Hello there!

I deployed my custom application to an Azure Container App in the last post using Infra-as-Code (bicep) via the Azure Devops CICD pipeline. Now I will configure and enable authentication using EntraID. I will use ClientId and Secret to connect my Azure Container App to EntraID. Firstly from the EntraID admin portal, I create a new App Registration and then generate a new secret. Update My Bicep Code I will update my existing bicep code to include the authconfigs resource to configure the Authentication. The ClientID, Secret and TenantID are parameters which I will pass in my CICD pipeline. ...

Today I will share and document how I deploy and run containers on Azure Container Apps. I’ve tested Azure Container Apps previously and I like how simpler it is compared to Azure Kubernetes Service. Overview of my Setup As a quick overview, I will use a simple Server Inventory application that I wrote using PowerShell. It uses the PODE PowerShell module to create a simple web server for the frontend (please check out how I used this in a previous post). I will store my Server Inventory data on an Azure Storage Account table. ...

In the previous post about Just-in-Time access for Active Directory, I wrote a custom web portal using the PODE PowerShell module to serve as a GUI interface as well as to provide an approval workflow process. Although this works, using just HTTP bothered me so today, I’ll document how easy it is to enable HTTPS on the PODE generated web server. Currently, my PowerShell script is configured to use HTTP on port 8080. ...

With EntraID, there is an option to enable Privileged Identity Management to provide Just-in-Time (JIT) access. There are of course 3rd party products that provide a similar feature for Active Directory and more, but today, I will use the built-in functionality. Enable Just in Time Access First, I will need to enable it. The AD Domain functional level must be at least Windows 2016. At the moment, it is not enabled on my Domain. ...

Today I’d like to document how I digitally sign my PowerShell scripts. The purpose of signing the script is to prove who wrote it and that it has not been tampered with. If the script is modified, the script becomes untrusted. To provide added security to my environment, I will set the Execution Policy so that all PowerShell scripts are signed by the person who wrote it. First, I create a Code Signing certificate template on my internal Certificate Authority. If required, we can restrict who can enroll for a CodeSigning Certificate using the template’s ACL. ...

In my last post, I configured /mnt/cephfs for my shared volume. Today, I’m documenting the installation and configuration of Keepalived on my Docker Swarm cluster nodes. Instead of connecting directly to individual node IP addresses when accessing containerized applications, Keepalived allows me to implement a Virtual IP (VIP). This VIP acts as a single highly available entry point for the entire cluster. If the active node hosting the VIP goes down, Keepalived automatically fails over the VIP to a healthy node ensuring uninterrupted access to my applications. ...

Most use Kubernetes these days, but for small environments such as my home lab, Docker Swarm is just way easier to manage. I’ve been running my Swarm cluster on NFS storage for a while now, but I’m currently switching over to CephFS using MicroCeph. Instead of managing a separate NFS server, I can run CephFS distributed storage on my existing Docker nodes using the local disks. On each server, I install MicroCeph. I have 3 nodes in my Docker Swarm cluster so I need to run these commands on each. ...

In today’s post, I will share how I restrict what URLs can be accessed via the MS Edge browser. Using the MS Edge Group Policy Template The MicrosoftEdgePolicyTemplates can be downloaded from Microsoft’s website. On my Domain Controller, I create a PolicyDefinitions folder under \sysvol\domain\policies\ and copy the msedge admx and language files. From the Group Policy Management Console, I create a new Group Policy Object for my target OU. ...

I’m looking to see if Azure Container Apps is the right solution for my latest project. In the past, I used Azure Container Instances for a simpler setup, but this time I need something that scales a bit better. That said, Azure Kubernetes Service is a bit overkill for what I require. To test the waters and get a baseline understanding of how Azure Container Apps work, I’m going to walk through deploying using a basic Microsoft quickstart image for now. In production or even on my lab, I would normally use Infra as Code and Devops pipelines to deploy resources in Azure but for learning and experimentation, I use both the CLI and Azure Portal so I could document my learnings. ...

In my last post I was working on an Azure Storage Account with the SFTP feature enabled. I thought I’d explore the SFTP capability that comes with Windows Server as part of the built-in OpenSSH feature. For some reason, it is already enabled on a fresh install of Windows Server (I’m using Windows Server 2025). I double-check to see if the service is running. Next I create a local user account on the Windows Server. I will use this account for the SFTP file transfer. ...