory - One of my Python scripts interacting with a headless Chrome instance forgot a close a few tabs… a lesson for another day.

So, a few pkills & a systemctl start elasticsearch later, my node was back up and running, but he wasn’t looking too healthy - I had an unassigned shard for one of my indices.

Deploying a Hugo Static Site Using GitLab, CI/CD, & SSH

Tue, 08 May 2018 20:23:00 +0100

Recently (April 2018), I redeployed grh.am using Hugo after running the site with Jekyll for a number of years (which I never really blogged about, the last blog post talks about Pelican!

Previously, deployment felt a little clunky, requiring a git push to a remote repository set up on a server, where a git hook picks up on the new commit and runs Jekyll (as per the Jekyll documentation).

This time round, I fancied doing it a little differently & automating all of the deployment whilst also removing a lot of the moving parts to limit areas for things to go wrong. I’ve been using GitLab for a while now thanks to their free private repositories & various other wonderful offerings, one of which is CI/CD which we’ll be using a little later in this post.

IPv6 With BT Infinity and an EdgeRouter X

Wed, 25 Apr 2018 11:22:47 +0100

In late 2016, I replaced my ISP router & modem combination – the BT SmartHub 6 – with separate bits of kit, to give me a little more freedom and something to occasionally tinker with. After a bit of research and bargain hunting, I ended up with:

Modem – BT Openreach ECI VDSL 1b
Router – Linksys WRT1200AC

I originally picked up the WRT1200AC for its wireless speed & the ability to use opensource operating systems on it. I ran it from the very beginning with OpenWRT/LEDE, but found it cumbersome to keep it up to date. Upgrading LEDE meant I had to continually reinstall various software packages which didn’t come as standard (igmpproxy for multicast connections for BT YouView etc.), as well as reinstating the config for that software. Whilst I could have written scripts to handle all of this, it felt clunky and not really fit for purpose. You want your router to be almost invisible & rock solid, not something you have to SSH into every couple of weeks.

Holiday Hack Challenge 2017 - Write-Up

Wed, 10 Jan 2018 00:00:00 +0000

This will be the third year of taking part in the SANS Holiday Hack Challenge, and like many, I have been looking forward to it since late November.

I should really get round to publishing my unfinished attempt for 2016, seeing as it will complete this current series of blog posts…

Cranberry Terminals

First up, lets complete the Cranberry terminals in each of the snowball rolling games, to get us in the mood.

QNAP NAS Cannot unmount disk

Wed, 03 Aug 2016 21:17:01 +0000

Whilst setting up my new QNAP NAS, I received a warning:

[Volume DataVol1] The file system is not clean. It is suggested that you go to [Storage Manager] to run "Check File System".

So, wishing to ensure my new HDD was healthy, I did as I was told and ran the ‘File System Check’ tool.

After a couple of minutes, I received another message, this time an error:

[Volume DataVol1] Examination failed (Cannot unmount disk).

Not a great sign. A swift Google for the error message (which you have no doubt done to get to this page!) revealed that SSH and the command line was the way to go, thanks to Maciej Mensfeld:

Holiday Hack Challenge 2015 - Write-Up

Wed, 06 Jan 2016 00:00:00 +0000

This was to be my very first CTF challenge, and what better time to start than during the festive period! Lots of chocolate, alcohol, and mix in a bit of hacking. Perfect to improve my skills and prove my theoretical knowledge hasn’t gone to waste.

So… lets get started:

Download PCAP from ‘Josh’

wget http://holidayhackchallenge.com/2015/giyh-capture.pcap

Download Python script from ‘Josh’

wget http://holidayhackchallenge.com/2015/gnomeitall.py

Had to re-order the PCAP due to it throwing an error in Wireshark - 2 packets were out of place.

The hint from one of the NPC’s suggested using http://www.packetstan.com/2011/05/sorting-packet-captures-with-scapy.html which shows how to go about re-ordering the PCAP:

Pesky "AMD-Action:authenticate:SP" and its Fix

Thu, 29 Oct 2015 00:00:00 +0000

Over the last few weeks, I’ve been plagued with an issue within the OSX El Capitan App Store, that resulted in me being unable to install any updates or install/purchase new applications. At first, I wondered if this was due to my hasty upgrade to the GM of OSX 10.11, which almost certainly was going have a few bugs and issues being the initial release of a new OS.

After a few attempts at trying to fix the issue using Google, it seemed that although I wasn’t the only one being stung by this error message, it also wasn’t particularly wide spread. A recurring theme was the use of multiple Volumes on OSX, where the ‘/Users/’ directory was not where the App Store expected it to be.

Cute MailChimp Subscriber Count Buttons

Tue, 19 Nov 2013 00:00:00 +0000

This post is rather outdated now, and so the details contained within are no longer valid. Read with caution.

I recently came across the rather snazzy looking subscriber count button on the Smashing Magazine website. A quick Google revealed that these are no longer available after MailChimp redesigned their service. Boo!

An example of the Smashing Magazine counter:

So, a quick look through the coding on this Smashing Magazine page revealed the following:

Tumblr as a Subdirectory (On Apache)

Tue, 19 Nov 2013 00:00:00 +0000

Not on nginx, but still want your Tumblr blog in a subdirectory? Henrik Nyh has got your back.

Have not personally used this, being a fan of nginx, but should at least be a good starting point to get you on your way.

Tumblr as a Subdirectory (On Nginx)

Mon, 18 Nov 2013 00:00:00 +0000

Tumblr will let you run a blog as a sub-domain (blog.domain.com) rather than using their own URL scheme (username.tumblr.com), allowing your blog to appear much more professional and appear directly linked to your domain/website.

However, it is argued within the SEO scene that a subdomain is bad practice for maximising your search engine optimisation. This is because subdomains do not always receive the benefits from the root domain they’re on. For example, just because tumblr.com is a highly ranked domain, does not mean that this ranking will affect deadblog.tumblr.com or john doe.tumblr.com.

My Pelican Adventures, Powered by Dropbox

Wed, 29 May 2013 00:00:00 +0000

This is a legacy post referring to how this blog was originally setup, using Pelican and Dropbox. It no longer reflects the current state of affairs, which can be read about here.

This website is powered solely by the wonderful static blogging engine known as Pelican. A static blogging engine means that each time a change is made i.e. a new post is created, the entire site is rebuilt as static HTML & CSS pages. This may sound laborious, but does mean that everything is extremely simple once setup correctly. For example, my work flow is as follows: