Dominik Rys

How We Saved $3.5M in BigQuery Costs on Deleting Inactive User Data

Thu, 27 Mar 2025 15:15:07 +0000

This post was also posted on the GoCardless Tech blog.

GoCardless was founded 13 years ago. Over this time, we’ve had hundreds of thousands of merchants create accounts with us and actively use our product. However, we’ve also accumulated a large number of inactive accounts over this time, leaving a lot of their data across our systems. At GoCardless we take our data responsibilities seriously, so we decided to remove this data, reducing the impact of any potential data breaches.

Scraping Grafana Agent Metrics in Kubernetes

Sun, 03 Jul 2022 10:08:23 +0100

After deploying the Grafana Agent in a Kubernetes cluster, you’ll most likely want to monitor it to ensure that no observability data gets lost. Grafana provides a comprehensive guide on how to configure alerts for the agent, but I found it to not work for all cases. Namely, enabling agent integration didn’t enable scraping metrics of the agent itself. This could be due to running the Grafana Agent in Kubernetes, which the guide may not be targeted at, or due to configuring the agent in a manner that deviates from Grafana’s recommended way.

Automatically Generating a Grafana Agent Configuration for a Kubernetes Cluster

Wed, 30 Mar 2022 21:37:36 +0100

Configuring the Grafana Agent to collect metrics from nodes in a Kubernetes cluster can be quite a daunting task. Manually configuring scrape jobs for all the pods running in your cluster can be a laborious undertaking that is not maintainable in the long run, especially as new services are added. In this post, I describe a way to generate a Grafana Agent configuration for a Kubernetes cluster using the Grafana Agent Operator.

Live Reload Browserify + TypeScript in Node.js

Mon, 17 Jan 2022 20:39:17 +0000

I’ve recently been working on a Node.js project in TypeScript and bundling its dependencies using Browserify. To increase the speed of iteration, I wanted to automatically reload the tab with my web app whenever I made code changes, which would entail recompiling the TypeScript code into JavaScript. However, I couldn’t find a good guide on how to achieve this online. In the end, I managed to figure it out by bolting some tools together - with no JavaScript task runner such as Gulp or Grunt needed!

HashiCorp Certified: Terraform Associate Course Review

Mon, 27 Dec 2021 10:38:04 +0000

I’ve recently been working with Terraform a lot at work. However, I was never taught properly how it works. I jumped straight into the code and figured things out, which wasn’t particularly difficult. Nevertheless, I was curious as to what I was missing and how I could set Terraform up myself in a new project. Therefore, I looked at how I could learn Terraform on my own.

After some initial looking around, I found Zeal Vora’s ‘HashiCorp Certified: Terraform Associate’ course on Udemy to be well-regarded. Now, I’m not a fan of courses. I’d much rather get stuck into a project of my own and avoid the hand-holding that most courses offer. In the case of Terraform though, since I didn’t have deploying any complicated infrastructure in mind, completing a course seemed like the right approach. The instructor of the course also seemed credible, seeing as he’s released many courses on Cloud Engineering topics and works as a Cloud Security Consultant.

Mapping Google Groups to Kibana Roles

Mon, 20 Dec 2021 15:05:10 +0000

I’ve recently configured authentication for the Elastic Stack. To take some of the burden off managing permissions manually, we wanted to map Google Groups to Kibana roles, since we manage authentication to most of our systems using Google Groups.

Having followed Elastic’s documentation on setting up Google OIDC authentication, however, I found that this task is not so easy, as Google OIDC doesn’t return group memberships in the JWT that the application receives.

Creating Alerts from Logs in Kibana

Sat, 18 Dec 2021 12:35:54 +0000

I’ve recently deployed the Elastic Stack and set up sending logs to it. To automate certain checks, I then wanted to set up some alerts based on the logs. However, I found that there is several ways that this can be set up in Kibana. Each way has its shortcomings and pre-requisites, which aren’t particularly well documented in Elastic’s documentation. I’ll explain my findings in this post.

Types of Kibana Alerts

Rules

These used to be called Kibana Alerts (for some reason Elastic has done a lot of renaming over the years), and in most cases I found these to be the best choice. These can be found by navigating to Stack Management > Rules and Connectors in Kibana.

Caveats to Creating Datadog Log Metrics in Terraform

Sun, 14 Nov 2021 09:52:58 +0000

In this post, I give an overview of how to create Datadog Log Metrics in Terraform. Having had done this recently, I encountered a couple of caveats that warranted documenting. Hopefully it will help others that encountered similar issues.

This post assumes that you have a basic configuration for Datadog in Terraform already. If you don’t, Datadog’s post on managing Datadog with Terraform is a good starting point.

Datadog Terraform Resources

There are three Terraform resources that you can use to configure log metrics in Datadog:

Installing Zsh (and oh-my-zsh) in Windows Git Bash

Thu, 11 Nov 2021 19:10:26 +0000

I’ve recently started using Windows again. After a long time using a customised Zsh shell on macOS and Linux though, I’ve started to miss some of the small productivity boosts that Zsh plugins offered me. Of course, I could set up the shell as I want it under WSL, but WSL doesn’t always play nicely with Windows-native applications and tools. To remedy this, I looked into how I could set up Zsh to run instead of Bash in Git Bash.

Injecting Build-Time Variables to Nested Golang Packages

Sun, 07 Nov 2021 18:32:38 +0000

I’ve recently tried to figure out how to inject variables to a Go executable at build-time. The available guidance online was straightforward, but it all referred to simple Go programs with rudimentary package structures that aren’t hosted remotely. None also mentioned working with the Cobra CLI library, which usually results in multiple levels of nesting in the Go application’s package structure.

To address what the other posts don’t cover, I thought I’d write this short blog post.

Enforcing Uniqueness of Multiple Attributes in DynamoDB

Sun, 31 Oct 2021 09:53:52 +0000

I’ve recently tried to solve a problem that involved enforcing uniqueness of multiple attributes in DynamoDB. Surprisingly, this wasn’t a trivial undertaking. Given most of my database experience is using SQL databases, I initially started solving the problem using SQL paradigms that didn’t translate well to NoSQL.

In this post, I will describe what I learned, and how it’s possible to implement enforcing uniqueness of multiple attributes in DynamoDB.

Approaches That Don’t Work

Using Condition Expressions

After some initial research, I tried implementing a Conditional Put using a condition expression. This seemed logical - add a condition expression with chained attribute_not_exists(attribute_name) statements and suddenly the database will start enforcing uniqueness of whichever combination of attributes I’d like.

Tips for Developing a Static Site Using Hugo

Fri, 20 Aug 2021 21:08:18 +0000

I’ve been asked a handful of times how this blog is written and maintained. The answer changed every time, as the blog’s gone through a couple of iterations in the time I’ve had it. I reckon that it’s in a good state now, so I thought that I’d collate and document what I found works well with developing a Hugo static site, and what I wished that I knew earlier.

Resources for Learning about Operating Systems

Tue, 03 Aug 2021 16:07:52 +0100

I’ve recently graduated with a Computer Science degree. Overall, the course covered most of the fundamentals of computer science. However, the course structure changed when I was on my year in industry, causing me to completely miss out on operating systems modules! Since I’ve always been interested in operating systems, I decided to teach myself about them.

In this short post, I will cover what online resources I found to be particularly useful in teaching myself about operating systems. I’ll mention resources ranging from ones that can be gone through in a couple of hours to acquire some surface-level knowledge, to those that will take a bit longer but prepare you to write the next Unix successor.

10 Tips for Getting a First in a Computer Science Dissertation

Thu, 22 Jul 2021 11:02:23 +0100

I’m proud to have recently graduated with a First Class BSc degree in Computer Science from the University of Birmingham. To my surprise, during the graduation ceremony, I have also been awarded the Distinguished Dissertation Prize 2020/2021 for the highest-graded dissertation in the graduating cohort. This was a huge honour as it came completely unexpected, and it made a lot of the effort that went into writing my dissertation worthwhile.

Executing Stream Cipher Attacks on IP Packets

Fri, 09 Jul 2021 15:36:55 +0100

For part of my bachelor’s dissertation, I implemented and executed a bit-flipping attack on encrypted IP packets in LTE networks. The attack was first documented by David Rupprecht et al. in their academic paper “Breaking LTE on Layer Two”.

The attack is possible due to a specification flaw in LTE standards, where IP packets are not integrity protected. Therefore, a man-in-the-middle (MITM) attacker can modify the packets and the receiver will decrypt them successfully since it can’t verify the authenticity of the data. This kind of attack is not specific to LTE networks, however, and can be executed in different environments.

How I Started Learning Rust

Wed, 16 Jun 2021 18:56:21 +0100

I wanted to learn Rust for a while. The promises of memory-safety and performance have piqued my interest and I needed to see what all the hype was about. In turn, I spent some time learning Rust on and off over the last couple of months alongside university work.

In this post, I describe how I went about learning Rust and what resources I used. I also reflect on what methods worked well and what could have possibly been skipped. I hope this will be useful to anyone that’s also curious about Rust.

How to Disable UDP Checksum Validation in Linux

Thu, 20 May 2021 12:37:22 +0100

I recently needed to disable the validation of UDP checksums of incoming packets on a Linux machine for a security project. To my surprise, there weren’t any satisfactory solutions that I could easily find online related to this. The top Google results suggest disabling checksum offloading, which doesn’t disable checksum validation. Another result mentions a solution from within application source code, which you may not have access to or be able to modify.

How to Transparently Proxy IP Packets With Spoofed Destinations

Sat, 17 Apr 2021 10:44:53 +0100

I’ve recently worked on a security project which required me to transparently proxy IP packets that have had their destination IPs spoofed. By this, I mean that the destination IP in an IP packet is not the IP of the destination which a DNS request would correctly resolve. For example, this could be due to a DNS query being spoofed and sending an IP address of another destination in reply. The diagram above shows what we want to achieve.

Configuring Squid as a Transparent Proxy

Sat, 10 Apr 2021 10:08:45 +0100

I’ve recently set up Squid as a transparent proxy for a security project. What should have been relatively straightforward had me browsing through prehistoric tutorials that don’t quite work any more. In the end, I managed to get a minimal transparent proxy configuration on a modern version of Linux hosted in the cloud.

With the hopes of saving someone some time that may be embarking on a similar journey, I thought I’d write this post. We discuss HTTP transparent proxying at the start, but provide resources for allowing support for HTTPS.

How to Debug srsLTE

Sat, 13 Feb 2021 10:34:48 +0100

I’ve recently been working extensively with srsLTE for my bachelor’s dissertation. So far, the greatest difficulty has been debugging the software. In this short post, I will describe various ways I found that srsLTE can be debugged, and any pitfalls that come with them.

I’ll assume you know how to debug ordinary C/C++ programs (I’ll patiently wait here if you need to have a look into that).

Compiling srsLTE in Debug Mode

Your first attempt at debugging may have been to compile with the Debug CMake flag, and then executing the binaries using GDB or another debugger:

Setting up a TLS-Secured Monitoring Solution in Docker using InfluxDB, Grafana, and Traefik

Tue, 01 Dec 2020 12:51:48 +0100

During my last internship, I’ve been tasked with designing and deploying infrastructure for monitoring a cluster of machines that were used for performance testing. I wrote a blog post detailing high-level choices about it which you can check out here. The post also includes justifications for why I chose to deploy everything in Docker, and why I chose to work with Grafana and InfluxDB as the front-end and time-series database, respectively.

Monitoring Corda Nodes Using Grafana, InfluxDB, and Telegraf

Mon, 21 Sep 2020 16:52:48 +0100

This post is also hosted on the Corda Blog. The main goal behind this post was to provide an easily accessible high-level overview on monitoring Corda nodes. It also showcases part of what I’ve done during my summer internship at R3.

Intro

Here at R3, we have a cluster of Corda nodes that we use for performance testing. We have developed a performance testing suite that enables us to establish baseline numbers, quantify improvements from new features, and identify regressions.

Compiling My C++ CHIP-8 Emulator to WebAssembly

Sat, 15 Aug 2020 16:55:48 +0100

A couple of months ago I wrote a CHIP-8 emulator in C++17, as I wanted to learn about emulation and expand my C++ knowledge outside of work. In this post I’ll explain how I went about compiling the emulator which was designed to run natively, to also run on the web using the magic of WebAssembly. You can try out the result here.

My main motivation for getting the emulator working on the web was that in its current state, it took some effort to get it up and running. I could send someone the pre-compiled binary or give building instructions, but those aren’t guaranteed to work on every platform. Ideally, I wanted a solution that can be hosted on the web, and I recently heard about this cool new “WebAssembly” which seemed perfect for the job.

First Blog Post

Sat, 01 Aug 2020 15:16:16 +0100

Hi, I’m Dom. Welcome to my first blog post!

My main objective for this blog is to start documenting my work more. Having had completed some small side projects and interning at some companies, I wanted a place to document the details of my past work. I thought that a blog is the perfect place for this!

I’ve also been quite curious about Swyx’s Learn in Public philosophy for a little while, so I thought I’d give blogging a go and put it to the test. Reading Show Your Work by Austin Kleon has also been quite a factor in terms of giving me that final push I needed to get this blog set up.