When running my legacy pipeline on Azure devops I ran into the following issue when running AZCopy.
<pre><code class="language-bash">2020-11-15T12:30:03.1523563Z ##[error]Upload to container: 'css' in storage
account: 'tmdn' with blob prefix: '' failed with error: 'AzCopy.exe exited with
non-zero exit code while uploading files to blob storage.' For more info please
refer to https://aka.ms/azurefilecopyreadme 
</code></pre>
<hr>
After some investigation I discovered that I had to apply the following roles to the service principal at the Storage Account IAM level:
<ul>
<li>Storage Blob Data Contributor</li>
<li>Storage Blob Data Owner</li>
</ul>
Once the above roles were applied the issue was resolved and I was able to copy items into Azure Storage.

Solving the Azure Copy permissions by ensuring that the correct roles are applied to the service principal at the storage account IAM level.

Azure Copy Permissions Error

I decided to setup my local NAS server using a raspberry Pi and a USB connected SSD. This will involve installing and configuring samba on the raspberry Pi to allow access from Windows.
Here are the steps I followed in order to get everything working.
<ul>
<li>If your setting up your raspberry Pi for the first time, install the <a href="https://www.raspberrypi.com/software/">Raspberry Pi Imager</a> which will allow you to install the Raspberry Pi OS (aka Raspbian) onto an SD card.</li>
<li>Once you installed the Raspberry Pi Imager install the latest headless (aka desktop free) software. Ensure that you give your Pi a hostname and enable SSH.</li>
<li>Connect your raspberry Pi to your network. My raspberry Pi has the <a href="https://www.raspberrypi.com/products/poe-hat/" title="PoE hat">PoE hat</a> hence once I connect it to my network via Ethernet it will recieve power. </li>
<li>Connect your external SSD drive ensuring that it has been formatted correctly. SSH to your pi and run the following to determine whether your SSD has connected: </li>
</ul>
<code>sudo lsblk -o UUID,NAME,FSTYPE,SIZE,MOUNTPOINT,LABEL,MODEL</code>
<ul>
<li>You should see a similar result to this:</li>
</ul>
<img src="//images.ctfassets.net/ifshb5hrrgy8/4tOw3ZBDf9IygaKxp29Cam/4ad31eac608abba88e28d6b7c8ca565d/image.png" alt="List Disks">
<ul>
<li>You should be able to see your drive in the list, take note of the path at the beginning and the label.</li>
<li>You'll need to create a folder of the location where you would like to mount your external device<ul>
<li><code>sudo mkdir /mnt/main-share-1</code></li>
</ul></li>
<li>Mount the external drive onto the share locations.<ul>
<li><code>sudo mount /dev/sda2 /mnt/main-share-1</code></li>
</ul></li>
<li>Change permissions on /mnt directory<ul>
<li><code>sudo chmod 775 /mnt/main-share-1</code></li>
</ul></li>
<li>Create a separate user for accessing the media files. Follow all the steps in the user creation wizard.<ul>
<li><code>sudo adduser mediapi</code></li>
</ul></li>
<li>List the users just to confirm that the creation went successfully
<img src="//images.ctfassets.net/ifshb5hrrgy8/3fGFDA2rzZWs2EMzhIpa4a/47cf701e46ede52b0506ec2a25ea3e42/image.png" alt="List users"></li>
<li>Install samba and then backup the config<ul>
<li><code>sudo apt install samba</code></li>
<li><code>sudo cp /etc/samba/smb.conf /etc/samba/smb.conf.bk</code></li>
</ul></li>
<li>Edit samba config<ul>
<li><code>sudo nano /etc/samba/smb.conf</code></li>
</ul></li>
<li>Add the share info at the bottom</li>
</ul>
<pre><code> [main-share-1]
 comment = Samba on Ubuntu
 path = /mnt/main-share-1
 read only = no
 browsable = yes
</code></pre>
<ul>
<li>Then save the file</li>
<li>Restart samba server<ul>
<li><code>sudo service smbd restart</code></li>
</ul></li>
<li>Update firewall rules to allow samba<ul>
<li><code>sudo ufw allow samba</code></li>
</ul></li>
<li>Setup samba user <ul>
<li><code>sudo smbpasswd -a mediapi</code></li>
</ul></li>
</ul>
The NAS configuration is complete and you should be able to access the server from a Windows PC.
<ul>
<li>Go to your Windows PC and open a run dialog and type in the IP address followed by the share path in the UNC format:</li>
</ul>
<img src="//images.ctfassets.net/ifshb5hrrgy8/0DZuHAS7Kq8Ik0RccTK4m/15211d0104b20a3d4a8017246f3762db/image.png" alt="UNC share for NAS drive">
If you want you can add the network location share permantley in Windows.

Creating a NAS drive can be a simple affair however maintainability becomes an issue when you are beholden to specific OEMs. An alternative is to try and configure your server as much as possible using this method of a Pi and a SSD.

Media NAS Pi Server

<h3>Introduction</h3>
Below are the steps needed to setup PiHole with Unifi UDM Pro.
The sofware versions involved are:
<ul>
<li>Unifi UDM Pro: Network v6.5.55</li>
<li>Raspberry PI 4: PiHole v5.8.1 </li>
</ul>
<h3>TL;DR</h3>
The main actions to note are:
<ul>
<li>Setup networks for devices that you require in Unifi.</li>
<li>Ensure the networks have no content filtering in Unifi.</li>
<li>Setup appropriate network/firewall rules to allow access to DNS.</li>
<li>Install and enable PiHole</li>
</ul>
<h3>Configuration</h3>
<h5>PiHole</h5>
I have a raspberry Pi 4 attached to my home network. 
<ul>
<li>Configure &#x26; install raspbery Pi on your device: <a href="https://www.raspberrypi.com/software/">https://www.raspberrypi.com/software/</a> make sure SSH is enabled.</li>
<li>Install PiHole <a href="https://docs.pi-hole.net/main/basic-install/">https://docs.pi-hole.net/main/basic-install/</a></li>
<li>If you have several networks/subnets set up you'll need to Permit all origins</li>
<li>Go to settings -> DNS -> Interface Settings</li>
<li><img src="//images.ctfassets.net/ifshb5hrrgy8/5Q6e7LEbZHQLAVD7DC6cqH/8e035bcc266f3b4c3e20b2a60a216ecb/image.png" alt="PiHole Permit All Origins"></li>
<li>Save those changes.</li>
</ul>
<h5>Unifi</h5>
I have setup 4 networks with the following CIDRs:
<a href="//images.ctfassets.net/ifshb5hrrgy8/3gkb1FLnAm1NGDfRbQpAlS/1ef1a8e89f97796c853d3e0c13928260/image.png">Unifi network CIDRs</a>
You need to setup firewall rules to control traffic on your network but in order to allow DNS traffic to your PiHole you'll need the following:
<ul>
<li>Rule Type: LAN in</li>
<li>Description: ALLOW ALL to DNS</li>
<li>Action: Accept</li>
<li>IPv4 Protocol: TCP and UDP</li>
</ul>
Source Settings
<ul>
<li>Source Type: Address/Port Group</li>
<li>IPv4 Address Group: Any</li>
<li>IPv4 Port Group: Any</li>
</ul>
Destination Settings
<ul>
<li>Destination Type: Address/Port Group</li>
<li>IPv4 Protocol: DNS Server -> Create a group with the IP of the DNS Server with PiHole.</li>
<li>Port Group: DNS Port -> Create a group with the port number 53.</li>
</ul>
Save those settings.
Next you'll need to set the DNS IP for all the networks that you've setup as follows:
Go to each network and set the DNS IP to the DNS Server (in my case it's 192.168.1.2):
<img src="//images.ctfassets.net/ifshb5hrrgy8/3VucMvIh4TNg8rMxdHHfRh/3e19d2864fc30ee5de72b4e0420367ad/image.png" alt="DNS settings for network">
Make sure that no content filtering settings have been set as this will interfere with DNS queries.
<img src="//images.ctfassets.net/ifshb5hrrgy8/66mYZHW0PvDC8vgZhsMORq/667614ff0298a85e2c3b8a45862c3d76/image.png" alt="Content filtering settings">
Save those settings.

Configuring PiHole and Unifi for DNS content filtering

M is for Mackolicious

Developer

Blogger

Services