I have HTTP(s) exposed, plus a wireguard port. HTTP points at a traefik gateway running in a kubernetes environment, based on hardened talos and using cilium network policies to isolate and direct traffic. I know that I am not super safe, but given this weeks news I think the only way to be truly safe in terms of cybersecurity is to use paper notebooks, snail mail and a subscription to the local print newspaper and no digital services whatsoever. In other words: how certain can we be that tailscale, or wireguard in general, or any other securit tool isn‘t suddenly at risk? Can we live with that risk? There always was a trade-off you had to make. Unfortunately „just use lets-encrypt, fail2ban and key-auth for ssh“ isn‘t really cutting it anymore.

I tried both voidauth and authelia and found that I really like that you can (actually must, as far as I’ve seen) configure authelias OIDC clients as configuration files. That fits a gitops style approach much better when paired with e.g. sealed secrets. It was a real pain to figure out that authelia configuration, hard agree on that… The official helm chart felt way too over-parametrized and is badly documented. The project website has a lot of basically-copy-paste configs for all kinds if self hosted software though.

Another point to keep in mind - many distros now ship Podman instead of Docker, with Fedora being at the forefront of that change. If you‘re currently running Docker, you might want to check if your setup is drop-in compatible with Podman as some images will not work (usually related to permission or user switching, privileged ports).

Ingress controllers usually use the standard k8s services. In fact metal-lb allows workloads (like the nginx ingress controller) in the cluster to use services of type LoadBalancer, which is the default configuration. This results in an actual IP being made available to your ingress controller.

To get nginx ingress to use the external clients IP, you can configure the ingress controllers traffic policy. Using the helm chart, I used these values:

controller:
          service:
            # this has a bunch of downsides, but allows source-ip based access white/deny listing.
            externalTrafficPolicy: Local

For the ingress IP, I configured metal-lb to receive traffic on a static IP (using IP4AddressPool and L2Advertisement CRDs from metal-lb), which is then used for the port forwarding. I’ve never tested it because I only have a single worker node, but I expect the metal-lb controller will continue receiving traffic to that same static IP if a node goes down.

I think the NPCs did that in KCD1 if you were dirty, had high charisma but a fancy armor or similar. It feels like it works similarly in KCD2, since their demeanor changes significantly when switching from peasant clothes to a proper armor. Don’t have knights armor or any other fancy outfits yet though, so I can’t tell for KCD2.

No. But the arrow tip points towards the center. Weapon sway makes it nigh impossible to aim on the controller. I can’t relate to KCD1 since I played that on PC.

Yes, you don’t want to fight against more than one enemy, the game even has a tutorial with a stylistic drawing of you lining up the enemies in a line, so that only one can engage you at any time. I managed to pull this off with two enemies, with three you would need to tank some hits.

To be honest, it’s still a little hectic for me, but I feel the most notable change is that you can avoid being countered / masterstriked. By positioning your weapon, you can block, perfect block (allows you to strike back) or masterstrike which remains unblockable. There is now an interesting back and forth between blocking, striking back and being blocked, which can go on forever - until someone has no stamina left or someone pulls off a masterstrike.

I can’t imagine myself streaming to an audience, just not my thing I guess.

Steam does this as far as I know.

63.03% rejecting it is less than I had expected. I was expecting 70% or more, so maybe there is hope for the matter to be reiterated upon in the coming years.