Larvitz Blog
Mastodon

Welcome to Larvitz Blog! I’m Christian, a Senior Consultant by day and FreeBSD enthusiast by night, with over 20 years in enterprise IT. Here I write about FreeBSD jails, PF firewalling, self-hosting, Linux system administration, and anything that’s cleanly engineered. Most articles are hands-on guides born from running my own infrastructure, from dual-stack networking and Ansible automation to hosting a Mastodon instance on FreeBSD.

Have a question or want to discuss something? Find me on the Fediverse at @Larvitz@burningboard.net. I’m always happy to chat!

#jails Articles

I Wanted an IPv4 Toast and Accidentally Built an IP Service

At 10:15 this morning I added a gently condescending toast for IPv4-only visitors to hofstede.it. It called ipify, which felt increasingly inappropriate for somebody operating an ASN. Three hours later I had written a Rust IP-information service, put it behind Caddy, given it three DNS names, and deployed it in its own dual-stack FreeBSD VNET jail. This is how a two-line dependency became infrastructure.

bhyve Inside a Jail: The FreeBSD Feature Nobody Uses

A jail shares the host kernel, so sooner or later you need a real virtual machine. bhyve has been able to run inside a jail since FreeBSD 12.0, and almost nobody does it. This is the full build from my production hypervisor: the devfs ruleset, the four things that have to line up, the two-tier bridge topology, and an honest account of what allow.vmm does and does not buy you.

Three Test Jails on a 512 MB Free-Tier VPS

A bug report against my jailexec connection plugin needed a real FreeBSD jail to reproduce. An idle free-tier VPS with 512 MB of RAM turned out to be plenty: pkgbase provides a 33 MB base userland, persistent jails need no idle processes, and three Python-equipped test targets added only 1.1 GB of disk use. This is the build, including the two sharp edges that cost me twenty minutes.

Running Your Own AS: An IXP over VXLAN, IPv4 on the Overlay, and a Config Spring Clean

Part 5 of the AS201379 journey: joining EVIX, an internet exchange that hands out VXLAN tunnels instead of switch ports, carrying a routed IPv4 /29 across the IPv6 overlay with PF policy routing, the dual-FIB routing that makes a VPS work as both a normal host and a routed AS site, moving the downstream MikroTik onto WireGuard, and a long-overdue cleanup of four routers’ worth of accumulated configuration.

Building My Own TV Station: ErsatzTV in a FreeBSD Jail, With Intel Hardware Transcoding

Being ill for a week taught me that a large Jellyfin library is not entertainment, it is homework. ErsatzTV turns a media library back into linear television with real channels and schedules, but it only ships for Linux, Windows, and macOS. It is a .NET application driving ffmpeg, so I built it in a FreeBSD Bastille jail instead. One missing conditional was all that stood between FreeBSD and Intel VAAPI hardware acceleration.

Monitoring a FreeBSD Mastodon Instance with Prometheus, Grafana, and Loki

How I watch burningboard.net, my multi-jail FreeBSD Mastodon instance, from a separate observer host. A pull-based Prometheus stack reaching exporters across my own AS201379 backbone (locked down at the perimeter firewall, not by binding to unroutable addresses), Loki and Promtail for nginx logs, a textfile collector that fills the gaps FreeBSD exporters leave (ZFS, S3, pkg audit, Mastodon API stats), one Grafana dashboard that tells me at a glance whether the instance is healthy, and an Alertmanager ruleset that emails me before users notice.

Automating FreeBSD Jails with cdist - Zero Dependencies Inside the Jail

cdist is refreshingly minimal - the target only needs POSIX sh, and the control machine speaks ssh. But cdist expects one ssh endpoint per host, and FreeBSD jails are not normally their own ssh targets. Two small Python wrappers plug cdist into jexec on the host, so configuration state flows into every jail without running a single daemon, agent, or Python interpreter inside the jail itself.