<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://docs.delftsolutions.nl/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Thexa4</id>
	<title>Delft Solutions - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://docs.delftsolutions.nl/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Thexa4"/>
	<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/wiki/Special:Contributions/Thexa4"/>
	<updated>2026-04-03T22:18:15Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.39.3</generator>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=691</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=691"/>
		<updated>2026-01-21T13:36:04Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!&lt;br /&gt;
&lt;br /&gt;
# Set bash as your default shell: [[New_Mac_Setup#Use_Bash_as_Shell]]&lt;br /&gt;
# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents.&lt;br /&gt;
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt&lt;br /&gt;
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA&lt;br /&gt;
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/user.key -out ~/Library/IPA/user.csr&lt;br /&gt;
# Go to your user in IPA&lt;br /&gt;
# Click on Actions &amp;gt; New Certificate&lt;br /&gt;
# CA = ipa&lt;br /&gt;
# Profile ID = caIPAserviceCert&lt;br /&gt;
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/user.csr&lt;br /&gt;
# Request the certificate&lt;br /&gt;
# Store the resulting certificate in ~/Library/IPA/user.crt&lt;br /&gt;
# Add the following lines to your ~/.bash_profile - Make sure to replace &amp;lt;mac_username&amp;gt; with your Mac username and &amp;lt;ipa_username&amp;gt; with your IPA username!&lt;br /&gt;
## alias ds_pkinit=&amp;quot;/usr/bin/kinit -C FILE:/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.crt,/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.key --keychain &amp;lt;ipa_username&amp;gt;&amp;quot;&lt;br /&gt;
## ds_pkinit &amp;amp; disown&lt;br /&gt;
# Add the following lines to your ~/.zshrc - Make sure to replace &amp;lt;mac_username&amp;gt; with your Mac username and &amp;lt;ipa_username&amp;gt; with your IPA username!&lt;br /&gt;
## alias ds_pkinit=&amp;quot;/usr/bin/kinit -C FILE:/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.crt,/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.key --keychain &amp;lt;ipa_username&amp;gt;&amp;quot;&lt;br /&gt;
## ds_pkinit &amp;amp; disown&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=679</id>
		<title>New Mac Setup</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=679"/>
		<updated>2025-12-02T11:57:06Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: /* TouchID sudo */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of tweaks that are useful when setting up a new Mac.&lt;br /&gt;
&lt;br /&gt;
== TouchID sudo ==&lt;br /&gt;
* Run: `sed -e &#039;s/#auth/auth/&#039; /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local`&lt;br /&gt;
&lt;br /&gt;
== Kerberos authentication ==&lt;br /&gt;
See: [[Enroll Mac in Kerberos]]&lt;br /&gt;
&lt;br /&gt;
== Trust IPA as Root Certificate ==&lt;br /&gt;
# Make sure to first execute [[Enroll Mac in Kerberos]]&lt;br /&gt;
# Run: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
== Install MacPorts ==&lt;br /&gt;
Follow instructions here: https://www.macports.org/install.php&lt;br /&gt;
&lt;br /&gt;
== Install iTerm2 ==&lt;br /&gt;
https://iterm2.com&lt;br /&gt;
&lt;br /&gt;
== Use Bash as Shell ==&lt;br /&gt;
# `chsh -s /bin/bash`&lt;br /&gt;
# `echo &#039;export BASH_SILENCE_DEPRECATION_WARNING=1&#039; &amp;gt;&amp;gt; ~/.bash_profile`&lt;br /&gt;
&lt;br /&gt;
== Use Kerberos Certificate as Mumble Certificate ==&lt;br /&gt;
# Make sure to perform: [[Enroll Mac in Kerberos]]&lt;br /&gt;
# Make sure to perform: [[#Trust IPA as Root Certificate]]&lt;br /&gt;
# Convert certificate to pkcs12: `openssl pkcs12 -export -passout pass: -in ~/Library/IPA/user.crt -inkey ~/Library/IPA/user.key -out ~/Library/IPA/user.pkcs12 -name &amp;quot;IPA Certificate&amp;quot;`&lt;br /&gt;
# Open mumble&lt;br /&gt;
# On the Certificate Management overview, select &amp;quot;Import a certificate&amp;quot;&lt;br /&gt;
# In the Import from field, enter the following text: ~/Library/IPA/user.pkcs12&lt;br /&gt;
#&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=12%25-time&amp;diff=565</id>
		<title>12%-time</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=12%25-time&amp;diff=565"/>
		<updated>2025-03-04T14:14:43Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;12%-time&#039;&#039;&#039; is an innovation program wherein employees dedicate approximately 12% of their work week (typically four hours out of a 32-hour workweek) to pursue projects of personal interest that could potentially benefit the company. This concept is adapted from [https://en.wikipedia.org/wiki/Side_project_time Google&#039;s 20% time concept]. &lt;br /&gt;
&lt;br /&gt;
== Goals ==&lt;br /&gt;
12%-time creates structured slack in employees&#039; schedules. This has two primary goals: &lt;br /&gt;
# force us to create slack in project schedules, that can be consumed when time runs over. &lt;br /&gt;
# allow for more experimentation and creativity that might not naturally come up in projects. &lt;br /&gt;
&lt;br /&gt;
Slack in projects is important. A fully utilized project (or team) is [https://blog.danslimmon.com/2016/08/26/the-most-important-thing-to-understand-about-queues/ virtually guaranteed to fail to meet its deadlines]: any small delay during a project would cause you to violate the deadline. One of the ways we ensure slack is included in our workweek, is by booking &#039;&#039;up to 4 hours&#039;&#039; every week of 12%-time. Yes, that&#039;s actually 12,5% of your 32-hour workweek, but the shorter name has stuck. &lt;br /&gt;
&lt;br /&gt;
Secondly, 12%-time allows for experimentation and learning outside our regular projects. The availability of work shapes projects. It might benefit Delft Solutions to have you know React, but a React-based project might not come up for months. 12%-time allows for learning React on your terms. Or we might want a new plugin to calculate vacation hours in Kimai, but can&#039;t create a project for that. You could build it in 12%-time. 12%-time allows for exploration of new ideas, innovation outside of your daily responsibilities, skill development, and potential development of new products or features. &lt;br /&gt;
&lt;br /&gt;
== Doing 12%-time at Delft Solutions ==&lt;br /&gt;
# What to work on:&lt;br /&gt;
## Choose your own topics &amp;amp; projects. No one assigns you 12% work. While others might have suggestions, you decide how to allocate time. &lt;br /&gt;
## You can work on things over multiple weeks, or choose a different topic every week for variation.&lt;br /&gt;
## What you work on, should be &amp;quot;work-related&amp;quot;. We take an expansive view of that requirement; it doesn&#039;t have to be directly related to your job. Learning a new programming language, trying some new technology, building a badge reader for the office door, learning bookkeeping or accounting, making a meeting timer, etc. are all great examples of using 12%-time. On the contrary, underwater basket weaving, sleeping and remodelling your bathroom are not. &lt;br /&gt;
# How to budget time:&lt;br /&gt;
## Limit your 12%-time to 4 hours per week over a long term average. It&#039;s okay to spend more or less time on 12%-time per week, it doesn&#039;t have to be exactly 4 hours. &lt;br /&gt;
## Try to stick closely to four hours per week though; having you do 0-0-0-16 hours in a month would defeat goal 1 of having slack every week. &lt;br /&gt;
## Do not catch-up on &#039;missed&#039; 12%-time. If a week was quite busy, the work consumes the 12%-time as a buffer, as it was intended. The next week, just do 4 hours rather than 8 hours on 12%-time.&lt;br /&gt;
## If you miss 12%-time multiple weeks in a row, especially when you do so as the whole team, bring it up as a topic for the weekly retrospective. It&#039;s an early sign that we might be overbooked w.r.t. capacity. &lt;br /&gt;
## Missing work objectives or deadlines while still working 12%-time in a particular week is a major cause for concern and should never happen. The 12%-time is a buffer, not a dedicated project. &lt;br /&gt;
# Planning when to take 12%-time:&lt;br /&gt;
## Spend your 12%-time towards the end of the workweek, probably Thursday or Friday, as it becomes clear that work objectives will be delivered on time for this week. &lt;br /&gt;
## Do not spend 12%-time on weekends to catch up on your hours for the week. Weekends should -- practically and legally -- be for rest, while 12%-time is still considered work. &lt;br /&gt;
# Demo your work on Friday&lt;br /&gt;
## Every week on Friday in the weekly retrospective, we have an agenda item for showing the results of our 12%-time. &lt;br /&gt;
## Prepare beforehand to discuss your 12%-time in the past week. In about 3-4 minutes, you should share: &lt;br /&gt;
### anything new you&#039;ve built&lt;br /&gt;
### any learnings you had. Don&#039;t assume that everyone already knows what you&#039;ve learned: often that&#039;s not the case!&lt;br /&gt;
### You can talk about your process of going about it, but the main focus should be on results.&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=550</id>
		<title>New Mac Setup</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=550"/>
		<updated>2025-02-13T13:53:36Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of tweaks that are useful when setting up a new Mac.&lt;br /&gt;
&lt;br /&gt;
== TouchID sudo ==&lt;br /&gt;
* Edit `/etc/pam.d/sudo_local` as root and remove the &#039;#&#039; before this line: `auth       sufficient     pam_tid.so`&lt;br /&gt;
&lt;br /&gt;
== Kerberos authentication ==&lt;br /&gt;
See: [[Enroll Mac in Kerberos]]&lt;br /&gt;
&lt;br /&gt;
== Trust IPA as Root Certificate ==&lt;br /&gt;
# Make sure to first execute [[Enroll Mac in Kerberos]]&lt;br /&gt;
# Run: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
== Install MacPorts ==&lt;br /&gt;
Follow instructions here: https://www.macports.org/install.php&lt;br /&gt;
&lt;br /&gt;
== Install iTerm2 ==&lt;br /&gt;
https://iterm2.com&lt;br /&gt;
&lt;br /&gt;
== Use Bash as Shell ==&lt;br /&gt;
# `chsh -s /bin/bash`&lt;br /&gt;
# `echo &#039;export BASH_SILENCE_DEPRECATION_WARNING=1&#039; &amp;gt;&amp;gt; ~/.bash_profile`&lt;br /&gt;
&lt;br /&gt;
== Use Kerberos Certificate as Mumble Certificate ==&lt;br /&gt;
# Make sure to perform: [[Enroll Mac in Kerberos]]&lt;br /&gt;
# Make sure to perform: [[#Trust IPA as Root Certificate]]&lt;br /&gt;
# Convert certificate to pkcs12: `openssl pkcs12 -export -passout pass: -in ~/Library/IPA/user.crt -inkey ~/Library/IPA/user.key -out ~/Library/IPA/user.pkcs12 -name &amp;quot;IPA Certificate&amp;quot;`&lt;br /&gt;
# Open mumble&lt;br /&gt;
# On the Certificate Management overview, select &amp;quot;Import a certificate&amp;quot;&lt;br /&gt;
# In the Import from field, enter the following text: ~/Library/IPA/user.pkcs12&lt;br /&gt;
#&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=549</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=549"/>
		<updated>2025-02-12T14:56:50Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!&lt;br /&gt;
&lt;br /&gt;
# Set bash as your default shell: [[New_Mac_Setup#Use_Bash_as_Shell]]&lt;br /&gt;
# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents.&lt;br /&gt;
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt&lt;br /&gt;
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA&lt;br /&gt;
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/user.key -out ~/Library/IPA/user.csr&lt;br /&gt;
# Go to your user in IPA&lt;br /&gt;
# Click on Actions &amp;gt; New Certificate&lt;br /&gt;
# CA = ipa&lt;br /&gt;
# Profile ID = caIPAserviceCert&lt;br /&gt;
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/user.csr&lt;br /&gt;
# Request the certificate&lt;br /&gt;
# Store the resulting certificate in ~/Library/IPA/user.crt&lt;br /&gt;
# Add the following lines to your ~/.bash_profile. Make sure to replace &amp;lt;mac_username&amp;gt; with your Mac username and &amp;lt;ipa_username&amp;gt; with your IPA username!&lt;br /&gt;
## alias ds_pkinit=&amp;quot;/usr/bin/kinit -C FILE:/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.crt,/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.key --keychain &amp;lt;ipa_username&amp;gt;&amp;quot;&lt;br /&gt;
## ds_pkinit &amp;amp; disown&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=513</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=513"/>
		<updated>2025-01-21T15:01:53Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!&lt;br /&gt;
&lt;br /&gt;
# Set bash as your default shell: [[New_Mac_Setup#Use_Bash_as_Shell]]&lt;br /&gt;
# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents.&lt;br /&gt;
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt&lt;br /&gt;
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA&lt;br /&gt;
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/user.key -out ~/Library/IPA/user.csr&lt;br /&gt;
# Go to your user in IPA&lt;br /&gt;
# Click on Actions &amp;gt; New Certificate&lt;br /&gt;
# CA = ipa&lt;br /&gt;
# Profile ID = caIPAserviceCert&lt;br /&gt;
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/user.csr&lt;br /&gt;
# Request the certificate&lt;br /&gt;
# Store the resulting certificate in ~/Library/IPA/user.crt&lt;br /&gt;
# Add the following lines to your ~/.bash_profile. Make sure to replace &amp;lt;mac_username&amp;gt; with your Mac username and &amp;lt;ipa_username&amp;gt; with your IPA username!&lt;br /&gt;
## alias ds_pkinit=&amp;quot;kinit -C FILE:/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.crt,/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.key --keychain &amp;lt;ipa_username&amp;gt;&amp;quot;&lt;br /&gt;
## ds_pkinit &amp;amp; disown&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=512</id>
		<title>New Mac Setup</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=512"/>
		<updated>2025-01-21T14:40:55Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of tweaks that are useful when setting up a new Mac.&lt;br /&gt;
&lt;br /&gt;
== TouchID sudo ==&lt;br /&gt;
* Edit `/etc/pam.d/sudo_local` as root and remove the &#039;#&#039; before this line: `auth       sufficient     pam_tid.so`&lt;br /&gt;
&lt;br /&gt;
== Kerberos authentication ==&lt;br /&gt;
See: [[Enroll Mac in Kerberos]]&lt;br /&gt;
&lt;br /&gt;
== Trust IPA as Root Certificate ==&lt;br /&gt;
# Make sure to first execute [[Enroll Mac in Kerberos]]&lt;br /&gt;
# Run: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
== Install MacPorts ==&lt;br /&gt;
Follow instructions here: https://www.macports.org/install.php&lt;br /&gt;
&lt;br /&gt;
== Use Bash as Shell ==&lt;br /&gt;
# `chsh -s /bin/bash`&lt;br /&gt;
# `echo &#039;export BASH_SILENCE_DEPRECATION_WARNING=1&#039; &amp;gt;&amp;gt; ~/.bash_profile`&lt;br /&gt;
&lt;br /&gt;
== Use Kerberos Certificate as Mumble Certificate ==&lt;br /&gt;
# Make sure to perform: [[Enroll Mac in Kerberos]]&lt;br /&gt;
# Make sure to perform: [[#Trust IPA as Root Certificate]]&lt;br /&gt;
# Convert certificate to pkcs12: `openssl pkcs12 -export -passout pass: -in ~/Library/IPA/user.crt -inkey ~/Library/IPA/user.key -out ~/Library/IPA/user.pkcs12 -name &amp;quot;IPA Certificate&amp;quot;`&lt;br /&gt;
# Open mumble&lt;br /&gt;
# On the Certificate Management overview, select &amp;quot;Import a certificate&amp;quot;&lt;br /&gt;
# In the Import from field, enter the following text: ~/Library/IPA/user.pkcs12&lt;br /&gt;
#&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=511</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=511"/>
		<updated>2025-01-21T14:22:25Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!&lt;br /&gt;
&lt;br /&gt;
# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents.&lt;br /&gt;
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt&lt;br /&gt;
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA&lt;br /&gt;
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/user.key -out ~/Library/IPA/user.csr&lt;br /&gt;
# Go to your user in IPA&lt;br /&gt;
# Click on Actions &amp;gt; New Certificate&lt;br /&gt;
# CA = ipa&lt;br /&gt;
# Profile ID = caIPAserviceCert&lt;br /&gt;
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/user.csr&lt;br /&gt;
# Request the certificate&lt;br /&gt;
# Store the resulting certificate in ~/Library/IPA/user.crt&lt;br /&gt;
# Add the following lines to your ~/.bash_profile. Make sure to replace &amp;lt;mac_username&amp;gt; with your Mac username and &amp;lt;ipa_username&amp;gt; with your IPA username!&lt;br /&gt;
## alias ds_pkinit=&amp;quot;kinit -C FILE:/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.crt,/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/user.key --keychain &amp;lt;ipa_username&amp;gt;&amp;quot;&lt;br /&gt;
## ds_pkinit &amp;amp; disown&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=510</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=510"/>
		<updated>2025-01-21T14:12:56Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!&lt;br /&gt;
&lt;br /&gt;
# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents.&lt;br /&gt;
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt&lt;br /&gt;
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA&lt;br /&gt;
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/laptop.key -out ~/Library/IPA/laptop.csr&lt;br /&gt;
# Go to your user in IPA&lt;br /&gt;
# Click on Actions &amp;gt; New Certificate&lt;br /&gt;
# CA = ipa&lt;br /&gt;
# Profile ID = caIPAserviceCert&lt;br /&gt;
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/laptop.csr&lt;br /&gt;
# Request the certificate&lt;br /&gt;
# Store the resulting certificate in ~/Library/IPA/laptop.crt&lt;br /&gt;
# Add the following lines to your ~/.bash_profile. Make sure to replace &amp;lt;mac_username&amp;gt; with your Mac username and &amp;lt;ipa_username&amp;gt; with your IPA username!&lt;br /&gt;
## alias ds_pkinit=&amp;quot;kinit -C FILE:/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/laptop.crt,/Users/&amp;lt;mac_username&amp;gt;/Library/IPA/laptop.key --keychain &amp;lt;ipa_username&amp;gt;&amp;quot;&lt;br /&gt;
## ds_pkinit &amp;amp; disown&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=509</id>
		<title>New Mac Setup</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=509"/>
		<updated>2025-01-21T14:09:19Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of tweaks that are useful when setting up a new Mac.&lt;br /&gt;
&lt;br /&gt;
== TouchID sudo ==&lt;br /&gt;
* Edit `/etc/pam.d/sudo_local` as root and remove the &#039;#&#039; before this line: `auth       sufficient     pam_tid.so`&lt;br /&gt;
&lt;br /&gt;
== Kerberos authentication ==&lt;br /&gt;
See: [[Enroll Mac in Kerberos]]&lt;br /&gt;
&lt;br /&gt;
== Install MacPorts ==&lt;br /&gt;
Follow instructions here: https://www.macports.org/install.php&lt;br /&gt;
&lt;br /&gt;
== Use Bash as Shell ==&lt;br /&gt;
1. `chsh -s /bin/bash`&lt;br /&gt;
2. `echo &#039;export BASH_SILENCE_DEPRECATION_WARNING=1&#039; &amp;gt;&amp;gt; ~/.bash_profile`&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=508</id>
		<title>New Mac Setup</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=508"/>
		<updated>2025-01-21T14:07:01Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: Protected &amp;quot;New Mac Setup&amp;quot;: Contains command line examples ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of tweaks that are useful when setting up a new Mac.&lt;br /&gt;
&lt;br /&gt;
== Kerberos authentication ==&lt;br /&gt;
See: [[Enroll Mac in Kerberos]]&lt;br /&gt;
&lt;br /&gt;
== TouchID sudo ==&lt;br /&gt;
* Edit `/etc/pam.d/sudo_local` as root and remove the &#039;#&#039; before this line: `auth       sufficient     pam_tid.so`&lt;br /&gt;
&lt;br /&gt;
== Install MacPorts ==&lt;br /&gt;
Follow instructions here: https://www.macports.org/install.php&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=507</id>
		<title>New Mac Setup</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=507"/>
		<updated>2025-01-21T14:06:43Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of tweaks that are useful when setting up a new Mac.&lt;br /&gt;
&lt;br /&gt;
== Kerberos authentication ==&lt;br /&gt;
See: [[Enroll Mac in Kerberos]]&lt;br /&gt;
&lt;br /&gt;
== TouchID sudo ==&lt;br /&gt;
* Edit `/etc/pam.d/sudo_local` as root and remove the &#039;#&#039; before this line: `auth       sufficient     pam_tid.so`&lt;br /&gt;
&lt;br /&gt;
== Install MacPorts ==&lt;br /&gt;
Follow instructions here: https://www.macports.org/install.php&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=506</id>
		<title>New Mac Setup</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=New_Mac_Setup&amp;diff=506"/>
		<updated>2025-01-21T14:05:01Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: Created page with &amp;quot;This is a list of tweaks that are useful when setting up a new Mac.  == Kerberos authentication == See: Enroll Mac in Kerberos  == TouchID sudo == * Edit `/etc/pam.d/sudo_local` as root and remove the &amp;#039;#&amp;#039; before this line: `auth       sufficient     pam_tid.so`&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This is a list of tweaks that are useful when setting up a new Mac.&lt;br /&gt;
&lt;br /&gt;
== Kerberos authentication ==&lt;br /&gt;
See: [[Enroll Mac in Kerberos]]&lt;br /&gt;
&lt;br /&gt;
== TouchID sudo ==&lt;br /&gt;
* Edit `/etc/pam.d/sudo_local` as root and remove the &#039;#&#039; before this line: `auth       sufficient     pam_tid.so`&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Internal&amp;diff=505</id>
		<title>Internal</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Internal&amp;diff=505"/>
		<updated>2025-01-21T14:03:11Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: /* SRE */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Finance ==&lt;br /&gt;
&lt;br /&gt;
=== Exact ===&lt;br /&gt;
&lt;br /&gt;
* [[booking bonus|Booking bonus]]&lt;br /&gt;
* [[booking wages|Booking wages]]&lt;br /&gt;
* [[booking quarterly hosting invoice|Booking quarterly hosting invoice]]&lt;br /&gt;
* [[new receipt|Enter a new receipt]]&lt;br /&gt;
* [[reconciliation|Reconciliation of transaction]]&lt;br /&gt;
* [[invoicing|Send an invoice]]&lt;br /&gt;
* [[payment reminders|Send payment reminder]]&lt;br /&gt;
* [[invoice approval|Process for approving invoices (/filed receipts)]]&lt;br /&gt;
&lt;br /&gt;
=== Bunq ===&lt;br /&gt;
&lt;br /&gt;
* [[top up account|Top up expense account]]&lt;br /&gt;
&lt;br /&gt;
== Work Process ==&lt;br /&gt;
&lt;br /&gt;
* [[Definition of done|Definition of Done]]&lt;br /&gt;
* [[Incident Handling|Incident Handling]]&lt;br /&gt;
* [[SRE Maintenance|SRE Maintenance]]&lt;br /&gt;
&lt;br /&gt;
== Internal Process ==&lt;br /&gt;
* [[timetracking|Timetracking process]]&lt;br /&gt;
* [[Starting work for a new client]]&lt;br /&gt;
* [[12 percent|12% time]]&lt;br /&gt;
* [[Annual leave|Annual leave]]&lt;br /&gt;
* [[Bonus allocation|Bonus allocation]]&lt;br /&gt;
* [[Calamity leave|Calamity leave]]&lt;br /&gt;
* [[Overtime|Overtime]]&lt;br /&gt;
* [[Retrospectives|Retrospectives]]&lt;br /&gt;
* [[Sick leave|Sick leave]]&lt;br /&gt;
* [[Training and self-study|Training and Self-Study]]&lt;br /&gt;
* [[Daily|Daily]]&lt;br /&gt;
&lt;br /&gt;
== Projects ==&lt;br /&gt;
&lt;br /&gt;
* Era Inventory [[project_era_inventory_api|API Description]]&lt;br /&gt;
&lt;br /&gt;
== SRE ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To be further populated with guide from drive&#039;&#039;&lt;br /&gt;
* [[create gitlab runner host|Create a GitLab runner host]]&lt;br /&gt;
* [[vm setup|Create a (Debian) VM]]&lt;br /&gt;
* [[border update|Process for updating a border]]&lt;br /&gt;
* [[border reboot|Reboot border without downtime]]&lt;br /&gt;
* [[WS Proxmox node reboot|Reboot WS Proxmox node without downtime]]&lt;br /&gt;
* [[Resize VM Disk]]&lt;br /&gt;
* [[SRE tools]]&lt;br /&gt;
* [[Enroll Mac in Kerberos]]&lt;br /&gt;
* [[New Mac Setup]]&lt;br /&gt;
* [[Creating a VM on Hetzner]]&lt;br /&gt;
* [[Rebooting VM]]&lt;br /&gt;
* [[Rebooting Offsite]]&lt;br /&gt;
* [[ssh-fingerprints|Verifying SSH fingerprints]]&lt;br /&gt;
* [[Removing VM]]&lt;br /&gt;
* [[Install a new Disk in Server]]&lt;br /&gt;
* [[Setting Up Wildcard Subdomains with SSL on a Debian Application]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
&lt;br /&gt;
* [[stack|Greenfield stack]]&lt;br /&gt;
* [[standard tools|Standard Tools]]&lt;br /&gt;
* [[list of unfurl debuggers|List of unfurl debuggers]]&lt;br /&gt;
* [[Recommended suppliers]]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=504</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=504"/>
		<updated>2025-01-21T14:02:39Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This will make your laptop automatically log you in to IPA. Only do this on machines that are exclusively used by you!&lt;br /&gt;
&lt;br /&gt;
# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents. Make sure to replace &amp;lt;username&amp;gt; with your actual username!&lt;br /&gt;
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt&lt;br /&gt;
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA&lt;br /&gt;
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/laptop.key -out ~/Library/IPA/laptop.csr&lt;br /&gt;
# Go to your user in IPA&lt;br /&gt;
# Click on Actions &amp;gt; New Certificate&lt;br /&gt;
# CA = ipa&lt;br /&gt;
# Profile ID = caIPAserviceCert&lt;br /&gt;
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/laptop.csr&lt;br /&gt;
# Request the certificate&lt;br /&gt;
# Store the resulting certificate in ~/Library/IPA/laptop.crt&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Incident_Handling&amp;diff=491</id>
		<title>Incident Handling</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Incident_Handling&amp;diff=491"/>
		<updated>2024-11-22T11:20:34Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Zulip migration ==&lt;br /&gt;
Due to a migration to Zulip, the integration as was available on Mattermost is not available yet on Zulip. This leads to the following process changes:&lt;br /&gt;
* Acknowlegements and triggers resolving are not posted to Zulip by Zabbix&lt;br /&gt;
* Triggers are grouped in a topic on Zulip per host&lt;br /&gt;
* When an incident has been fully resolved, mark the topic as resolved, when any other incidents reported for the host are resolved&lt;br /&gt;
* There&#039;s no `?ongoing`, instead for now we can track open incidents by checking for unresolved topics&lt;br /&gt;
* The posting of incidents is less smart (only posting when not posted yet), so in order to prevent an incident from not being reported due to network issues or the likes, a message is posted after an inteval (8 hours for non-critical and lower, 1 hour for critical and above) while the incident has not been acknowleged.&lt;br /&gt;
* Incidents can be manually tracked by creating a topic by hand and reporting the problem.&lt;br /&gt;
* There is no automatic gitlab issue creation or syncing anymore.&lt;br /&gt;
&lt;br /&gt;
Finally, where this process says to do something on Mattermost, you should now do so on Zulip. The updates in the process chapters themselves are WIP.&lt;br /&gt;
&lt;br /&gt;
== Critical incidents ==&lt;br /&gt;
&#039;&#039;&#039;Critical incidents are resolved within 16 hours.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
As first responder you take on the responsiblity of seeing an incident resolved. This does not mean that you are the person required to do all the work. You can attempt to involve other to help you (often referred to as escalating the incident), but since other are not on-call, they are not obliged to help you, especially outside of normal working hours.&lt;br /&gt;
Involving multiple people can quickly be required if multiple critical incidents with different causes occur simultaniously. In that case, the First Responder usually takes on a more information management role and steers those that are brought on into resolving the issues. (Example: if a server crashes, several critical triggers can fire, but the underlying cause can quite quickly be determined to be a single issue, the crashed server. So you wouldn&#039;t need to call in people to manage each incident. But a client&#039;s service being down in one cluster while in a different cluster a different VM no longer boots is likely to be to different issues, so in order to resolve them on time you&#039;d want to call in help to resolve the incident in time).&lt;br /&gt;
&lt;br /&gt;
=== Process ===&lt;br /&gt;
The general process is made up of the folowing steps. Each step has additional information on how to handle/execute them in the sections below.&lt;br /&gt;
# Take responsibility for seeing the incident resolved&lt;br /&gt;
# Determine if incident is still ongoing&lt;br /&gt;
# If ongoing: Communicate to affected clients that the issue is being investigated&lt;br /&gt;
# Communicate plan/next steps (even if that is gathering information)&lt;br /&gt;
# Communicate findings/results of executed plan, go back to previous step if not resolved&lt;br /&gt;
# Resolve incident + cleanup&lt;br /&gt;
&lt;br /&gt;
During working on an incident it is expected that all communication is done in the incident&#039;s thread. This means all information to a problem can be found in a clear a predictable place. Sometimes an incident can be resolved by work done in another incident. In that case, it is required to post a link to that thread in the incident&#039;s thread with the comment that the resolution is done in that thread.&lt;br /&gt;
&lt;br /&gt;
==== Acknowledge the incident on Zabbix ====&lt;br /&gt;
The first step is to take responsibility for seeing the incident resolved by acknowledging the incident on Zabbix. Simply acknowledging the trigger suffices. It is however entirely possible that multiple critical incidents are firing at the same time. This can be a coincidence, or can be because of a share cause of failure. For example, a server crashing will cause server VM&#039; to reboot, or the router having an connectivity issue will lead to most other VM&#039;s having connectivity issues as well. If there are multiple critical incidents, it is advised to quickly observe what&#039;s ongoing, Zabbix is the best source of firing triggers for this, and pick the incident that is likely the root cause to  &lt;br /&gt;
&lt;br /&gt;
* Acknowledging an incident on Zabbix will stop Zabbix from calling the First Responder to notify them of the ongoing incident. And stops Zabbix from posting reminders on Zulip.&lt;br /&gt;
&lt;br /&gt;
==== Determine if incident is still ongoing ====&lt;br /&gt;
The next step is to check if the reported problem is still ongoing. Depending on the observations made here your process to follow and steps needed to resolve the incident can change. There are three options:&lt;br /&gt;
# The trigger resolved itself and the problem cannot be observed. Example: HTTPS is down for a site, but the FR can access the site through HTTPS without incident.&lt;br /&gt;
# The trigger resolved itself and the problem can still be observed.&lt;br /&gt;
# The trigger is still firing but the problem cannot be observed: Our triggers might not be perfect, so it could be that something else is causing it to fire. A simple example would be that Zabbix reports that the the DNS for a site can&#039;t be resolved, but in reality there&#039;s a bug in the script we wrote that checks if the DNS resolves and the DNS resolves fine. Final note: keep in mind that an &#039;it works on my machine&#039; does not necessarily mean it works for most other people, so depening on the trigger you need to do some evaluations if your tests suffice. &lt;br /&gt;
&lt;br /&gt;
In order to make sure you are actually trying to observe the same thing as the trigger is looking for, make sure to check the trigger definition and the current data of the associated item(s). Some triggers might fire if one of multiple conditions is met (Such as a trigger that monitors the ping response time firing if the value exceeds a certain threshold, or if no data for a certain period of time was observed).&lt;br /&gt;
&lt;br /&gt;
Make sure to report your findings in the incident&#039;s thread. It&#039;s advised to post a screenshot of the relevant item(s) and your own observations. (Continuing the ping example, you would post a screenshot of the relevant values, state your conclusion why the trigger is firing, and your own observations/pings)&lt;br /&gt;
&lt;br /&gt;
==== Communicate to affected clients ====&lt;br /&gt;
If the incident is still ongoing and the service is down, we need to communicate to affected clients that we are aware of the problem and that we are investigating it. This is because critical incident usually mean the service is down, something the clients can notice/are affected by, so we to be transparent that something is going on. There are some additional notes to this though:&lt;br /&gt;
* If an incident has already resolved itself and the problem is no longer observable, we don&#039;t communicate anything. Doing so might only cause confusion, and since the client has not reported any issues, they have not had a noticeable problem with it themselves.&lt;br /&gt;
* Although a critical incident generally means that the client service is down or experiencing reduced service, not all critical incidents are of that nature. Some are more administrative, or are only an issue for Delft Solutions itself. As of writing I don&#039;t have an exhaustive list, but here is those I can think of:&lt;br /&gt;
** SSH Service is down: We don&#039;t have any clients that SSH into their services, so it&#039;s generally not a problem. But SSH is mostly used for SRE maintenance and publishing new builds. The SRE maintenance is an internal problem, so no need to communicate to the client. The publishing is done to Kaboom, preventing new builds from being published, and the two SM VM&#039;s.&lt;br /&gt;
** No backup for x days: Clients don&#039;t notice it if a backup is running late, so no need to communicate with clients. Just need to make sure the backup gets completed&lt;br /&gt;
** SSL certificate is expiring in &amp;lt; 24 hours: This is a bit dependent on how soon this incident is being handled, but if it handled quickly, the certificate never actually expired, and there has not been any disruption to the client&#039;s service, so no need for communicating about it.&lt;br /&gt;
* Determining which clients are being affected can be done by looking at the host&#039;s DNS in the trigger, and/or looking up the VM in Proxmox and checking the tags of the VM&#039;s for client names. In the case that this issue is causing multiple other critical triggers to fire, you would have to check for which clients are affected by those incidents.&lt;br /&gt;
* Communicating to DS about ongoing incidents is usually assumed to be automaticly have been done by the fact that the incident was reported on Zulip.&lt;br /&gt;
&lt;br /&gt;
As always, report the decisions taken and actions maded in the incident thread. (e.g.: I&#039;ve sent a message in the Slack to let Kaboom know that we aware of problem x, and that we are investigating it)&lt;br /&gt;
&lt;br /&gt;
==== Communicate plan/next steps + Communicate findings/results of executed plan ====&lt;br /&gt;
This is the main part of handling an incident. There are several actions you can take in these steps, but at the basis they consist of sharing your next steps, performing those, and reporting the results. The reason all this needs to be reported is to ensure that all known information about a problem is logged, making it easier for someone else to be onboarded into the issue, for later reference if a similar issue is encountered, and even for use during the incident itself in case an older configuration needs to be referenced after you changed it.&lt;br /&gt;
The objective from these steps is determining what is actually wrong and how to resolve it. Depending on the observations made earlier on whether the incident is still ongoing and is (still) observable your investigation can go into different directions. (e.g. Find the underlying cause for a trigger, or determining why the trigger is firing while it likely shouldn&#039;t, and then how to resolve that underlying cause or how to update the trigger to work better)&lt;br /&gt;
&lt;br /&gt;
There are three main types of steps defined, but you are not limited to these:&lt;br /&gt;
# Hypothesis: If you have an idea what could be causing it, you would state your hypothesis and your next step would be to prove that hypothesis. For example, for an incident &#039;SSH service is down on X&#039; your hypothesis could be that this is due to &#039;MaxStartups&#039; throttling, which can be proven by &#039;grep&#039;ing journalctl for that, and compare the start and end times of throttling with the timestamps of the item reporting the status of the SSH service.&lt;br /&gt;
# Information gathering: Sometimes it just helps to get some facts about the situation collected. What is usefull information that is relevant depends on the triggers, but some examples are: The syslog/journalctl of the host from around the time of the incident (it can contain a reference to the an underlying problem in various levels of explicitness), the ping response from several hosts on the route to a host or a traceroute (this helps with networking issues). The gathered information is usually intended to help you come up with an hypothesis on what&#039;s wrong.&lt;br /&gt;
# Investigative: The most rigorous of process. The full process is described here originally [https://docs.google.com/document/d/1AQYJM1Q9l2Tyk6zfCVaQ2aEq-dpbfUH5okE88bpKkhw/edit#heading=h.5fq2skijqbdc Drive - Final Coundown - General Investigative Process]. To summarize, when you don&#039;t know why something is failing, and/or don&#039;t have any decent hypotheses to follow up, you can follow this process to systematicly find the problem.&lt;br /&gt;
&lt;br /&gt;
Regarding the resolution to an incident: The resolution to any incident is usually one of two things:&lt;br /&gt;
# Fix the underlying problem.&lt;br /&gt;
# Fix the trigger itself.&lt;br /&gt;
Fixing the trigger is relavively straightforward, but do make sure document in the thread what you changed to which trigger.&lt;br /&gt;
Fixing the underlying problem can be more complex. A trade-off needs to be made sometimes between resolving technical debt, or simply patching the current system to resolve the issue. We usually look for a resolution that ensures that the problem won&#039;t re-occur soon, or makes it unexpected/unlikely for the problem to re-occur. Taking into account the timeframe that is available to resolve the incident you can make some trade-offs. An example would be: normal backups of VM&#039;s are failing due to the Proxmox backup server being down/unreachable and it is determined that this cannot be resolved at that moment. We can set up automatic backups to local storage temporary to resolve the immediate problem and ensure we keep our SLO&#039;s versus setting up a new Proxmox Backup server at a different location. Since we don&#039;t have much time to resolve the problem, the resolution would be to set up the automatic backups to local storage, and set up a new Proxmox Backup Server later as a seperate issue.&lt;br /&gt;
&lt;br /&gt;
Some know issues and their resolutions:&lt;br /&gt;
* SSH service is down: The internet is a vile place. There&#039;s constant port scanning and hacking attempts ongoing to any machine connected to the internet (mostly IPv4). Due to this, SSH has a throttling functionality build in to prevent a system from being DDOS&#039;ed by the amount of malicious SSH requests. This throttling can cause the Zabbix server from being denied an SSH connection, of which several failures fire this trigger. This hypothesis can be proven with a `journalctl -u ssh | grep &#039;MaxStartupsThrottling&#039;` (you probably want to select a relevant time period with `--since &amp;quot;2 hours ago&amp;quot;` or something similar to prevent having to process a month of logging). You can then compare the throttling start and end times with the timestamps of the item data itself. The resolution for the issue is to add our custom ssh configuration [https://chat.dsinternal.net/#narrow/stream/23-SRE---General/topic/DS.20Whitelisted.20Custom.20SSH.20configuration/near/1620 Custom SSH Configuration].&lt;br /&gt;
* No backup for 3 days: Are S3 backup is very slow. Not much to prove as an underlying issue here. What needs to be done is check that the backup process is ongoing. The Zabbix latest data can be checked to verify that backups are running by checking that that days backups were done for the smaller buckets. The devteam email can be checked for if the backup process could not start on day due to it already running (it takes 24+ hours, and an attempt to start it is done each day by cron).&lt;br /&gt;
* git.* HTTPS is down: On Sunday mostly, Gitlab gets automaticly updated, but this incurs some downtime as the service is restarted. This is usually short enough to not be reported to Zulip as per our settings, but sometimes it&#039;s longer. If the service does not stay down, the issue can be just resolved.&lt;br /&gt;
&lt;br /&gt;
==== Resolve incident + cleanup ====&lt;br /&gt;
When you&#039;ve executed and verified the resolution in the previous steps we can proceed resolving the issue in our Mattermost integration. Resolving an incident can be done by doing the following:&lt;br /&gt;
# Verify that the trigger is no longer firing. An incident will be immediatly re-opened if the trigger is still firing, and the incident cannot be considered resolved if the trigger is still firing. If the trigger is still firing but you&#039;re sure that you&#039;ve resolved the problem, you might need to force the item the trigger depends on to update. This can be done by finding the item in the host&#039;s configuration on Zabbix and selecting &#039;Execute Now&#039;, after a short period this should force Zabbix to re-execute the item. You can check the timestamps in the latest data of an item to check if it was updated.&lt;br /&gt;
# Close the incident by marking the topic as resolved, when there are no other triggers firing for the host.&lt;br /&gt;
&lt;br /&gt;
Unfortunatly, some problems cause multiple critical and non-critical triggers to fire. This means we have to check Zabbix and Zulip for other fired triggers and ongoing incidents. The goal is to identify critical and non-critical incidents that were caused by the incident/underlying issue you just resolved.&lt;br /&gt;
# First, these incidents need to be acknowledged on Zabbix, and in the acknowledgement message you mention the incident/problem that caused this.&lt;br /&gt;
# Next, check the incident tracked by the integration on Mattermost using the `?ongoing` command. Resolve incidents that were (re-)opened by this incident by executing the following steps. If the first two fail (problem still persists, trigger is still firing), the incident needs to considered it&#039;s own issue and the relevant process needs to be followed (critical or non-critical depending on criticality).&lt;br /&gt;
## Ensuring the mentioned problem is no longer observable&lt;br /&gt;
## The trigger has resolved (You might need to force an update with `Execute Now`).&lt;br /&gt;
## Posting a link to the main incident you resolved with the comment that the underlying problem was resolved in that topic.&lt;br /&gt;
## Closing the incident by marking the topic as resolved, when there are no other triggers firing for the host.&lt;br /&gt;
&lt;br /&gt;
When you are done, there should be no more critical triggers firing in Zabbix or open in the Zabbix-Mattermost intergration, for which no-one has taken responsibility or you have taken responsibility for and are not actively handling.&lt;br /&gt;
&lt;br /&gt;
===Additional context===&lt;br /&gt;
* Critical incidents are posted in [https://chat.dsinternal.net/#narrow/stream/24-SRE-.23-Critical &#039;&#039;&#039;SLA - Critical&#039;&#039;&#039;].&lt;br /&gt;
* &amp;lt;s&amp;gt;When it is being tracked on GitLab a heavy check mark is added to the message.&amp;lt;/s&amp;gt;&lt;br /&gt;
* &amp;lt;s&amp;gt;Responses on the thread and on GitLab are automatically synced (to some extend)&amp;lt;/s&amp;gt;&lt;br /&gt;
* &amp;lt;s&amp;gt;When you reply with &#039;&#039;&#039;I agree that this has been fully resolved&#039;&#039;&#039; eventually our Zabbix-Mattermost integration will pick this up and a green check mark is added to the message.&amp;lt;/s&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Non-Critical incidents ==&lt;br /&gt;
* Non-critical incidents are acknowledged within 9 hours and resolved within one week.&lt;br /&gt;
&lt;br /&gt;
=== Acknowledging ===&lt;br /&gt;
Fully acknowledging a non-critical incident requires the following tasks to have been completed:&lt;br /&gt;
* Acknowledging the incident on Zabbix&lt;br /&gt;
* Add the non-critical incident as a milestone in the metrics sheet&lt;br /&gt;
** Start date is the date of the incident&lt;br /&gt;
** DoD states what needs to be true for the non-critical incident to be consider resolved&lt;br /&gt;
* Add the non-critical incident to Lynx as a project&lt;br /&gt;
** Tasks need to be added&lt;br /&gt;
** Final tasks needs to have the SLO deadline set as &#039;contraint&#039;&lt;br /&gt;
** Project priority is set to 20 (as a default)&lt;br /&gt;
** The tasks are estimated for SP&lt;br /&gt;
* The Lynx project ID is reported in the non-critical incident&#039;s topic on Zulip&lt;br /&gt;
* A Kimai activity is created in Kimai for the non-critical incident&lt;br /&gt;
&lt;br /&gt;
Checklist (outdated)&lt;br /&gt;
# Acknowledge on Zabbix and state who is responsible for resolving this in the description&lt;br /&gt;
# Communicate plan/next steps (even if that is gathering information)&lt;br /&gt;
# Communicate findings/results of executed plan, go back to previous step if not resolved&lt;br /&gt;
# If there is no resolution to the incident, evaluate if the trigger needs updating/disabling&lt;br /&gt;
# Resolve incident&lt;br /&gt;
&lt;br /&gt;
== Informational incidents ==&lt;br /&gt;
* Informational incidents are acknowledged within 72 hours&lt;br /&gt;
&lt;br /&gt;
Checklist&lt;br /&gt;
# Acknowledge on Zabbix&lt;br /&gt;
# Sanity check the event, post result in thread&lt;br /&gt;
# If action needed, perform action&lt;br /&gt;
&lt;br /&gt;
== If an incident is reported by other means than the Zabbix-Zulip intergration ==&lt;br /&gt;
# Acknowledge receipt.&lt;br /&gt;
# Classify the incident as critical, non-critical, or informational.&lt;br /&gt;
# Create an topic in the relevant SRE channel, stating the problem and that you is responsible for resolving it.&lt;br /&gt;
# Proceed to treat the incident according to the criticality you just classified it as. (So for a critical incident, it means you now start the critical incident handling process)&lt;br /&gt;
&lt;br /&gt;
== Handover ==&lt;br /&gt;
When handing over the responsibility of &#039;&#039;&#039;first responder&#039;&#039;&#039; (FR), the following needs to happen:&lt;br /&gt;
* The handover can be initiated by both the upcoming FR or the acting FR&lt;br /&gt;
* Acting FR adds the upcoming FR the the IPA sla-first-responder user group and enables Zabbix calling for that the upcoming FR if they have that set by going to Zabbix &amp;gt; Configuration &amp;gt; Actions &amp;gt; [https://status.delftinfra.net/zabbix/actionconf.php?eventsource=0# Trigger actions]&lt;br /&gt;
* The upcoming FR makes sure they are aware of the state of the SLA and knows what questions they wants to ask the acting FR.&lt;br /&gt;
* The upcoming FR makes sure they are subscribed to the right channels.&lt;br /&gt;
&lt;br /&gt;
The following steps can be done async or in person:&lt;br /&gt;
* The acting FR announces/informs the upcoming FR has been added to the sla-first-responder group (In Zulip&#039;s [https://chat.dsinternal.net/#narrow/stream/13-Organisational Organisational channel] if asynq).&lt;br /&gt;
* If the acting FR wants to hand over responsibility for any ongoing incident they also state which incidents they want the upcoming FR to take over.&lt;br /&gt;
* If there are any particularities the upcoming FR needs to be aware of, those are shared.&lt;br /&gt;
* The upcoming FR asks their questions until they are satisfied and able to take over the FR&lt;br /&gt;
* The upcoming FR ensures they are subscribed to the following channels on Zulip: [https://chat.dsinternal.net/#narrow/stream/23-SRE---General SRE - General], [https://chat.dsinternal.net/#narrow/stream/24-SRE-.23-Critical SRE # Critical] and if part of the SRE team [https://chat.dsinternal.net/#streams/4/SRE%20##%20Non-critical SRE ## Non-Critical] and [https://chat.dsinternal.net/#streams/5/SRE%20###%20Informational SRE ### Informational].&lt;br /&gt;
* The upcoming FR announces/informs that they are now the acting FR over Zulip&#039;s [https://chat.dsinternal.net/#narrow/stream/13-Organisational Organisational channel]&lt;br /&gt;
* The now acting FR removes the previous FR from IPA the sla-first-responder user group and disables Zabbix calling for the previous FR if they had that enabled by going to Zabbix &amp;gt; Configuration &amp;gt; Actions &amp;gt; [https://status.delftinfra.net/zabbix/actionconf.php?eventsource=0# Trigger actions]&lt;br /&gt;
&lt;br /&gt;
===Checklist for Handing Over First Responder (FR) Responsibilities===&lt;br /&gt;
&lt;br /&gt;
When transferring the role of First Responder (FR), follow these steps:&lt;br /&gt;
&lt;br /&gt;
1. Initiate the Handover:&lt;br /&gt;
   - Acting FR or Upcoming FR*: Initiate the handover process.&lt;br /&gt;
&lt;br /&gt;
2. Add Upcoming FR to User Group and Enable Zabbix Calling:&lt;br /&gt;
   - Acting FR:&lt;br /&gt;
     - Add the upcoming FR to the IPA `sla-first-responder` user group.&lt;br /&gt;
     - Enable Zabbix calling for the upcoming FR (if applicable) by navigating to:&lt;br /&gt;
       - Zabbix&amp;gt; Configuration &amp;gt; Actions &amp;gt; [Trigger actions](https://status.delftinfra.net/zabbix/actionconf.php?eventsource=0#).&lt;br /&gt;
&lt;br /&gt;
3. Announce Addition to User Group:&lt;br /&gt;
   - Acting FR:&lt;br /&gt;
     - Inform the upcoming FR that they have been added to the `sla-first-responder` group.&lt;br /&gt;
     - If communicating asynchronously, announce this in Zulip&#039;s [Organisational channel](https://chat.dsinternal.net/#narrow/stream/13-Organisational).&lt;br /&gt;
&lt;br /&gt;
4. Communicate Ongoing Incidents and Particularities:&lt;br /&gt;
   - Acting FR:&lt;br /&gt;
     - Share details of any ongoing incidents to be handed over.&lt;br /&gt;
     - Inform the upcoming FR of any specific details they need to be aware of.&lt;br /&gt;
&lt;br /&gt;
5. Review SLA State and Prepare Questions:&lt;br /&gt;
   - Upcoming FR:&lt;br /&gt;
      - Familiarize yourself with the current state of the SLA.&lt;br /&gt;
      - Prepare any questions for the acting FR.&lt;br /&gt;
&lt;br /&gt;
6. Clarify and Confirm Understanding:&lt;br /&gt;
   - Upcoming FR:&lt;br /&gt;
     - Ask all necessary questions until you are confident in taking over the FR role.&lt;br /&gt;
&lt;br /&gt;
7. Subscribe to Relevant Zulip Channels:&lt;br /&gt;
   - Upcoming FR:&lt;br /&gt;
     - Subscribe to the following channels:&lt;br /&gt;
       - [SRE - General](https://chat.dsinternal.net/#narrow/stream/23-SRE---General)&lt;br /&gt;
       - [SRE # Critical](https://chat.dsinternal.net/#narrow/stream/24-SRE-.23-Critical)&lt;br /&gt;
     - If part of the SRE team, also subscribe to:&lt;br /&gt;
       - [SRE ## Non-Critical](https://chat.dsinternal.net/#streams/4/SRE%20##%20Non-critical)&lt;br /&gt;
       - [SRE ### Informational](https://chat.dsinternal.net/#streams/5/SRE%20###%20Informational)&lt;br /&gt;
&lt;br /&gt;
8. Announce Acceptance of FR Role:&lt;br /&gt;
   - Upcoming FR (now Acting FR):&lt;br /&gt;
     - Announce that you are now the acting FR in Zulip&#039;s [Organisational channel](https://chat.dsinternal.net/#narrow/stream/13-Organisational).&lt;br /&gt;
&lt;br /&gt;
9. Remove Previous FR from User Group and Disable Zabbix Calling:&lt;br /&gt;
   - Now Acting FR:&lt;br /&gt;
     - Remove the previous FR from the IPA `sla-first-responder` user group.&lt;br /&gt;
     - Disable Zabbix calling for the previous FR by navigating to:&lt;br /&gt;
       - Zabbix&amp;gt; Configuration &amp;gt; Actions &amp;gt; [Trigger actions](https://status.delftinfra.net/zabbix/actionconf.php?eventsource=0#).&lt;br /&gt;
     - Ensure the previous FR&#039;s phone number is disabled in Zabbix calling settings.&lt;br /&gt;
&lt;br /&gt;
10. Confirm Completion of Handover:&lt;br /&gt;
    - Now Acting FR:&lt;br /&gt;
      - Verify that all steps have been completed and the handover is fully executed.&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Incident_Handling&amp;diff=490</id>
		<title>Incident Handling</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Incident_Handling&amp;diff=490"/>
		<updated>2024-11-21T15:12:23Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Zulip migration ==&lt;br /&gt;
Due to a migration to Zulip, the integration as was available on Mattermost is not available yet on Zulip. This leads to the following process changes:&lt;br /&gt;
* Acknowlegements and triggers resolving are not posted to Zulip by Zabbix&lt;br /&gt;
* Triggers are grouped in a topic on Zulip per host&lt;br /&gt;
* When an incident has been fully resolved, mark the topic as resolved, when any other incidents reported for the host are resolved&lt;br /&gt;
* There&#039;s no `?ongoing`, instead for now we can track open incidents by checking for unresolved topics&lt;br /&gt;
* The posting of incidents is less smart (only posting when not posted yet), so in order to prevent an incident from not being reported due to network issues or the likes, a message is posted after an inteval (8 hours for non-critical and lower, 1 hour for critical and above) while the incident has not been acknowleged.&lt;br /&gt;
* Incidents can be manually tracked by creating a topic by hand and reporting the problem&lt;br /&gt;
* There is no automatic gitlab issue creation or syncing anymore.&lt;br /&gt;
&lt;br /&gt;
Finally, where this process says to do something on Mattermost, you should now do so on Zulip. The updates in the process chapters themselves are WIP.&lt;br /&gt;
&lt;br /&gt;
== Critical incidents ==&lt;br /&gt;
&#039;&#039;&#039;Critical incidents are resolved within 16 hours.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
As first responder you take on the responsiblity of seeing an incident resolved. This does not mean that you are the person required to do all the work. You can attempt to involve other to help you (often referred to as escalating the incident), but since other are not on-call, they are not obliged to help you, especially outside of normal working hours.&lt;br /&gt;
Involving multiple people can quickly be required if multiple critical incidents with different causes occur simultaniously. In that case, the First Responder usually takes on a more information management role and steers those that are brought on into resolving the issues. (Example: if a server crashes, several critical triggers can fire, but the underlying cause can quite quickly be determined to be a single issue, the crashed server. So you wouldn&#039;t need to call in people to manage each incident. But a client&#039;s service being down in one cluster while in a different cluster a different VM no longer boots is likely to be to different issues, so in order to resolve them on time you&#039;d want to call in help to resolve the incident in time).&lt;br /&gt;
&lt;br /&gt;
=== Process ===&lt;br /&gt;
The general process is made up of the folowing steps. Each step has additional information on how to handle/execute them in the sections below.&lt;br /&gt;
# Take responsibility for seeing the incident resolved&lt;br /&gt;
# Determine if incident is still ongoing&lt;br /&gt;
# If ongoing: Communicate to affected clients that the issue is being investigated&lt;br /&gt;
# Communicate plan/next steps (even if that is gathering information)&lt;br /&gt;
# Communicate findings/results of executed plan, go back to previous step if not resolved&lt;br /&gt;
# Resolve incident + cleanup&lt;br /&gt;
&lt;br /&gt;
During working on an incident it is expected that all communication is done in the incident&#039;s thread. This means all information to a problem can be found in a clear a predictable place. Sometimes an incident can be resolved by work done in another incident. In that case, it is required to post a link to that thread in the incident&#039;s thread with the comment that the resolution is done in that thread.&lt;br /&gt;
&lt;br /&gt;
==== Acknowledge the incident on Zabbix ====&lt;br /&gt;
The first step is to take responsibility for seeing the incident resolved by acknowledging the incident on Zabbix. Simply acknowledging the trigger suffices. It is however entirely possible that multiple critical incidents are firing at the same time. This can be a coincidence, or can be because of a share cause of failure. For example, a server crashing will cause server VM&#039; to reboot, or the router having an connectivity issue will lead to most other VM&#039;s having connectivity issues as well. If there are multiple critical incidents, it is advised to quickly observe what&#039;s ongoing, Zabbix is the best source of firing triggers for this, and pick the incident that is likely the root cause to  &lt;br /&gt;
&lt;br /&gt;
* Acknowledging an incident on Zabbix will stop Zabbix from calling the First Responder to notify them of the ongoing incident. And stops Zabbix from posting reminders on Zulip.&lt;br /&gt;
&lt;br /&gt;
==== Determine if incident is still ongoing ====&lt;br /&gt;
The next step is to check if the reported problem is still ongoing. Depending on the observations made here your process to follow and steps needed to resolve the incident can change. There are three options:&lt;br /&gt;
# The trigger resolved itself and the problem cannot be observed. Example: HTTPS is down for a site, but the FR can access the site through HTTPS without incident.&lt;br /&gt;
# The trigger resolved itself and the problem can still be observed.&lt;br /&gt;
# The trigger is still firing but the problem cannot be observed: Our triggers might not be perfect, so it could be that something else is causing it to fire. A simple example would be that Zabbix reports that the the DNS for a site can&#039;t be resolved, but in reality there&#039;s a bug in the script we wrote that checks if the DNS resolves and the DNS resolves fine. Final note: keep in mind that an &#039;it works on my machine&#039; does not necessarily mean it works for most other people, so depening on the trigger you need to do some evaluations if your tests suffice. &lt;br /&gt;
&lt;br /&gt;
In order to make sure you are actually trying to observe the same thing as the trigger is looking for, make sure to check the trigger definition and the current data of the associated item(s). Some triggers might fire if one of multiple conditions is met (Such as a trigger that monitors the ping response time firing if the value exceeds a certain threshold, or if no data for a certain period of time was observed).&lt;br /&gt;
&lt;br /&gt;
Make sure to report your findings in the incident&#039;s thread. It&#039;s advised to post a screenshot of the relevant item(s) and your own observations. (Continuing the ping example, you would post a screenshot of the relevant values, state your conclusion why the trigger is firing, and your own observations/pings)&lt;br /&gt;
&lt;br /&gt;
==== Communicate to affected clients ====&lt;br /&gt;
If the incident is still ongoing and the service is down, we need to communicate to affected clients that we are aware of the problem and that we are investigating it. This is because critical incident usually mean the service is down, something the clients can notice/are affected by, so we to be transparent that something is going on. There are some additional notes to this though:&lt;br /&gt;
* If an incident has already resolved itself and the problem is no longer observable, we don&#039;t communicate anything. Doing so might only cause confusion, and since the client has not reported any issues, they have not had a noticeable problem with it themselves.&lt;br /&gt;
* Although a critical incident generally means that the client service is down or experiencing reduced service, not all critical incidents are of that nature. Some are more administrative, or are only an issue for Delft Solutions itself. As of writing I don&#039;t have an exhaustive list, but here is those I can think of:&lt;br /&gt;
** SSH Service is down: We don&#039;t have any clients that SSH into their services, so it&#039;s generally not a problem. But SSH is mostly used for SRE maintenance and publishing new builds. The SRE maintenance is an internal problem, so no need to communicate to the client. The publishing is done to Kaboom, preventing new builds from being published, and the two SM VM&#039;s.&lt;br /&gt;
** No backup for x days: Clients don&#039;t notice it if a backup is running late, so no need to communicate with clients. Just need to make sure the backup gets completed&lt;br /&gt;
** SSL certificate is expiring in &amp;lt; 24 hours: This is a bit dependent on how soon this incident is being handled, but if it handled quickly, the certificate never actually expired, and there has not been any disruption to the client&#039;s service, so no need for communicating about it.&lt;br /&gt;
* Determining which clients are being affected can be done by looking at the host&#039;s DNS in the trigger, and/or looking up the VM in Proxmox and checking the tags of the VM&#039;s for client names. In the case that this issue is causing multiple other critical triggers to fire, you would have to check for which clients are affected by those incidents.&lt;br /&gt;
* Communicating to DS about ongoing incidents is usually assumed to be automaticly have been done by the fact that the incident was reported on Zulip.&lt;br /&gt;
&lt;br /&gt;
As always, report the decisions taken and actions maded in the incident thread. (e.g.: I&#039;ve sent a message in the Slack to let Kaboom know that we aware of problem x, and that we are investigating it)&lt;br /&gt;
&lt;br /&gt;
==== Communicate plan/next steps + Communicate findings/results of executed plan ====&lt;br /&gt;
This is the main part of handling an incident. There are several actions you can take in these steps, but at the basis they consist of sharing your next steps, performing those, and reporting the results. The reason all this needs to be reported is to ensure that all known information about a problem is logged, making it easier for someone else to be onboarded into the issue, for later reference if a similar issue is encountered, and even for use during the incident itself in case an older configuration needs to be referenced after you changed it.&lt;br /&gt;
The objective from these steps is determining what is actually wrong and how to resolve it. Depending on the observations made earlier on whether the incident is still ongoing and is (still) observable your investigation can go into different directions. (e.g. Find the underlying cause for a trigger, or determining why the trigger is firing while it likely shouldn&#039;t, and then how to resolve that underlying cause or how to update the trigger to work better)&lt;br /&gt;
&lt;br /&gt;
There are three main types of steps defined, but you are not limited to these:&lt;br /&gt;
# Hypothesis: If you have an idea what could be causing it, you would state your hypothesis and your next step would be to prove that hypothesis. For example, for an incident &#039;SSH service is down on X&#039; your hypothesis could be that this is due to &#039;MaxStartups&#039; throttling, which can be proven by &#039;grep&#039;ing journalctl for that, and compare the start and end times of throttling with the timestamps of the item reporting the status of the SSH service.&lt;br /&gt;
# Information gathering: Sometimes it just helps to get some facts about the situation collected. What is usefull information that is relevant depends on the triggers, but some examples are: The syslog/journalctl of the host from around the time of the incident (it can contain a reference to the an underlying problem in various levels of explicitness), the ping response from several hosts on the route to a host or a traceroute (this helps with networking issues). The gathered information is usually intended to help you come up with an hypothesis on what&#039;s wrong.&lt;br /&gt;
# Investigative: The most rigorous of process. The full process is described here originally [https://docs.google.com/document/d/1AQYJM1Q9l2Tyk6zfCVaQ2aEq-dpbfUH5okE88bpKkhw/edit#heading=h.5fq2skijqbdc Drive - Final Coundown - General Investigative Process]. To summarize, when you don&#039;t know why something is failing, and/or don&#039;t have any decent hypotheses to follow up, you can follow this process to systematicly find the problem.&lt;br /&gt;
&lt;br /&gt;
Regarding the resolution to an incident: The resolution to any incident is usually one of two things:&lt;br /&gt;
# Fix the underlying problem.&lt;br /&gt;
# Fix the trigger itself.&lt;br /&gt;
Fixing the trigger is relavively straightforward, but do make sure document in the thread what you changed to which trigger.&lt;br /&gt;
Fixing the underlying problem can be more complex. A trade-off needs to be made sometimes between resolving technical debt, or simply patching the current system to resolve the issue. We usually look for a resolution that ensures that the problem won&#039;t re-occur soon, or makes it unexpected/unlikely for the problem to re-occur. Taking into account the timeframe that is available to resolve the incident you can make some trade-offs. An example would be: normal backups of VM&#039;s are failing due to the Proxmox backup server being down/unreachable and it is determined that this cannot be resolved at that moment. We can set up automatic backups to local storage temporary to resolve the immediate problem and ensure we keep our SLO&#039;s versus setting up a new Proxmox Backup server at a different location. Since we don&#039;t have much time to resolve the problem, the resolution would be to set up the automatic backups to local storage, and set up a new Proxmox Backup Server later as a seperate issue.&lt;br /&gt;
&lt;br /&gt;
Some know issues and their resolutions:&lt;br /&gt;
* SSH service is down: The internet is a vile place. There&#039;s constant port scanning and hacking attempts ongoing to any machine connected to the internet (mostly IPv4). Due to this, SSH has a throttling functionality build in to prevent a system from being DDOS&#039;ed by the amount of malicious SSH requests. This throttling can cause the Zabbix server from being denied an SSH connection, of which several failures fire this trigger. This hypothesis can be proven with a `journalctl -u ssh | grep &#039;MaxStartupsThrottling&#039;` (you probably want to select a relevant time period with `--since &amp;quot;2 hours ago&amp;quot;` or something similar to prevent having to process a month of logging). You can then compare the throttling start and end times with the timestamps of the item data itself. The resolution for the issue is to add our custom ssh configuration [https://chat.dsinternal.net/#narrow/stream/23-SRE---General/topic/DS.20Whitelisted.20Custom.20SSH.20configuration/near/1620 Custom SSH Configuration].&lt;br /&gt;
* No backup for 3 days: Are S3 backup is very slow. Not much to prove as an underlying issue here. What needs to be done is check that the backup process is ongoing. The Zabbix latest data can be checked to verify that backups are running by checking that that days backups were done for the smaller buckets. The devteam email can be checked for if the backup process could not start on day due to it already running (it takes 24+ hours, and an attempt to start it is done each day by cron).&lt;br /&gt;
* git.* HTTPS is down: On Sunday mostly, Gitlab gets automaticly updated, but this incurs some downtime as the service is restarted. This is usually short enough to not be reported to Zulip as per our settings, but sometimes it&#039;s longer. If the service does not stay down, the issue can be just resolved.&lt;br /&gt;
&lt;br /&gt;
==== Resolve incident + cleanup ====&lt;br /&gt;
When you&#039;ve executed and verified the resolution in the previous steps we can proceed resolving the issue in our Mattermost integration. Resolving an incident can be done by doing the following:&lt;br /&gt;
# Verify that the trigger is no longer firing. An incident will be immediatly re-opened if the trigger is still firing, and the incident cannot be considered resolved if the trigger is still firing. If the trigger is still firing but you&#039;re sure that you&#039;ve resolved the problem, you might need to force the item the trigger depends on to update. This can be done by finding the item in the host&#039;s configuration on Zabbix and selecting &#039;Execute Now&#039;, after a short period this should force Zabbix to re-execute the item. You can check the timestamps in the latest data of an item to check if it was updated.&lt;br /&gt;
# Close the incident by marking the topic as resolved, when there are no other triggers firing for the host.&lt;br /&gt;
&lt;br /&gt;
Unfortunatly, some problems cause multiple critical and non-critical triggers to fire. This means we have to check Zabbix and Zulip for other fired triggers and ongoing incidents. The goal is to identify critical and non-critical incidents that were caused by the incident/underlying issue you just resolved.&lt;br /&gt;
# First, these incidents need to be acknowledged on Zabbix, and in the acknowledgement message you mention the incident/problem that caused this.&lt;br /&gt;
# Next, check the incident tracked by the integration on Mattermost using the `?ongoing` command. Resolve incidents that were (re-)opened by this incident by executing the following steps. If the first two fail (problem still persists, trigger is still firing), the incident needs to considered it&#039;s own issue and the relevant process needs to be followed (critical or non-critical depending on criticality).&lt;br /&gt;
## Ensuring the mentioned problem is no longer observable&lt;br /&gt;
## The trigger has resolved (You might need to force an update with `Execute Now`).&lt;br /&gt;
## Posting a link to the main incident you resolved with the comment that the underlying problem was resolved in that topic.&lt;br /&gt;
## Closing the incident by marking the topic as resolved, when there are no other triggers firing for the host.&lt;br /&gt;
&lt;br /&gt;
When you are done, there should be no more critical triggers firing in Zabbix or open in the Zabbix-Mattermost intergration, for which no-one has taken responsibility or you have taken responsibility for and are not actively handling.&lt;br /&gt;
&lt;br /&gt;
===Additional context===&lt;br /&gt;
* Critical incidents are posted in [https://chat.dsinternal.net/#narrow/stream/24-SRE-.23-Critical &#039;&#039;&#039;SLA - Critical&#039;&#039;&#039;].&lt;br /&gt;
* &amp;lt;s&amp;gt;When it is being tracked on GitLab a heavy check mark is added to the message.&amp;lt;/s&amp;gt;&lt;br /&gt;
* &amp;lt;s&amp;gt;Responses on the thread and on GitLab are automatically synced (to some extend)&amp;lt;/s&amp;gt;&lt;br /&gt;
* &amp;lt;s&amp;gt;When you reply with &#039;&#039;&#039;I agree that this has been fully resolved&#039;&#039;&#039; eventually our Zabbix-Mattermost integration will pick this up and a green check mark is added to the message.&amp;lt;/s&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Non-Critical incidents ==&lt;br /&gt;
* Non-critical incidents are acknowledged within 9 hours and resolved within one week.&lt;br /&gt;
&lt;br /&gt;
=== Acknowledging ===&lt;br /&gt;
Fully acknowledging a non-critical incident requires the following tasks to have been completed:&lt;br /&gt;
* Acknowledging the incident on Zabbix&lt;br /&gt;
* Add the non-critical incident as a milestone in the metrics sheet&lt;br /&gt;
** Start date is the date of the incident&lt;br /&gt;
** DoD states what needs to be true for the non-critical incident to be consider resolved&lt;br /&gt;
* Add the non-critical incident to Lynx as a project&lt;br /&gt;
** Tasks need to be added&lt;br /&gt;
** Final tasks needs to have the SLO deadline set as &#039;contraint&#039;&lt;br /&gt;
** Project priority is set to 20 (as a default)&lt;br /&gt;
** The tasks are estimated for SP&lt;br /&gt;
* The Lynx project ID is reported in the non-critical incident&#039;s topic on Zulip&lt;br /&gt;
* A Kimai activity is created in Kimai for the non-critical incident&lt;br /&gt;
&lt;br /&gt;
Checklist (outdated)&lt;br /&gt;
# Acknowledge on Zabbix and state who is responsible for resolving this in the description&lt;br /&gt;
# Communicate plan/next steps (even if that is gathering information)&lt;br /&gt;
# Communicate findings/results of executed plan, go back to previous step if not resolved&lt;br /&gt;
# If there is no resolution to the incident, evaluate if the trigger needs updating/disabling&lt;br /&gt;
# Resolve incident&lt;br /&gt;
&lt;br /&gt;
== Informational incidents ==&lt;br /&gt;
* Informational incidents are acknowledged within 72 hours&lt;br /&gt;
&lt;br /&gt;
Checklist&lt;br /&gt;
# Acknowledge on Zabbix&lt;br /&gt;
# Sanity check the event, post result in thread&lt;br /&gt;
# If action needed, perform action&lt;br /&gt;
&lt;br /&gt;
== If an incident is reported by other means than the Zabbix-Zulip intergration ==&lt;br /&gt;
# Acknowledge receipt.&lt;br /&gt;
# Classify the incident as critical, non-critical, or informational.&lt;br /&gt;
# Create an topic in the relevant SRE channel, stating the problem and that you is responsible for resolving it.&lt;br /&gt;
# Proceed to treat the incident according to the criticality you just classified it as. (So for a critical incident, it means you now start the critical incident handling process)&lt;br /&gt;
&lt;br /&gt;
== Handover ==&lt;br /&gt;
When handing over the responsibility of &#039;&#039;&#039;first responder&#039;&#039;&#039; (FR), the following needs to happen:&lt;br /&gt;
* The handover can be initiated by both the upcoming FR or the acting FR&lt;br /&gt;
* Acting FR adds the upcoming FR the the IPA sla-first-responder user group and enables Zabbix calling for that the upcoming FR if they have that set by going to Zabbix &amp;gt; Configuration &amp;gt; Actions &amp;gt; [https://status.delftinfra.net/zabbix/actionconf.php?eventsource=0# Trigger actions]&lt;br /&gt;
* The upcoming FR makes sure they are aware of the state of the SLA and knows what questions they wants to ask the acting FR.&lt;br /&gt;
* The upcoming FR makes sure they are subscribed to the right channels.&lt;br /&gt;
&lt;br /&gt;
The following steps can be done async or in person:&lt;br /&gt;
* The acting FR announces/informs the upcoming FR has been added to the sla-first-responder group (In Zulip&#039;s [https://chat.dsinternal.net/#narrow/stream/13-Organisational Organisational channel] if asynq).&lt;br /&gt;
* If the acting FR wants to hand over responsibility for any ongoing incident they also state which incidents they want the upcoming FR to take over.&lt;br /&gt;
* If there are any particularities the upcoming FR needs to be aware of, those are shared.&lt;br /&gt;
* The upcoming FR asks their questions until they are satisfied and able to take over the FR&lt;br /&gt;
* The upcoming FR ensures they are subscribed to the following channels on Zulip: [https://chat.dsinternal.net/#narrow/stream/23-SRE---General SRE - General], [https://chat.dsinternal.net/#narrow/stream/24-SRE-.23-Critical SRE # Critical] and if part of the SRE team [https://chat.dsinternal.net/#streams/4/SRE%20##%20Non-critical SRE ## Non-Critical] and [https://chat.dsinternal.net/#streams/5/SRE%20###%20Informational SRE ### Informational].&lt;br /&gt;
* The upcoming FR announces/informs that they are now the acting FR over Zulip&#039;s [https://chat.dsinternal.net/#narrow/stream/13-Organisational Organisational channel]&lt;br /&gt;
* The now acting FR removes the previous FR from IPA the sla-first-responder user group and disables Zabbix calling for the previous FR if they had that enabled by going to Zabbix &amp;gt; Configuration &amp;gt; Actions &amp;gt; [https://status.delftinfra.net/zabbix/actionconf.php?eventsource=0# Trigger actions]&lt;br /&gt;
&lt;br /&gt;
===Checklist for Handing Over First Responder (FR) Responsibilities===&lt;br /&gt;
&lt;br /&gt;
When transferring the role of First Responder (FR), follow these steps:&lt;br /&gt;
&lt;br /&gt;
1. Initiate the Handover:&lt;br /&gt;
   - Acting FR or Upcoming FR*: Initiate the handover process.&lt;br /&gt;
&lt;br /&gt;
2. Add Upcoming FR to User Group and Enable Zabbix Calling:&lt;br /&gt;
   - Acting FR:&lt;br /&gt;
     - Add the upcoming FR to the IPA `sla-first-responder` user group.&lt;br /&gt;
     - Enable Zabbix calling for the upcoming FR (if applicable) by navigating to:&lt;br /&gt;
       - Zabbix&amp;gt; Configuration &amp;gt; Actions &amp;gt; [Trigger actions](https://status.delftinfra.net/zabbix/actionconf.php?eventsource=0#).&lt;br /&gt;
&lt;br /&gt;
3. Announce Addition to User Group:&lt;br /&gt;
   - Acting FR:&lt;br /&gt;
     - Inform the upcoming FR that they have been added to the `sla-first-responder` group.&lt;br /&gt;
     - If communicating asynchronously, announce this in Zulip&#039;s [Organisational channel](https://chat.dsinternal.net/#narrow/stream/13-Organisational).&lt;br /&gt;
&lt;br /&gt;
4. Communicate Ongoing Incidents and Particularities:&lt;br /&gt;
   - Acting FR:&lt;br /&gt;
     - Share details of any ongoing incidents to be handed over.&lt;br /&gt;
     - Inform the upcoming FR of any specific details they need to be aware of.&lt;br /&gt;
&lt;br /&gt;
5. Review SLA State and Prepare Questions:&lt;br /&gt;
   - Upcoming FR:&lt;br /&gt;
      - Familiarize yourself with the current state of the SLA.&lt;br /&gt;
      - Prepare any questions for the acting FR.&lt;br /&gt;
&lt;br /&gt;
6. Clarify and Confirm Understanding:&lt;br /&gt;
   - Upcoming FR:&lt;br /&gt;
     - Ask all necessary questions until you are confident in taking over the FR role.&lt;br /&gt;
&lt;br /&gt;
7. Subscribe to Relevant Zulip Channels:&lt;br /&gt;
   - Upcoming FR:&lt;br /&gt;
     - Subscribe to the following channels:&lt;br /&gt;
       - [SRE - General](https://chat.dsinternal.net/#narrow/stream/23-SRE---General)&lt;br /&gt;
       - [SRE # Critical](https://chat.dsinternal.net/#narrow/stream/24-SRE-.23-Critical)&lt;br /&gt;
     - If part of the SRE team, also subscribe to:&lt;br /&gt;
       - [SRE ## Non-Critical](https://chat.dsinternal.net/#streams/4/SRE%20##%20Non-critical)&lt;br /&gt;
       - [SRE ### Informational](https://chat.dsinternal.net/#streams/5/SRE%20###%20Informational)&lt;br /&gt;
&lt;br /&gt;
8. Announce Acceptance of FR Role:&lt;br /&gt;
   - Upcoming FR (now Acting FR):&lt;br /&gt;
     - Announce that you are now the acting FR in Zulip&#039;s [Organisational channel](https://chat.dsinternal.net/#narrow/stream/13-Organisational).&lt;br /&gt;
&lt;br /&gt;
9. Remove Previous FR from User Group and Disable Zabbix Calling:&lt;br /&gt;
   - Now Acting FR:&lt;br /&gt;
     - Remove the previous FR from the IPA `sla-first-responder` user group.&lt;br /&gt;
     - Disable Zabbix calling for the previous FR by navigating to:&lt;br /&gt;
       - Zabbix&amp;gt; Configuration &amp;gt; Actions &amp;gt; [Trigger actions](https://status.delftinfra.net/zabbix/actionconf.php?eventsource=0#).&lt;br /&gt;
     - Ensure the previous FR&#039;s phone number is disabled in Zabbix calling settings.&lt;br /&gt;
&lt;br /&gt;
10. Confirm Completion of Handover:&lt;br /&gt;
    - Now Acting FR:&lt;br /&gt;
      - Verify that all steps have been completed and the handover is fully executed.&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Starting_work_for_a_new_client&amp;diff=354</id>
		<title>Starting work for a new client</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Starting_work_for_a_new_client&amp;diff=354"/>
		<updated>2024-06-28T19:16:51Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: /* Getting agreement from the client */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Creating proposal ==&lt;br /&gt;
# Write down document&lt;br /&gt;
# Get Max or DJ to sign-off&lt;br /&gt;
# Send proposal to client&lt;br /&gt;
&lt;br /&gt;
== Getting agreement from the client==&lt;br /&gt;
# Get the client to agree to the proposal. We require agreement in writing digitally. (Docusign)&lt;br /&gt;
&lt;br /&gt;
== Administrative ==&lt;br /&gt;
⚠️ Do not start work on a client without agreement, as mentioned above. &lt;br /&gt;
&lt;br /&gt;
# Create a client entry in time-tracking&lt;br /&gt;
# Create the project activities in the client in time-tracking.&lt;br /&gt;
# Add the client and project in the metrics sheet&lt;br /&gt;
# Add the expected invoices as sales opportunities in Exact&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Starting_work_for_a_new_client&amp;diff=353</id>
		<title>Starting work for a new client</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Starting_work_for_a_new_client&amp;diff=353"/>
		<updated>2024-06-28T13:17:40Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: /* Administrative */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Creating proposal ==&lt;br /&gt;
# Write down document&lt;br /&gt;
# Get Max or DJ to sign-off&lt;br /&gt;
# Send proposal to client&lt;br /&gt;
&lt;br /&gt;
== Getting agreement from the client==&lt;br /&gt;
# Get the client to agree to the proposal. We require agreement in writing digitally. &lt;br /&gt;
&lt;br /&gt;
== Administrative ==&lt;br /&gt;
⚠️ Do not start work on a client without agreement, as mentioned above. &lt;br /&gt;
&lt;br /&gt;
# Create a client entry in time-tracking&lt;br /&gt;
# Create the project activities in the client in time-tracking.&lt;br /&gt;
# Add the client and project in the metrics sheet&lt;br /&gt;
# Add the expected invoices as sales opportunities in Exact&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=341</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=341"/>
		<updated>2024-06-20T12:37:16Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents&lt;br /&gt;
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt&lt;br /&gt;
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA&lt;br /&gt;
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/laptop.key -out ~/Library/IPA/laptop.csr&lt;br /&gt;
# Go to your user in IPA&lt;br /&gt;
# Click on Actions &amp;gt; New Certificate&lt;br /&gt;
# CA = ipa&lt;br /&gt;
# Profile ID = KDCs_PKINIT_Certs&lt;br /&gt;
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/laptop.csr&lt;br /&gt;
# Request the certificate&lt;br /&gt;
# Store the resulting certificate in ~/Library/IPA/laptop.crt&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
        pkinit_identity = FILE:/Users/&amp;lt;username&amp;gt;/Library/IPA/laptop.crt,/Users/&amp;lt;username&amp;gt;/Library/IPA/laptop.key&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=340</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=340"/>
		<updated>2024-06-20T12:36:27Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents&lt;br /&gt;
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt&lt;br /&gt;
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA&lt;br /&gt;
# Create a certificate request, entering your username for the Common Name and a single dot for the other fields: openssl req -newkey rsa:4096 -nodes -keyout ~/Library/IPA/laptop.key -out ~/Library/IPA/laptop.csr&lt;br /&gt;
# Go to your user in IPA&lt;br /&gt;
# Click on Actions &amp;gt; New Certificate&lt;br /&gt;
# CA = ipa&lt;br /&gt;
# Profile ID = KDCs_PKINIT_Certs&lt;br /&gt;
# Paste the contents of this command into the big textfield: cat ~/Library/IPA/laptop.csr&lt;br /&gt;
# Request the certificate&lt;br /&gt;
# Store the resulting certificate in ~/Library/IPA/laptop.crt&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
        pkinit_identity = FILE:/etc/ipa/pkinit.crt,/etc/ipa/pkinit.key&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=339</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=339"/>
		<updated>2024-06-20T11:58:48Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: /* krb5.conf */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
    pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
        pkinit_identity = FILE:/etc/ipa/max.crt,/etc/ipa/max.key&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=338</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=338"/>
		<updated>2024-06-20T11:58:04Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;br /&gt;
# Ensure /etc/krb5.conf file has the correct contents&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== krb5.conf ==&lt;br /&gt;
&amp;lt;pre&amp;gt;&lt;br /&gt;
[libdefaults]&lt;br /&gt;
    default_realm = DELFTSOLUTIONS.NL&lt;br /&gt;
    kdc_timesync = 1&lt;br /&gt;
    ccache_type = 4&lt;br /&gt;
    forwardable = true&lt;br /&gt;
    proxiable = true&lt;br /&gt;
    fcc-mit-ticketflags = true&lt;br /&gt;
    ticket_lifetime = 24h&lt;br /&gt;
&lt;br /&gt;
[appdefaults]&lt;br /&gt;
        pkinit_anchors = FILE:/etc/ipa/ca.crt&lt;br /&gt;
&lt;br /&gt;
[realms]&lt;br /&gt;
    DELFTSOLUTIONS.NL = {&lt;br /&gt;
        default_domain = delftsolutions.nl&lt;br /&gt;
	pkinit_identity = FILE:/etc/ipa/max.crt,/etc/ipa/max.key&lt;br /&gt;
    }&lt;br /&gt;
&lt;br /&gt;
[domain_realm]&lt;br /&gt;
    .delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
    delftsolutions.nl = DELFTSOLUTIONS.NL&lt;br /&gt;
&amp;lt;/pre&amp;gt;&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=337</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=337"/>
		<updated>2024-06-20T11:56:30Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: Protected &amp;quot;Enroll Mac in Kerberos&amp;quot;: Security ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=336</id>
		<title>Enroll Mac in Kerberos</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Enroll_Mac_in_Kerberos&amp;diff=336"/>
		<updated>2024-06-20T11:56:07Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: Created page with &amp;quot;# Create host on IPA # Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;; # On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;# Create host on IPA&lt;br /&gt;
# Create a keytab on an enrolled host: TMPFILE=&amp;quot;$(mktemp -u)&amp;quot;; ipa-getkeytab -s ipa.delftsolutions.nl -p host/&amp;lt;hostname&amp;gt; -k &amp;quot;$TMPFILE&amp;quot;; base64 -w0 &amp;quot;$TMPFILE&amp;quot; &amp;amp;&amp;amp; echo; rm -f &amp;quot;$TMPFILE&amp;quot;;&lt;br /&gt;
# On the mac as root, create the keytab: umask 026; base64 -D &amp;gt;/etc/krb5.keytab &amp;lt;&amp;lt;&amp;lt;&amp;quot;&amp;lt;key&amp;gt;&amp;quot;; umask 022&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Internal&amp;diff=333</id>
		<title>Internal</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Internal&amp;diff=333"/>
		<updated>2024-06-20T10:22:17Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: /* SRE */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Finance ==&lt;br /&gt;
&lt;br /&gt;
=== Exact ===&lt;br /&gt;
&lt;br /&gt;
* [[booking bonus|Booking bonus]]&lt;br /&gt;
* [[booking wages|Booking wages]]&lt;br /&gt;
* [[new receipt|Enter a new receipt]]&lt;br /&gt;
* [[reconciliation|Reconciliation of transaction]]&lt;br /&gt;
* [[invoicing|Send an invoice]]&lt;br /&gt;
* [[payment reminders|Send payment reminder]]&lt;br /&gt;
* [[invoice approval|Process for approving invoices (/filed receipts)]]&lt;br /&gt;
&lt;br /&gt;
=== Bunq ===&lt;br /&gt;
&lt;br /&gt;
* [[top up account|Top up expense account]]&lt;br /&gt;
&lt;br /&gt;
== Work Process ==&lt;br /&gt;
&lt;br /&gt;
* [[Definition of done|Definition of Done]]&lt;br /&gt;
* [[Incident Handling|Incident Handling]]&lt;br /&gt;
* [[SRE Maintenance|SRE Maintenance]]&lt;br /&gt;
&lt;br /&gt;
== Internal Process ==&lt;br /&gt;
&lt;br /&gt;
* [[12 percent|12% time]]&lt;br /&gt;
* [[Annual leave|Annual leave]]&lt;br /&gt;
* [[Bonus allocation|Bonus allocation]]&lt;br /&gt;
* [[Calamity leave|Calamity leave]]&lt;br /&gt;
* [[Overtime|Overtime]]&lt;br /&gt;
* [[Retrospectives|Retrospectives]]&lt;br /&gt;
* [[Sick leave|Sick leave]]&lt;br /&gt;
* [[Training and self-study|Training and Self-Study]]&lt;br /&gt;
&lt;br /&gt;
== Projects ==&lt;br /&gt;
&lt;br /&gt;
* Era Inventory [[project_era_inventory_api|API Description]]&lt;br /&gt;
&lt;br /&gt;
== SRE ==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To be further populated with guide from drive&#039;&#039;&lt;br /&gt;
* [[create gitlab runner host|Create a GitLab runner host]]&lt;br /&gt;
* [[vm setup|Create a (Debian) VM]]&lt;br /&gt;
* [[border reboot|Reboot border without downtime]]&lt;br /&gt;
* [[WS Proxmox node reboot|Reboot WS Proxmox node without downtime]]&lt;br /&gt;
* [[Resize VM Disk]]&lt;br /&gt;
* [[SRE tools]]&lt;br /&gt;
* [[Enroll Mac in Kerberos]]&lt;br /&gt;
&lt;br /&gt;
== Other ==&lt;br /&gt;
&lt;br /&gt;
* [[stack|Greenfield stack]]&lt;br /&gt;
* [[standard tools|Standard Tools]]&lt;br /&gt;
* [[list of unfurl debuggers|List of unfurl debuggers]]&lt;br /&gt;
* [[Recommended suppliers]]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=318</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=318"/>
		<updated>2024-05-28T17:09:30Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* [https://www.asterisk.org/community/documentation/ Asterisk]&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* [https://docs.ceph.com/en/latest/ Ceph]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* [https://www.freeipa.org/page/Documentation FreeIPA]&lt;br /&gt;
* [https://howhttps.works/ HTTPS/TLS]&lt;br /&gt;
* [https://web.mit.edu/kerberos/www/krb5-latest/doc/ Kerberos]&lt;br /&gt;
* [https://www.keycloak.org/documentation Keycloak]&lt;br /&gt;
* [https://manpages.debian.org/unstable/ldap-utils/ldapsearch.1.en.html LDAP]&lt;br /&gt;
* [https://www.gnu.org/software/make/manual/make.html Make]&lt;br /&gt;
* [https://netboxlabs.com/docs/netbox/en/stable/ Netbox]&lt;br /&gt;
* [https://nginx.org/en/docs/ Nginx]&lt;br /&gt;
* [https://pve.proxmox.com/pve-docs/ Proxmox]&lt;br /&gt;
* [https://pbs.proxmox.com/docs/ Proxmox Backup Server]&lt;br /&gt;
* [https://www.zabbix.com/manuals Zabbix]&lt;br /&gt;
* [https://zulip.com/help/ Zulip]&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=317</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=317"/>
		<updated>2024-05-28T17:09:23Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* [https://www.asterisk.org/community/documentation/ Asterisk]&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* [https://docs.ceph.com/en/latest/ Ceph]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* [https://www.freeipa.org/page/Documentation FreeIPA]&lt;br /&gt;
* [https://howhttps.works/ HTTPS/TLS]&lt;br /&gt;
* [https://web.mit.edu/kerberos/www/krb5-latest/doc/ Kerberos]&lt;br /&gt;
* [https://www.keycloak.org/documentation Keycloak]&lt;br /&gt;
* [https://manpages.debian.org/unstable/ldap-utils/ldapsearch.1.en.html LDAP]&lt;br /&gt;
* [https://www.gnu.org/software/make/manual/make.html Make]&lt;br /&gt;
* [https://netboxlabs.com/docs/netbox/en/stable/ Netbox]&lt;br /&gt;
* [https://nginx.org/en/docs/ Nginx]&lt;br /&gt;
* [https://pve.proxmox.com/pve-docs/ Proxmox]&lt;br /&gt;
* [https://pbs.proxmox.com/docs/ Proxmox Backup Server]&lt;br /&gt;
* [https://www.zabbix.com/manuals Zabbix]&lt;br /&gt;
* [https://zulip.com/help/ Zulip]&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;br /&gt;
&lt;br /&gt;
test&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=316</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=316"/>
		<updated>2024-05-28T17:09:15Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* [https://www.asterisk.org/community/documentation/ Asterisk]&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* [https://docs.ceph.com/en/latest/ Ceph]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* [https://www.freeipa.org/page/Documentation FreeIPA]&lt;br /&gt;
* [https://howhttps.works/ HTTPS/TLS]&lt;br /&gt;
* [https://web.mit.edu/kerberos/www/krb5-latest/doc/ Kerberos]&lt;br /&gt;
* [https://www.keycloak.org/documentation Keycloak]&lt;br /&gt;
* [https://manpages.debian.org/unstable/ldap-utils/ldapsearch.1.en.html LDAP]&lt;br /&gt;
* [https://www.gnu.org/software/make/manual/make.html Make]&lt;br /&gt;
* [https://netboxlabs.com/docs/netbox/en/stable/ Netbox]&lt;br /&gt;
* [https://nginx.org/en/docs/ Nginx]&lt;br /&gt;
* [https://pve.proxmox.com/pve-docs/ Proxmox]&lt;br /&gt;
* [https://pbs.proxmox.com/docs/ Proxmox Backup Server]&lt;br /&gt;
* [https://www.zabbix.com/manuals Zabbix]&lt;br /&gt;
* [https://zulip.com/help/ Zulip]&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=315</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=315"/>
		<updated>2024-05-28T17:08:34Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* [https://www.asterisk.org/community/documentation/ Asterisk]&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* [https://docs.ceph.com/en/latest/ Ceph]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* [https://www.freeipa.org/page/Documentation FreeIPA]&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* [https://web.mit.edu/kerberos/www/krb5-latest/doc/ Kerberos]&lt;br /&gt;
* [https://www.keycloak.org/documentation Keycloak]&lt;br /&gt;
* [https://manpages.debian.org/unstable/ldap-utils/ldapsearch.1.en.html LDAP]&lt;br /&gt;
* [https://www.gnu.org/software/make/manual/make.html Make]&lt;br /&gt;
* [https://netboxlabs.com/docs/netbox/en/stable/ Netbox]&lt;br /&gt;
* [https://nginx.org/en/docs/ Nginx]&lt;br /&gt;
* [https://pve.proxmox.com/pve-docs/ Proxmox]&lt;br /&gt;
* [https://pbs.proxmox.com/docs/ Proxmox Backup Server]&lt;br /&gt;
* [https://www.zabbix.com/manuals Zabbix]&lt;br /&gt;
* [https://zulip.com/help/ Zulip]&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=314</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=314"/>
		<updated>2024-05-28T17:07:07Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* [https://www.asterisk.org/community/documentation/ Asterisk]&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* [https://docs.ceph.com/en/latest/ Ceph]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* [https://www.freeipa.org/page/Documentation FreeIPA]&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* [https://web.mit.edu/kerberos/www/krb5-latest/doc/ Kerberos]&lt;br /&gt;
* Keycloak&lt;br /&gt;
* [https://manpages.debian.org/unstable/ldap-utils/ldapsearch.1.en.html LDAP]&lt;br /&gt;
* [https://www.gnu.org/software/make/manual/make.html Make]&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=313</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=313"/>
		<updated>2024-05-28T17:05:25Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* [https://docs.ceph.com/en/latest/ Ceph]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* [https://manpages.debian.org/unstable/ldap-utils/ldapsearch.1.en.html LDAP]&lt;br /&gt;
* [https://www.gnu.org/software/make/manual/make.html Make]&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=312</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=312"/>
		<updated>2024-05-28T17:04:56Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* [https://docs.ceph.com/en/latest/ Ceph]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* [https://manpages.debian.org/unstable/ldap-utils/ldapsearch.1.en.html LDAP]&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=311</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=311"/>
		<updated>2024-05-28T17:04:25Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* [https://docs.ceph.com/en/latest/ Ceph]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=310</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=310"/>
		<updated>2024-05-28T17:03:54Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* Ceph&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=309</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=309"/>
		<updated>2024-05-28T17:03:49Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* Ceph&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;br /&gt;
&lt;br /&gt;
== References you want to know exist ==&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=308</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=308"/>
		<updated>2024-05-28T17:03:31Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* Ceph&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;br /&gt;
&lt;br /&gt;
&#039; References you want to know exist&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=307</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=307"/>
		<updated>2024-05-28T17:03:21Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* [https://www.gnu.org/software/bash/manual/bash.html Bash]&lt;br /&gt;
* Ceph&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;br /&gt;
&lt;br /&gt;
&amp;quot; References you want to know exist&lt;br /&gt;
* [https://refspecs.linuxfoundation.org/FHS_3.0/fhs/index.html Filesystem Hierarchy Standard]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=305</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=305"/>
		<updated>2024-05-28T17:02:22Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* Bash&lt;br /&gt;
* Ceph&lt;br /&gt;
* [https://www.debian.org/doc/manuals/debian-handbook/ Debian]&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=304</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=304"/>
		<updated>2024-05-28T17:01:05Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* Bash&lt;br /&gt;
* Ceph&lt;br /&gt;
* Debian&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Proxmox Backup Server&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=303</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=303"/>
		<updated>2024-05-28T17:00:30Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* Bash&lt;br /&gt;
* Ceph&lt;br /&gt;
* Debian&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=302</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=302"/>
		<updated>2024-05-28T16:59:50Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Asterisk&lt;br /&gt;
* Ceph&lt;br /&gt;
* Debian&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* Make&lt;br /&gt;
* Netbox&lt;br /&gt;
* Nginx&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=301</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=301"/>
		<updated>2024-05-28T16:59:21Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Ceph&lt;br /&gt;
* Debian&lt;br /&gt;
* [https://www.debian.org/doc/manuals/maint-guide/ Debian packaging]&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* MAKE&lt;br /&gt;
* Netbox&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=300</id>
		<title>SRE tools</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=SRE_tools&amp;diff=300"/>
		<updated>2024-05-28T16:58:42Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Ceph&lt;br /&gt;
* Debian&lt;br /&gt;
* [Debian packaging](https://www.debian.org/doc/manuals/maint-guide/)&lt;br /&gt;
* FreeIPA&lt;br /&gt;
* HTTPS/TLS&lt;br /&gt;
* Kerberos&lt;br /&gt;
* Keycloak&lt;br /&gt;
* LDAP&lt;br /&gt;
* MAKE&lt;br /&gt;
* Netbox&lt;br /&gt;
* Proxmox&lt;br /&gt;
* Zabbix&lt;br /&gt;
* Zulip&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Incident_Handling&amp;diff=151</id>
		<title>Incident Handling</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Incident_Handling&amp;diff=151"/>
		<updated>2023-01-18T14:31:33Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: Created page with &amp;quot;* Critical incidents are resolved within 16 hours. * Non-critical incidents are diagnosed within 9 hours and resolved within one week.&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;* Critical incidents are resolved within 16 hours.&lt;br /&gt;
* Non-critical incidents are diagnosed within 9 hours and resolved within one week.&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Definition_of_done&amp;diff=149</id>
		<title>Definition of done</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Definition_of_done&amp;diff=149"/>
		<updated>2021-03-05T14:00:17Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: /* Non-Functional Requirements */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;At Delft Solutions we aim to have a shared understanding what it takes to release an incremental update to one of our projects. Having a shared understanding of what it means to call something **done** also means we don&#039;t have to ask &amp;quot;But is it _really_ done?&amp;quot; or &amp;quot;Hey you said it was done but I don&#039;t see it, where is it?&amp;quot;.&lt;br /&gt;
&lt;br /&gt;
== Functional Requirements ==&lt;br /&gt;
&lt;br /&gt;
These are the &#039;&#039;business&#039;&#039; requirements that emerge through conversation about a particular issue or feature, as well as the requirements listed in the issue (acceptance criteria). &lt;br /&gt;
&lt;br /&gt;
== Quality ==&lt;br /&gt;
&lt;br /&gt;
In order to keep the code maintainable and relatively bug-free, as well as broaden the amount of people that know about a certain feature&#039;s implementation, we expect PRs to be peer-reviewed and senior-reviewed (someone senior to the project, or, if not available, senior in the company).&lt;br /&gt;
&lt;br /&gt;
Any automated analysis that runs on a project should also be without errors. When there are warnings, it should be explained &#039;&#039;why&#039;&#039; the warning isn&#039;t resolved. Yes, some of this tooling sometimes gets it wrong, but overall they make the code more consistent in style, and it often prevents a lot of common issues.&lt;br /&gt;
&lt;br /&gt;
The code must be tested. This can be a manual test or an automated test. If changes are made after the test has been performed, the test &#039;&#039;&#039;must&#039;&#039;&#039; be performed again.&lt;br /&gt;
&lt;br /&gt;
== Non-Functional Requirements ==&lt;br /&gt;
&lt;br /&gt;
* We make things better, not worse&lt;br /&gt;
* Build errors and warnings must be solved or explained (and accepted)&lt;br /&gt;
* Existing tests passed&lt;br /&gt;
* Peer code review passed&lt;br /&gt;
* Deployed (if applicable)&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Main_Page&amp;diff=145</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Main_Page&amp;diff=145"/>
		<updated>2021-01-19T14:05:51Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;This wiki contains our [[API Guidelines | guidelines]] for designing and implementing [[HATEOAS API | HATEOAS APIs]].&lt;br /&gt;
&lt;br /&gt;
Feel free to add [[Error | error documentation]] on this wiki. [[Special:CreateAccount | Registration]] is free.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re a [https://www.delftsolutions.nl Delft Solutions] employee you might be interested in our [[Internal|Internal pages]].&lt;br /&gt;
&lt;br /&gt;
* [[Media-Types Validation (Ruby)]]&lt;br /&gt;
* [[Media-Types Serialization (Ruby)]]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Ruby-media-types&amp;diff=144</id>
		<title>Ruby-media-types</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Ruby-media-types&amp;diff=144"/>
		<updated>2021-01-19T14:05:28Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: Changed redirect target from Media-Types Validatoin (Ruby) to Media-Types Validation (Ruby)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;#REDIRECT [[Media-Types Validation (Ruby)]]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Media-Types_Validatoin_(Ruby)&amp;diff=143</id>
		<title>Media-Types Validatoin (Ruby)</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Media-Types_Validatoin_(Ruby)&amp;diff=143"/>
		<updated>2021-01-19T14:05:23Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: Thexa4 moved page Media-Types Validatoin (Ruby) to Media-Types Validation (Ruby)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;#REDIRECT [[Media-Types Validation (Ruby)]]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
	<entry>
		<id>https://docs.delftsolutions.nl/index.php?title=Media-Types_Validation_(Ruby)&amp;diff=142</id>
		<title>Media-Types Validation (Ruby)</title>
		<link rel="alternate" type="text/html" href="https://docs.delftsolutions.nl/index.php?title=Media-Types_Validation_(Ruby)&amp;diff=142"/>
		<updated>2021-01-19T14:05:19Z</updated>

		<summary type="html">&lt;p&gt;Thexa4: Thexa4 moved page Media-Types Validatoin (Ruby) to Media-Types Validation (Ruby)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The repository for the &amp;lt;code&amp;gt;media_types&amp;lt;/code&amp;gt; [https://rubygems.org/gems/media_types gem] currently lives at GitHub: &amp;lt;code&amp;gt;[https://github.com/SleeplessByte/media-types-ruby sleeplessbyte/media-types-ruby]&amp;lt;/code&amp;gt;.&lt;br /&gt;
&lt;br /&gt;
= MediaTypes =&lt;br /&gt;
&lt;br /&gt;
Media Types based on scheme, with versioning, views, suffixes and validations.&lt;br /&gt;
&lt;br /&gt;
This library makes it easy to define schemas that can be used to validate JSON objects based on their Content-Type.&lt;br /&gt;
&lt;br /&gt;
== Installation ==&lt;br /&gt;
&lt;br /&gt;
Add this line to your application’s Gemfile:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;gem &#039;media_types&#039;&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
And then execute:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;$ bundle&amp;lt;/pre&amp;gt;&lt;br /&gt;
Or install it yourself as:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;pre&amp;gt;$ gem install media_types&amp;lt;/pre&amp;gt;&lt;br /&gt;
== Usage ==&lt;br /&gt;
&lt;br /&gt;
Define a validation:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;require &#039;media_types&#039;&lt;br /&gt;
&lt;br /&gt;
module Acme&lt;br /&gt;
  MediaTypes::set_organisation Acme, &#039;acme&#039;&lt;br /&gt;
&lt;br /&gt;
  class FooValidator&lt;br /&gt;
    include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
    use_name &#039;foo&#039;&lt;br /&gt;
&lt;br /&gt;
    validations do&lt;br /&gt;
      attribute :foo, String&lt;br /&gt;
    end&lt;br /&gt;
  end&lt;br /&gt;
end&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Validate an object:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;Acme::FooValidator.validate!({ foo: &#039;bar&#039; })&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Full example ==&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;require &#039;media_types&#039;&lt;br /&gt;
&lt;br /&gt;
class Venue&lt;br /&gt;
  include MediaTypes::Dsl&lt;br /&gt;
  &lt;br /&gt;
  def self.organisation&lt;br /&gt;
    &#039;mydomain&#039;&lt;br /&gt;
  end&lt;br /&gt;
  &lt;br /&gt;
  use_name &#039;venue&#039;&lt;br /&gt;
&lt;br /&gt;
  validations do&lt;br /&gt;
    version 2 do&lt;br /&gt;
      attribute :name, String&lt;br /&gt;
      collection :location do&lt;br /&gt;
        attribute :latitude, Numeric&lt;br /&gt;
        attribute :longitude, Numeric&lt;br /&gt;
        attribute :altitude, AllowNil(Numeric)&lt;br /&gt;
      end&lt;br /&gt;
&lt;br /&gt;
      link :self&lt;br /&gt;
      link :route, allow_nil: true&lt;br /&gt;
    end&lt;br /&gt;
    &lt;br /&gt;
    version 1 do&lt;br /&gt;
      attribute :name, String&lt;br /&gt;
      attribute :coords, String&lt;br /&gt;
      attribute :updated_at, String&lt;br /&gt;
    &lt;br /&gt;
      link :self&lt;br /&gt;
    end&lt;br /&gt;
    &lt;br /&gt;
    view &#039;create&#039; do&lt;br /&gt;
      collection :location do&lt;br /&gt;
        attribute :latitude, Numeric&lt;br /&gt;
        attribute :longitude, Numeric&lt;br /&gt;
        attribute :altitude, AllowNil(Numeric)&lt;br /&gt;
      end&lt;br /&gt;
      &lt;br /&gt;
      version 1 do&lt;br /&gt;
        collection :location do&lt;br /&gt;
          attribute :latitude, Numeric&lt;br /&gt;
          attribute :longitude, Numeric&lt;br /&gt;
          attribute :altitude, AllowNil(Numeric)&lt;br /&gt;
        end&lt;br /&gt;
      end&lt;br /&gt;
    end&lt;br /&gt;
  end&lt;br /&gt;
end&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Schema Definitions ==&lt;br /&gt;
&lt;br /&gt;
If you include ‘MediaTypes::Dsl’ in your class you can use the following functions within a &amp;lt;code&amp;gt;validation do&amp;lt;/code&amp;gt; block to define your schema:&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;attribute&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Adds an attribute to the schema, if a +block+ is given, uses that to test against instead of +type+&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!width=&amp;quot;26%&amp;quot;| param&lt;br /&gt;
!width=&amp;quot;23%&amp;quot;| type&lt;br /&gt;
!width=&amp;quot;50%&amp;quot;| description&lt;br /&gt;
|-&lt;br /&gt;
| key&lt;br /&gt;
| &amp;lt;code&amp;gt;Symbol&amp;lt;/code&amp;gt;&lt;br /&gt;
| the attribute name&lt;br /&gt;
|-&lt;br /&gt;
| opts&lt;br /&gt;
| &amp;lt;code&amp;gt;Hash&amp;lt;/code&amp;gt;&lt;br /&gt;
| options to pass to &amp;lt;code&amp;gt;Scheme&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;Attribute&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| type&lt;br /&gt;
| &amp;lt;code&amp;gt;Class&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;===&amp;lt;/code&amp;gt;, Scheme&lt;br /&gt;
| The type of the value, can be anything that responds to &amp;lt;code&amp;gt;===&amp;lt;/code&amp;gt;, or scheme to use if no &amp;lt;code&amp;gt;&amp;amp;amp;block&amp;lt;/code&amp;gt; is given. Defaults to &amp;lt;code&amp;gt;Object&amp;lt;/code&amp;gt; without a &amp;lt;code&amp;gt;&amp;amp;amp;block&amp;lt;/code&amp;gt; and to Hash with a &amp;lt;code&amp;gt;&amp;amp;amp;block&amp;lt;/code&amp;gt;.&lt;br /&gt;
|-&lt;br /&gt;
| optional:&lt;br /&gt;
| &amp;lt;code&amp;gt;TrueClass&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;FalseClass&amp;lt;/code&amp;gt;&lt;br /&gt;
| if true, key may be absent, defaults to &amp;lt;code&amp;gt;false&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;amp;amp;block&lt;br /&gt;
| &amp;lt;code&amp;gt;Block&amp;lt;/code&amp;gt;&lt;br /&gt;
| defines the scheme of the value of this attribute&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Add an attribute named foo, expecting a string ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;require &#039;media_types&#039;&lt;br /&gt;
&lt;br /&gt;
class MyMedia&lt;br /&gt;
  include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
  validations do&lt;br /&gt;
    attribute :foo, String&lt;br /&gt;
  end&lt;br /&gt;
end&lt;br /&gt;
&lt;br /&gt;
MyMedia.valid?({ foo: &#039;my-string&#039; })&lt;br /&gt;
# =&amp;gt; true&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Add an attribute named foo, expecting nested scheme ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;class MyMedia&lt;br /&gt;
 include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
 validations do&lt;br /&gt;
   attribute :foo do&lt;br /&gt;
     attribute :bar, String&lt;br /&gt;
   end&lt;br /&gt;
 end&lt;br /&gt;
end&lt;br /&gt;
&lt;br /&gt;
MyMedia.valid?({ foo: { bar: &#039;my-string&#039; }})&lt;br /&gt;
# =&amp;gt; true&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;any&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Allow for any key. The &amp;lt;code&amp;gt;&amp;amp;amp;block&amp;lt;/code&amp;gt; defines the Schema for each value.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!width=&amp;quot;26%&amp;quot;| param&lt;br /&gt;
!width=&amp;quot;23%&amp;quot;| type&lt;br /&gt;
!width=&amp;quot;50%&amp;quot;| description&lt;br /&gt;
|-&lt;br /&gt;
| scheme&lt;br /&gt;
| &amp;lt;code&amp;gt;Scheme&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;NilClass&amp;lt;/code&amp;gt;&lt;br /&gt;
| scheme to use if no &amp;lt;code&amp;gt;&amp;amp;amp;block&amp;lt;/code&amp;gt; is given&lt;br /&gt;
|-&lt;br /&gt;
| allow_empty:&lt;br /&gt;
| &amp;lt;code&amp;gt;TrueClass&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;FalsClass&amp;lt;/code&amp;gt;&lt;br /&gt;
| if true, empty (no key/value present) is allowed&lt;br /&gt;
|-&lt;br /&gt;
| expected_type:&lt;br /&gt;
| &amp;lt;code&amp;gt;Class&amp;lt;/code&amp;gt;,&lt;br /&gt;
| forces the validated value to have this type, defaults to &amp;lt;code&amp;gt;Hash&amp;lt;/code&amp;gt;. Use &amp;lt;code&amp;gt;Object&amp;lt;/code&amp;gt; if either &amp;lt;code&amp;gt;Hash&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;Array&amp;lt;/code&amp;gt; is fine&lt;br /&gt;
|-&lt;br /&gt;
| &amp;amp;amp;block&lt;br /&gt;
| &amp;lt;code&amp;gt;Block&amp;lt;/code&amp;gt;&lt;br /&gt;
| defines the scheme of the value of this attribute&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Add a collection named foo, expecting any key with a defined value ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;class MyMedia&lt;br /&gt;
 include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
 validations do&lt;br /&gt;
   collection :foo do&lt;br /&gt;
     any do&lt;br /&gt;
       attribute :bar, String&lt;br /&gt;
     end&lt;br /&gt;
   end&lt;br /&gt;
 end&lt;br /&gt;
end&lt;br /&gt;
&lt;br /&gt;
MyMedia.valid?({ foo: [{ anything: { bar: &#039;my-string&#039; }, other_thing: { bar: &#039;other-string&#039; } }] })&lt;br /&gt;
# =&amp;gt; true&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;not_strict&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Allow for extra keys in the schema/collection even when passing &amp;lt;code&amp;gt;strict: true&amp;lt;/code&amp;gt; to &amp;lt;code&amp;gt;#validate!&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Allow for extra keys in collection ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;class MyMedia&lt;br /&gt;
 include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
 validations do&lt;br /&gt;
   collection :foo do&lt;br /&gt;
     attribute :required, String&lt;br /&gt;
     not_strict&lt;br /&gt;
   end&lt;br /&gt;
 end&lt;br /&gt;
end&lt;br /&gt;
&lt;br /&gt;
MyMedia.valid?({ foo: [{ required: &#039;test&#039;, bar: 42 }] })&lt;br /&gt;
# =&amp;gt; true&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;collection&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Expect a collection such as an array or hash. The &amp;lt;code&amp;gt;&amp;amp;amp;block&amp;lt;/code&amp;gt; defines the Schema for each item in that collection.&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!width=&amp;quot;26%&amp;quot;| param&lt;br /&gt;
!width=&amp;quot;23%&amp;quot;| type&lt;br /&gt;
!width=&amp;quot;50%&amp;quot;| description&lt;br /&gt;
|-&lt;br /&gt;
| key&lt;br /&gt;
| &amp;lt;code&amp;gt;Symbol&amp;lt;/code&amp;gt;&lt;br /&gt;
| key of the collection (same as &amp;lt;code&amp;gt;#attribute&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| scheme&lt;br /&gt;
| &amp;lt;code&amp;gt;Scheme&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;NilClass&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;Class&amp;lt;/code&amp;gt;&lt;br /&gt;
| scheme to use if no &amp;lt;code&amp;gt;&amp;amp;amp;block&amp;lt;/code&amp;gt; is given or &amp;lt;code&amp;gt;Class&amp;lt;/code&amp;gt; of each item in the&lt;br /&gt;
|-&lt;br /&gt;
| allow_empty:&lt;br /&gt;
| &amp;lt;code&amp;gt;TrueClass&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;FalseClass&amp;lt;/code&amp;gt;&lt;br /&gt;
| if true, empty (no key/value present) is allowed&lt;br /&gt;
|-&lt;br /&gt;
| expected_type:&lt;br /&gt;
| &amp;lt;code&amp;gt;Class&amp;lt;/code&amp;gt;,&lt;br /&gt;
| forces the validated value to have this type, defaults to &amp;lt;code&amp;gt;Array&amp;lt;/code&amp;gt;. Use &amp;lt;code&amp;gt;Object&amp;lt;/code&amp;gt; if either &amp;lt;code&amp;gt;Array&amp;lt;/code&amp;gt; or &amp;lt;code&amp;gt;Hash&amp;lt;/code&amp;gt; is fine.&lt;br /&gt;
|-&lt;br /&gt;
| optional:&lt;br /&gt;
| &amp;lt;code&amp;gt;TrueClass&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;FalseClass&amp;lt;/code&amp;gt;&lt;br /&gt;
| if true, key may be absent, defaults to &amp;lt;code&amp;gt;false&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;amp;amp;block&lt;br /&gt;
| &amp;lt;code&amp;gt;Block&amp;lt;/code&amp;gt;&lt;br /&gt;
| defines the scheme of the value of this attribute&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Collection with an array of string ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;class MyMedia&lt;br /&gt;
 include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
 validations do&lt;br /&gt;
   collection :foo, String&lt;br /&gt;
 end&lt;br /&gt;
end&lt;br /&gt;
&lt;br /&gt;
MyMedia.valid?({ collection: [&#039;foo&#039;, &#039;bar&#039;] })&lt;br /&gt;
# =&amp;gt; true&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Collection with defined scheme ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;class MyMedia&lt;br /&gt;
 include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
 validations do&lt;br /&gt;
   collection :foo do&lt;br /&gt;
     attribute :required, String&lt;br /&gt;
     attribute :number, Numeric&lt;br /&gt;
   end&lt;br /&gt;
 end&lt;br /&gt;
end&lt;br /&gt;
&lt;br /&gt;
MyMedia.valid?({ foo: [{ required: &#039;test&#039;, number: 42 }, { required: &#039;other&#039;, number: 0 }] })&lt;br /&gt;
# =&amp;gt; true&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;link&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Expect a link with a required &amp;lt;code&amp;gt;href: String&amp;lt;/code&amp;gt; attribute&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
!width=&amp;quot;26%&amp;quot;| param&lt;br /&gt;
!width=&amp;quot;23%&amp;quot;| type&lt;br /&gt;
!width=&amp;quot;50%&amp;quot;| description&lt;br /&gt;
|-&lt;br /&gt;
| key&lt;br /&gt;
| &amp;lt;code&amp;gt;Symbol&amp;lt;/code&amp;gt;&lt;br /&gt;
| key of the link (same as &amp;lt;code&amp;gt;#attribute&amp;lt;/code&amp;gt;)&lt;br /&gt;
|-&lt;br /&gt;
| allow_nil:&lt;br /&gt;
| &amp;lt;code&amp;gt;TrueClass&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;FalseClass&amp;lt;/code&amp;gt;&lt;br /&gt;
| if true, value may be nil&lt;br /&gt;
|-&lt;br /&gt;
| optional:&lt;br /&gt;
| &amp;lt;code&amp;gt;TrueClass&amp;lt;/code&amp;gt;, &amp;lt;code&amp;gt;FalseClass&amp;lt;/code&amp;gt;&lt;br /&gt;
| if true, key may be absent, defaults to &amp;lt;code&amp;gt;false&amp;lt;/code&amp;gt;&lt;br /&gt;
|-&lt;br /&gt;
| &amp;amp;amp;block&lt;br /&gt;
| &amp;lt;code&amp;gt;Block&amp;lt;/code&amp;gt;&lt;br /&gt;
| defines the scheme of the value of this attribute, in addition to the &amp;lt;code&amp;gt;href&amp;lt;/code&amp;gt; attribute&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Links as defined in HAL, JSON-Links and other specs ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;class MyMedia&lt;br /&gt;
  include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
  validations do&lt;br /&gt;
    link :_self&lt;br /&gt;
    link :image&lt;br /&gt;
  end&lt;br /&gt;
end&lt;br /&gt;
&lt;br /&gt;
MyMedia.valid?({ _links: { self: { href: &#039;https://example.org/s&#039; }, image: { href: &#039;https://image.org/i&#039; }} })&lt;br /&gt;
# =&amp;gt; true&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
==== Link with extra attributes ====&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;class MyMedia&lt;br /&gt;
 include MediaTypes::Dsl&lt;br /&gt;
&lt;br /&gt;
 validations do&lt;br /&gt;
   link :image do&lt;br /&gt;
     attribute :templated, TrueClass&lt;br /&gt;
   end&lt;br /&gt;
 end&lt;br /&gt;
end&lt;br /&gt;
&lt;br /&gt;
MyMedia.valid?({ _links: { image: { href: &#039;https://image.org/{md5}&#039;, templated: true }} })&lt;br /&gt;
# =&amp;gt; true&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== Validation ==&lt;br /&gt;
&lt;br /&gt;
If your type has a validations, you can now use this media type for validation:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;Venue.valid?({&lt;br /&gt;
  #...&lt;br /&gt;
})&lt;br /&gt;
# =&amp;gt; true if valid, false otherwise&lt;br /&gt;
&lt;br /&gt;
Venue.validate!({&lt;br /&gt;
  # /*...*/ &lt;br /&gt;
})&lt;br /&gt;
# =&amp;gt; raises if it&#039;s not valid&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
If an array is passed, check the scheme for each value, unless the scheme is defined as expecting a hash: &lt;br /&gt;
&lt;br /&gt;
&amp;lt;syntaxhighlight lang=&amp;quot;ruby&amp;quot;&amp;gt;expected_hash = Scheme.new(expected_type: Hash) { attribute(:foo) } expected_object = Scheme.new { attribute(:foo) }&lt;br /&gt;
&lt;br /&gt;
expected_hash.valid?({ foo: ‘string’ }) # =&amp;amp;gt; true&lt;br /&gt;
&lt;br /&gt;
expected_hash.valid?([{ foo: ‘string’ }]) # =&amp;amp;gt; false&lt;br /&gt;
&lt;br /&gt;
expected_object.valid?({ foo: ‘string’ }) # =&amp;amp;gt; true&lt;br /&gt;
&lt;br /&gt;
expected_object.valid?([{ foo: ‘string’ }]&amp;lt;/syntaxhighlight&amp;gt;&lt;br /&gt;
&lt;br /&gt;
== API ==&lt;br /&gt;
&lt;br /&gt;
A defined schema has the following functions available:&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;valid?&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.valid?({ foo: &#039;bar&#039; })&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Allows passing in validation options as a second parameter.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;validate!&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.validate!({ foo: &#039;bar&#039; })&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Allows passing in validation options as a second parameter.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;validatable?&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.version(42).validatable?&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Tests wether the current configuration of the schema has a validation defined.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;register&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.register&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Registers the media type to the registry.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;view&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.view(&#039;create&#039;)&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Returns a schema validator configured with the specified view.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;version&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.version(42)&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Returns a schema validator configured with the specified version.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;suffix&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.suffix(:json)&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Returns a schema validator configured with the specified suffix.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;identifier&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.version(2).identifier&amp;lt;/code&amp;gt; (returns &amp;lt;code&amp;gt;&#039;application/vnd.application.venue.v2&#039;&amp;lt;/code&amp;gt;)&lt;br /&gt;
&lt;br /&gt;
Returns the IANA compatible [https://en.wikipedia.org/wiki/Media_type Media Type Identifier] for the configured schema.&lt;br /&gt;
&lt;br /&gt;
=== &amp;lt;code&amp;gt;available_validations&amp;lt;/code&amp;gt; ===&lt;br /&gt;
&lt;br /&gt;
Example: &amp;lt;code&amp;gt;Venue.available_validations&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Returns a list of all the schemas that are defined.&lt;br /&gt;
&lt;br /&gt;
== Related ==&lt;br /&gt;
&lt;br /&gt;
* [https://github.com/XPBytes/media_types-serialization &amp;lt;code&amp;gt;MediaTypes::Serialization&amp;lt;/code&amp;gt;]: :cyclone: Add media types supported serialization to Rails.&lt;br /&gt;
&lt;br /&gt;
== Development ==&lt;br /&gt;
&lt;br /&gt;
After checking out the repo, run &amp;lt;code&amp;gt;bin/setup&amp;lt;/code&amp;gt; to install dependencies. Then, run &amp;lt;code&amp;gt;rake test&amp;lt;/code&amp;gt; to run the tests. You can also run &amp;lt;code&amp;gt;bin/console&amp;lt;/code&amp;gt; for an interactive prompt that will allow you to experiment.&lt;br /&gt;
&lt;br /&gt;
To install this gem onto your local machine, run &amp;lt;code&amp;gt;bundle exec rake install&amp;lt;/code&amp;gt;. To release a new version, update the version number in &amp;lt;code&amp;gt;version.rb&amp;lt;/code&amp;gt;, call &amp;lt;code&amp;gt;bundle exec rake release&amp;lt;/code&amp;gt; to create a new git tag, push git commits and tags, and push the &amp;lt;code&amp;gt;.gem&amp;lt;/code&amp;gt; file to rubygems.org.&lt;br /&gt;
&lt;br /&gt;
== Contributing ==&lt;br /&gt;
&lt;br /&gt;
Bug reports and pull requests are welcome on GitHub at [https://github.com/SleeplessByte/media-types-ruby SleeplessByte/media-types-ruby]&lt;/div&gt;</summary>
		<author><name>Thexa4</name></author>
	</entry>
</feed>