Online

Featured Blog Post:

upgrades - 2026-10-31 11:18:17 -0400

In light of CVE-2026-98432, I upgraded all my systems and patched them to the new linux kernel.

NixOS

Both my desktop and virtual machines are running NixOS. I’m fairly new to the ecosystem and thought that nixos-rebuild switch was analogous to sudo apt update && sudo apt upgrade on debian-based systems. This is not true. The packages are pinned to a channel and won’t change unless explicitly specified with nixos-rebuild switch --upgrade, which is the whole appeal of the nix package manager.

Flakes complicate this slightly. Instead of a channel (e.g. nightly, unstable, stable, whatever), A flake can pin specific packages per directory. The flake lockfile must be updated to upgrade a NixOS machine that uses flakes. nix flake update then nixos-rebuild switch solved my issues. In retrospect, this was a great lesson on what flakes actually are and how they differ from channels. Prior to doing this, the implications of each were unclear to me.

Proxmox

The hypervisor has a nice gui and all of the upgrades were handled nicely. I was on Debian for 3 or 4 years before switching to NixOS, which might explain my familiarity with the apt package manager and the painless install.

Both the hypervisor and guest container images run a custom linux kernel, I’m not actually sure if the newest version of this kernel was patched against the CVE, since I haven’t checked the release date. This is a problem for future me.

FreeBSD

I consider the FreeBSD documentation a great feat equal to the Arch linux wiki. I just went to the upgrade section and followed the instruction. The setup was a little different, since this server uses the ports collection, but overall pretty good.

This server wasn’t actually vulnerable to the CVE, since it’s not linux, but I thought I should do it while I’m in the area.

OpenWRT

The router was a bit of a bear. edge/embedded computing usually doesn’t have the margins for robusts systems and this was especially true for this upgrade.

  1. Take a backup of system configurations
  2. Generate new firmware with all the upgraded packages
  3. Flash the firmware, destroying all the files
  4. Log back into the “brand new” router
  5. Restore system configurations from backup
  6. Reboot

For whatever reason, the gui got stuck generating the new image and I had to do this from the terminal. The actual process wasn’t so bad, but having to figure everything out with owut was new to me.

Poor visibility

I’d like more visibility and automation as I build out this homelab. It feels a little uncomfortable not knowing what’s going on with my computers and I know my patching cadences are terrible. NixOS has provisions for automated upgrades, which I’ll likely do for my guest images in the future.

Featured Recipe:

chai - 2026-10-19 23:16:23 -0400

Ingredients:

  1. Heavy cream
  2. 2 cinnamon sticks
  3. 4 portions assam black tea
  4. 4 portions ground ginger
  5. 2 portions ground black pepper
  6. 1 portions star anise
  7. 1 portions cloves
  8. 1 portions green cardamom pods

Typically use 4 tablespoons of assam black tea in a medium sauce pan

Instructions:

  1. Crush spices with the broad side of a knife
  2. Boil water in a medium saucepan over high heat
  3. Except the tea, place all dry ingredients in the water
  4. Wait for water to come to a roiling boil
  5. Reduce to a medium heat
  6. Add tea
  7. Wait 4 minutes
  8. Add heavy cream until desired color is reached
  9. Wait until chai simmers again
  10. Pour into a french press and strain
  11. Optionally serve with sugar