bruck.me

About

Fri, 07 Aug 2026 20:00:00 +0000

Hi, I’m Kordian — an SRE and software engineer based in Munich. This site is where I write about the things I run into building and operating production systems: Kubernetes, CI/CD, infrastructure, and the occasional cat or pizza tangent.

Since 2015 I’ve led TUM Dev, an open-source engineering team at TU Munich, where we build and run gocast, the university’s lecture-streaming platform, and NavigaTUM, a search engine for campus rooms and buildings.

Privacy Policy

Fri, 07 Aug 2026 20:00:00 +0000

Last updated: August 2026

This is the personal website and consulting page of Kordian Bruck (“I”, “me”), reachable at k@bruck.me. This policy explains what happens with your data when you visit bruck.me.

What this site collects

This site does not use cookies, does not run advertising, and does not require an account to read anything on it. No personal data is collected automatically beyond what your browser or hosting infrastructure sends as part of normal web traffic (e.g. IP address in server logs), which is not linked to any identity.

Consulting

Wed, 12 Feb 2025 09:41:07 +0000

Pinning SSL Certs with cURL from PHP

Sun, 18 Apr 2021 17:41:56 +0000

I wanted to do some REST client stuff in PHP with cURL today. It has the neat CURLOPT_PINNEDPUBLICKEY option that one can use to set the certificate fingerprint. Unfortunately its a bit cumbersome, as one needs to enter the fingerprint in base64, instead of just the format the browser displays if you look at the cert directly (e.g.: 529728d7c43746c0bb02ac4a4c3bffb7028ac1591ecb08b6a0721a660aa1d3ce).

Luckily we can just get the correct fingerprint format using this one command:

Silos and Knowledge Sharing

Sat, 26 Sep 2020 21:05:01 +0000

This blog post is a reworked chapter from my master thesis with the title “Site Reliability Engineering in a Transformative IT Landscape – Transitioning from Monolith to Microservices” at TUM submitted on the 15.12.2018. I wrote this thesis while working as an SRE at eGym in Munich, observing their technological transformation and how they applied SRE in practice.

Introducing a microservice landscape to an existing system is not only a challenge on the technical side. It especially requires a change of mind in the way our development processes works.

Why software matters

Sun, 21 Jun 2020 15:31:20 +0000

Years ago I worked at a consulting company writing software for a German car manufacturer. This project was a multi-year endeavor and had all the bits and pieces in place to become the next generation legacy software that nobody wants to touch. We are talking about a multi-million investment and a 50 person team of engineers, business analysts, architects and managers.

We were essentially building a Java EE monolith with a Javascript-backed frontend. Back then, in 2017, Kubernetes was starting to emerge as an interesting option and we experimented around with deployments, but it didn’t affect the architecture decisions too much. We continued to build a humongous monolith and the project was only set to go live after the core functionality had been built.

RestartOPs

Sun, 21 Jun 2020 13:11:19 +0000

This term describes the general operational practice of restarting backend services to overcome system failures. While popular with java deployments, this can be observed with other systems as well.

I took the liberty to collect a few gems from the Internet:

With all the above documentation, this obviously shows to be a widely spread industry practice that everyone should absolutely adopt right away! RestartOPs allows you to save precious time spent on debugging applications and understanding the actual problem that one is seeing.

The simplest CI setup ever

Fri, 01 May 2020 23:25:44 +0000

This weekend I started to go back and look at a few projects of mine. A few years ago I setup most of those using a mix of Travis CI for building/testing, docker hub for image building/hosting and then somehow wiring this all together with a custom stack. Today this feels outdated and overly complex. As an SRE I’m allergic to complexity. So I spent a few hours checking out the new Github packages and actions.

Operating your own mail server is a pain

Sun, 05 Apr 2020 15:17:59 +0000

tl:dr; I’m going to tell you all the reasons you shouldn’t run your own mail server.

I actually wanted to name this post “Thinking about running your own mail server? Here is why this is a bad idea” but I’d like for everyone to opt out of click bait titles. I stopped clicking on anything that sounds like click bait (Youtube, Twitter, News) as my brain got trained to see those as low quality time stealers.

Where it all started – goodbye Cybton

Thu, 13 Jun 2019 00:49:20 +0000

In my previous post I’ve mentioned my entry to programming was first via C++ and afterwards I wandered of into the wide fields of web development. A fundamental problem back then for me was that I did not have any money and that properly running a website required you to have a static IP with a Webserver that ideally could not only deliver static content like HTML, CSS and images, but also included PHP to have dynamic content.

Kubernetes: proxy requests without additional pods

Thu, 04 Oct 2018 13:12:10 +0000

Sometimes you need to provide a legacy access to various downloads or proxy some requests to a different endpoint, that might not be running in your cluster. One can natively redirect such requests with having to add additional deployments / containers to your Kubernetes cluster.

There is a special type of Kubernete’s service object that simply points any traffic to that external DNS name. This isn’t really document all too well but eventually you will find enough issues and pointers to frankenstein a solution together. For anybody else looking on how to do this correctly, here is run down with nginx-ingress-controller:0.19.0 that worked for me.

Kubernetes: get service account secret for dashboard login

Mon, 09 Apr 2018 22:27:27 +0000

To login to the Kubernetes dashboard, you need a token. This token can be retrieved with the following command:

kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep <admin-user> | awk '{print $1}')

ZSH shortcut: quickly commit using a function

Sat, 07 Apr 2018 14:52:42 +0000

I have many private git repos to manage all the configuration files, ansible playbooks, source code and other stuff you would want to version. Most of them are just for me to view and often I want to quickly ‘save’ my current process by creating a commit I can go back to.

I just recently switched to zsh after years of using bash – never had I thought that my life would change that much. So many neat little things that are really helpful and make my life easier. Themes, plugins and the oh so amazing oh-my-zsh really make it a pleasure to do stuff on the console. (I always have to bite my tongue once I SSH into a server that only has sh or bash now.

The road to Kubernetes: hosting your own cluster on VMs

Fri, 06 Apr 2018 22:45:00 +0000

I finally wanted to setup my own kubernetes cluster as everyone I talk to, said its the hottest shit.

I’m using three VMs, hosted at Netcup running the latest Debian 9 Stretch build. I’ve installed most basic tools for me and also already set up docker using this amazing ansible role. Make sure to disable any swap you have configured – kubelet will not start otherwise.

The documentation on how to install things is pretty good, but I’ve missed some details, that I banged my head on, so I will copy most snippets over for future reference. Keep in mind, that this might have already changed and is no longer working at the time you read this.

Termina(l)te your way in style

Fri, 06 Apr 2018 19:42:45 +0000

Usually I love to use guake as my terminal in gnome, as it quickly hides using the F12 key and you always have your terminal in reach.

When doing more server heavy tasks, I often end up having several tabs in guake which tends to be messy. In those cases I love to use Terminator – the ultimate Terminal.

Quickly installed using the following:

# Debian / Ubuntu
apt install terminator

# Arch Linux
pacman -S terminator

Then you can use the following keyboard shortcuts to easily spawn new terminals the GUI way, instead of using tmux.

Arch Linux: Touchpad right click no longer working

Thu, 29 Mar 2018 08:16:18 +0000

I’ve been using Arch on my XPS 2015 edition since the very beginning. Not only was the support of the software components newer/better than Dell’s official Ubuntu version for the developer edition, but also I absolutely love the rolling release before it was cool.

So as we are bleeding edge, sometimes things break. Arch moved over to wayland some time ago, but like two days ago my touchpad’s right & middle click stopped working. Quick google search later revealed, that my gnome settings had the following option set to ‘fingers’. That didn’t work as my XPS has ‘areas’ – so switching it over with this simple command, fixed things for me.

Easily add your Github SSH Keys to any Server or Docker Image

Sat, 24 Mar 2018 18:12:11 +0000

The default way to copy your ssh key(s) to a remote server is to use the _ssh-copy-id _command. This will create a secure connection to the remote server over SSH and then check if the user exists, create the folder&files if needed and add your keys. Works, Easy, Simple.

My problem is, that often I’m already in the shell and I logged in with some password combination, that I would need to enter a second time to copy my ids. Also I don’t always have all my keys on one machine. As I often get asked by my colleagues, what my SSH keys are, there is a nifty trick you can do, instead of sending them over via E-Mail.

Github requires referer header field to login

Wed, 22 Feb 2017 18:33:00 +0000

So I’ve had this happen for some time now and could not determine the perpetrator as it was happening not really too often. From time to time I would encounter a error when trying to Login to Github:

Oops! Something went wrong. Please try again later.

In many cases this was related to something using oAuth but not in mine. I simply wanted to login to Github as usual.

So after some trial and error, I’ve noticed that disabling the “Referer Control” extension in chrome or chromium would solve the issue. My guess is they simply use that to prevent XSRF attacks.

LetsEncrypt now used everywhere

Wed, 22 Jun 2016 00:46:00 +0000

So today I decided to move all my certificates from StartSSL to LetsEncrypt. Not only is StartSSL really a bad CA with recent problems, but also they limit you with several obstacles that just don’t make any sense. They really just want you to sign up for one of their “great” extended validation thingys. Over the last couple months they have really improved the web interface but still this is not enough to deal with today’s challenges of delivering secure connections to users easily. Their new APIs and StartEncrypt service are merely a late effort, trying to outbid LE with a worse service. Not worth the time or effort.

“libGL error: unable to load driver: i965_dri.so” fix

Fri, 10 Jun 2016 09:49:49 +0000

So I actually rarely encounter any problems with my Arch Linux, but sometimes they just want to see the world burn. Apparently after updating the mesa driver, so library got lost.

Easy fix:

# Arch Linux
mv ~/Android/Sdk/tools/lib64/libstdc++/libstdc++.so.6{,.bak}
mv ~/Android/Sdk/tools/lib64/libstdc++/libstdc++.so.6.0.18{,.bak}
ln -s /usr/lib/libstdc++.so ~/Android/Sdk/tools/lib64/libstdc++/

Thanks to proft.me for providing this!

Featured on Codementor – 25 PHP Interview Questions

Tue, 01 Mar 2016 04:33:43 +0000

I’m glad to be part of the amazing community at codementor.io. In the past years I’ve been able to talk and help many different people with a range of problems. Often some hints and good advice was enough to point them in the right direction and I really enjoy teaching other people.

Codementor recently approached me and asked me if I could contribute some questions from my experience in the last years to their blog post “25 PHP Interview Questions”. I’m happy they found my suggestions useful and featured me in that article! Hope it helps some developers that are just getting to know the world of PHP and all its hiccups.

Properly setup proguard for an Android project

Tue, 05 Jan 2016 16:15:25 +0000

When dealing with an Android project you want to use Proguard to minify, shrink and possibly even obfuscate the code. The gains from this are huge and many smart minds have put a lot of thought into Proguard. We encountered that the TUM Campus App shrinked from 20 Megabytes to just 9 Megabytes with all the optimization in place – huge savings if you deploy it to 10k+ clients!

Really if you are not using this in your project currently you must be insane!

Git command of the day: git remote prune

Mon, 04 Jan 2016 17:04:04 +0000

In this series of posts I’ll document useful git commands ready to copy&paste which nobody knows by heart but you need once in a while. Today:

git remote prune <name>

From the docs:

prune

Deletes all stale remote-tracking branches under . These stale branches have already been removed from the remote repository referenced by , but are still locally available in “remotes/”.

With --dry-run option, report what branches will be pruned, but do not actually prune them.

Very useful when working with Github and you just merged a PR then usually you also delete the branch on the remote immediately after. This does not however delete the branch from your local repository and over time it can get messy. With this simple command you delete all local references tracking upstream branches which were deleted on the server. If your remote is called origin then just type enter it like so::

git remote prune origin