Update configuration and post metadata for improved clarity and SEO

rajsinghtech · rajsinghtech · commit 2c485ee6890f · 2025-07-15T02:20:08.000-05:00
- Changed baseurl in config.toml to reflect the new domain.
- Updated disqusShortname for consistency with the new blog name.
- Enhanced metadata for multiple posts, including slugs, descriptions, and image references.
- Standardized tag casing across posts for uniformity.
- Adjusted weights for better content organization in the blog.
diff --git a/config/_default/config.toml b/config/_default/config.toml
@@ -1,5 +1,5 @@
 # Change baseurl before deploy
-baseurl = "https://demo.stack.jimmycai.com"
+baseurl = "https://rajsingh.info"
 languageCode = "en-us"
 title = "Raj Singh"
 
@@ -12,7 +12,7 @@ defaultContentLanguage = "en"
 hasCJKLanguage = false
 
 # Change it to your Disqus shortname before using
-disqusShortname = "hugo-theme-stack"
+disqusShortname = "rajsingh-blog"
 
 [pagination]
 pagerSize = 5
diff --git a/content/post/argocd-tailscale/index.md b/content/post/argocd-tailscale/index.md
@@ -1,9 +1,13 @@
 ---
 title: "Multi-Cluster Kubernetes Setup with Tailscale and ArgoCD"
 date: 2025-05-06 00:00:00+0000
+slug: multi-cluster-kubernetes-setup-with-tailscale-and-argocd
+description: "Learn how to connect multiple Kubernetes clusters using Tailscale and manage them centrally with ArgoCD for seamless multi-cluster GitOps deployments"
+image: argo-clusters.png
 draft: false
-tags: ["Kubernetes", "Tailscale", "ArgoCD", "Networking", "DevOps"]
+tags: ["kubernetes", "tailscale", "argocd", "networking", "devops"]
 categories: ["Kubernetes", "Tailscale"]
+weight: 3
 ---
 
 This guide focuses on configuring the Tailscale Kubernetes operator to expose Kubernetes API servers across multiple clusters for ArgoCD multi-cluster management.
@@ -78,7 +82,7 @@ For egress proxies to communicate with Kubernetes API servers exposed by the Tai
 ### Why ACL Grants Are Required
 
 Without proper ACL grants:
-1. Access to remote Kubernetes API servers will be blocked by Tailscale\'s access controls
+1. Access to remote Kubernetes API servers will be blocked by Tailscale's access controls
 2. Tailscale Egress proxies will be unable to manage resources across clusters
 3. Cross-cluster API server communication will fail with authentication errors
 
@@ -126,7 +130,7 @@ DNS configuration is a critical component that enables your ArgoCD cluster to re
 2. Communication between clusters would fail as hostname resolution would not work
 3. ArgoCD would be unable to connect to remote Kubernetes API servers
 
-The Tailscale DNS nameserver provides resolution for all nodes in your Tailnet, enabling seamless cross-cluster communication through Tailscale\'s private network.
+The Tailscale DNS nameserver provides resolution for all nodes in your Tailnet, enabling seamless cross-cluster communication through Tailscale's private network.
 
 ### Implementation
 
diff --git a/content/post/byod-gatewayapi-tailscale/index.md b/content/post/byod-gatewayapi-tailscale/index.md
@@ -1,9 +1,13 @@
 ---
 title: "BYO Domain Gateway API Tailscale Operator"
 date: 2025-05-21 00:00:00+0000
+slug: byo-domain-gateway-api-tailscale-operator
+description: "Use custom domains with Tailscale services by integrating Kubernetes Gateway API, ExternalDNS, and CertManager for automated DNS and TLS management"
+image: gateway-traffic.png
 draft: false
-tags: ["Kubernetes", "Tailscale", "GatewayAPI", "Networking", "DevOps"]
+tags: ["kubernetes", "tailscale", "gatewayapi", "networking", "devops"]
 categories: ["Kubernetes", "Tailscale"]
+weight: 2
 ---
 
 While Tailscale excels at making services accessible via its managed `*.ts.net` domain names, using your own custom domain (like `hello.example.com`) for services exposed through the Tailscale Kubernetes operator requires a different approach. Tailscale itself doesn't manage DNS records or issue TLS certificates for domains it doesn't control. This guide presents a robust solution to this by integrating the Kubernetes Gateway API (specifically with Envoy Gateway) with ExternalDNS and CertManager. This combination allows you to seamlessly use your custom domains for services on your tailnet, complete with automated DNS and TLS management.
diff --git a/content/post/cluster-architecture/index.md b/content/post/cluster-architecture/index.md
@@ -7,8 +7,8 @@ image: cover.png
 categories:
     - Kubernetes
 tags:
-    - Kubernetes
-weight: 1
+    - kubernetes
+weight: 6
 draft: false
 ---
 
diff --git a/content/post/tailscale-operator/index.md b/content/post/tailscale-operator/index.md
@@ -8,11 +8,11 @@ categories:
     - Kubernetes
     - Tailscale
 tags:
-    - Kubernetes
-    - Tailscale
-    - Networking
-    - Security
-weight: 1
+    - kubernetes
+    - tailscale
+    - networking
+    - security
+weight: 5
 draft: false
 ---
 
diff --git a/content/post/tsflow-tailscale/index.md b/content/post/tsflow-tailscale/index.md
@@ -7,8 +7,8 @@ image: tsflow.png
 categories:
     - Tailscale
 tags:
-    - Tailscale
-weight: 1
+    - tailscale
+weight: 4
 draft: false
 ---
 
diff --git a/content/post/tsidp-tailscale/client-create-sucess.png b/content/post/tsidp-tailscale/client-create-sucess.png
diff --git a/content/post/tsidp-tailscale/client-create.png b/content/post/tsidp-tailscale/client-create.png
diff --git a/content/post/tsidp-tailscale/clients.png b/content/post/tsidp-tailscale/clients.png
diff --git a/content/post/tsidp-tailscale/grafana-login.mov b/content/post/tsidp-tailscale/grafana-login.mov
diff --git a/content/post/tsidp-tailscale/index.md b/content/post/tsidp-tailscale/index.md
@@ -0,0 +1,197 @@
+---
+title: "tsidp Just Got a UI, and Managing SSO Has Never Been Easier"
+date: 2025-07-15 00:00:00+0000
+slug: tsidp-ui-tailscale
+categories:
+  - Tailscale
+tags:
+  - tailscale
+  - authentication
+  - oidc
+  - ui
+description: "Introducing a web UI for tsidp that makes turning your Tailscale network into a single sign-on provider as easy as clicking a button"
+featured: true
+toc: true
+weight: 1
+---
+
+## tsidp Now Has a Web UI!
+
+If you've been following Tailscale's experimental features, you might have heard about tsidp—the tool that turns your tailnet into an OpenID Connect provider. It's brilliant: use your Tailscale identity to log into Grafana, Portainer, or any OIDC-compatible app. No more passwords. No more separate user management.
+
+The latest update brings something game-changing: **a built-in web UI for managing OIDC clients**. No more JSON files, no more command-line configuration. Just a clean, simple interface that makes SSO setup as easy as clicking buttons.
+
+Let me show you how much easier authentication just got.
+
+## Before: Manual Configuration Hell
+
+Previously, managing OIDC clients in tsidp meant:
+
+```bash
+# Option 1: Edit JSON files directly
+vim /var/lib/tsidp/oidc-clients.json
+
+# Option 2: Use curl to make API calls
+curl -X POST https://idp.ts.net/clients \
+  -H "Content-Type: application/json" \
+  -d '{"name":"grafana","redirect_uris":["https://grafana.ts.net/oauth/callback"]}'
+
+# Hope you saved that secret somewhere...
+```
+
+No visual feedback. No easy way to see all your clients. Just raw JSON and API calls.
+
+## After: Click, Type, Done
+
+With the new UI, here's the same process:
+
+1. Open `https://idp.your-tailnet.ts.net`
+2. Click "New Client"
+3. Type in a name and redirect URI
+4. Copy the generated secret
+5. Save
+
+That's it. No JSON. No command line. No manual secret generation.
+
+## What the UI Brings to the Table
+
+![tsidp client dashboard](clients.png)
+
+### Client Management Dashboard
+The main screen shows all your OIDC clients at a glance. No more guessing what's configured—everything's right there:
+- Client names and IDs
+- When they were created
+- Quick edit and delete buttons
+
+### One-Click Client Creation
+Adding a new app to your SSO setup is now ridiculously simple:
+
+![Creating a new OIDC client](client-create.png)
+
+1. Click "New Client"
+2. Give it a friendly name (like "Grafana" or "Portainer")
+3. Add your redirect URIs
+4. Hit save
+
+The UI generates a cryptographically secure secret and shows it exactly once. This isn't me being paranoid—it's good security practice that prevents accidental secret exposure.
+
+![Client created successfully with one-time secret display](client-create-sucess.png)
+
+### Visual Feedback That Makes Sense
+- Clear success messages when clients are created
+- Obvious warnings about one-time secret viewing
+- Form validation that catches errors before they happen
+- Dark theme that matches Tailscale's aesthetic (because consistency matters)
+
+## Real-World Usage: From Setup to Login in 3 Minutes
+
+Let me walk you through setting up Grafana with tsidp using the new UI:
+
+### Step 1: Create the Client (30 seconds)
+
+1. Navigate to your tsidp UI
+2. Click "New Client"
+3. Name: "Grafana"
+4. Redirect URI: `https://grafana.ts.net/login/generic_oauth`
+5. Save and copy that secret!
+
+### Step 2: Configure Grafana (2 minutes)
+
+Add this to your `grafana.ini`:
+
+```ini
+[auth.generic_oauth]
+enabled = true
+name = Tailscale
+client_id = [your-client-id-from-ui]
+client_secret = [that-secret-you-copied]
+scopes = openid email profile
+auth_url = https://idp.your-tailnet.ts.net/authorize
+token_url = https://idp.your-tailnet.ts.net/token
+api_url = https://idp.your-tailnet.ts.net/userinfo
+```
+
+### Step 3: There Is No Step 3
+
+Restart Grafana. Click "Sign in with Tailscale". You're in. No passwords. No 2FA dance. Just your tailnet doing what it does best.
+
+<video src="grafana-login.mov" controls style="width: 100%; max-width: 800px;">
+  Your browser does not support the video tag.
+</video>
+
+## Who This Is For
+
+### The Homelab Hero
+Running 20+ services with different passwords? The UI makes it trivial to migrate them all to Tailscale-based auth. No more password resets, no more forgotten credentials.
+
+### The Small Team Lead
+Managing access for a small team? Add their Tailscale emails to your network, and they automatically get access to all your internal tools. When someone leaves, remove them from Tailscale—done.
+
+### The Security-Conscious Developer
+Want SSO without the complexity of enterprise solutions? The UI makes tsidp accessible without compromising security. One-time secret viewing, secure generation, clear audit trails.
+
+## Getting Started in 5 Minutes
+
+Ready to simplify your authentication? Here's the quickest way with Docker:
+
+### 1. Run tsidp with Docker (1 minute)
+
+```bash
+docker run -d \
+    --name tsidp \
+    -p 443:443 \
+    -e TS_AUTHKEY=tskey-auth-krxBUk3kED11CNTRL-JrD6Kq5tqUB2ykyBgYxkUB9x3vTLpsZ9a \
+    -e TAILSCALE_USE_WIP_CODE=1 \
+    -v tsidp-data:/var/lib/tsidp \
+    tailscale/tsidp:unstable \
+    tsidp --hostname=idp --dir=/var/lib/tsidp
+```
+
+Replace the `TS_AUTHKEY` with your actual Tailscale auth key from [the admin console](https://login.tailscale.com/admin/settings/keys).
+
+### 2. Access the UI (10 seconds)
+
+Once it's running, open your browser to `https://idp.your-tailnet.ts.net`
+
+You'll see the clean client management dashboard:
+
+![tsidp client dashboard](clients.png)
+
+### 3. Create Your First Client (1 minute)
+
+Click "New Client" and fill in:
+- **Name**: Your app's name (e.g., "Grafana")
+- **Redirect URI**: Your app's OAuth callback URL
+- Click save and **copy that secret immediately!**
+
+### 4. Configure Your App (2-3 minutes)
+
+Each app needs these tsidp endpoints:
+- **Authorization**: `https://idp.your-tailnet.ts.net/authorize`
+- **Token**: `https://idp.your-tailnet.ts.net/token`
+- **User Info**: `https://idp.your-tailnet.ts.net/userinfo`
+
+### 5. Test It Out
+
+Log out of your app, click "Sign in with Tailscale", and enjoy password-free access!
+
+## Common Apps That Work Great
+
+Here are some popular services that work seamlessly with tsidp:
+
+- **Grafana** - Monitoring dashboards
+- **Portainer** - Container management
+- **Proxmox** - Virtualization platform
+- **Wiki.js** - Documentation
+- **Gitea** - Git hosting
+- **NextCloud** - File sharing
+- **Jellyfin/Plex** - Media servers
+- **Home Assistant** - Home automation
+
+Basically, if it supports OIDC, it works with tsidp.
+
+---
+
+*tsidp is experimental and requires `TAILSCALE_USE_WIP_CODE=1`. Perfect for homelabs and internal tools, but not recommended for production use yet.*
+
+*The UI is open source and contributions are welcome! Find it on [GitHub](https://github.com/tailscale/tailscale) and help make authentication even simpler.*
diff --git a/content/post/unifi-cilium/index.md b/content/post/unifi-cilium/index.md
@@ -1,17 +1,17 @@
 ---
 title: Advertise Routes from Kubernetes Running Cilium to a Unifi Router over BGP
-description: 
+description: "Configure BGP routing between Cilium-enabled Kubernetes clusters and Unifi routers for dynamic route advertisement and seamless network connectivity"
 slug: cilium-unifi
 date: 2024-11-19 00:00:00+0000
 image: unifi-cilium.png
 categories:
     - Kubernetes
 tags:
-    - Cilium
-    - Unifi
-    - BGP
-    - FRR
-weight: 1
+    - cilium
+    - unifi
+    - bgp
+    - frr
+weight: 7
 draft: false
 ---
 
