One of the things I missed moving from WordPress to Hugo: scheduled posts. WP just… does that. Set a future date, and forget about it.

And static site generators don’t… The site only rebuilds when you git push, and that’s it. 😢

Why schedule posts, you ask? Because at times I write 3-4 posts in a day, and I don’t want to spam. ¯\(ツ)/¯ I have a rule that there should only be a single published post a day, and if I know I’m out of topics (especially for FlatTurtle) I tend to add a week or 2 between posts to spread it out evenly.

So I wrote (aka vibe coded) a little thing about a year or two ago, originally called BlogTurtle Rebuilder, because it was meant for FlatTurtle’s hugo blog. I’ve since repurposed it for this site.

The flow is quite simple:

1. I push a Markdown post to GitLab with date = "..." set to whenever I want it published.
2. Gitlab runs CI and deploys to Cloudflare Pages. Hugo will, however, hide posts with a date in the future.
3. On push, GitLab also pings a webhook (a docker container on a server).
4. Said container does a git pull and scans every .md for that date field.
5. Anything in the future gets an in-memory timer for that exact moment. Anything already due gets ignored at Gitlab CI would’ve deployed it.
6. When the timer pops, it triggers the GitLab CI/CD pipeline (through another webhook) that does a new Hugo build + deploy.
7. As an added bonus, I get an email telling me the post is live, with a Things3 deep-link to add a follow-up task to share it somewhere. It’s one click away.

That’s the whole thing.

What a time to be alive! The web is truly, utterly broken.

To be entirely clear, I’m not doing anything. It just refreshes a million times, DoSing itself in the process, until, after a while, it actually loads “perfectly” fine. All I run is uBlock and NextDNS to get rid of (a portion of) the trackers and ads.

This is the foundation post for the rest of my Home Assistant energy series (if I ever get to it). Before I could automate around electricity, I obviously needed a (real-time) view of what’s actually flowing in and out.

Some context first

• I have solar panels (with a Huawei inverter installed by the previous owner)
• Smappee EV charger (bad purchase, it’s quite dumb and has a terrible UI and Home Assistant can’t control it),
• and I recently got 2x Marstek batteries (great hardware, cheap, and the worst software ever, truly terrible software. Oh and support started ghosting me after I lost my patience around Lunar New Year — they just will not reply to any of my help messages anymore).
• I drive a Polestar 4 (first edition, 2025)

note: the original Huawei inverter was dead when I moved in and likely never worked, don’t think the previous owners ever noticed & it got replaced under warranty after a lot of chasing and nagging Huawei directly. Rensol couldn’t move it forward and I basically asked to be cc’ed in the ticket and got my PA to chase Huawei with all het wrath. Great service from both Huawei and Rensol…

So that’s that… ;)

SlimmeLezer

… And more context.

I use a SlimmeLezer+ with my P1 port (Fluvius smart meter). As ESPHome has significantly changed since I got mine and it wouldn’t compile on a recent release, here’s my working config. ¯\(ツ)/¯

The SlimmeLezer used to be entirely powered by the P1 port but brownouts did happen; my initial config tried to limit memory and WiFi usage in an attempt to prevent these brownouts)… As this is no longer much of an issue (see below), I’ve stopped optimising that. But YMMV depending on your setup.

As the Marstek CT also uses the P1 port and I needed a splitter: I started off with a passive splitter but it was quite clear from the get-go that there were tons of issues (both meters were powered over P1). It’s been a while but I think roughly half the messages didn’t go through to SlimmeLezer (IIRC the message would just be forwarded across the two ports but would be too weak to be consistently read or something). I then got an active P1 splitter. As I only had one power plug available, I’d power either the splitter or the SlimmeLezer over a USB-C PSU… But what really fixed it and brought stability was doubling the power sockets: the splitter is powered over P1 power, both the SlimmeLezer and the Marstek CT have their dedicated power in via USB-C.

Honestly, I had a lot of issues with the Marstek CT, to the point they actually shipped me a replacement unit. In hindsight I don’t think it was broken, more a mix of crap software + P1 power issues + delayed/laggy Marstek dashboards + …

The setup, end to end

                ┌─────────────┐
                │ Solar panels│
                └──────┬──────┘
                       │ DC
                ┌──────┴──────┐
                │   Huawei    │── fusion_solar (cloud)
                │   inverter  │
                └──────┬──────┘
                       │ AC
        ───────────────┴───────────────  ← house AC bus
        │              │                │
  ┌─────┴──────┐ ┌─────┴──────┐  ┌──────┴────────┐
  │ Marstek    │ │ Fluvius P1 │  │ Smappee EV    │
  │ Venus E ×2 │ │ smart meter│  │ Wall + CTs    │
  │ (1× CT003) │ └─────┬──────┘  └──────┬────────┘
  └─────┬──────┘       │ RJ12, DSMR     │ (cloud; read-only)
        │ Modbus       │                │ 
        │ TCP   ┌──────┴──────┐         │
        │       │SlimmeLezer+ │         │
        │       └──────┬──────┘         │
        ▼              ▼                ▼
        ┌────────────────────────────────┐
        │       Home Assistant           │
        └────────────────────────────────┘

SlimmeLezer is fire-and-forget (at least as long as you don’t update ESPHome). Huawei is a cloud-poll. Marstek is local Modbus (but Modbus/battery BMS or firmware does crash and gets stuck. Restarting the integration sometimes fixes it). Smappee, cloud-only, can only read data (as opposed to telling it when to, for example, start/stop charging my EV).

Sensors

What you get out of it, sensor-wise:

sensor.slimmelezer_power_consumed — instantaneous import (kW)
sensor.slimmelezer_power_produced — instantaneous export (kW)
Per-phase power in / out
Per-phase voltage and current
Cumulative energy import + export per tariff
Gas consumption (if you have a gas meter on the same connector)

That’s all I need to know whether I’m paying or selling at any given moment.

The SlimmeLezer YAML

Stock Zuidwijk firmware with three small tweaks and a few changes to get it to compile on the latest ESPHome at the time of writing):

1. output_power: 14dB on the WiFi to fit inside the P1 250mA budget without rebooting (before getting an active splitter and dedicated power).
2. rx_buffer_size: 1200 on UART (down from default 1700). Belgian P1 telegrams are well under 1200 bytes; saves ~500 bytes of heap which the ESP8266 will thank you for.
3. A “Last Restart” and “Last Time Sync” template sensor so I can spot if the device has flatlined.

---
substitutions:
  device_name: slimmelezer
  timezone: "Europe/Brussels"
  domain: ".iot.internal"
  wifi_fast_connect: "false"

esphome:
  name: ${device_name}
  name_add_mac_suffix: false
  project:
    name: zuidwijk.slimmelezer
    version: "2.0"
  on_boot:
    then:
      - if:
          condition:
            lambda: return id(has_key);
          then:
            - lambda: |-
                std::string key(id(stored_decryption_key), 32);
                id(dsmr_instance).set_decryption_key(key.c_str());
          else:
            - logger.log:
                level: INFO
                format: "Not using decryption key. If you need to set a key use Home Assistant service 'ESPHome: ${device_name}_set_dsmr_key'"

esp8266:
  restore_from_flash: true
  board: d1_mini

mdns:
  disabled: false

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password
  fast_connect: "${wifi_fast_connect}"
  domain: "${domain}"
  # Powersaving for brownout due to 250mA restriction P1
  output_power: 14dB

logger:
  level: INFO
  baud_rate: 0

api:
  reboot_timeout: 15min
  encryption:
    key: !secret encryption_key_slimmelezer
  services:
    service: set_dsmr_key
    variables:
      private_key: string
    then:
      - logger.log:
          format: Setting private key %s. Set to empty string to disable
          args: [std::string(private_key).c_str()]
      - globals.set:
          id: has_key
          value: !lambda "return private_key.length() == 32;"
      - lambda: |-
          std::string pk_str(private_key);
          if (pk_str.length() == 32)
            pk_str.copy(id(stored_decryption_key), 32);
          id(dsmr_instance).set_decryption_key(pk_str.c_str());

ota:
  platform: esphome
  password: !secret ota_password
  on_error:
    then:
      - logger.log:
          format: "OTA update error %s"
          args: ["x"]

dashboard_import:
  package_import_url: github://zuidwijk/dsmr/slimmelezer.yaml@main
  import_full_config: true

time:
  - platform: homeassistant
    id: homeassistant_time
    timezone: "${timezone}"
    on_time_sync:
      then:
        - text_sensor.template.publish:
            id: last_time_sync
            state: !lambda 'return id(homeassistant_time).now().strftime("%Y-%m-%d %H:%M:%S");'
        - if:
            condition:
              lambda: 'return id(device_last_restart).state == "";'
            then:
              - text_sensor.template.publish:
                  id: device_last_restart
                  state: !lambda 'return id(homeassistant_time).now().strftime("%Y-%m-%d %H:%M:%S");'

globals:
  - id: has_key
    type: bool
    restore_value: yes
    initial_value: "false"
  - id: stored_decryption_key
    type: char[32]
    restore_value: yes

uart:
  baud_rate: 115200
  rx_pin: D7
  # Drop DSMR/UART buffers from 1700 → 1200 (Belgian P1 is fine at 1200; saves ~500–600 bytes).
  rx_buffer_size: 1200

dsmr:
  id: dsmr_instance
  max_telegram_length: 1200

sensor:
  - platform: dsmr
    energy_delivered_lux:
      name: "Energy Consumed Luxembourg"
    energy_delivered_tariff1:
      name: "Energy Consumed Tariff 1"
    energy_delivered_tariff2:
      name: "Energy Consumed Tariff 2"
    energy_returned_lux:
      name: "Energy Produced Luxembourg"
    energy_returned_tariff1:
      name: "Energy Produced Tariff 1"
    energy_returned_tariff2:
      name: "Energy Produced Tariff 2"
    power_delivered:
      name: "Power Consumed"
      accuracy_decimals: 3
    power_returned:
      name: "Power Produced"
      accuracy_decimals: 3
    electricity_failures:
      name: "Electricity Failures"
      icon: mdi:alert
    electricity_long_failures:
      name: "Long Electricity Failures"
      icon: mdi:alert
    voltage_l1:
      name: "Voltage Phase 1"
    voltage_l2:
      name: "Voltage Phase 2"
    voltage_l3:
      name: "Voltage Phase 3"
    current_l1:
      name: "Current Phase 1"
    current_l2:
      name: "Current Phase 2"
    current_l3:
      name: "Current Phase 3"
    power_delivered_l1:
      name: "Power Consumed Phase 1"
      accuracy_decimals: 3
    power_delivered_l2:
      name: "Power Consumed Phase 2"
      accuracy_decimals: 3
    power_delivered_l3:
      name: "Power Consumed Phase 3"
      accuracy_decimals: 3
    power_returned_l1:
      name: "Power Produced Phase 1"
      accuracy_decimals: 3
    power_returned_l2:
      name: "Power Produced Phase 2"
      accuracy_decimals: 3
    power_returned_l3:
      name: "Power Produced Phase 3"
      accuracy_decimals: 3
    gas_delivered:
      name: "Gas Consumed"
    gas_delivered_be:
      name: "Gas Consumed Belgium"
  - platform: uptime
    name: "SlimmeLezer Uptime"
  - platform: wifi_signal
    name: "SlimmeLezer Wi-Fi Signal"
    update_interval: 60s
  - platform: template
    name: "Free Heap"
    lambda: |-
      return (float)system_get_free_heap_size();
    unit_of_measurement: "bytes"
    accuracy_decimals: 0
    entity_category: diagnostic
    icon: "mdi:memory"

text_sensor:
  - platform: dsmr
    identification:
      name: "DSMR Identification"
    p1_version:
      name: "DSMR Version"
    p1_version_be:
      name: "DSMR Version Belgium"
  - platform: wifi_info
    ip_address:
      name: "SlimmeLezer IP Address"
    ssid:
      name: "SlimmeLezer Wi-Fi SSID"
    bssid:
      name: "SlimmeLezer Wi-Fi BSSID"
  - platform: version
    name: "ESPHome Version"
    hide_timestamp: true
  - platform: template
    name: 'Last Restart'
    id: device_last_restart
    icon: mdi:timeline-clock
    entity_category: diagnostic
  - platform: template
    name: "Last Time Sync"
    id: last_time_sync
    icon: mdi:clock
    entity_category: diagnostic

Drop that into ESPHome, set your WiFi/encryption secrets, flash, and the device will appear in HA’s ESPHome integration with all the sensors above.

I’m very happy with the SlimmeLezer+ and got my parents one too.

I recently got a WP6003 Air Box (Aliexpress). The official product page seems to be offline but can be accessed through Archive.org.

It's quite straightforward to integrate in a Bluetooth Proxy and Home Assistant thanks to Omar's work.

The major problem I have with it, is that the Bluetooth (4.0) range is terrible. Neither my Mac Mini nor my Bluetooth Proxy could connect with it if I moved it from the office to the kitchen (had it on top of the fridge, so some metal there) that's roughly 10ish meters away.

Sensor wise, I've only had it working for a few days, and so far, it doesn't seem to be very accurate. The temperature is 1-2° below my other sensors... But hey, it's quite cheap and the previous tool I linked has a way to calibrate it (but I haven't tried that yet).

In the screenshot, Airquality level converts bytes into meaningful sensor readings:

• Temperature: Extracted from bytes 6 and 7, then divided by 10 to get the temperature in degrees
• TVOC (Total Volatile Organic Compounds): Extracted from bytes 10 and 11, then divided by 1000 to get the concentration in parts per
• HCHO (Formaldehyde): Extracted from bytes 12 and 13, similarly processed to TVOC.
• CO2 (Carbon Dioxide): Calculated from bytes 16 and 17, adjusted by subtracting 150 to correct the baseline.

Each of these values is then published to different sensor IDs within ESPHome, allowing Home Assistant to display and use this data.

The function returns the size of the data packet as a float, which can be used for debugging or validation. In my case (and assume yours as well) it's 18. I've marked it as internal: true in my config, as it's not useful to show once it's working.

My config for ESPhome can be found here.

You can use this tool to read out the sensor (and find the MAC address) from Chrome.

Guess it's a bit hard to show (and for some reason Firefox refused to take a screenshot of the entire page) but this is my current view in Home Assistant.

Note that I have since added 3 more ATC Xiaomi thermometers and hidden Airquality levels.

In my Home Assistant quest and simplifying (not sure if that's actually happening) and getting more control (aka less reliant on the cloud and 3rd parties) I've been playing with Zigbee.

Zigbee is quite cool because it's a mesh network. As I used it before with my Philips Hue bulbs, I was eager to expand and play with Zigbee.

First thing first. Not all routers are equal. I've got these two smart power plugs as an example (Grey and Blue colour, v2 with HomeKit support) and they act weirdly. They don't seem to route sensors properly, and randomly turn off whatever is plugged in.

The one that seems to work reliably well is this orange Zigbee plug.

Compared to my bulbs (more on that here) the sensors do detect them the two aforementioned power plugs, and do connect, but generally little to no data flows. I'm not entirely sure what the issue is (bad antenna, bad routing software) but the consensus on the internet seems to be: add more routers, don't trust some routers (Ikea and Hue seem decent), and not all endpoints are very smart and pick the best router (so may need to repair or force it to join a specific router). Unlike WiFi, in this case it seems that more is better.

When setting up the network, it's also recommended to first set up and pair the routers and then the endpoints (battery-powered sensors).

And the network takes a while to stabilise (and all routes to be learned). Some people even suggest waiting one or two days for the dust to settle.

Moving routers screws up a lot, too. I've had sensors stop working (and refusing to pair again) after moving some routers and turning some off -- routers that weren't used by said sensors. So really odd stuff.

As always, with Aliexpress, it's very much unclear what the brand/model is, but according to Z2M, all three are TS011F, but two of the three are definitely different (has Apple Homekit support and the plugs are bigger).

The energy (kWh) and Power (W) reporting works well, though, on all three models.

Can see when a charger is plugged in, and charging a MacBook Air.

I'm buying EU plugs because I'll be relocating back to Europe in the next 6 months. So I'm slowly getting rid of my UK smart plugs and replacing them with EU plugs.

Note that these plugs are not approved for (official) sale in Belgium though: child safety is not up to spec and the grounding is not approved (i.e. needs to be a pin). 

In my Home Assistant quest and simplifying (not sure if that's actually happening) and getting more control (aka less reliant on the cloud and 3rd parties) I've been playing with Zigbee.

Zigbee is quite cool because it's a mesh network. As I used it before with my Philips Hue bulbs, I was eager to expand and play with Zigbee.

I have several bulbs, including: Hue Iris, Hue Go, some random bulb, a reading spot, and Hue Play (3x).

My Home Assistant setup uses the Skyconnect. I've updated the firmware (on a Mac) to use Ember firmware as ezsp will be deprecated soon(™).

At the time of writing you can't update the firmware directly from HA just yet, you need another device.

As I had two Zigbee networks (one for Hue, and one for my sensors and Ikea bulb) it made sense to merge them (and have one less connected bridge): it would reduce interference, and the bulbs all act as a router, so that would greatly improve my network coverage and stability.

Generally speaking, it went quite smoothly: delete the devices in the Hue app (it factory resets them and puts them in pairing mode) and then pair them in Zigbee2Mqtt (I use that over ZHA).

However, my main issue was that my Zigbee bulbs were unreliable: it sometimes worked, but often it lagged or timed out. Especially when controlling multiple bulbs at once (such as a big room such as the living room) or sending multiple commands in sequence (on/off/on/off).

In hindsight, my sensors were unreliable as well: there was data missing, and it didn't properly broadcast/update every 5 minutes. I first thought it was just because they were cheap Chinese (TuYa) sensors using battery-power. If the temp or humidity didn't change enough, it wouldn't broadcast.

I often saw errors such as these in Z2M:

2024-05-26 22:29:02Publish 'set' 'state' to 'Hue Play Right' failed: 'Error: ZCL command 0x0017880104d89bc4/11 genOnOff.on({}, {"timeout":10000,"disableResponse":false,"disableRecovery":false,"disableDefaultResponse":false,"direction":0,"srcEndpoint":null,"reservedBits":0,"manufacturerCode":null,"transactionSequenceNumber":null,"writeUndiv":false}) failed ({"target":29608,"apsFrame":{"profileId":260,"clusterId":6,"sourceEndpoint":1,"destinationEndpoint":11,"options":4416,"groupId":0,"sequence":110},"zclSequence":244,"commandIdentifier":11} timed out after 10000ms)'

But the annoying thing (in debugging, and thinking the network "needs to settle") was that it often worked just fine, and then randomly started breaking down/time outing when I thought it was finally solved.

I almost gave up and went back to a Hue bridge, when I asked for some advice on Discord. The reason was the channel...

First off: check the Zigbee channel of your Hue. It's likely 25. Z2M uses channel 11 by default.

There are 4 channels that are getting the least WiFi interference. These are called ZLL channels (whatever that stands for): 11, 15, 20, 25. However, it seems that 11 is quite terrible, and I would not recommend using it.

My Z2M sat on Channel 11 (which is Channel 1 for WiFi). I live in Singapore, in an apartment building, with a shit-ton of WiFi, hence the massive interference and lag on Zigbee.

Also, 2.4Ghz WiFi is generally 20Mhz channel width, whereas Zigbee is 2Mhz, so one WiFi channel overlaps many Zigbee channels. 

You can modify the channel (via the config file in /homeassistant/zigbee2mqtt/configuration.yaml) by adding the following and restarting the Z2M container:

advanced:
  [...] # there should already be a ton of things
  channel: 25

The problem with changing the channel, is that it requires repairing (some of) the Zigbee devices. And it's a total mess to repair Hue bulbs once they are no longer on a Hue bridge.

There's no need to remove the devices from Z2M as that will wipe their configs (I believe). It's possible that removing the devices from Z2M will put them in pairing mode again (for Hue bulbs, see below) but I couldn't get a confirmation.

Ikea has the 6x power off/on sequence that resets them, but Hue dropped support for something similar in some firmware upgrade (why?!?!).

TouchLink is another option, but that didn't work for me at all.

Some Hue bulbs can be reset by long pressing (30-60seconds) the power button (for example the Hue Go), but what worked best for me is pairing them again on the Hue bridge using the serial (force pair), deleting them again, and pairing on Z2M.

However, I didn't have the serial of two bulbs: one Hue Play has the label missing, and the Hue Iris didn't have any label at all. I thought I would be forced to go and purchase a Hue dimmer/remote control (that comes with TouchLink and allows resetting the bulbs)...

However, suddenly, after an hour or two of messing around, the Hue bulbs that weren't repaired just started working again.

So it seems that if they are disconnected from their bridge for a while, they start changing channels until they find the bridge again. I guess there's a chance, with enough patience, that I didn't have to repair my Hue bulbs (not sure about Ikea, and I would definitely not trust my Chinese Power plugs and sensors to come back online).

The sensors are quite easily repaired (long press the pairing button or pinhole and done -- don't forget to set Z2M in Permit join)

Other stuff you can try if the range or network sucks can be found here.

However, if it kinda works, you better not mess with it... :)

I've finally started working with Home Assistant and while the learning curve has been steep, it's been fun.

I'm going to post some random notes (mostly for myself) on things I discovered, and I need to keep in mind.

For example, I have set up an ESP32-c3 Bluetooth Proxy for a Mi ble thermometer.

I've assigned the ESP device to an area: IT cabinet. However, the BLE sensors are scattered across the house (in different areas). Took me a while to figure it out, but you can assign entities to specific areas.

Head to Entities and select the entity config, and at the bottom, unselect use device area, and select the correct area.

Tadaaa, you can now assign the sensors to the correct area, and they'll show up in the right dashboards/cards.

The proxy config can be found here.

I have set up an ESP32-c3 Bluetooth Proxy for a Mi ble thermometer (and I have a few other BLE sensors that I haven't managed to set up yet).

The proxy config can be found here.

Be sure to modify the variables to match whatever you want to do. I'm using static IPs because auto discovery is unreliable (hostname.iot.internal).

You'll also need to add the !secret variables into the secrets.yaml file.

Note that there's an issue with Bluetooth and WiFi on single cores (i.e.: the ESP locks up as it can't do both at boot). The workaround is in that config file.

Use on single-core chips

On dual-core devices the WiFi component runs on core 1, while this component runs on core 0. When using this component on single core chips such as the ESP32-C3 both WiFi and ble_tracker must run on the same core, and this has been known to cause issues when connecting to WiFi. A work-around for this is to enable the tracker only while the native API is connected. The following config will achieve this:

esp32_ble_tracker:
  scan_parameters:
    continuous: false

api:
  encryption:
    key: !secret encryption_key
  on_client_connected:
    - esp32_ble_tracker.start_scan:
       continuous: true
  on_client_disconnected:
    - esp32_ble_tracker.stop_scan:

Esphome

To flash the Mi thermometer, use this flasher and the firmware from here.

Example output of the log (from Esphome in Home Assistant directly, but can be seen from the web interface as well):

You can then add the proxy (and the entities) in Home Assistant. It should update every couple of minutes (the Mi device updates every 5 or so minutes, the Proxy scans every channel every 3-ish minutes).

In the example above, I (at the time of writing) only have one Bluetooth sensor, but it should be quite trivial to add more. The hardest part is finding the right MAC address of the sensors... :)

Recently migrated Shan from Windows to an Apple/macOS and every reboot she kept getting "Unable to connect with Autodesk Desktop Licensing Service" when launching AutoCAD on her Mac.

The official bullshit is to reinstall the Licensing Service (why is there even such a thing). But alas, that didn't fix it.

Also updating AutoCad to 2025 (we're barely even in 2024) didn't fix it (but made it work until the next reboot).

The trick was to go to System Settings > General > Login Items and heading down to "Allow in the Background". Make sure AutoDesk is turned on (no need to turn on AutoCAD).

Sigh.

As iRail's servers go down once in a while (and contain some legacy files, making it a bit messy), I decided to back up and host the GTFS feeds of Belgian Railway (NMBS), and the 3 Belgian bus companies (De Lijn, TEC and MIVB) at gtfs.flatturtle.cloud.

Every night, around 3am (CET), the GTFS files are uploaded to Cloudflare R2.

I keep the historical files as well (iRail only did this for NMBS, but I'm doing it for all). The latest available GTFS is in */_latest/<file>.zip.

The directory listing is created using Workers.

I'm trying to get access to dewaterbus.be as well, but so far, they haven't replied.

Yesterday, three blogs I'm hosting suddenly went offline and alerts went off.

They all had the same error that they couldn't connect to their SQL database, and it seemed that the container recently was auto-updated.

Docker logs also showed (which may or may not have been related):

2024-02-21  7:30:29 97 [Warning] Aborted connection 97 to db: 'unconnected' user: 'unauthenticated' host: '192.168.200.4' (This connection closed normally without authentication)

This was odd. I started the usual troubleshooting:

• As these containers have their own network, maybe the IPs changed and as the SQL users can only access from a certain IP range, something broke there -- nothing seemed to have changed and I could connect from the nginx container to the other just fine
• Password somehow changed -- nah, connections were accepted
• Roll back to a previous version of MariaDB -- didn't do anything, odd
• This was not actually a MariaDB problem but a WordPress problem? Was there an auto-update? Didn't make sense because one of the blogs is running a very old WP version
• Worth noting that I also host two Ghosts blogs using the same setup (nginx+mariadb in container) and they were unaffected and humming along just fine...
• At this point I was starting to think something was massively corrupt and this was gonna be a long day.

I then continued and created a php (testconnection.php) file on the nginx:

<?php
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

// Connection Details
$hostname = "container-mariadb";  // Your MariaDB hostname 
$username = "your_username"; // Your MariaDB username
$password = "your_password"; // Your MariaDB password
$database = "your_database_name"; // The database

// Create the connection
$conn = new mysqli($hostname, $username, $password, $database);

// Check for errors
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Print Debug Information
echo "Connected successfully\n"; 
echo "Host information: " . $conn->host_info . "\n";
echo "Client information: " . $conn->client_info . "\n";

// Close the connection
$conn->close();
?>

This threw the following error... We were getting somewhere:

Fatal error: Uncaught mysqli_sql_exception: Server sent charset (0) unknown to the client. Please, report to the developers in /var/www/domain/testconnection.php:13 Stack trace: #0 /var/www/domain/testconnection.php(13): mysqli->__construct() #1 {main} thrown in /var/www/domain/testconnection.php on line 13

The charset I was using was utf8mb4 with a collate of utf8mb4_general_ci:

SHOW CREATE DATABASE your_database_name;

My wp-config.php file already had DB_CHARSET, but DB_COLLATE was not set. I added that in the config as well:

define( 'DB_CHARSET', 'utf8mb4' );
define( 'DB_COLLATE', 'utf8mb4_general_ci' );

Sadly, that didn't fix it either. Still saying it can't connect to the database. Grmbl.

I then went ahead and checked /etc/mysql/mariadb.conf and the files in /etc/mariadb.conf.d/. It included character-set-server = utf8mb4, but not collation-server = utf8mb4_general_ci. The line was specifically in /etc/mariadb.conf.d/50-server.cnf.

Adding the latter solved the problem... 2hrs of my life gone.

As this file (likely) is managed in the container and changed by the OS (it's apparently based on Ubuntu, ewwww) or the MariaDB version, the easiest way was just creating another file: /etc/mariadb.conf.d/51-<something>.cnf.

This is my very dirty hack (as I'm not using Docker Compose for this):

docker exec -it container-mariadb bash -c "echo -e '[mysqld]\ncollation-server = utf8mb4_general_ci'> /etc/mysql/mariadb.conf.d/51-yeri.cnf"
docker restart container-mariadb

It now works fine again...

Software is typically sold on the promise of increased convenience or productivity, or both. If we were to believe all the clichéd marketing lingo about time-saving, our lives would now consist largely of uninterrupted leisure time. 

In a recent post, Brett Scott argues persuasively that, far from making our lives easier, technology is making them faster and more discombobulated. To understand how this shift happens, Scott tells us to look at the issue from a systemic perspective: 

“We don’t just live in any economy. We live in a mega-scale corporate capitalist economy, and in such a setting technology is never used to save time. It’s used to speed up production and consumption in order to expand the system. The basic rule is this: technology doesn’t make our lives easier. It makes them faster and more crammed with stuff.”

The invention of the car is a great example because it enabled us to move greater distances at much higher speeds, but didn’t fundamentally change our experience of work. The time ‘saved’ by driving versus walking was quickly taken up by more work. Fast travel by car (a high-value consumer good) quickly became the new default. 

“Los Angeles only exists in its current form because of cars, which means life will be difficult there if you don’t have one. In this scenario you’re essentially held hostage by the auto industry, whose products are the very thing that have catalysed our dependence on giant megacities. Rather than acknowledge that, we lapse into a type of Stockholm Syndrome where we choose to imagine the car as a saviour that grants us our independence in that context. In reality, the car is just a minimum requirement to scrape by in a car-catalysed environment. ...”

“Each technology not only unlocks a new state of expanded acceleration (that will be hardcoded into our lives as the new basis for our survival), but will also be used as the basis for new technologies to continue that process. The vast majority of people do not experience this technology as ‘liberating’ them. Rather, they experience it as something that propagates itself around them, and something they must race to keep up with in order to not be ‘left behind’.”

The irony is that as the world around us feels hectic and more unmanageable due to technology, we turn to the very same tools for help: 

“In reality, we’ll just be more burned out, which in turn will be weaponised to sell us more acceleration tech. Feeling burned out? Why not automate more? … We increasingly live a ‘just in time’ life because, at a systemic level, there’s pressure to pack in as much stuff as possible at both a consumption and production level. We’re just as dissatisfied, only busier.”

In Scott’s view, AI will have the same accelerating effect, raising employers’ productivity expectations and demanding that we all do more, faster. Because that is the gospel of innovation:

“In the mythology of Silicon Valley, and in corporate capitalism more generally, it’s believed that we expand alongside our system, and that new products are turning us into fuller expressions of ourselves. In reality, we’re biological beings with finite capacities ensnared within an economy with an acceleration drive, and its constant attempt to expand just crowds out other stuff in our lives.”

As with all systemic issues, individuals lack the agency to effectively counteract this dynamic. Still, Scott encourages us “to realise that all these things we’re told we need are just illusions generated by the numb logic of a system that cannot value anything except accumulation and profit. From that point we can strive to build balances of power to prevent the worst excesses of the situation coming out.” It’s the economy, stupid!

Source: Dense Discovery

DALL-E 3 is here. And the future too, or almost at least.

Prompt: generate 3D images of the inside of a house in Singapore. It needs to look modern and minimalistic, with light colours, to show a customer. Focus on the living room.

It still sucks at generating text... Trying to get an 80s style logo for superuser.one...

Website content... The prompt was a weird one.

prompt: for a website, I need an image of a coworking space. It needs to show people working. Our tech is the WiFi and efficient networking equipment that needs to be displayed but not clearly visible. Make it so it's not a given, but shows happy people. Make it photo realistic

Prompt: draw a 3D comic style dolphin with a canon on its back jumping out of the sea

Raspberry Pi recently launched Bookworm, and with that, a new kernel package.

However, due to the massive changes from Bullseye to Bookworm, they are not suggesting a dist-upgrade.

In the past, we have suggested procedures for updating an existing image to the new version, but always with the caveat that we do not recommend it, and you do this at your own risk.

This time, because the changes to the underlying architecture are so significant, we are not suggesting any procedure for upgrading a Bullseye image to Bookworm; any attempt to do this will almost certainly end up with a non-booting desktop and data loss.

Bookworm — the new version of Raspberry Pi OS

But screw that, ain't nobody got time to reinstall all their RPis in the wild (and in all fairness, I've had zero issues updating; just some messing around with kernels -- hence the post)...

As this is not very well documented, and Raspberry Pi, across all their versions, has 4 different architectures, it's confusing.

There's a quick dirty guide on how to update from raspberrypi-kernel and raspberrypi-bootloader to linux-image-rpi.

However, it's unclear in terms of which kernel to pick, so here goes:

• RPi3 (including RPi4) and newer in 64 bit¹ (aarch64):
  apt install -y linux-image-rpi-v8 linux-headers-rpi-v8
• RPi4 and 400 in 32 bit²:
  apt install -y linux-image-rpi-v7l linux-headers-rpi-v7l
• RPi2 (only 32bit) or 3, 3+, Zero 2 W, Compute Modules 3 and 3+ in 32 bit mode³ (armhf):
  apt install -y linux-image-rpi-v7 linux-headers-rpi-v7
• RPi1, Zero, Zero W, Compute Module 1 (armel):
  apt install -y linux-image-rpi-v6 linux-headers-rpi-v6

This mostly comes from here.

So, in short, this is what worked for me. As I use Wireguard as well, I needed to remove the package first to prevent conflicts.

apt remove -y wireguard
apt autoremove -y

dpkg --purge --force-depends raspberrypi-kernel raspberrypi-bootloader
umount /boot
fsck -y /boot
mkdir /boot/firmware
sed -i.bak -e "s#boot#boot/firmware#" /etc/fstab
systemctl daemon-reload
mount /boot/firmware
apt install raspi-firmware -y

# rpi3+ 64bit
#apt install linux-image-rpi-v8 linux-headers-rpi-v8
# rpi4+ 32bit
#apt install linux-image-rpi-v7l linux-headers-rpi-v7l
# rpi2 and rest
#apt install linux-image-rpi-v7 linux-headers-rpi-v7
# rpi1
#apt install linux-image-rpi-v6 linux-headers-rpi-v6

sed -i.bak '$ a\auto_initramfs=1' /boot/firmware/config.txt 

apt install wireguard -y
systemctl enable wg-quick@wg0.service
systemctl start wg-quick@wg0.service

# reboot

When running apt install <kernel> -- do write down the package it'll install. The listed packages are just meta packages and will pull a bunch of other packages that actually hold the important files. Running apt --reinstall on those meta packages, for example, won't actually reinstall the kernel.

To roll back, you can purge those packages and reinstall raspberrypi-kernel raspberrypi-bootloader (be aware of the path changes in /boot). If you made a mistake, just apt install --reinstall -y <all the packages you wrote down> and it should reinstall everything.

Very simple Python script that tracks one or multiple hosts/domains for IP changes, and prints it in a Matrix room.

# docker logs ipchanged
29-09-2023 - 11:26:35 - Logged in as @turtlebot:matrix.org
29-09-2023 - 11:26:35 - IP address for be.yeri.be is 94.105.123.126
29-09-2023 - 11:26:35 - IP address for sg.yeri.be is 58.96.238.208
29-09-2023 - 11:26:35 - IP address for industry.yeri.be is 78.23.172.72
29-09-2023 - 11:29:36 - IP address for be.yeri.be is 94.105.123.126
29-09-2023 - 11:29:36 - IP address for sg.yeri.be is 58.96.238.208
29-09-2023 - 11:29:36 - IP address for industry.yeri.be is 78.23.172.72

Includes a Docker container to keep it running.

I made it less noisy (i.e. won't talk when the IP didn't change) and as the IP of my DynDNS hosts hasn't changed yet, there's not much to see... ;)

This is quick and dirty (and with the help of ChatGPT).

FlatTurtle has a new site, and there's been some fine-tuning here and there that led to a few typos creeping in. I wanted a quick tool to plug in a page, and that would highlight possible mistakes.

I've been a personal (paying) user of LanguageTool for a few years now (European, and less spammy and dodgy than Grammarly)

Started off with a terminal tool, but in the end that wasn't working out (hard to get the colouring to work and make it clear enough).

Figured a website would be easier:

• Insert a site
• Let it go through the LanguageTool API for mistakes*
• Show what is potentially wrong and explain why so I can go and edit it

(*) Surprisingly hard because it needs to trim all HTML and js and other crap. And it has issues detecting headers (without punctuation) from paragraph text, etc).

It's far from perfect, but it works well enough for half a day of fiddling around.

You can hover your mouse over the red words to get some information as to why something is wrong.

The code, provided as-is, is here, and you can run it using:

python3 -m pip install flask selenium beautifulsoup4 geckodriver-autoinstaller requests
python3 web_check.py --api-key KEY --username EMAIL

And opening http://localhost:5000.

EMAIL is your login, the KEY can be found here.

Have fun.

You can see how this script makes that couple very happy.

Quick and dirty script that shows your Mac battery information (health, cycles, etc). If an Apple keyboard or mouse is connected, it'll also display the battery % of those.

# Battery information
battery() {

	if !ioreg > /dev/null 2>&1; then
		echo "ioreg not found. Exiting."
		return 1
	fi

	_ioreg=`ioreg -l`
	_profile=`system_profiler SPPowerDataType`

	MOUSE=`echo $_ioreg -l | grep -A 10 "Mouse" | grep '"BatteryPercent" =' | sed 's/[^0-9]*//g'`
	TRACKPAD=`echo $_ioreg -l | grep -A 10 "Track" | grep '"BatteryPercent" =' | sed 's/[^0-9]*//g'`
	KEYBOARD=`echo $_ioreg -l | grep -A 10 "Keyboard" | grep '"BatteryPercent" =' | sed 's/[^0-9]*//g'`
	CYCLE=`echo $_profile | grep "Cycle Count" | awk '{print $3}'`

	if [ -n "$MOUSE" ]; then
		echo "Mouse: "$MOUSE"%"
	fi

	if [ -n "$TRACKPAD" ]; then
		echo "Trackpad: "$TRACKPAD"%"
	fi

	if [ -n "$KEYBOARD" ]; then
		echo "Keyboard: "$KEYBOARD"%"
	fi

	if [ -n "$CYCLE" ] && [ "$CYCLE" -ne 0 ]; then
		echo "Mac battery "`echo $_profile | grep "State of Charge" | awk '{print $5}'`"%"
		echo "Charging: "`echo $_profile | grep "Charging" | head -n 1 | awk '{print $2}'`
		echo "Cycles: "$CYCLE
		echo "Condition: "`echo $_profile | grep "Condition" | awk '{print $2}'`
		echo "Health: "`echo $_profile | grep "Maximum Capacity" | awk '{print $3}'`
	fi
}

Outputs something similar to this (no mouse or keyboard connected):

nazgul ~ $ battery
Mac battery 54%
Charging: No
Cycles: 224
Condition: Normal
Health: 89%

This works on zsh and may not work in bash.

Content Update

The provided scripts have been updated on 16 Jul 2023. Specifically the SmartStrip part was not working as intended.

I've been a big fan of Betteruptime. I've started using it to monitor all my assets online (websites, DNS, ping, successful script runs) as well as my servers (using heartbeats).

I have a few Raspberry Pi's, and once in a while they hang (not sure why, maybe USB-to-SSD issues or something). Nothing too critical, but annoying.

I've plugged them all on TP-Link Kasa smart plugs to remotely restart them if I had to (once or twice a year).

Note, to confuse everyone, TP-Link also launched Tapo, which... competes with Kasa and is not compatible, but does the exact same thing... ¯\_(ツ)_/¯

After some Googling (actually Kagi'ing) I found out, there's a Python library that lets you control your smart plugs.

So, the idea was born to:

• Check Betteruptime heartbeats, if down, power cycle the smart plug
• Do this at most once per day (in case something else is causing issues)
• Betteruptime heartbeats manage when a device is marked as offline (i.e.: it expects a heartbeat every 5 minutes, but will only consider the device down if no heartbeats are received for 2 hours).
• The bulk of the code had to be written by ChatGPT. Let ChatGPT choose the language (it ended up being a mix of Bash and Python)
• Everything needs to run in Docker (using a cron, the Docker container doesn't daemonise)
• These run on Raspberry Pi's (but of course the RPi can't check itself: so RPi1 checks for RPi2, and vice versa. As these RPis are on different networks (my parent's home, my own home, etc) I had to enable "--net=host" in Docker run to get the correct routes from the host system, but you may not actually need this
• To top if off, sent an email (using Mailgun EU servers) to warn me something broke and it rebooted

So, after some fiddling (half an evening or so) the proof-of-concept worked.

I should probably throw this in a Git repo but shrug. I don't want to give the impression that I'll maintain this and provide support.

Dockerfile:

FROM python:alpine
RUN apk add bash curl jq
RUN pip3 install python-kasa
COPY heartbeat.sh kasa-api.py /
VOLUME /tmp/kasa/
CMD ["/heartbeat.sh"]

Python script kasa-api.py (this works with both smart strips and smart plugs):

import sys
import asyncio
from kasa import SmartPlug, SmartStrip

async def main():
	if len(sys.argv) != 4:
		print("Usage: python kasa-api.py type IP-address outlet-index")
		return

	device_type = sys.argv[1]
	ip_address = sys.argv[2]
	outlet_index = int(sys.argv[3])

	if device_type == "smartplug":
		await control_smart_plug(ip_address)
	elif device_type == "smartstrip":
		await control_smart_strip(ip_address, outlet_index)
	else:
		print(f"Unsupported device type: {device_type}")

async def control_smart_plug(ip_address):
	plug = SmartPlug(ip_address)

	try:
		await plug.update()

		# Retrieve the current state
		plug_state = plug.is_on

		# Turn off the plug
		await plug.turn_off()

		print(f"Turned off SmartPlug at {ip_address}")
		await asyncio.sleep(5)

		# Turn on the plug if it was previously on
		if plug_state:
			await plug.turn_on()

		print(f"Turned on SmartPlug at {ip_address}")
	except Exception as e:
		print(f"Failed to control SmartPlug at {ip_address}: {e}")

async def control_smart_strip(ip_address, outlet_index):
	strip = SmartStrip(ip_address)

	try:
		await strip.update()

		# Retrieve the current state of the specified child plug
		child_state = strip.children[outlet_index].is_on

		# Turn off the specified child plug
		await strip.children[outlet_index].turn_off()

		print(f"Turned off child plug {outlet_index} in SmartStrip at {ip_address}")
		await asyncio.sleep(5)

		# Turn on the child plug if it was previously on
		await strip.children[outlet_index].turn_on()

		print(f"Turned on child plug {outlet_index} in SmartStrip at {ip_address}")
	except Exception as e:
		print(f"Failed to control SmartStrip at {ip_address}: {e}")

# Run the asyncio event loop
asyncio.run(main())

heartbeat.sh -- with example devices. Be sure to fill in the variables (including hb, that's the heartbeat ID you can get from the Betteruptime URL and the IP or DNS hostname of the smartplug):

#!/bin/bash

API_KEY="BetterUptime API token"
BU="https://uptime.betterstack.com/api/v2/heartbeats/" # no need to change this

MAILGUN_API_KEY="Mailgun API token"
MAILGUN_DOMAIN="mg.you.com" # use your own domain

if [[ "$DEVICE" = tyr ]] || [[ "$1" = tyr ]]; then

	# Tyr
	device="Tyr"
	hb=1111
	bu="https://uptime.betterstack.com/team/1/heartbeats/$hb"
	plug_type="smartplug"
	plug_host="smartplug1.kasa.you.com"

elif [[ "$DEVICE" = mammoth ]] || [[ "$1" = mammoth ]]; then

	# Mammoth
	device="mammoth"
	hb=2222
	bu="https://uptime.betterstack.com/team/1/heartbeats/$hb"
	plug_type="smartstrip"
	plug_host="smartstrip1.kasa.you.com"
	plug_index=0 # plug 2 is rly plug 3 because the index counts from 0 to 2 and not from 1 to 3.

elif [[ "$DEVICE" = liana ]] || [[ "$1" = liana ]]; then

	# Liana
	device="liana"
	hb=3333
	bu="https://uptime.betterstack.com/team/1/heartbeats/$hb"
	plug_type="smartstrip"
	plug_host="smartstrip1.kasa.you.com"
	plug_index=1 # plug 2 is rly plug 3 because the index counts from 0 to 2 and not from 1 to 3.

elif [[ "$DEVICE" = eagle ]] || [[ "$1" = eagle ]]; then

	device="eagle"
	hb=4444
	bu="https://uptime.betterstack.com/team/1/heartbeats/$hb"
	plug_type="smartstrip"
	plug_host="smartstrip1.kasa.yeri.be"
	plug_index=2 # plug 2 is rly plug 3 because the index counts from 0 to 2 and not from 1 to 3.

else
	echo "Unknown device."
	exit 1
fi

url=$BU/$hb

send_alert() {
	MAILGUN_URL="https://api.eu.mailgun.net/v3/$MAILGUN_DOMAIN/messages"
	from="kasa@you.com"
	to="alert@you.com"
	subject="Smartplug power cycled: $device"
	body="rebooted device $device!"$'\n'"Kasa IP: $plug_host."$'\n'"$bu"

	# Send alert email
	curl -s --user "api:$MAILGUN_API_KEY" \
		"$MAILGUN_URL" \
		-F from="$from" \
		-F to="$to" \
		-F subject="$subject" \
		-F text="$body"
}

kasa_cycle() {
	echo "Betteruptime heartbeat ($hb) says the service for $device is down, restarting."
	python /kasa-api.py "$plug_type" "$plug_host" "$plug_index"
	# Update the last execution date in the file
	echo "$current_date" > "$file"
}

kasa_info() {
	kasa --host $plug_host
}

response=$(curl -sL "$url" -H "Authorization: Bearer $API_KEY")
status=$(echo "$response" | jq -r '.data.attributes.status')

if [[ "$status" == "down" ]]; then
	dir="/tmp/.kasa/"
	mkdir -p "$dir"
	file="${dir}${device}.txt"

	# Get current date
	current_date=$(date "+%F")
	# Check if the file exists
	if [ -f "$file" ]; then
		# Get last execution date from the file
		last_execution=$(cat "$file")
		# We only want to run this once every 24hrs. If a reboot doesn't fix it, something more
		# serious is going on and likely needs manual intervention. No point spam rebooting the device.
		if [[ "$current_date" != "$last_execution" ]]; then
			kasa_cycle
			send_alert
		else
			echo "Power cycle already executed today."
		fi
	else
		kasa_cycle
		send_alert
	fi
elif [[ "$status" == "up" ]]; then
	echo "Betteruptime heartbeat says the service ($hb) for $device is up."
else
	# this could happen if the heartbeat is paused.
	echo "Unknown status."
	kasa_info
	exit 1
fi

I run Docker with two scripts, a builder (rebuild.sh) and a file that runs it (start.sh). It should rebuild in case a docker cleanup script ran (and deleted dangling containers).

I run this as root and probably shouldn't, but yeah... That'll be for another lifetime.

Be sure to change the paths (/root/git/kasa-api) in both scripts.

rebuild.sh:

#!/bin/bash
cd /root/git/kasa-api # the path where this project exists

git pull > /dev/null

BASEIMAGE=`cat Dockerfile | grep FROM | awk '{print $2}'`
docker pull $BASEIMAGE
docker build -q -t kasa-api .
rm -f /tmp/.kasa/*.txt

start.sh:

#!/bin/bash

if [ -z "$1" ]; then
	echo "Missing device name."
	exit 1
fi

docker stop kasa-api 2> /dev/null
docker rm kasa-api 2> /dev/null

run_kasa() {
	DEVICE=$1
	docker run --net=host -v /tmp/.kasa:/tmp/.kasa --rm -e DEVICE=$DEVICE --name kasa-api kasa-api
}

if [[ $(docker image ls | grep kasa-api) ]]; then
	run_kasa $1
else
	cd /root/git/kasa-api
	/root/git/kasa-api/rebuild.sh > /dev/null
	run_kasa $1
fi

And that's pretty much it. I run this using with cron in /etc/cron.d/. For example (be sure to edit the parameter/device name/path):

#
# cron-jobs for kasa-api
#

MAILTO=root

*/15 * * * *	root	if [ -x /root/git/kasa-api/start.sh ] && [ -f /root/git/kasa-api/start.sh ]; then /root/git/kasa-api/start.sh tyr >/dev/null; fi

I'm sure there must be bugs in this ChatGPT generated code but... so far, it has actually worked.

Is your company forcing Cloudflare Warp on you, and are you running on a Mac (with sudo access)?

It probably sucks, spies on you, does MitM attacks, breaks most video conferencing tools, and is generally not very stable... Also... Zero trust!

Add this function to your .bashrc or .zshrc (whichever shell you're using*):

func killwarp() {
	sudo launchctl remove com.cloudflare.1dot1dot1dot1.macos.warp.daemon
	sudo killall Cloudflare\ WARP
}

Open a new shell window (to reload your dot files), and type killwarp.

This will permanently disable Warp (until your Mac is rebooted; as it's most likely force installed/started by your admin). So just run this after every reboot.

(*) Find out with echo $SHELL.

Especially those at the pinnacle that've lost touch with their customers.

I've blogged about it before.

Here is how platforms die: first, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die.

Source: Pluralistic

I've just learned that Amazon Kindle killed the book loaning feature... Something they initially used as a selling point when I got my first Kindle in 2017 (or whenever it was).

I've spent about an hour on the phone with 4 (!) Amazon support reps to find a solution (tl;dr: there are none, but they recommend one of the following three options: 1/ share your Amazon account/password with whoever you want to loan your book to, 2/ add the person to your household (never mind you can only have 2 adults in your household), 3/ buy the books again).

As I told them none of these options realistically worked (and are not a solution to the problem) I asked for a gift voucher (to re-purchase the books I wanted to loan to a friend) which they initially said were unable to do, and eventually admitted were able to do, but refused to do because they felt they offered workable solutions: "you can just purchase them again". Sigh.

It is a disheartening reality that companies often take a turn towards evil once they hit a certain size. Lose touch with reality.

The initial promises of exceptional service and genuine customer care gradually fade away. Instead, the focus shifts to maximizing profits, leaving customer satisfaction behind. Shareholders exert pressure, prioritizing returns on investment over the long-term relationship with customers.

Don't trust corporates.

We've turned the world into a place where we don't actually own anything. SaaS offers ease of access (streaming, cloud, etc), but if consumers are at the whims of corporates to turn features on and off, give or take away access, something is wrong.

Started updating my Debian systems from Bullseye to Bookworm.

The first thing I noticed was that ethX renamed to enXY.

To get back to the old naming scheme, you can fix this by adding the following in /etc/network/interfaces:

rename enX0=eth0
rename enX1=eth1

And reboot.

For my Mastodon instance, I use Cloudflare R2; mainly for two reasons:

• Storage was growing quickly (~80Gb during its peak); I am hosting my instance on a RPi4 (w/ 8Gb RAM) and the SSD was filling up rapidly,
• I wanted something speedy to serve (big and cacheable) content (i.e. a CDN).

While I didn't care much about storage any more, I still wanted to make sure it was kept in check, also for two reasons:

• Mastodon downloads a copy of all content it says on the Fediverse, and keeps it until purged. So every instance has all the content from other instances. This could theoretically lead to you hosting illegal content and getting in trouble for it,
• Cloudflare used to be my employer, and I have free access to R2. However, there's always a risk they'll disable my employee benefits one day and get me to pay for my used storage.

I run my Mastodon in a Docker instance, so your commands may vary (basically tootctl X Y is what matters). I run most of these commands once a week using systemd (except the media remover, that runs every day).

This will clear:

• accounts (you never interacted with)
• header files (big picture every account can upload)
• profile pictures
• link preview cards
• orphaned media (uploaded media but not posted)
• media (from other accounts)
• statuses (from other accounts)
• and as a bonus include updating Elasticsearch indices (which sound run every once in a while to optimise search)

/usr/bin/docker compose -f /srv/mastodon/docker-compose.yml run --rm shell tootctl accounts prune

/usr/bin/docker compose -f /srv/mastodon/docker-compose.yml run --rm shell tootctl media remove --remove-headers --days 15

/usr/bin/docker compose -f /srv/mastodon/docker-compose.yml run --rm shell tootctl media remove--prune-profiles --days 30

/usr/bin/docker compose -f /srv/mastodon/docker-compose.yml run --rm shell tootctl preview_cards remove --days 15

/usr/bin/docker compose -f /srv/mastodon/docker-compose.yml run --rm shell tootctl media remove-orphans

/usr/bin/docker compose -f /srv/mastodon/docker-compose.yml run --rm shell tootctl media remove --days 30

/usr/bin/docker compose -f /srv/mastodon/docker-compose.yml run --rm shell tootctl statuses remove --days 30

/usr/bin/docker compose -f /srv/mastodon/docker-compose.yml run --rm shell tootctl search deploy

Note that you should play with the --days X to find something that works for you (i.e.: you can scroll back in the history and still see posts/media, but not overload your storage).

I've included all the systemd files that's needed here. Again, will only work in a Docker environment using the same paths as me.

The systemd files will need to be activated using something similar to this (but again, don't blindly run these commands as it'll likely not work):

cp *.service *.timer /etc/systemd/system/
systemctl daemon-reload
systemctl enable --now *.timer
systemctl list-timers | grep masto

Oh, and this is not specific to R2. This works even when storing everything locally.

I've written before on how to use Cloudflare CDN to protect/speed up your instance.

Just got myself a Flipper Zero because #whynot.

However, the updating process from 0.6x.y to 0.82.3 was not very smooth sailing:

• First it was stuck in synchronising on the iOS app refusing to initiate the update (had to force quit + reboot Flipper Zero to get it to continue)
• After that, once I managed to upload the new firmware, it was stuck on Waiting for SD card after the Flipper rebooted.

The SD card I tried was an old 2Gb Samsung SD I had lying around (have 3-4 of these).

Tried several times, but alas, until I tried a different SD card... Then the update process went fine and the firmware updated as expected.

So looks like this is a sign the SD card is not properly performing (even though format, benchmark and uploading firmware worked fine).

Because I keep forgetting and it takes me far too much time to go through one of my million sites where I set this up and find the right config...

To allow a USG (Unifi Security Gateway) to reply to external (WAN) ping requests, do the following:

• Head to the Unifi dashboard -> Settings -> Firewall & Security
• Create a new rule
• Type: Internet Local
• Description: Allow Ping (Echo Request)
• Rule Applied: Before Predefined Rules
• Action: Accept
• IPv4 Protocol: ICMP
• IPv4 IMP Type Name: Echo Request
• Apply Changes -> wait ~2 minutes

That's it...

All this for Smokeping.

A while back, I wrote about installing NetworkManager if NextDNS activate fails to work.

Only... I realised that for some reason on Raspberry Pi (4), WiFi stopped working with the following errors:

Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.2204] device (wlan0): state change: config -> failed (reason 'ssid-not-found', sys-iface-state: 'managed')
Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.7525] device (wlan0): set-hw-addr: set MAC address to 92:F3:ED:C2:8F:9B (scanning)
Feb 17 11:55:02 tyr NetworkManager[449]: <warn>  [1676631302.7559] device (wlan0): Activation: failed for connection 'superuser.one'
Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.7562] device (wlan0): supplicant interface state: scanning -> disconnected
Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.7562] device (p2p-dev-wlan0): supplicant management interface state: scanning -> disconnected
Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.7577] device (wlan0): supplicant interface state: disconnected -> interface_disabled
Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.7578] device (p2p-dev-wlan0): supplicant management interface state: disconnected -> interface_disabled
Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.7579] device (wlan0): supplicant interface state: interface_disabled -> disconnected
Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.7579] device (p2p-dev-wlan0): supplicant management interface state: interface_disabled -> disconnected
Feb 17 11:55:02 tyr NetworkManager[449]: <info>  [1676631302.7585] device (wlan0): state change: failed -> disconnected (reason 'none', sys-iface-state: 'managed')

The WiFi SSID and password (wpa_supplicant) never changed, so I wasn't sure what it was. However, as most Pi's are wired I didn't pay much attention, until today.

As I had one RPi where nextdns activate worked fine, without NetworkManager installed, and where WiFi worked, I figured there was something evil about NetworkManager (= breaks my WiFi) and NextDNS not actually needing it...

I reverted my changed from my previous post (and removed some extra stuff that was not needed in my case, YMMV):

apt purge -y network-manager dnsmasq-base resolvconf modemmanager ppp ; apt install -y powermgmt-base openresolv ; apt autoremove -y

The powermgmt-base, and modemmanager, ppp parts are likely not needed, but this is just a copy and paste of what I did.

Reboot... And WiFi worked again. However, nextdns activate would still throw an error:

# nextdns activate
Error: NetworkManager resolver management: exit status 5

Going through the source code (yay for open-source) I noticed:

var networkManagerFile = "/etc/NetworkManager/conf.d/nextdns.conf"

That file indeed existed on both RPis that had the activate issue.

I ran the following command...

rm /etc/NetworkManager/conf.d/nextdns.conf

But that still gave the same error. But as I had purged the entire NetworkManager, I didn't need its lingering config files... So, why not rid ourselves of everything:

rm -r /etc/NetworkManager

And tada... Now activate works fine:

tyr ~ # nextdns activate
tyr ~ #

Go figure ¯\_(ツ)_/¯

Here is how platforms die: First, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die.

[...]

This is enshittification: Surpluses are first directed to users; then, once they’re locked in, surpluses go to suppliers; then once they’re locked in, the surplus is handed to shareholders and the platform becomes a useless pile of shit. From mobile app stores to Steam, from Facebook to Twitter, this is the enshittification lifecycle.

Source: Kottke, via Pluralistic

I reinstalled one of my RPis (moving from 32 to 64 bit).

Before doing the full reinstall, I took a dump (dd) of my disk.

Usually, I create one per partition, but this was the Christmas season, and I was half occupied with feasting and half occupied with entertaining Ila. So, mistakes were made.

I ran dd if=/dev/sdb of=backup.img -- but this means I can't mount the disk directly, as it's not a partition:

# mount backup.img /tmp/disk
mount: /tmp/disk: wrong fs type, bad option, bad superblock on /dev/loop0, missing codepage or helper program, or other error.

I should've dd'd /dev/sdb2 instead of the entire disk.

All right, so let's figure out what can be done... First, let's look at the content of the image:

# fdisk -l backup.img
Disk backup.img: 111.8 GiB, 120040980480 bytes, 234455040 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x8297a463

Device          Boot  Start      End  Sectors  Size Id Type
backup.img1 *      8192   532479   524288  256M  c W95 FAT32 (LBA)
backup.img2      532480 34078199 33545720   16G 83 Linux

So, we can probably mount starting from sector 532480.

We can see that the sector size is 512 (which, I think, is the default for most). So, if we multiply 512 * 532480 we get 272629760.

Now we can mount the disk using the following command:

mount -o loop,offset=272629760 backup.img /tmp/disk

And that should do it.

The 2nd partition (the one with data) is now mounted and accessible under /tmp/disk.

If you need the first partition, the same can be done by running 512 * 8192 = 4194304; the following command mounts the boot partition:

mount -o loop,offset=4194304 backup.img /tmp/disk.

Recently reinstalled NextDNS on a RPi4 64bit and came across this error:

# nextdns activate
Error: NetworkManager resolver management: exit status 1

It seems like NextDNS was actually running, but just throwing an error when running nextdns activate. Restarting did seem to work without throwing any error.

The logs showed the same error:

Dec 20 14:06:20 tyr nextdns[5753]: Starting NextDNS 1.38.0/linux on :53
Dec 20 14:06:20 tyr nextdns[5753]: Listening on TCP/:53
Dec 20 14:06:20 tyr nextdns[5753]: Starting mDNS discovery
Dec 20 14:06:20 tyr nextdns[5753]: Listening on UDP/:53
Dec 20 14:06:21 tyr nextdns[5753]: Connected 45.90.28.0:443 (con=13ms tls=58ms, TCP, TLS13)
Dec 20 14:06:21 tyr nextdns[5753]: Connected 185.18.148.91:443 (con=12ms tls=28ms, TCP, TLS13)
Dec 20 14:06:21 tyr nextdns[5753]: Switching endpoint: https://dns.nextdns.io#185.18.148.91,2a04:b80:1:30::2
Dec 20 14:06:25 tyr nextdns[5753]: Setting up router
Dec 20 14:06:25 tyr nextdns[5753]: Activating
Dec 20 14:06:25 tyr nextdns[5753]: Activate: NetworkManager resolver management: exit status 1

The solution was (as root):

apt install network-manager resolvconf -y
systemctl enable NetworkManager
systemctl start NetworkManager
nextdns activate

Looks like, instead of resolvconf, openresolv was installed.

First time I heard about openresolv; usually resolvconf is the default. Not entirely sure if this was the culprit (and NetworkManager not being started) but the errors are now gone.

Google recently updated their Google TV, to include "in your face" supposedly recommendations.

I don't mind recommendations if...:

a/ they are useful (i.e. I don't see how kid shows are something I'd be interested in; and Google has no idea Ila exists, and she's at least 2-3 years too young to watch those shows anyway).

b/ the recommendations would be for apps and subscriptions I actually have. Don't recommend me something on Amazon Prime if I don't have Amazon Prime installed, nor an active subscription. Idem dito for Disney+.

Google had recommendations before but at the bottom of the app list. It was not so much in your face. Now it's all the way on top and I need to click 2x down on the remote before getting access to the apps (Netflix, Kodi, Youtube, etc).

So far the best method I found was to enable your Google TV in apps-only mode. It turns off ALL recommendations (so your home screen becomes rather bare; but at least less clicking). Note that the article doesn't mention rebooting the device; but I had to restart it to get rid of all the ads recommendations.

Turn on Apps only mode:

1. On a Google TV device, from the home screen, scroll to your profile.
2. Select Settings.
3. Select Accounts & Sign In.
4. Select your profile.
5. Select Apps only mode and then Continue.
7. Reboot the device

It's now been roughly 6 months I've switched from DuckDuckGo to Kagi. I started paying right away after roughly the one month trial.

I had not been very happy with DDG; mostly the results were very low quality (having to switch back to Google one too many times; results often lagged behind by months of publishing), many search bugs, and there's been that thing with Bing advertising, and generally not seeing many improvements over the ~2 years I tried to use it full-time.

Kagi, on the other hand, has his search engine worked out. I know they also pull data from Bing, but also various other sources (apparently that includes Google) and their own scraper (Teclis, TinyGem), etc.

You can compare the Google and Kagi results. While not entirely the same, I don't think Google's are better than Kagi's.

So search is really good and I very very rarely ever need to head back to Google. Only for very obscure errors with very few results, and Google almost never has a better answer.

It also adds some cool other features, like rewriting URLs.

For example, I run my own Libreddit, so when search results include reddit, I can now redirect to my own Reddit instance (sorry, you won't have access).

There's a bunch of other cool stuff, like Bangs (short codes that would redirect directly to a site, for example w for wiki -- so w flightradar would show this result instantly; and there's more like hackernews, reddit, google, etc).

You can also lower priority of certain sites. Seeing too much Tiktok or Pinterest? Want to boost Hackernew results? All possible!

To make it work on iOS, you need to install a browser extension, but that works relatively well (it rewrites your search from Google to Kagi).

I was a bit apprehensive as it's a very small team, and they are also trying to reinvent the browser space with Orion, which is a cut-throat tough market to get in. Two massive enterprises that would need a lot of funding and a lot of dev time.

Orion is based on Safari, and far from good enough to replace Firefox, but I'm actually mildly enthusiastic about this project as well.

The company is very transparent and there's clear progress. If you want to get involved, they also have a Discord and a feedback/bug forum.

I'm considering a family plan and will force Shan to switch once released.

So, all things considered, quite excited about this. Looking forward to see if they can revolutionise search. And I truly hope they make it.

The only thing I don't like is that their logo looks too much like Google's... 🙈

This is a very short post because to be honest, I didn't figure much out myself.

My uploads/static files are now saved in R2 under its own URL (part of my enterprise zone) so that my normal caching rules and other settings are applied.

Add these to your application.env file:

3_ENABLED = "true"
S3_BUCKET = "<bucket name>"
S3_ENDPOINT = "https://<some-id>.r2.cloudflarestorage.com"
S3_ALIAS_HOST = "<connected domain>" 
S3_PERMISSION = "private"
AWS_ACCESS_KEY_ID = "<access_key>"
AWS_SECRET_ACCESS_KEY = "<secret_access_key>"

The token/API key is a bit hard to find, but it's on the top right.

Then (re)deploy your site.

I did set up a new server (my RPi4 started to struggle, and I guess if I'm half serious about Mastodon, I shouldn't host it at home), so I started afresh... But there's a way to migrate existing data to R2 as well, following this guide. 

I specifically disagree with his stance on free speech, because I think that it depends on your interpretation of what free speech means. If you allow the most intolerant voices to be as loud as they want to, you’re going to shut down voices of different opinions as well. So allowing free speech by just allowing all speech is not actually leading to free speech, it just leads to a cesspit of hate.

I think that is a very uniquely American idea of creating this marketplace of ideas where you can say anything you want completely without limits. It is very foreign to the German mindset where we, in our Constitution, our number one priority is maintaining human dignity. And so, hate speech is not part of the German concept of free speech, for example. So I think that when Elon Musk says that everything’s gonna be allowed, or whatever, I generally disagree with that.

Source: Time.com interview with Eugen Rochko

Regardless of what happens to Twitter, Elon Musk is without a doubt the most interesting man in the world right now. He's positioned himself at the intersection of so many trends and topics that it's hard to keep count, and through it all, he's tweeting memes. It's the greatest show on earth, no work of fiction could ever hope to compete.

It's also incredibly divisive. Not since Trump has a single character managed to invoke such extreme levels of love and hate on the world stage for weeks at the time. Nor has anyone been able to play the media like a fiddle with such virtuosity.

Thankfully the stakes are so much lower, though. Musk might be firing rockets into space, but they won't accidentally have any nuclear warheads on them. His media trolling isn't coming from within the White House. This reality show is playing out over something as disposable as a struggling social media website.

Furthermore, the world doesn't need Twitter. In fact, the world would almost certainly be better off without Twitter.

That's what makes this show so guiltlessly entertaining to watch: Whichever the outcome, the world wins. If Musk manages to fix Twitter, we're left with a better Twitter. Great! If Musk manages to burn down Twitter, we're left with a world free of Twitter. Great!

This is a 44 billion dollar gamble where the rest of us will win whatever the outcome.

Source: David Heinemeier from 37signals and Hey

If you're using Mastodon with Cloudflare CDN/protection and minify turned on, you'll notice the site may look broken (after a few visits, when hitting Cloudflare cache).

And you'll notice errors in the webdev tools similar to Failed to find a valid digest in the 'integrity' attribute, with computed SHA-256 integrity:

Failed to find a valid digest in the 'integrity' attribute for resource 'https://mastodon.yeri.be/packs/js/common-997d98113e1e433a9a9f.js' with computed SHA-256 integrity 'YgEhHmwjKL88zKfUOMt/qRulYurIuHzhn4SZC9QQ5Mg='. The resource has been blocked.
@yeri:1 Failed to find a valid digest in the 'integrity' attribute for resource 'https://mastodon.yeri.be/packs/js/locale_en-f70344940a5a8f625e92.chunk.js' with computed SHA-256 integrity '1VgpQjY/9w/fgRLw1QH2pfzqr36p3hINvg9ahpBiI2U='. The resource has been blocked.
@yeri:1 Failed to find a valid digest in the 'integrity' attribute for resource 'https://mastodon.yeri.be/packs/js/public-a52a3460655116c9cf18.chunk.js' with computed SHA-256 integrity 'onh6vHxzykkVgJkiww+OCPk0tKC48KMUD9GVJ8/LKJQ='. The resource has been blocked.

Basically, the sha256 hash doesn't match the js or css static files.

This happens because Cloudflare minifies those files and thus the hash has been changed.

To get it to work correctly, you'll need to create a Page Rule via Rules > Page Rules > Create Page Rule with the following info:

• URL: YourMastodonURL.com/packs/*
• Settings: Auto Minify: off (do not select anything)
• Rocket Loader: slider off

Don't forget to purge your cache via the dashboard (for the Mastodon domain) via Caching > Custom Purge > Hostname > YourMastodonURL.com.

Always a hassle to get mail delivery to work.

Had a similar problem with a VoIP (Nexmo SMS/call forwarding) tool that just refused to work using local mail servers without a valid cert. Gave up and started using Mailgun. 

Long story short: use something like Mailgun or another provider.

Using localhost SMTP server support seems to be limited if you don't have working certs. The documentation is also lacking as to what does what. Didn't figure out how to have it ignore SSL.

This is what worked for me, using Mailgun server:

SMTP_SERVER=smtp.eu.mailgun.org
SMTP_PORT=465
SMTP_LOGIN=mastodon@your.domain
SMTP_PASSWORD=some-password
SMTP_FROM_ADDRESS=you@anything.com
SMTP_DELIVERY_METHOD=smtp
SMTP_SSL=true
SMTP_ENABLE_STARTTLS_AUTO=false
SMTP_AUTH_METHOD=plain
SMTP_OPENSSL_VERIFY_MODE=none

And it looks like I'm not the only one struggling.

Started looking into a service to auto-post from this blog onto my Mastodon feed. Feed2Toot fit the bill perfectly.

I wanted to run the whole thing from a Docker container, though, so I'll quickly write a how-to.

This whole thing runs from a Raspberry Pi, as root. No k8s or k3s for me. The path I use is /root/git/feed2toot/, so be sure to modify that to whatever you're using.

First off, get your credentials for the app. You can either install the Feed2Toot package on a system (i.e. throwaway VM, to keep it clean), or use the Docker container below, but add RUN apk add bash and change the last line to CMD ["bash"] and then chroot into it via docker exec -it feed2toot bash.

This will generate two files (feed2toot_clientcred.txt and feed2toot_usercred.txt). Be sure to save these.

You can also try to run Feed2Toot at least once to make sure it's working and to fine-tune your ini file. This is mine:

[mastodon]
instance_url=https://m.superuser.one
; Here you need the two files created by register_feed2toot_app
user_credentials=/etc/feed2toot/feed2toot_usercred.txt
client_credentials=/etc/feed2toot/feed2toot_clientcred.txt
; Default visibility is public, but you can override it:
; toot_visibility=unlisted

[cache]
cachefile=/feed2toot/feed2toot.db
cache_limit=10000

[lock]
lock_file=/var/lock/feed2toot.lock
lock_timeout=3600

[rss]
uri=https://yeri.be/feed
; uri_list=/feed2toot/rsslist.txt
toot={title} {link}
; toot_max_len=500
title_pattern=Open Source
title_pattern_case_sensitive=true
no_uri_pattern_no_global_pattern=true
; ignore_ssl=false

[hashtaglist]
; several_words_hashtags_list=/feed2toot/hashtags.txt
; no_tags_in_toot=false

[feedparser]
; accept_bozo_exceptions=true

[media]
; custom=/var/lib/feed2toot/media/logo.png

I have three other files to make this work, first off Dockerfile:

FROM python:3.6-alpine
RUN pip3 install feed2toot && mkdir -p /etc/feed2toot/
COPY feed2toot.ini feed2toot_clientcred.txt feed2toot_usercred.txt /etc/feed2toot/
VOLUME /feed2toot/
CMD ["feed2toot", "-c", "/etc/feed2toot/feed2toot.ini"]

The script I run to build the container (start.sh):

#!/bin/bash
git pull

BASEIMAGE=`cat Dockerfile | grep FROM | awk '{print $2}'`
docker pull $BASEIMAGE
docker stop feed2toot
docker rm feed2toot
docker build -t feed2toot .
./run.sh

And finally, the script to run the container every so often (run.sh):

#!/bin/bash
docker run -d --rm -v /srv/mastodon/feed2toot/:/feed2toot/ --name feed2toot feed2toot

This will save the database file under /srv/mastodon/, to preserve states across rebuilds.

Note that once Feed2Toot runs, it'll exit, and the container will be stopped. So it does not automatically run all the time.

So, you'll want to run this every so often. You can add a file to /etc/cron.d/ to run it, for example, every six hours:

#
# cron-jobs for feed2toot
#

MAILTO=root

0 */6 * * *		root	if [ -x /root/git/feed2toot/run.sh ]; then /root/git/feed2toot/run.sh >/dev/null; fi

That's it. Should do the trick. It'll now post stuff from your RSS feed onto your timeline.

Oh, and Jeroen has a good post about Mastodon.

Recently visited Ikea and had to get a Christmas star-light like I used to have during my childhood.

Most of my (non-track) light at home is smart using either a TP-Link Kasa smartplug or Philips Hue (and I want to avoid adding more brands, more apps, and more shit). However, Philips Hue is quite $$$ and not always all that easy to get in Singapore (shady retailers, limited stock, not many options).

I knew that Tradfri was technically compatible with the Hue Bridge, but never made the jump as I just wanted things to work (don't want to mess around with lights). Until today. Figured I may as well give it a go.

Surprisingly, everything worked out of the box. I had to do a factory reset (not sure if that's because I kept the light on for ~10 minutes before trying to set it up, or if this was a returned product as clearly the box had been opened before)...

• Turn on light
• Reset light by turning it off and on 6 times
• Open Philips Hue app and search/add light
• Tada... Should work

Side note: it requires a modern firmware (and I assume all lights being sold today have said firmware, but if for some reason you end up with old stock, you may need to update). To update you need the Ikea Bridge though (or... apparently the dimmers/buttons may work as well -- did not test).

All the controls are working as well (dimming, changing colours, etc).

The QR-code menu—which you access by scanning a black-and-white square with your smartphone—has taken off ever since. It may dominate going forward. But I hope not, because I detest those digital menus. Never mind dying peacefully in my sleep; I want to go out while sitting in a restaurant on my 100th birthday, an aperitif in my left hand and a paper menu in my right. And as eager as I’ll be for heaven if I’m lucky enough to stand on its threshold, I want one last downward glance at a paramedic prying the menu from my fist. In that better future, where old-school menus endure, I’ll go to my urn happy that coming generations will still begin meals meeting one another’s eyes across a table instead of staring at a screen.

Source: The Atlantic

Every single restaurant in Singapore uses these terrible, crappy UI, QR code menus. They suck. It's time for them to die in a fire. The pandemic is over and there's no reason for them to be used.

I need to use my phone, I can't easily discuss with my party on who is ordering what by showing and sharing a menu, the internet often sucks, and the page fails to load (or takes forever), the UI is broken on a tiny screen (text/ingredients are not fully shown, impossible to scan through a one-pager with 100s of items), some restaurants explicitly ask you to order only from one phone (imagine having two phones ordering food! Nuclear disaster!!) and some of those apps/sites clear the cart when going "back" in the browser, and each have their own, terrible, UI built differently taking forever to figure it out).

Even worse are those menus where you need to fill in your credit card to pre-pay (god forbid using Apple/Google Pay) that block copying and pasting numbers (out of 1password) or clear the input field every time you tab out of the browser and for example into 1password). AAAARGGHHH.

For now, we can't escape them, but I will happily get out of my way to avoid a restaurant that uses QR codes and get into one that provides a proper menu.

I've revamped my Smokeping infra a bit since 2020.

First off, starting to use the smokeping.eu¹ domain that Bianco got 10 or so years ago instead of using weird URLs under superuser.one domain.

It's running on four nodes as we speak:

• a virtual machine on a colocation server in Leaseweb, Amsterdam, NL -> leaseweb.nl.smokeping.eu
• a RPi3 (+SD card, slowest of all), Telenet, Belgium -> telenet.be.smokeping.eu
• a RPi4, EDPnet, Belgium -> edpnet.be.smokeping.eu
• a RPi4, Starhub, Singapore -> starhub.sg.smokeping.eu

This is achieved using Smokeping in a docker container, Cloudflare tunnel and Cloudflare CDN/DNS.

1 Doesn't point at anything at the moment. To do later.

Shan uses her iPad a lot, but a lot of the more serious (interior design) work needs to happen on AutoCAD or Photoshop. That is just not going to work on an iPad.

When we're travelling (read: holiday) she's carrying an old Lenovo ThinkPad 13 (great device!) just "in case" she needs to open AutoCAD and edit something minor or read the drawings/dimensions. But honestly, most of the time that device is turned off and dead weight.

But all the above is just an excuse to "I was bored, and I wanted to test something": can I use an old Raspberry Pi (zero W) to remotely wake her Intel NUC, and then use Tailscale to use RD on her iPad? Well, yes I can.

I completed this using:

• Tailscale to remote desktop from anywhere to home
• Cloudflare Tunnels, Access and DNS to have a web interface to wake the desktop
• A Linux device that's always on and in the same LAN, and that'll run a PHP script.

Prep work: enable WOL

First off: enable Wake-on-LAN (WOL) in the BIOS and in your Windows settings. This article explains it for Intel NUCs, but would be similar enough for most devices. The Device Manager pane looked different on our i5 NUC, but was close enough.

On Mac, you just need to enable it in the Energy preference pane, for Linux I have no clue. 🤷‍♂️

Second step: have a working Raspberry Pi (or any Linux device) in the same LAN. This device needs to be turned on 24/7, so use something that uses very little power.

I do have a more powerful RPi4 I wish I could've reused (running Docker and some other "serious" stuff; however it's currently in a different VLAN, and it's quite crucial the Linux device is in the same LAN as the device(s) you want to wake up), so I went with an old Raspberry Pi Zero W that was collecting dust (it used to run pwnagotchi).

On the Linux device, install etherwake. The command to run is quite simply etherwake aa:bb:cc:11:22:33 (= the ethernet MAC address of your device).

If this doesn't wake your desktop, something is wrong and there's no point continuing. Go and troubleshoot.

Install Tailscale and RD

On the (Windows) desktop and your iPad, install Tailscale. Login, and make sure it works by pinging from one to the other.

Then set up Remote Desktop on both (Windows, iPad). You should test and make sure you can properly connect using the LAN IP address and then the Tailscale IP address.

Fun fact: I create a DNS record for all my devices using Cloudflare DNS with the syntax of device-name.ts.yeri.be, so I don't need to ever remember IPs, and can easily ssh or ping devices without having to look up IPs. 

Fun fact side track: I actually have a dynamic script that runs (on Linux) and creates hostname.ts.yeri.be for the Tailscale IP, hostname.wg.yeri.be based on the Wireguard IP, hostname.lan.yeri.be based on the LAN IP. This dyndns script runs every so often and updates IPs if needed. All this is running using Cloudflare DNS and their API. Super convenient.

Nginx, php and etherwake

I'm a 80s kid, so I'll use dirty PHP to run this script. I'm sure I'll go straight to hell for this, but yolo.

Install nginx and PHP (no need for MySQL and other stuff).

etherwake requires root to run (because it needs root access to create a weird magic ethernet packet). Create a file in /etc/sudoers.d/etherwake and add this line:

www-data ALL=(ALL) NOPASSWD: /usr/sbin/etherwake

This will allow www-data (nginx/php) to run /usr/sbin/etherwake using sudo, without password.

In /var/www/html/ create an index.php file with:

<html>
<head><title>Wake on Lan</title></head>
<body>
<p>Wake up <a href="mycooldesktop.php">My Cool Desktop</a>
</body>
</html>

And a mycooldesktop.php (or whatever) file with:

<?php
$output = shell_exec('sudo /usr/sbin/etherwake aa:bb:cc:11:22:33 2>&1');
echo "<pre>$output</pre>";
?>
<p><a href="..">Back</a></p>

It ain't pretty -- but it gets the job done. 

And be sure to edit the MAC address to match your desktop's ethernet MAC address.

Cloudflare tunnels

Install Cloudflare Tunnel (via Zero Trust dashboard).

When creating a new tunnel, the dashboard will give you all needed commands to install the tunnel on your RPi -- but be sure to select the right OS/architecture (arm64? arm? armhf?).

And then point the tunnel to http://localhost. No need to mess around with SSL certs.

Lastly, set up Cloudflare Access (via the same Zero Trust dashboard): create a new application, and make sure only approved users can sign in (i.e.: using a pin code emailed to only approved emails).

You can try it yourself via wol.superuser.one. You won't get in. :)

Optionally, but recommended: lock down Nginx to only allow connections from localhost (127.0.0.0/8 and ::1) if using Cloudflare Tunnels, or Cloudflare IPs if using port forwarding with Cloudflare Access in front. 

To recap

• We used Tailscale to create a VPN network between the desktop and the iPad. The big benefit is that Tailscale works effortlessly across NAT networks without having to open ports,
• We used Cloudflare DNS so we don't need to remember hostnames :),
• We used Cloudflare Tunnels to make sure the RPi web interface is accessible across NAT (without port forwarding) and from anywhere,
• We used Cloudflare Acces and locked down access to the right people using ACLs,
• We used etherwake running on a RPi to wake up devices that are hibernating or turned off.

And that's it really.

PS: technically WoL works with WiFi, but when I enabled WoL on the WiFi adapter, the NUC refused to hibernate/sleep for more than a minute, and kept waking itself up. So, there seems to be some kind of trigger in my network that keeps waking it up. Also, not sure if WoL via WiFi would work if the device is turned off (as opposed to sleep or hibernate). I just ended up using ethernet. 

PPS: both Cloudflare Tunnels and Tailscale use Wireguard tech in the background, so that's really cool. 

I'm pro-Becky who found out at her 20-week anatomy scan that the infant she had been so excited to bring into this world had developed without life sustaining organs.

I'm pro-Susan who was sexually assaulted on her way home from work, only to come to the horrific realization that her assailant planted his seed in her when she got a positive pregnancy test result a month later.

I'm pro-Theresa who hemorrhaged due to a placental abruption, causing her parents, spouse, and children to have to make the impossible decision on whether to save her or her unborn child.

I'm pro-little Cathy who had her innocence ripped away from her by someone she should have been able to trust and her 11-year-old body isn't mature enough to bear the consequence of that betrayal.

I'm pro-Melissa who's working two jobs just to make ends meet and has to choose between bringing another child into poverty or feeding the children she already has because her spouse walked out on her.

I'm pro-Brittany who realizes that she is in no way financially, emotionally, or physically able to raise a child.

I'm pro-Emily who went through IVF, ending up with SIX viable implanted eggs requiring selective reduction to ensure the safety of her and a SAFE number of fetuses.

I'm pro-Jessica who is FINALLY getting the strength to get away from her physically abusive spouse only to find out that she is carrying the monster's child.

I'm pro-Vanessa who went into her confirmation appointment after YEARS of trying to conceive only to hear silence where there should be a heartbeat.

I'm pro-Lindsay who lost her virginity in her sophomore year with a broken condom and now has to choose whether to be a teenage mom or just a teenager.

I'm pro-Courtney who just found out she's already 13 weeks along, but the egg never made it out of her fallopian tube, so either she terminates the pregnancy or risks dying from internal bleeding.

You can argue and say that I'm pro-choice all you want, but the truth is:
I'm pro-life.
Their lives.
Women's lives.

You don't get to pick and choose which scenarios should be accepted. It's not about which stories you don't agree with. It's about fighting for the women in the stories that you do agree with and the CHOICE that was made.

Women's rights are meant to protect ALL women, regardless of their situation!

Overturning Roe does not stop abortions, it stops SAFE abortions! 

Abortion is healthcare.

Source/Author Unknown, reposted

Web 3 goes against the core promise of the internet which tries to be a great equalizer.

The Web was about making information accessible to all, Web 3 is trying to provide value to a few, where everything is done for the benefit of the few rather than benefit of all.

Web 2 gave us Wikipedia, Google search, Facebook and more. They are not perfect systems, any system which involves humans will have loopholes & problems driven by greed and a hunger for power. But, they did act as an equalizer. Where is Wikipedia of Web3? Wikipedia never started with the mission of making it's contributors rich.

Source: Ravi Vyas

I'm extremely pessimistic to what Web 3.0 will supposedly bring.

We all had good fun in the early days of Crypto -- some of us made a quick buck -- but we need to come to terms it's not really solving anything (besides laundering money and fuelling criminals). And it's not sustainable at all. And don't get me started on NFTs.

This summer, the Lithuanian government went public with an astounding finding. A Xiaomi phone sold in Europe — the Mi 10T 5G — could censor approximately 450 words and phrases, it said. The blocklist wasn’t active, but could be activated remotely. It was filled with political terms, including “Democratic Movement” and “Long live Taiwan’s independence.”

[...]

The accusations, which Xiaomi disputes, clarified just how fraught the West’s relationship is with China’s growing technology power. As China-based tech companies like Xiaomi and TikTok flourish, there’s still no playbook in North America or Europe to deal with their potential to censor or steer culture via algorithms.

“Western countries,” Abukevicius said, “are more and more reliant on technologies, and a big part of those technologies comes from countries which are not friendly, which we don't trust, and it poses risks.”

Source.

I am not sure what is the problem -- I've upgraded Shan's 27" 2k monitor to a 32" 4k monitor and AutoCAD LT recently updated from 2021 to 2022. Shan's been using a 2017 i5 NUC (NUC7i5BNB) with 32Gb RAM using the onboard GPU. Something that should be plenty for a bit of Windows, Chrome, Photoshop and AutoCAD LT.

For the past few weeks, several times a day her screen would black out for half a second or so and then everything should go back to normal. Sometimes it would happen several times in a row, sometimes it wouldn't for hours on end.

I tried several things, including getting a 8k 120hz HDMI cable, using a usb-c to DP cable, changing the GPU vRAM minimum from 128Mb to 2048Mb (quite the hack, as it can't be set in the bios -- requires messing around in the registry. Wow.), updating all the drivers, updating the bios, making sure the NUC was properly ventilated and keeping cool (every full moon the NUC shuts down due to overheating in Singapore if I set the fan to 'balanced' instead of 'cool'), and probably more. And because it happened so sporadically it was quite hard to debug (to the point I sometimes didn't want to believe her as I couldn't see it blacken out).

Shan was getting frustrated (which in turn means I get frustrated)... and I started looking at getting either an eGPU (I can get a free Nividia M6000, just need the enclosure, but the enclosure would be $$), an AMD Ryzen 5 or 7 NUC (no more Intel in this house, but also $$$), or some other refurb (massive) desktop some friend had lying around (HP z240 or something, zero $, but Shan would kill me for having this massive thing on her desk).

Turns out, the quick fix, was to simply disable hardware acceleration.

Run GRAPHICSCONFIG and uncheck hardware acceleration.

This is probably not ideal in the long run (hopefully it's an issue with AutoCAD 2022 that is getting fixed, as opposed to the onboard Intel GPU getting messed up with AutoCAD).

When in doubt… Turn off hardware acceleration.

I've been running the Apple WatchOS 7 beta for a while now, and when updating, my watch face lost the "date": it was no longer showing the date and day of the week (i.e. Fri).

Quite annoying -- but it's a beta after all. I shouldn't complain. I did what every good beta tester would do: I filed a bug (it's still unanswered from what I can see).

Beta updates came and went but the date did not come back. Would I be unable to use my watch to figure out the date?! It's when you lose a feature that you see how often a day you use it.

And then, out of the blue, the big stable release. Apple Watch OS 7 is released to the general public. Surely, I thought, they must've fixed it now.

But alas, I was to be disappointed.

I updated Shan's watch (that never ran the beta) to see if she had the same issue -- but her watch was fine. Sooooo... What was I doing wrong? Why me, Apple Overlord?

I started fiddling around with my language and regional settings (nope, not it), and was contemplating a factory reset (argh, re-adding all my cards to Apple Pay)...

And then...

An epiphany.

They wouldn't?!?! Would they??

Something only Apple would dare to do.

I deleted the Apple Calendar app (on my iPhone) -- as I use the Google Calendar app. Would that somehow be related?

And guess what... Installing the Apple Calendar app via the App Store resolved it:

Check Apple Watch and the option is back!

That's one way of forcing people to use your apps.

I rarely use Bluetooth on my RPis. I'm already facing enough issues with my iMac and Mac Mini (it lags, it randomly disconnects in meetings, etc).

My pwnagotchi on the other hand is counting on a BLE network to connect to the internet: for now I am using my iPad, and while that works, it causes my iPad to disconnect from WiFi (because of course, it can only do tethering from a mobile network, not from its WiFi network).

I wanted to explore if I could set up bluetooth tethering/internet sharing from my RPi4 server... But for that BLE had to work! And for some reason BLE was not working on Liana.

[bluetooth]# power on
No default controller available

For some reason no controller was available. The drivers were definitely installed...

apt install bluetooth pi-bluetooth bluez raspberrypi-sys-mods

but hcitool dev ; hciconfig -a weren't returning anything.

After quite some extensive Googling I found the solution...

Check if this returns something:

# ls -l /dev | grep ttyAMA0
lrwxrwxrwx 1 root root           7 Sep  1 15:08 serial1 -> ttyAMA0
crw-rw---- 1 root dialout 204,  64 Sep  1 15:08 ttyAMA0

As opposed to:

# ls -l /dev | grep ttyS0
# (no output)

Then continue to do the following:

# make a backup
cp /boot/cmdline.txt /boot/cmdline.txt.bak
# edit the file
nano -w /boot/cmdline.txt
# edit the first part from
# console=ttySerial0 to console=ttyAMA0
# the line should be something similar to but do NOT blindly copy paste it as you won't be able to boot due to your PARTUUID being different
console=ttyAMA0,115200 console=tty1 root=PARTUUID=6c586e13-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait
reboot

After rebooting ... it works!

liana ~ # hcitool dev ; hciconfig -a
Devices:
	hci0	DC:A6:32:B1:0E:79
hci0:	Type: Primary  Bus: UART
	BD Address: DC:A6:32:B1:0E:79  ACL MTU: 1021:8  SCO MTU: 64:1
	UP RUNNING 
	RX bytes:2397 acl:0 sco:0 events:118 errors:0
	TX bytes:2603 acl:0 sco:0 commands:99 errors:0
	Features: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87
	Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3 
	Link policy: RSWITCH SNIFF 
	Link mode: SLAVE ACCEPT 
	Name: 'liana'
	Class: 0x000000
	Service Classes: Unspecified
	Device Class: Miscellaneous, 
	HCI Version: 5.0 (0x9)  Revision: 0x13b
	LMP Version: 5.0 (0x9)  Subversion: 0x6119
	Manufacturer: Cypress Semiconductor Corporation (305)

liana ~ # bluetoothctl 
Agent registered
[bluetooth]# scan on
Discovery started
[CHG] Controller DC:A6:32:B1:0E:79 Discovering: yes
[NEW] Device 7F:A9:BC:8D:E4:14 7F-A9-BC-8D-E4-14
[NEW] Device 58:EB:19:D8:D4:23 58-EB-19-D8-D4-23
[NEW] Device A4:83:E7:42:79:F6 A4-83-E7-42-79-F6
[NEW] Device 58:7B:24:1B:CC:5C 58-7B-24-1B-CC-5C
[NEW] Device D9:05:9F:DB:55:19 N0163
[NEW] Device 5F:DA:90:34:82:68 5F-DA-90-34-82-68
[NEW] Device 77:2A:1B:11:54:7D 77-2A-1B-11-54-7D
[NEW] Device 42:BF:0B:38:F3:20 42-BF-0B-38-F3-20

Next step is trying to get tethering to work...

Right. With the pandemic and all none of us are going to travel much but still...

About a year ago I purchased myself an OpenWRT router to use on the plane and in hotels.

And so far I really like both the device and the Hong Kong based brand (launching new and updated products, and releasing relatively regular updates for older products). Pick a device that fits your needs (USB powered? LTE? Small form factor?).

The GL-AR750S aka Slate is fully customizable but runs a few nice things out of the box: WireGuard (with a physical button to turn it on or off), OpenVPN, shell access, Tor (requires the latest firmware), IPv6, DoH (Cloudflare only for now), multiple SSIDs (i.e. Guest WiFi), and more.

Oh and I specifically picked this version (compared to other or cheaper ones) because it had both 2.4Ghz and 5Ghz, as well as 3 Gbit ports (1x WAN, 2x LAN).

I use the device on flights, where I connect to the network once in the air, purchase WiFi or use iPass "for one device" and then connect to the interwebs behind my NAT-router from my iPad, phone(s), laptop(s), and even Shan's devices if she is travelling with me.

In hotels, I either connect it to the wired ethernet, if still available (tends to be more stable), or connect it to the guest WiFi and then connect my devices to the router: saves me from connecting to a new network and typing the room number and login/password/family name on every device. And once again hides the true number of connected devices; quite handy trick for those pesky hotels providing free access only to two devices.

Sure it takes a bit of setup every time: find a working USB port, sign in to the web interface, search for new networks if this is a new hotel or I haven't travelled on this airline, connect to said network, sign in with iPass, and optionally enable VPN)...

And once in a while some fiddling with VPN or DNS that's borking up or being blocked by overzealous firewalls.

Also, some in-flight entertainment USB ports don't provide enough power (and/or are often broken -- looking at you Lufthansa in economy) so be sure to carry a couple of these (US-plug works best) -- I've already forgotten one on my last flight from MUC-SIN on LH, but luckily I have pretty easy access to these.

If you travel a lot it's totally worth the money.

All right. With the release of the new RPi4 with 8Gb of RAM I had to get myself one to see if it was already a viable desktop replacement for surfing and emails.

While a SD card works fine for certain tasks (things that don't require a lot of IO) -- for a desktop that's a no-go... It's just too slow.

I still had an old Macbook Pro 13" (2o15?) SSD lying around that was collecting dust. Why not use that one to use as root for the RPi?

This article will focus on making it work on Raspbian first. Technically this should all work on other distros as well, but YMMV seeing all this is still beta.

I use Raspbian Lite: I like to work with minimalstic systems and install just what I need. But technically this should work with any flavour.

But first, let's prep the device.

Case

I already have a RPi4 (4Gb) at home running mostly Docker containers (nginx proxy and a few personal things and Smokeping).

And one of the 'best' purchases I made for the RPi4 was the "Raspberry Pi 4 Model B Aluminium Case" (Lazada, AliExpress). This case is passive and dissipates enough heat (even in a closed cabinet in Singapore where it's 30°) for the CPU never to throttle back when overclocked at 2Ghz (see below).

Do note that this case (which is pretty much just a massive heat sink) gets pretty hot if the RPi is running at max performance for long periods of time.

USB-SSD

Get one that fits your SSD and that ideally has Linux support. As Apple uses custom SSD connectors (prior to being soldered onto the motherboard) I had to get a converter from China. It was a bit of Russian Roulette to see if it would work or be supported on Linux. I got myself this one (chipset: Netchip Technology). As I didn't remember what type of Macbook Pro this came from, using this site to compare serial/model was useful. This USB-to-SSD converted also works on Mac and Windows by the way.

In my case, the RPi also did not provider enough power to the USB-SSD converter (although... it really should but whatevs), so be sure to use the provided power cable and plug it into a USB power source. Not doing so will cause the SSD to heat up and show a bunch of disconnects/errors in dmesg.

raspbian ~ # fdisk -l /dev/sda1 
Disk /dev/sda1: 233.8 GiB, 250999127552 bytes, 490232671 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
raspbian ~ # lsusb 
Bus 002 Device 002: ID 0525:622b Netchip Technology, Inc. 
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 002: ID 2109:3431 VIA Labs, Inc. Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
raspbian ~ # lsusb -t
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/4p, 5000M
    |__ Port 2: Dev 2, If 0, Class=Mass Storage, Driver=usb-storage, 5000M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/1p, 480M
    |__ Port 1: Dev 2, If 0, Class=Hub, Driver=hub/4p, 480M

eeprom update

Disconnect the USB-SSD for now.

At the time of writing we need to update the eeprom to boot from USB. I'm using the latest eeprom available to me. Note that the USB-boot eeprom is about to hit stable so you might not need to do this anymore.

There are two methods for updating. We can do it manually:

rpi-update
cd /lib/firmware/raspberrypi/bootloader/beta
rpi-eeprom-update -d -f ./pieeprom-2020-06-15.bin
# BCM2711 detected
# VL805 firmware in bootloader EEPROM
# BOOTFS /boot
# *** INSTALLING ./pieeprom-2020-06-15.bin ***
# BOOTFS /boot
# EEPROM update pending. Please reboot to apply the update.
reboot
# RPi should come back online after a reboot

Or we use rpi-eeprom-update (see article, at the bottom):

nano -w /etc/default/rpi-eeprom-update
# edit critical to stable
rpi-eeprom-update
rpi-eeprom-update -a

The good thing is that, even if you boot from a Raspbian that does not have /etc/default/rpi-eeprom-update edited to use stable instead of critical, it will not downgrade your eeprom.

Now you can plug in the SD card in an USB-SD card reader, and test if the RPi boots from USB. Note that the SD card might be slower.

All right -- so everything is working. I am keeping this SD card to update the eeprom again at a later stage (as the one we flashed is beta). If we use Archlinux or Ubuntu the eeprom update tools won't be included.

Next step is to flash Raspbian to the USB-SSD.

Boot-up from the USB-SSD.

Errors

In case you are getting an error similar to start4.elf: is not compatible you'll need to copy paste /boot/start4.elf from a Raspbian that ran rpi-update (i.e. the one from the SD card, or see below).

If you are booting (a fresh) Raspbian, it might complain about cma: Failed to reserve 256 MiB (and several other errors). The solution is running rpi-update.

Boot from the working Raspbian (using the SD card):

# check which drive is your USB-SSD (i.e. using fdisk -l or dmesg). 
# In my case I booted from USB-SD (/dev/sda) and we'll update the new/clean Raspbian on the SSD (/dev/sdb).
#
# First resize the partition, if the system never booted it'll be 1.5Gb and thus not big enough:
# Device     Boot  Start     End Sectors  Size Id Type
# /dev/sdb1         8192  532479  524288  256M  c W95 FAT32 (LBA)
# /dev/sdb2       532480 3620863 3088384  1.5G 83 Linux
fdisk /dev/sdb
# Type the following:
# p (and visually check it all makes sense)
# d
# 2
# n
# Select (default p): p
# Partition number (2-4, default 2): <enter>
# First sector (2048-490234751, default 2048): 532480 (or whichever is the same "start" from the 2nd partition) 
# Last sector, +/-sectors or +/-size{K,M,G,T,P} (532480-490234751, default 490234751): <enter>
# Created a new partition 2 of type 'Linux' and of size 233.5 GiB.
# Partition #2 contains a ext4 signature.
# Do you want to remove the signature? [Y]es/[N]o: n
# p (visually check once again it makes sense, if not you can cancel/quit by typing q)
# w (if it makes sense)
# The last command will write the changes to the partition table and sync all changes. 
# Then we need to check and resize the filesystem:
e2fsck -f /dev/sdb2
resize2fs /dev/sdb2
# If all that worked we can start mounting everything
mkdir /tmp/ssd
mount /dev/sdb2 /tmp/ssd/
mount /dev/sdb1 /tmp/ssd/boot/
mount /proc/ /tmp/ssd/proc/ -t proc
mount --rbind /sys/ /tmp/ssd/sys/
mount --rbind /dev/ /tmp/ssd/dev/
# Once everything is mounted, we're chrooting into the fresh Raspbian running on the SSD
chroot /tmp/ssd/ /bin/bash
# you can double confirm the partition size using:
df -h
# And we update the system. Again, if all this hits stable it might not be needed.
rpi-update
# say "y" when it's asking you to.
# exit the chroot and turn off the device, remove the USB-SD and leave USB-SSD connected. 
exit 
halt

My first reboot the boot process threw errors about failing to mount the root fs.

We'll need to update /etc/fstab with the correct partuuid.

# Boot from the (USB-)SD card again
# In my case sdb became sda and vice versa, so double check
lsblk
# be sure to select the right disk (the SSD, no the SD)!
mkdir /tmp/ssd
mount /dev/sda2 /tmp/ssd/
# And find the SSD here as well.
# look for the last column, partuuid, something like 
"6f6cc2fb-01"
blkid
nano -w /tmp/ssd/etc/fstab
# edit the existing partuuid's with the ones from blkid
# you'll need to edit both /boot (-01) and / (root, -02).
halt
# When rebooting from the SSD it'll go through a fsck. In my case for some reason it failed and dropped to a shell. I did a manual check and everything was fine. Rebooted and it booted normally... *shrug*

Booting

At this stage booting from the USB-SSD should work just fine. You have a working system booting from USB.

Overclocking

Last thing I'd recommend is getting a bit more juice out of your four cores.

You can quite easily overclock the RPi4 to 2Ghz (per core). It's a pretty nice boost (~25%) and worth going for. I haven't seen any heat issues leading to underclocking (throttling back), and everything runs stable. Note that under real circumstances you are unlikely to be running at 100% for extended period of times.

This guide explains how to overclock Raspbian (but the same applies for Ubuntu RPi -- I'll eventually be using Ubuntu as the OS due to its 64 bit support; at the moment Raspbian only supports a 64 bit kernel (beta) and the userland still runs 32 bit. But that'll be a follow-up article.

The gist of the article is to edit /boot/config.txt and add:

over_voltage=6
arm_freq=2000

Save the file, reboot and monitor temp (echo $((cat /sys/class/thermal/thermal_zone0/temp/1000))) and core frequency (watch -n 1 vcgencmd measure_clock arm) while running stress -c 4 to make sure the cores are running at 100%.

Resilio Sync released an update last week and on Synology these package don't auto update. Time to manually update the packages again.

On my DS1515 (more RAM, more CPU) the manual update goes by fine (stop service, manual update, browse for file, upload, start service) but my DS216j, not so much.

Attempting to upload the file instantly fails with the useful error "Operation Failed".

I tried to re-download the file (was it corrupt)... Nop. Did I select the right architecture? Yep. Decided to give it a go via via the command line. Perhaps a reboot? Nop.

First, make sure SSH is enabled and you can SSH. Oh and pro tip: add your SSH key.

Something along these lines should get you started:

# Transfer the file to the NAS
scp *.spk NAS-IP:
# Connect to the device
ssh user@NAS-IP
# Install it as root using sudo. It'll ask for your psw
sudo synopkg install *.spk
[password]
# resiliosync_armada38x_DSM6_2.7.0.1366-1.spk install successfully
# All good? Then remove the installer
rm *.spk

Somehow this worked... 🤷‍♂️ Not sure what caused the error in the first place. I am guessing the device is a bit low on RAM.

Noticed that NextDNS was reporting old hostnames in the logs. For example old device names (devices that changed hostnames), devices that were definitely no longer on the network, or IPs that were matched to the wrong hostnames.

The culprit is how EdgeOS deals with its hosts file. Basically it just keeps all the old hosts added and just adds a new line at the end of the file.

NextDNS searches for the first valid entry in that file, which is always going to be an older record.

So the simplest solution I found was the turn off hostfile-update every so often. This clears the hosts file.

So ssh into the device, run configure, and then run these commands:

set service dhcp-server hostfile-update disable
commit
set service dhcp-server hostfile-update enable
commit
save

Update 22 Jun '23:

Be sure to restart NextDNS, or it won't actually publish the up-to-date client hostnames.

sudo /config/nextdns/nextdns restart

This follows the my two other posts about WireGuard.

Most of this can be copied from the amd64 post -- with a minor change for making it work on RPi4. This is the full git repo (including both rpi and amd64).

The main difference is in the run.sh file. The installation is a bit different and we'll need to install the Raspberry Pi kernel headers.

WireGuard is also installed from testing instead of Debian backports.

Note that for older RPi's (ie gen 1) you'll need to compile from scratch.

The Resilio Sync package that's provided on a Synology NAS' Packager Center is out of date (2.6.2) and has a bug that causes big files to fail to sync (and that causes a loop of endless retries).

The solution is to manually update the package from 2.6.2 to 2.6.4. Find your NAS architecture and then download (bottom of the page) the right binary and manually install it.

Note that you need to stop the Resilio Sync service running (manually stop it via Package Center) before uploading the package and installing it.

Once done, don't forget to manually start the service again.

Resilio Sync GUI will be at <NAS IP>:28888/gui/.

The howto guide to manually update the package can be found here.

I was rebuilding my WireGuard Docker container today and this error started popping up:

Setting up dkms (2.6.1-4) ...
Setting up wireguard-dkms (1.0.20200429-1~bpo10+1) ...
Loading new wireguard-1.0.20200429 DKMS files...
It is likely that 4.19.0-8-cloud-amd64 belongs to a chroot's host
Building for 4.19.0-8-amd64 and 4.19.0-8-cloud-amd64
Building initial module for 4.19.0-8-amd64
Error! Bad return status for module build on kernel: 4.19.0-8-amd64 (x86_64)
Consult /var/lib/dkms/wireguard/1.0.20200429/build/make.log for more information.
dpkg: error processing package wireguard-dkms (--configure):
 installed wireguard-dkms package post-installation script subprocess returned error exit status 10
Setting up build-essential (12.6) ...
Setting up libalgorithm-diff-xs-perl (0.04-5+b1) ...
Setting up libalgorithm-merge-perl (0.08-3) ...
dpkg: dependency problems prevent configuration of wireguard:
 wireguard depends on wireguard-dkms (>= 0.0.20200121-2) | wireguard-modules (>= 0.0.20191219); however:
  Package wireguard-dkms is not configured yet.
  Package wireguard-modules is not installed.

dpkg: error processing package wireguard (--configure):
 dependency problems - leaving unconfigured
Processing triggers for systemd (241-7~deb10u3) ...
Processing triggers for libc-bin (2.28-10) ...
Errors were encountered while processing:
 wireguard-dkms
 wireguard
E: Sub-process /usr/bin/dpkg returned an error code (1)

The solution was to install bc. Seems like Debian is not pulling the right dependencies. I'll be adding it to my Dockerfile.

This is the 2nd post about WireGuard.

So I am running two WireGuard servers -- one on a Raspberry Pi 4, and one in an amd64 virtual machine. This post will be about getting WireGuard working on amd64 in a Docker container.

As this container rarely get rebuild, I am running unattended-upgrades inside the container to make sure security updates are applied.

I am also running Bind9 to act as a caching DNS server inside the container. Ideally this should be running from its dedicated container but that makes everything more complicated and not worth it for what I am trying.

I am also

The public repo that acts as a proof of concept can be found here.

start.sh -- this file starts (or restarts) and builds the container. It will also create the files as needed, set the forwarding DNS server, etc.

Dockerfile -- the example will start a basic container based on debian-slim, set up the port forwarding, install the tools we need, and copy over the configs

run.sh -- this file will be executed after the container has been built. We need to install WireGuard from this file or it will fail due to the volume not being mounted and not having the right params.
This will also start the named (bind9) server.
I manually set ip address add dev wg0 10.200.200.1/24 because using Address in wg0.conf caused issues. I haven't recently tested if that's still the case.

named.conf.options -- pretty standard bind9 config file; I want to be in control of my forwarding server because I am using NextDNS and want to apply a different config.

And of course your wg0.conf.

Running docker exec wireguard wg should give details about your connected hosts.

This is the first post of several. Next posts will focus on running WireGuard inside a Docker container on amd64 Linux and a Raspberry Pi.

I've been running WireGuard for a few months now and I've been loving it.

I first started using it about a year ago when in China — OpenVPN was once again being actively blocked and it was driving me nuts. Overnight I set up a DigitalOcean server in Singapore and ran WireGuard from it — both my phone and laptop were able to actively bypass the GFW and (at that time) surf the internet freely once more. As WireGuard gains popularity, I am sure the GFW will start detecting it — it's a quiet but not a stealthy protocol.

Since then I've dug quite a bit deeper in WireGuard and am really looking forward to what it's going to bring.

WireGuard differentiates itself to be an extremely simple VPN server (which can make getting started and debugging a bit more challenging) — but it wants to seamlessly work together with existing tools. One of the main features still missing is for example running a DHCP server on the server and dynamically assigning IPs (like oVPN does).

It's also pretty cool because any node can both be a server and a client at the same time. In my setup I am running two servers: one running at home in Singapore on a RPi4 (1Gbit fiber connection) and one on a virtual machine in Amsterdam (1Gbit as well). The RPis at my parents are connected to the server in Amsterdam, my iPad and phones are connected to the server in Singapore. If I am in Europe I might switch over and let my iDevices connect to the AMS server instead.

The example above clearly shows speed gains by cloaking the traffic in UDP packets. The shared folder has only two nodes (sender and receiver) and shows several big files being transferred from Amsterdam to Singapore. Resilio Sync uses the Bittorrent protocol, something ISPs generally hate and tend to slow down as much as they can — thanks Starhub.

Wireguard also allows the client to decide what to route through the server: only the VPN LAN traffic, or a whole subnet, or 0.0.0.0/0? So for my iPhone I for example route all traffic through VPN to avoid hotel/airport/... WiFi's to mine/log/scan my data. For my laptop I have two configs, one to only connect to the LAN, but another that routes all my traffic through the VPN if I want to avoid exposure or circumvent censoring.

Note that I am not running WireGuard to remain anonymous and I'll definitely leak some information — just trying to minimise and remain in control of what I leak. This is not a Tor replacement.

A couple of months ago I had the great idea to set up a shell server in Docker. Simply because my docker skillz were quite rusty and a shell server was something I actually genuinely needed.

Shell servers... so 2005. I remember in the good old IRC days people asking for (free) shell servers to run their eggdrop and stuff. OMG am I getting old? Anyhow...

I ssh quite often. I manage quite a few servers (~15?) and routers that require me to login and do some random stuff. I also work on a laptop quite often and that means closing the lid and moving around.

First of all, mosh is amazing and allows you to stay connected via ssh, even with crappy (airport/hotel) internet as well as moving around networks -- that solves half the problem. If you are not using it, start using it now!

Second, during my datacenter technician days at Google we used to have a "jump server" -- a shell server that allowed us to bridge the corporate network and ssh into prod machines. Doubt that's still used nowadays, but the idea stuck. I wanted something similar to ssh from, wherever I was, and easily connect to my servers. And as the network the shell server is running on is stable, I only need to use mosh to the shell server. Thereafter, the connection very rarely dies.

And I guess, third, I recently purchased an iPad Pro and I really need to have my local "dev" environment with my git repo that I edit quite frequently but iPadOS isn't really your average computer, and doesn't even have a proper terminal. This is my experiment to make iPadOS work as a main computer when on the move.

Enter box -- Docker shell server...

I've copied over the files I use to this example repo, and added some comments. Mind you that this repo acts as a proof of concept and isn't kept up to date, as I have my own private repo -- but this should give you a good idea on how to set up your own shell server with Docker.

start.sh -- this is a simple script that I execute when I first run or need to update the container. I execute the same file on two different servers: Liana, my Raspberry Pi at home and Ocean, my server in Amsterdam.

zsh.sh -- this installs what I care about for zsh. This could be part of the Dockerfile but for some reason I separated it. ¯\_(ツ)_/¯

git.sh -- this clones my Git repos so I can edit and commit stuff from the shell server.

run.sh -- this file is launched by Dockerfile at the end and executes what matters: the ssh daemon. It also adds a Wireguard route and executes the scripts above.

Dockerfile -- this installs everything I need and configures the whole thing. I've added tons of comments that should get you going.

I am also cloning misc and homefiles as submodules in files/ -- but you should change this to something that works for you. See the Dockerfile for more info.

This.

Word (or Office in general) refusing to get proofing tools to work (spelling checker doesn't work, spawns these odd errors, won't find any spelling mistakes, etc).

Lots of Googling and running Microsoft "fixit" applications didn't do much.

Simple fix: run setup of the proofing tools again, and select repair, reboot, and all should be good.